From 1d53d83fcf4e30f287bec6120363ee20168480b1 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 4 Nov 2025 08:13:12 -0500
Subject: [PATCH] Fixes for all trees

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...i-video-force-native-for-lenovo-82k8.patch |  45 ++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 queue-5.10/series                             |  30 +++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...ti-pruss-don-t-use-pk-through-printk.patch |  47 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...ndlers-with-null-handler_address-or-.patch |  61 ++++++
 ...tel-cvs-acpi-hids-to-acpi_ignore_dep.patch |  52 +++++
 ...i-video-force-native-for-lenovo-82k8.patch |  45 ++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...-amd-cpu-extended-temperature-range-.patch | 140 ++++++++++++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...cheduling-association-deletion-twice.patch |  72 +++++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...sbs-charger-support-multiple-devices.patch | 114 ++++++++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 queue-5.15/series                             |  37 ++++
 ...peed-socinfo-add-ast27xx-silicon-ids.patch |  37 ++++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...ti-pruss-don-t-use-pk-through-printk.patch |  47 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ...ix-error-return-value-in-cpupower_wr.patch |  44 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...i-video-force-native-for-lenovo-82k8.patch |  45 ++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 queue-5.4/series                              |  23 ++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...ndlers-with-null-handler_address-or-.patch |  61 ++++++
 ...tel-cvs-acpi-hids-to-acpi_ignore_dep.patch |  52 +++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 ...lloc-flag-when-freeing-all-fragments.patch |  57 +++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...nitialized-const-pointer-warnings-wi.patch |  61 ++++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...eak-robust_list-pointer-on-exec-race.patch | 199 +++++++++++++++++
 ...nsors-increase-timeout-for-locking-a.patch |  38 ++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...-amd-cpu-extended-temperature-range-.patch | 140 ++++++++++++
 queue-6.1/hwmon-sy7636a-add-alias.patch       |  31 +++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...-pch-lpc-use-legacy-domain-for-pch-l.patch |  69 ++++++
 ...lic-respect-mask-state-when-setting-.patch |  54 +++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...o-kato-for-persistent-discovery-conn.patch |  52 +++++
 ...cheduling-association-deletion-twice.patch |  72 +++++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...sbs-charger-support-multiple-devices.patch | 114 ++++++++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 ...on-failures-exit-with-code-1-in-test.patch |  39 ++++
 queue-6.1/series                              |  46 ++++
 ...peed-socinfo-add-ast27xx-silicon-ids.patch |  37 ++++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...ti-pruss-don-t-use-pk-through-printk.patch |  47 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...rpc-if-add-resume-support-for-rz-g3e.patch |  36 ++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ...ix-error-return-value-in-cpupower_wr.patch |  44 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...ndlers-with-null-handler_address-or-.patch |  61 ++++++
 ...ip-irq-override-on-asus-vivobook-pro.patch |  45 ++++
 ...tel-cvs-acpi-hids-to-acpi_ignore_dep.patch |  52 +++++
 ...spcr-support-precise-baud-rate-field.patch |  53 +++++
 ...acpi_free-for-freeing-an-acpi-object.patch |  38 ++++
 ...i-video-force-native-for-lenovo-82k8.patch |  45 ++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 ...880-set-correct-touchscreen-clipping.patch |  41 ++++
 ...ormer-20-add-missing-magnetometer-in.patch |  37 ++++
 ...sformer-20-fix-audio-codec-interrupt.patch |  37 ++++
 ...-zynqmp-disable-coresight-by-default.patch |  59 ++++++
 ...ert-usb-node-drive-strength-and-slew.patch |  45 ++++
 ...ossible-deadlock-while-configuring-p.patch | 188 ++++++++++++++++
 ...lloc-flag-when-freeing-all-fragments.patch |  57 +++++
 ...-bpf_cgroup_from_id-to-current-s-nam.patch | 112 ++++++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...ms-for-jeq-jne-is_branch_taken-logic.patch | 106 ++++++++++
 ...aware-symbol-matching-for-x86_64-arc.patch | 126 +++++++++++
 ...nitialized-const-pointer-warnings-wi.patch |  61 ++++++
 ...ers-timer-rtl-otto-do-not-interfere-.patch |  70 ++++++
 ...ers-timer-rtl-otto-work-around-dying.patch | 113 ++++++++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...-update-the-efficient-idle-check-for.patch | 111 ++++++++++
 .../cpufreq-ti-add-support-for-am62d2.patch   |  43 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...ve-self_id_complete-tracepoint-after.patch |  55 +++++
 ...m-preserve-assign_mem-error-return-v.patch |  39 ++++
 ...e-qcom-tzmem-disable-sc7180-platform.patch |  38 ++++
 ...eak-robust_list-pointer-on-exec-race.patch | 199 +++++++++++++++++
 ...nsors-increase-timeout-for-locking-a.patch |  38 ++++
 ...emove-dell-precision-490-custom-conf.patch |  68 ++++++
 ...k10temp-add-device-id-for-strix-halo.patch |  41 ++++
 ...d-thermal-support-for-amd-family-1ah.patch |  50 +++++
 ...n-lenovo-ec-sensors-update-p8-supprt.patch | 123 +++++++++++
 ...-amd-cpu-extended-temperature-range-.patch | 140 ++++++++++++
 queue-6.12/hwmon-sy7636a-add-alias.patch      |  31 +++
 ...-pci-add-support-for-intel-wildcat-l.patch |  37 ++++
 ...ng-zctx-check-chained-notif-contexts.patch |  44 ++++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...-pch-lpc-use-legacy-domain-for-pch-l.patch |  69 ++++++
 ...lic-respect-mask-state-when-setting-.patch |  54 +++++
 ...sib-argument-handling-causing-unreco.patch | 200 ++++++++++++++++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...nt-of_node-s-refcount-before-linking.patch |  42 ++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...-add-intel-wildcat-lake-lpss-pci-ids.patch |  50 +++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...o-kato-for-persistent-discovery-conn.patch |  52 +++++
 ...cheduling-association-deletion-twice.patch |  72 +++++++
 ...release-allocated-memory-in-detach-p.patch |  56 +++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...-apple-add-apple-t8103-pmgr-pwrstate.patch |  41 ++++
 ...upply-qcom_battmgr-add-ooi-chemistry.patch |  37 ++++
 ...m_battmgr-handle-charging-state-chan.patch |  70 ++++++
 ...sbs-charger-support-multiple-devices.patch | 114 ++++++++++
 ...bulk-write-to-atomicially-update-reg.patch | 126 +++++++++++
 ...-fix-uninitialized-symbol-retval_off.patch |  48 +++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 ...ts-bpf-fix-flaky-bpf_cookie-selftest.patch |  53 +++++
 ...x-selftest-verifier_arena_large-fail.patch |  83 ++++++++
 ...on-failures-exit-with-code-1-in-test.patch |  39 ++++
 queue-6.12/series                             |  84 ++++++++
 ...peed-socinfo-add-ast27xx-silicon-ids.patch |  37 ++++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...ti-pruss-don-t-use-pk-through-printk.patch |  47 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...rpc-if-add-resume-support-for-rz-g3e.patch |  36 ++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ..._wise-allow-cooling-level-to-be-redu.patch |  81 +++++++
 ...lftests-workload_hint-mask-unsupport.patch |  38 ++++
 ...ix-error-return-value-in-cpupower_wr.patch |  44 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...ndlers-with-null-handler_address-or-.patch |  61 ++++++
 ...ip-irq-override-on-asus-vivobook-pro.patch |  45 ++++
 ...tel-cvs-acpi-hids-to-acpi_ignore_dep.patch |  52 +++++
 ...spcr-support-precise-baud-rate-field.patch |  53 +++++
 ...acpi_free-for-freeing-an-acpi-object.patch |  38 ++++
 ...i-video-force-native-for-lenovo-82k8.patch |  45 ++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 ...880-set-correct-touchscreen-clipping.patch |  41 ++++
 ...ormer-20-add-missing-magnetometer-in.patch |  37 ++++
 ...sformer-20-fix-audio-codec-interrupt.patch |  37 ++++
 ...sal-net-update-rtc-calibration-value.patch |  39 ++++
 ...-zynqmp-disable-coresight-by-default.patch |  59 ++++++
 ...ert-usb-node-drive-strength-and-slew.patch |  45 ++++
 ...ossible-deadlock-while-configuring-p.patch | 188 ++++++++++++++++
 ...-check-for-valid-bio-while-splitting.patch | 139 ++++++++++++
 ...lloc-flag-when-freeing-all-fragments.patch |  57 +++++
 ...-bpf_cgroup_from_id-to-current-s-nam.patch | 112 ++++++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...ms-for-jeq-jne-is_branch_taken-logic.patch | 106 ++++++++++
 ...aware-symbol-matching-for-x86_64-arc.patch | 126 +++++++++++
 ...nitialized-const-pointer-warnings-wi.patch |  61 ++++++
 ...ers-timer-rtl-otto-do-not-interfere-.patch |  70 ++++++
 ...ers-timer-rtl-otto-work-around-dying.patch | 113 ++++++++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...-update-the-efficient-idle-check-for.patch | 111 ++++++++++
 .../cpufreq-ti-add-support-for-am62d2.patch   |  43 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...ve-self_id_complete-tracepoint-after.patch |  55 +++++
 ...m-allow-qseecom-on-dell-inspiron-744.patch |  38 ++++
 ...m-preserve-assign_mem-error-return-v.patch |  39 ++++
 ...e-qcom-tzmem-disable-sc7180-platform.patch |  38 ++++
 ...enable-abort-handling-of-entry-to-lp.patch | 155 ++++++++++++++
 ...eak-robust_list-pointer-on-exec-race.patch | 199 +++++++++++++++++
 ...nsors-increase-timeout-for-locking-a.patch |  38 ++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...emove-dell-precision-490-custom-conf.patch |  68 ++++++
 ...k10temp-add-device-id-for-strix-halo.patch |  41 ++++
 ...d-thermal-support-for-amd-family-1ah.patch |  50 +++++
 ...n-lenovo-ec-sensors-update-p8-supprt.patch | 123 +++++++++++
 ...-amd-cpu-extended-temperature-range-.patch | 140 ++++++++++++
 queue-6.17/hwmon-sy7636a-add-alias.patch      |  31 +++
 ...down-support-to-dw_i3c_master-driver.patch |  67 ++++++
 ...-pci-add-support-for-intel-wildcat-l.patch |  37 ++++
 ...spect-submitter_task-in-io_register_.patch |  55 +++++
 ...g-zcrx-account-niov-arrays-to-cgroup.patch |  47 ++++
 ...eck-all-niovs-filled-with-dma-addres.patch |  36 ++++
 ...ng-zctx-check-chained-notif-contexts.patch |  44 ++++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...-eiointc-route-interrupt-parsed-from.patch | 100 +++++++++
 ...-pch-lpc-use-legacy-domain-for-pch-l.patch |  69 ++++++
 ...lic-respect-mask-state-when-setting-.patch |  54 +++++
 ...-tpidr2-switch-to-waitpid-over-wait4.patch |  52 +++++
 ...e-pci-on-uml-without-triggering-warn.patch |  78 +++++++
 ...sib-argument-handling-causing-unreco.patch | 200 ++++++++++++++++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...nt-of_node-s-refcount-before-linking.patch |  42 ++++
 ...-irq-enable-disable-to-encompass-for.patch |  66 ++++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...-add-intel-wildcat-lake-lpss-pci-ids.patch |  50 +++++
 ...acsmc-add-apple-t8103-smc-compatible.patch |  39 ++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...dle-errors-returned-from-qnap_mcu_wr.patch |  40 ++++
 ...lude-linux-types.h-in-qnap-mcu.h-sha.patch |  48 +++++
 ...2c-add-compatible-strings-for-layers.patch |  39 ++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...e-sd-card-clock-before-changing-para.patch |  67 ++++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...o-kato-for-persistent-discovery-conn.patch |  52 +++++
 ...cheduling-association-deletion-twice.patch |  72 +++++++
 ...release-allocated-memory-in-detach-p.patch |  56 +++++
 ...rzg2l-add-suspend-resume-support-for.patch |  87 ++++++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...-apple-add-apple-t8103-pmgr-pwrstate.patch |  41 ++++
 ...upply-qcom_battmgr-add-ooi-chemistry.patch |  37 ++++
 ...m_battmgr-handle-charging-state-chan.patch |  70 ++++++
 ...sbs-charger-support-multiple-devices.patch | 114 ++++++++++
 ...bulk-write-to-atomicially-update-reg.patch | 126 +++++++++++
 ...-fix-uninitialized-symbol-retval_off.patch |  48 +++++
 .../rust-kunit-allow-cfg-on-test-s.patch      | 139 ++++++++++++
 ...fix-arena_spin_lock-selftest-failure.patch |  86 ++++++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 ...ts-bpf-fix-flaky-bpf_cookie-selftest.patch |  53 +++++
 ...fix-incorrect-array-size-calculation.patch |  59 ++++++
 ...x-selftest-verifier_arena_large-fail.patch |  83 ++++++++
 ...on-failures-exit-with-code-1-in-test.patch |  39 ++++
 ...net-pull-data-before-parsing-headers.patch | 185 ++++++++++++++++
 ...ix-behavior-when-fio-is-not-installe.patch | 131 ++++++++++++
 queue-6.17/series                             | 111 ++++++++++
 ...peed-socinfo-add-ast27xx-silicon-ids.patch |  37 ++++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...info-add-information-for-am62l-sr1.1.patch |  53 +++++
 ...ti-pruss-don-t-use-pk-through-printk.patch |  47 ++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...rpc-if-add-resume-support-for-rz-g3e.patch |  36 ++++
 ...nd-handle-use_ecc-parameter-of-qcom_.patch |  56 +++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ..._wise-allow-cooling-level-to-be-redu.patch |  81 +++++++
 ...lftests-workload_hint-mask-unsupport.patch |  38 ++++
 ...ix-error-return-value-in-cpupower_wr.patch |  44 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...ostat-fix-incorrect-sorting-of-pmt-t.patch |  43 ++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 ...ndlers-with-null-handler_address-or-.patch |  61 ++++++
 ...tel-cvs-acpi-hids-to-acpi_ignore_dep.patch |  52 +++++
 ...r-use-acpi_ds_clear_operands-in-acpi.patch |  50 +++++
 ...const-foldability-via-__builtin_clzl.patch |  61 ++++++
 ...ormer-20-add-missing-magnetometer-in.patch |  37 ++++
 ...sformer-20-fix-audio-codec-interrupt.patch |  37 ++++
 ...ert-usb-node-drive-strength-and-slew.patch |  45 ++++
 ...ossible-deadlock-while-configuring-p.patch | 188 ++++++++++++++++
 ...lloc-flag-when-freeing-all-fragments.patch |  57 +++++
 ...-bpf_cgroup_from_id-to-current-s-nam.patch | 112 ++++++++++
 .../bpf-don-t-use-pk-through-printk.patch     |  47 ++++
 ...nitialized-const-pointer-warnings-wi.patch |  61 ++++++
 ...ers-vf-pit-replace-raw_readl-writel-.patch |  97 +++++++++
 ...-handle-null-policy-in-longhaul_exit.patch |  42 ++++
 ...idle-device-registration-if-there-is.patch |  53 +++++
 ...eak-robust_list-pointer-on-exec-race.patch | 199 +++++++++++++++++
 ...nsors-increase-timeout-for-locking-a.patch |  38 ++++
 ...m-add-support-for-dell-optiplex-7040.patch |  43 ++++
 ...k10temp-add-device-id-for-strix-halo.patch |  41 ++++
 ...d-thermal-support-for-amd-family-1ah.patch |  50 +++++
 ...-amd-cpu-extended-temperature-range-.patch | 140 ++++++++++++
 queue-6.6/hwmon-sy7636a-add-alias.patch       |  31 +++
 ...handle-multiple-msi-base-irq-alignme.patch |  61 ++++++
 ...-pch-lpc-use-legacy-domain-for-pch-l.patch |  69 ++++++
 ...lic-respect-mask-state-when-setting-.patch |  54 +++++
 ...imeout-to-prevent-indefinite-waiting.patch |  50 +++++
 ...-chip-variant-reading-in-two-bus-tra.patch |  92 ++++++++
 ...around-false-positive-wininitialized.patch |  61 ++++++
 ...stmpe-i2c-add-missing-module_license.patch |  31 +++
 ...stmpe-remove-irq-domain-upon-removal.patch |  37 ++++
 ...st-renesas_sdhi-fix-the-actual-clock.patch |  49 +++++
 ...able-tuning-for-sdr50-mode-for-sd-ca.patch |  74 +++++++
 ...-accessing-port_state-and-rport-stat.patch |  52 +++++
 ...o-kato-for-persistent-discovery-conn.patch |  52 +++++
 ...cheduling-association-deletion-twice.patch |  72 +++++++
 ...release-allocated-memory-in-detach-p.patch |  56 +++++
 ...ix-bias-pull-up-down-handling-in-pin.patch |  48 +++++
 ...-apple-add-apple-t8103-pmgr-pwrstate.patch |  41 ++++
 ...upply-qcom_battmgr-add-ooi-chemistry.patch |  37 ++++
 ...m_battmgr-handle-charging-state-chan.patch |  70 ++++++
 ...sbs-charger-support-multiple-devices.patch | 114 ++++++++++
 ...-fix-uninitialized-symbol-retval_off.patch |  48 +++++
 ...x-bpf_prog_detach2-usage-in-test_lir.patch |  40 ++++
 ...on-failures-exit-with-code-1-in-test.patch |  39 ++++
 queue-6.6/series                              |  57 +++++
 ...peed-socinfo-add-ast27xx-silicon-ids.patch |  37 ++++
 ...x-endian-unaware-access-of-num_entri.patch |  38 ++++
 ...dd-tegra114-nvmem-cells-and-fuse-loo.patch | 163 ++++++++++++++
 ...ack-test-don-t-use-pk-through-printk.patch |  86 ++++++++
 ...rpc-if-add-resume-support-for-rz-g3e.patch |  36 ++++
 ...er-to-allocate-a-tee_device-without-.patch |  38 ++++
 ...ix-error-return-value-in-cpupower_wr.patch |  44 ++++
 ...ix-incorrect-size-in-cpuidle_state_d.patch |  60 ++++++
 ...energy_perf_policy-enhance-hwp-enabl.patch |  49 +++++
 ...energy_perf_policy-fix-incorrect-fop.patch |  52 +++++
 ...energy_perf_policy-prefer-driver-hwp.patch |  75 +++++++
 ...ulate-sstep-original-instruction-whe.patch |  50 +++++
 ...lp855x_bl-set-correct-eprom-start-fo.patch |  37 ++++
 395 files changed, 24935 insertions(+)
 create mode 100644 queue-5.10/acpi-video-force-native-for-lenovo-82k8.patch
 create mode 100644 queue-5.10/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-5.10/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-5.10/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.10/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-5.10/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-5.10/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-5.10/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-5.10/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-5.10/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-5.10/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-5.10/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-5.10/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-5.10/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-5.10/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-5.10/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-5.10/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-5.10/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-5.10/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-5.10/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-5.10/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-5.10/soc-ti-pruss-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.10/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.10/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-5.10/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-5.10/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-5.10/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-5.10/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-5.10/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-5.10/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-5.15/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
 create mode 100644 queue-5.15/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
 create mode 100644 queue-5.15/acpi-video-force-native-for-lenovo-82k8.patch
 create mode 100644 queue-5.15/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-5.15/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-5.15/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.15/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-5.15/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-5.15/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-5.15/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-5.15/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
 create mode 100644 queue-5.15/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-5.15/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-5.15/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-5.15/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-5.15/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-5.15/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-5.15/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-5.15/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-5.15/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-5.15/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
 create mode 100644 queue-5.15/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-5.15/power-supply-sbs-charger-support-multiple-devices.patch
 create mode 100644 queue-5.15/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-5.15/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
 create mode 100644 queue-5.15/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-5.15/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-5.15/soc-ti-pruss-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.15/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.15/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-5.15/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
 create mode 100644 queue-5.15/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-5.15/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-5.15/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-5.15/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-5.15/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-5.15/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-5.4/acpi-video-force-native-for-lenovo-82k8.patch
 create mode 100644 queue-5.4/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-5.4/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-5.4/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.4/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-5.4/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-5.4/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-5.4/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-5.4/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-5.4/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-5.4/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-5.4/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-5.4/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-5.4/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-5.4/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-5.4/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-5.4/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-5.4/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-5.4/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-5.4/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-5.4/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-5.4/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-5.4/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-6.1/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
 create mode 100644 queue-6.1/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
 create mode 100644 queue-6.1/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-6.1/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-6.1/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
 create mode 100644 queue-6.1/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.1/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
 create mode 100644 queue-6.1/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-6.1/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-6.1/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-6.1/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
 create mode 100644 queue-6.1/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
 create mode 100644 queue-6.1/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-6.1/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
 create mode 100644 queue-6.1/hwmon-sy7636a-add-alias.patch
 create mode 100644 queue-6.1/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-6.1/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
 create mode 100644 queue-6.1/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
 create mode 100644 queue-6.1/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-6.1/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-6.1/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-6.1/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-6.1/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-6.1/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-6.1/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-6.1/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-6.1/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
 create mode 100644 queue-6.1/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
 create mode 100644 queue-6.1/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-6.1/power-supply-sbs-charger-support-multiple-devices.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-6.1/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
 create mode 100644 queue-6.1/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
 create mode 100644 queue-6.1/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-6.1/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-6.1/soc-ti-pruss-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.1/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.1/spi-rpc-if-add-resume-support-for-rz-g3e.patch
 create mode 100644 queue-6.1/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-6.1/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
 create mode 100644 queue-6.1/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-6.1/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-6.1/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-6.1/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-6.1/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-6.1/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-6.12/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
 create mode 100644 queue-6.12/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
 create mode 100644 queue-6.12/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
 create mode 100644 queue-6.12/acpi-spcr-support-precise-baud-rate-field.patch
 create mode 100644 queue-6.12/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
 create mode 100644 queue-6.12/acpi-video-force-native-for-lenovo-82k8.patch
 create mode 100644 queue-6.12/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-6.12/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-6.12/arm-tegra-p880-set-correct-touchscreen-clipping.patch
 create mode 100644 queue-6.12/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
 create mode 100644 queue-6.12/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
 create mode 100644 queue-6.12/arm64-zynqmp-disable-coresight-by-default.patch
 create mode 100644 queue-6.12/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
 create mode 100644 queue-6.12/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
 create mode 100644 queue-6.12/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
 create mode 100644 queue-6.12/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
 create mode 100644 queue-6.12/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.12/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
 create mode 100644 queue-6.12/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
 create mode 100644 queue-6.12/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
 create mode 100644 queue-6.12/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
 create mode 100644 queue-6.12/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
 create mode 100644 queue-6.12/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-6.12/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-6.12/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
 create mode 100644 queue-6.12/cpufreq-ti-add-support-for-am62d2.patch
 create mode 100644 queue-6.12/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-6.12/firewire-ohci-move-self_id_complete-tracepoint-after.patch
 create mode 100644 queue-6.12/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
 create mode 100644 queue-6.12/firmware-qcom-tzmem-disable-sc7180-platform.patch
 create mode 100644 queue-6.12/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
 create mode 100644 queue-6.12/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
 create mode 100644 queue-6.12/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
 create mode 100644 queue-6.12/hwmon-k10temp-add-device-id-for-strix-halo.patch
 create mode 100644 queue-6.12/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
 create mode 100644 queue-6.12/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
 create mode 100644 queue-6.12/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
 create mode 100644 queue-6.12/hwmon-sy7636a-add-alias.patch
 create mode 100644 queue-6.12/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
 create mode 100644 queue-6.12/io_uring-zctx-check-chained-notif-contexts.patch
 create mode 100644 queue-6.12/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-6.12/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
 create mode 100644 queue-6.12/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
 create mode 100644 queue-6.12/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
 create mode 100644 queue-6.12/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-6.12/mfd-core-increment-of_node-s-refcount-before-linking.patch
 create mode 100644 queue-6.12/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-6.12/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
 create mode 100644 queue-6.12/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-6.12/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-6.12/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-6.12/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-6.12/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-6.12/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-6.12/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
 create mode 100644 queue-6.12/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
 create mode 100644 queue-6.12/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
 create mode 100644 queue-6.12/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-6.12/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
 create mode 100644 queue-6.12/power-supply-qcom_battmgr-add-ooi-chemistry.patch
 create mode 100644 queue-6.12/power-supply-qcom_battmgr-handle-charging-state-chan.patch
 create mode 100644 queue-6.12/power-supply-sbs-charger-support-multiple-devices.patch
 create mode 100644 queue-6.12/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
 create mode 100644 queue-6.12/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
 create mode 100644 queue-6.12/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-6.12/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
 create mode 100644 queue-6.12/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
 create mode 100644 queue-6.12/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
 create mode 100644 queue-6.12/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
 create mode 100644 queue-6.12/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-6.12/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-6.12/soc-ti-pruss-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.12/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.12/spi-rpc-if-add-resume-support-for-rz-g3e.patch
 create mode 100644 queue-6.12/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-6.12/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
 create mode 100644 queue-6.12/thermal-intel-selftests-workload_hint-mask-unsupport.patch
 create mode 100644 queue-6.12/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
 create mode 100644 queue-6.12/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-6.12/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-6.12/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-6.12/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-6.12/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-6.12/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-6.17/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
 create mode 100644 queue-6.17/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
 create mode 100644 queue-6.17/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
 create mode 100644 queue-6.17/acpi-spcr-support-precise-baud-rate-field.patch
 create mode 100644 queue-6.17/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
 create mode 100644 queue-6.17/acpi-video-force-native-for-lenovo-82k8.patch
 create mode 100644 queue-6.17/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-6.17/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-6.17/arm-tegra-p880-set-correct-touchscreen-clipping.patch
 create mode 100644 queue-6.17/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
 create mode 100644 queue-6.17/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
 create mode 100644 queue-6.17/arm64-versal-net-update-rtc-calibration-value.patch
 create mode 100644 queue-6.17/arm64-zynqmp-disable-coresight-by-default.patch
 create mode 100644 queue-6.17/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
 create mode 100644 queue-6.17/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
 create mode 100644 queue-6.17/block-check-for-valid-bio-while-splitting.patch
 create mode 100644 queue-6.17/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
 create mode 100644 queue-6.17/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
 create mode 100644 queue-6.17/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.17/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
 create mode 100644 queue-6.17/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
 create mode 100644 queue-6.17/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
 create mode 100644 queue-6.17/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
 create mode 100644 queue-6.17/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
 create mode 100644 queue-6.17/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-6.17/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-6.17/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
 create mode 100644 queue-6.17/cpufreq-ti-add-support-for-am62d2.patch
 create mode 100644 queue-6.17/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-6.17/firewire-ohci-move-self_id_complete-tracepoint-after.patch
 create mode 100644 queue-6.17/firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch
 create mode 100644 queue-6.17/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
 create mode 100644 queue-6.17/firmware-qcom-tzmem-disable-sc7180-platform.patch
 create mode 100644 queue-6.17/firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch
 create mode 100644 queue-6.17/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
 create mode 100644 queue-6.17/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
 create mode 100644 queue-6.17/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-6.17/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
 create mode 100644 queue-6.17/hwmon-k10temp-add-device-id-for-strix-halo.patch
 create mode 100644 queue-6.17/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
 create mode 100644 queue-6.17/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
 create mode 100644 queue-6.17/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
 create mode 100644 queue-6.17/hwmon-sy7636a-add-alias.patch
 create mode 100644 queue-6.17/i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch
 create mode 100644 queue-6.17/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
 create mode 100644 queue-6.17/io_uring-rsrc-respect-submitter_task-in-io_register_.patch
 create mode 100644 queue-6.17/io_uring-zcrx-account-niov-arrays-to-cgroup.patch
 create mode 100644 queue-6.17/io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch
 create mode 100644 queue-6.17/io_uring-zctx-check-chained-notif-contexts.patch
 create mode 100644 queue-6.17/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-6.17/irqchip-loongson-eiointc-route-interrupt-parsed-from.patch
 create mode 100644 queue-6.17/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
 create mode 100644 queue-6.17/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
 create mode 100644 queue-6.17/kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch
 create mode 100644 queue-6.17/kunit-enable-pci-on-uml-without-triggering-warn.patch
 create mode 100644 queue-6.17/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
 create mode 100644 queue-6.17/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-6.17/mfd-core-increment-of_node-s-refcount-before-linking.patch
 create mode 100644 queue-6.17/mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
 create mode 100644 queue-6.17/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-6.17/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
 create mode 100644 queue-6.17/mfd-macsmc-add-apple-t8103-smc-compatible.patch
 create mode 100644 queue-6.17/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-6.17/mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch
 create mode 100644 queue-6.17/mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch
 create mode 100644 queue-6.17/mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch
 create mode 100644 queue-6.17/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-6.17/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-6.17/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-6.17/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch
 create mode 100644 queue-6.17/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-6.17/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-6.17/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
 create mode 100644 queue-6.17/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
 create mode 100644 queue-6.17/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
 create mode 100644 queue-6.17/pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch
 create mode 100644 queue-6.17/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-6.17/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
 create mode 100644 queue-6.17/power-supply-qcom_battmgr-add-ooi-chemistry.patch
 create mode 100644 queue-6.17/power-supply-qcom_battmgr-handle-charging-state-chan.patch
 create mode 100644 queue-6.17/power-supply-sbs-charger-support-multiple-devices.patch
 create mode 100644 queue-6.17/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
 create mode 100644 queue-6.17/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
 create mode 100644 queue-6.17/rust-kunit-allow-cfg-on-test-s.patch
 create mode 100644 queue-6.17/selftests-bpf-fix-arena_spin_lock-selftest-failure.patch
 create mode 100644 queue-6.17/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-6.17/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
 create mode 100644 queue-6.17/selftests-bpf-fix-incorrect-array-size-calculation.patch
 create mode 100644 queue-6.17/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
 create mode 100644 queue-6.17/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
 create mode 100644 queue-6.17/selftests-drv-net-pull-data-before-parsing-headers.patch
 create mode 100644 queue-6.17/selftests-ublk-fix-behavior-when-fio-is-not-installe.patch
 create mode 100644 queue-6.17/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
 create mode 100644 queue-6.17/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-6.17/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-6.17/soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch
 create mode 100644 queue-6.17/soc-ti-pruss-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.17/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.17/spi-rpc-if-add-resume-support-for-rz-g3e.patch
 create mode 100644 queue-6.17/spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch
 create mode 100644 queue-6.17/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-6.17/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
 create mode 100644 queue-6.17/thermal-intel-selftests-workload_hint-mask-unsupport.patch
 create mode 100644 queue-6.17/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
 create mode 100644 queue-6.17/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-6.17/tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch
 create mode 100644 queue-6.17/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-6.17/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-6.17/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-6.17/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-6.17/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
 create mode 100644 queue-6.6/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
 create mode 100644 queue-6.6/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
 create mode 100644 queue-6.6/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
 create mode 100644 queue-6.6/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
 create mode 100644 queue-6.6/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
 create mode 100644 queue-6.6/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
 create mode 100644 queue-6.6/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
 create mode 100644 queue-6.6/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
 create mode 100644 queue-6.6/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
 create mode 100644 queue-6.6/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
 create mode 100644 queue-6.6/bpf-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.6/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
 create mode 100644 queue-6.6/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
 create mode 100644 queue-6.6/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
 create mode 100644 queue-6.6/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
 create mode 100644 queue-6.6/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
 create mode 100644 queue-6.6/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
 create mode 100644 queue-6.6/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
 create mode 100644 queue-6.6/hwmon-k10temp-add-device-id-for-strix-halo.patch
 create mode 100644 queue-6.6/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
 create mode 100644 queue-6.6/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
 create mode 100644 queue-6.6/hwmon-sy7636a-add-alias.patch
 create mode 100644 queue-6.6/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
 create mode 100644 queue-6.6/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
 create mode 100644 queue-6.6/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
 create mode 100644 queue-6.6/memstick-add-timeout-to-prevent-indefinite-waiting.patch
 create mode 100644 queue-6.6/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 create mode 100644 queue-6.6/mfd-madera-work-around-false-positive-wininitialized.patch
 create mode 100644 queue-6.6/mfd-stmpe-i2c-add-missing-module_license.patch
 create mode 100644 queue-6.6/mfd-stmpe-remove-irq-domain-upon-removal.patch
 create mode 100644 queue-6.6/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
 create mode 100644 queue-6.6/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
 create mode 100644 queue-6.6/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
 create mode 100644 queue-6.6/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
 create mode 100644 queue-6.6/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
 create mode 100644 queue-6.6/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
 create mode 100644 queue-6.6/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
 create mode 100644 queue-6.6/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
 create mode 100644 queue-6.6/power-supply-qcom_battmgr-add-ooi-chemistry.patch
 create mode 100644 queue-6.6/power-supply-qcom_battmgr-handle-charging-state-chan.patch
 create mode 100644 queue-6.6/power-supply-sbs-charger-support-multiple-devices.patch
 create mode 100644 queue-6.6/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
 create mode 100644 queue-6.6/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
 create mode 100644 queue-6.6/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
 create mode 100644 queue-6.6/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
 create mode 100644 queue-6.6/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
 create mode 100644 queue-6.6/spi-loopback-test-don-t-use-pk-through-printk.patch
 create mode 100644 queue-6.6/spi-rpc-if-add-resume-support-for-rz-g3e.patch
 create mode 100644 queue-6.6/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
 create mode 100644 queue-6.6/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
 create mode 100644 queue-6.6/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
 create mode 100644 queue-6.6/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
 create mode 100644 queue-6.6/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
 create mode 100644 queue-6.6/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 create mode 100644 queue-6.6/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
 create mode 100644 queue-6.6/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch

diff --git a/queue-5.10/acpi-video-force-native-for-lenovo-82k8.patch b/queue-5.10/acpi-video-force-native-for-lenovo-82k8.patch
new file mode 100644
index 0000000000..dc5c5a7a45
--- /dev/null
+++ b/queue-5.10/acpi-video-force-native-for-lenovo-82k8.patch
@@ -0,0 +1,45 @@
+From 69314b68f9b8067ce64ca0290be43772c384e415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 338e1f44906a9..0ecc47e273140 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ 		},
+ 	},
++	/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++	{
++	 .callback = video_detect_force_native,
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-5.10/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..c80fcddc19
--- /dev/null
+++ b/queue-5.10/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 6d20d13f3510495c122944cce8bda2509f494bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 13c67f58e9052..5a2081ee37f55 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-5.10/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-5.10/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..8c384e9af0
--- /dev/null
+++ b/queue-5.10/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From 800775bf32b667402d0dcc8c771df04aa8da2b94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index fb98440c0bd4c..325512148c7b8 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -315,6 +315,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)
+  */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.10/bpf-don-t-use-pk-through-printk.patch b/queue-5.10/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..25562f22b8
--- /dev/null
+++ b/queue-5.10/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 8c5e8851db1991a9c4069e11dbe516f4fcfa27dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index e3aca0dc7d9c6..f97b0f1a4eab2 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1031,7 +1031,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-5.10/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-5.10/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..5f3694a299
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From ccf27983b5da8b099d4a913d28fd9071d48ed858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 1a86a4e7e3443..d948ab2720a76 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-5.10/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-5.10/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..223f8d08b4
--- /dev/null
+++ b/queue-5.10/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From fda9e8248bb61793e40923ed1b5e1fd2e1a38272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 182a4dbca0952..7197b0daabea2 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -955,6 +955,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-5.10/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-5.10/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..aa8ab42c0d
--- /dev/null
+++ b/queue-5.10/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From f3bd740e5d9284de9bba34773f4f30c10288cd16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 83af15f77f66f..1c1fa6ac9244a 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -576,8 +576,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -589,7 +595,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-5.10/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-5.10/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..9d2243d8dd
--- /dev/null
+++ b/queue-5.10/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From 253c4265932236204fe197111cfe675b4f035e25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 10c7b6295b02e..9fb389fa17817 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1065,6 +1065,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-5.10/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-5.10/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..9ac3062833
--- /dev/null
+++ b/queue-5.10/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From 5c9b31446c5021ee481b8de9e1396315833b2c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index b17deec1c5d4d..06c5087a439d7 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.10/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-5.10/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..d5a73d9674
--- /dev/null
+++ b/queue-5.10/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From e128e41bb7a24fb77d80f8e4a374bb7c4f296198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e24ab362e51a9..7b8483f8d6f4f 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-5.10/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-5.10/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..b220fc4d77
--- /dev/null
+++ b/queue-5.10/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From ae38d08f4ed324ec099e4d1e2c1323093c5fdac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 3419814d016b5..6e6a466c7d8c9 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-5.10/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-5.10/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..20049fc1ed
--- /dev/null
+++ b/queue-5.10/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 2ea5be1e18a5ee8cd2e1f824f69917581558b805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index 4ed6ad8ce0020..e3b7048de0c66 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -436,7 +436,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -642,7 +642,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-5.10/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-5.10/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..abc3c3f208
--- /dev/null
+++ b/queue-5.10/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From 6c8fb400f3c37f19d85bb6137f45f000d6a57c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-5.10/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-5.10/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..874d6b14aa
--- /dev/null
+++ b/queue-5.10/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From 6ffe64c19ba673e332a324e2d816465d0df43c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 7f758fb60c1fa..70ca3fe4e99ee 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-5.10/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-5.10/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..78cb4573c3
--- /dev/null
+++ b/queue-5.10/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From f913b9d8adf90b6f9b24d6864cc81f9e4cc941ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index a15b44ca87d35..c0acb309e3243 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -183,7 +183,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-5.10/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..052f9cb737
--- /dev/null
+++ b/queue-5.10/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 427daae05ddd6e836f21fd755a0024bbace6db8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 183617d56b446..c900525b52516 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -78,6 +78,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1113,6 +1114,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1181,6 +1186,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1197,6 +1204,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-5.10/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-5.10/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..bf61d7490b
--- /dev/null
+++ b/queue-5.10/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From abcdedf62ec36d28f5338ba04ea22d9537382149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index f49e98c2e31db..635ec11c9a6fc 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3042,11 +3042,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-5.10/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-5.10/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..c72eaef770
--- /dev/null
+++ b/queue-5.10/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From 9dc4f6267baf07f99821eb969ba76134e25e768d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 22fd7ebd5cf3f..9485737638b3c 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -586,8 +586,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 				break;
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-5.10/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..64091efea8
--- /dev/null
+++ b/queue-5.10/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From c215bfbcb81a7592b26fcb25b75ed5cd0fdfddd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.10/series b/queue-5.10/series
index e0ac784593..fc5e0b497f 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -33,3 +33,33 @@ x86-resctrl-fix-miscount-of-bandwidth-event-when-reactivating-previously-unavail
 x86-boot-compile-boot-code-with-std-gnu11-too.patch
 arch-back-to-std-gnu89-in-v5.18.patch
 tracing-fix-declaration-after-statement-warning.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
diff --git a/queue-5.10/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-5.10/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..b15a65dc2c
--- /dev/null
+++ b/queue-5.10/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From 6ad1a7d8decec911d3d92c00fa0f2d2ea07e6fa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 28c19bcb2f205..d2d62d2b378b4 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-5.10/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..4660184f98
--- /dev/null
+++ b/queue-5.10/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From 82accbe0ec50bce22a53065beef6d3fde7552bfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index c1aa7815bd6ec..f7f1a73a52f3a 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ };
+ #endif
+-- 
+2.51.0
+
diff --git a/queue-5.10/soc-ti-pruss-don-t-use-pk-through-printk.patch b/queue-5.10/soc-ti-pruss-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..476ded2eec
--- /dev/null
+++ b/queue-5.10/soc-ti-pruss-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From d0b5a0c160b3b47449523a25b05e8b537a223ec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 30695172a508f..bf2ba4c8595ba 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -229,7 +229,7 @@ static int pruss_probe(struct platform_device *pdev)
+ 		pruss->mem_regions[i].pa = res.start;
+ 		pruss->mem_regions[i].size = resource_size(&res);
+ 
+-		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ 			mem_names[i], &pruss->mem_regions[i].pa,
+ 			pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.10/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-5.10/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..68f218312a
--- /dev/null
+++ b/queue-5.10/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From e4fad11809f45b66a6b3608d4ba1994f3cb80795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 89fccb9da1b8e..556118c931092 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-5.10/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-5.10/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..6e5df21f03
--- /dev/null
+++ b/queue-5.10/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 6a6fbacc3e4074db474464c8963c953097e5eed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index e6de0e80b793e..7f205464a0c7a 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -894,7 +894,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-5.10/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-5.10/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..2d00e88215
--- /dev/null
+++ b/queue-5.10/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From 9c460523092b3edc5a8dc24a3dc63d64a5396363 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-5.10/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-5.10/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..a20413a6a5
--- /dev/null
+++ b/queue-5.10/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 46a21cc85c2ab03f7a96945c4b6d24b7086833ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 60917e32ec853..5c93546fc689b 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1077,13 +1077,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.10/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-5.10/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..c4b1cfabfc
--- /dev/null
+++ b/queue-5.10/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From deb1992ec0e164e7d893b5f1ad168c2e406f348a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 1c80aa498d543..60917e32ec853 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -627,7 +627,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -641,7 +641,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-5.10/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-5.10/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..152ce11cf5
--- /dev/null
+++ b/queue-5.10/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From 8f2b369f7f41640a65efe67dea393aaecba8b8ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 5c93546fc689b..702b5882cfce4 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -862,8 +863,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -918,6 +921,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -996,10 +1001,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-5.10/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-5.10/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..8fba0407e4
--- /dev/null
+++ b/queue-5.10/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 2f7c8ec31c6a1b1c8381fd6016cba60eb19c1807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 1ea2c1f311261..4f2a9fab8ae88 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2242,6 +2242,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-5.10/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..aa5e372365
--- /dev/null
+++ b/queue-5.10/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From 7a013e7d31a953abaf4617293c35c9c99fab1325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-5.15/acpi-prm-skip-handlers-with-null-handler_address-or-.patch b/queue-5.15/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
new file mode 100644
index 0000000000..048143f866
--- /dev/null
+++ b/queue-5.15/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
@@ -0,0 +1,61 @@
+From bae91285ee30facfed50779a6f8f0278784df27f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index 6290ed84c5950..04228582a1f56 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -138,15 +138,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ 		th = &tm->handlers[cur_handler];
+ 
+ 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++		/*
++		 * Print an error message if handler_address is NULL, the parse of VA also
++		 * can be skipped.
++		 */
++		if (unlikely(!handler_info->handler_address)) {
++			pr_info("Skipping handler with NULL address for GUID: %pUL",
++					(guid_t *)handler_info->handler_guid);
++			continue;
++		}
++
+ 		th->handler_addr =
+ 			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ 		/*
+-		 * Print a warning message if handler_addr is zero which is not expected to
+-		 * ever happen.
++		 * Print a warning message and skip the parse of VA if handler_addr is zero
++		 * which is not expected to ever happen.
+ 		 */
+-		if (unlikely(!th->handler_addr))
++		if (unlikely(!th->handler_addr)) {
+ 			pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ 				&th->guid, handler_info->handler_address);
++			continue;
++		}
+ 
+ 		th->static_data_buffer_addr =
+ 			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+-- 
+2.51.0
+
diff --git a/queue-5.15/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch b/queue-5.15/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
new file mode 100644
index 0000000000..b20de23bf8
--- /dev/null
+++ b/queue-5.15/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
@@ -0,0 +1,52 @@
+From 24d6c9d1c75a44cbcd6719bf71814241b93ac62a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 2393cd993b3cb..151c57c7bb3a4 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -789,6 +789,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ 	"PNP0D80", /* Windows-compatible System Power Management Controller */
+ 	"INT33BD", /* Intel Baytrail Mailbox Device */
++	"INTC10DE", /* Intel CVS LNL */
++	"INTC10E0", /* Intel CVS ARL */
+ 	"LATT2021", /* Lattice FW Update Client Driver */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-5.15/acpi-video-force-native-for-lenovo-82k8.patch b/queue-5.15/acpi-video-force-native-for-lenovo-82k8.patch
new file mode 100644
index 0000000000..611d82d86d
--- /dev/null
+++ b/queue-5.15/acpi-video-force-native-for-lenovo-82k8.patch
@@ -0,0 +1,45 @@
+From 69ec1b6a3ef14be3fbb14cce11af568bd92151ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 338e1f44906a9..0ecc47e273140 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ 		},
+ 	},
++	/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++	{
++	 .callback = video_detect_force_native,
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-5.15/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..9da87d0eb4
--- /dev/null
+++ b/queue-5.15/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 0aaf89578756821b2d1f5e65bd27dc8e3da1be3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 132ab74935be8..9aa7a24777e95 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-5.15/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-5.15/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..01938e2a56
--- /dev/null
+++ b/queue-5.15/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From 20029d42a9af020d13d4bf34f380224e1768acc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index a7daaf64ae344..ff4c0f3bae52c 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+  */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/bpf-don-t-use-pk-through-printk.patch b/queue-5.15/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..6d6347cf3f
--- /dev/null
+++ b/queue-5.15/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From eaa21f3135a63c626f5a2fcf649cfd2d8d0e5e8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 7d8294d0d7173..dc49c8eb00fd6 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1090,7 +1090,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-5.15/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-5.15/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..c59859e128
--- /dev/null
+++ b/queue-5.15/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From 7af0d82659ed29925a02d667da369cfe53692993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-5.15/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-5.15/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..413ad48f39
--- /dev/null
+++ b/queue-5.15/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From c0fb3b36e61c8757930f43f039e45d5b2628a57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index c538a153ee828..f116a1d555490 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-5.15/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-5.15/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..3c3733b46d
--- /dev/null
+++ b/queue-5.15/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From 87cd54593cdee84f542a0cb6431f473ce137c1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index ef2ea1b12cd84..e371d6972f8d9 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -597,8 +597,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -610,7 +616,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-5.15/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-5.15/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..80129afa15
--- /dev/null
+++ b/queue-5.15/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From bdb477dcab3b246438dfb8cf77473280fa8a80ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 597cbb4391bdc..ff0209c92a755 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1030,6 +1030,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-5.15/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch b/queue-5.15/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
new file mode 100644
index 0000000000..fbd23e3cd1
--- /dev/null
+++ b/queue-5.15/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
@@ -0,0 +1,140 @@
+From 9ea044602b33b80354e0fd03abb805bdec2b1a44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index e35357c48b8e6..b2ef2ada4bfe2 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -15,6 +15,7 @@
+ #include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+ 
+ /*
+  * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -30,8 +31,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC		0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC		0x14 /* RW */
+ 
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT	2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT	5
+ 
++#define SBTSI_TEMP_EXT_RANGE_ADJ	49000
++
+ #define SBTSI_TEMP_MIN	0
+ #define SBTSI_TEMP_MAX	255875
+ 
+@@ -39,6 +54,8 @@
+ struct sbtsi_data {
+ 	struct i2c_client *client;
+ 	struct mutex lock;
++	bool ext_range_mode;
++	bool read_order;
+ };
+ 
+ /*
+@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ 	struct sbtsi_data *data = dev_get_drvdata(dev);
+ 	s32 temp_int, temp_dec;
+-	int err;
+ 
+ 	switch (attr) {
+ 	case hwmon_temp_input:
+-		/*
+-		 * ReadOrder bit specifies the reading order of integer and
+-		 * decimal part of CPU temp for atomic reads. If bit == 0,
+-		 * reading integer part triggers latching of the decimal part,
+-		 * so integer part should be read first. If bit == 1, read
+-		 * order should be reversed.
+-		 */
+-		err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+-		if (err < 0)
+-			return err;
+-
+ 		mutex_lock(&data->lock);
+-		if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++		if (data->read_order) {
+ 			temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ 			temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ 		} else {
+@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ 		return temp_dec;
+ 
+ 	*val = sbtsi_reg_to_mc(temp_int, temp_dec);
++	if (data->ext_range_mode)
++		*val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+ 
+ 	return 0;
+ }
+@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ 		return -EINVAL;
+ 	}
+ 
++	if (data->ext_range_mode)
++		val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ 	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ 	sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+ 
+@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,
+ 	struct device *dev = &client->dev;
+ 	struct device *hwmon_dev;
+ 	struct sbtsi_data *data;
++	int err;
+ 
+ 	data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ 	if (!data)
+@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client,
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+ 
+-	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+-							 NULL);
++	err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++	if (err < 0)
++		return err;
++	data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++	data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++							 &sbtsi_chip_info, NULL);
+ 
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-5.15/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..b783731f89
--- /dev/null
+++ b/queue-5.15/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From 57030f856f31de251641d7ec10dda376c07b9b2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 9d99b19cd21b6..4d12f1b0a5394 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.15/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-5.15/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..af284e1c12
--- /dev/null
+++ b/queue-5.15/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From dbd8544bbcb5da1f62385955841665556876d160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 9a2acf5c40143..fc9e6db3bb72b 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-5.15/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-5.15/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..4694aa18a1
--- /dev/null
+++ b/queue-5.15/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From 570f82fb17244cf627c5cc0942c792ff12f4d064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 4b7f707b7952c..be7c2229d5510 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-5.15/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-5.15/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..823e09ab3c
--- /dev/null
+++ b/queue-5.15/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 7581698d304311406c972614aeb0e69b3cbf59b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index a2abc0094def7..87797d77c9f0c 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -457,7 +457,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -671,7 +671,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-5.15/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-5.15/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..cc2f160b67
--- /dev/null
+++ b/queue-5.15/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From 912d4cf4db7459e3a722199b24edccb6394a5aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-5.15/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-5.15/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..f5c8ed32df
--- /dev/null
+++ b/queue-5.15/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From d38e1c5525ba03e567e59d0192bda14aa545ad21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 743afbe4e99b7..0c4e49716ee1c 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1498,6 +1498,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-5.15/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-5.15/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..d578b17875
--- /dev/null
+++ b/queue-5.15/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From c0d4a79923ad0495fd4059ca6c484c0871e5fd17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 9ea9bc250543f..2b5dc342d30ab 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -193,7 +193,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-5.15/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..a026df0245
--- /dev/null
+++ b/queue-5.15/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 113f07f6d78e6bfcac1b1b1a38c5b392be928bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 8fb2ba20e221b..b4c785393be3c 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -79,6 +79,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-5.15/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-5.15/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..d96ea21a9e
--- /dev/null
+++ b/queue-5.15/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From 31e7bd053aa926ec61a247a3283889a5de1a557f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index ebe8c2f147a33..8a9cb7709b32d 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3039,11 +3039,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-5.15/nvmet-fc-avoid-scheduling-association-deletion-twice.patch b/queue-5.15/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
new file mode 100644
index 0000000000..1927b19882
--- /dev/null
+++ b/queue-5.15/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
@@ -0,0 +1,72 @@
+From 691183c54064b2c9a62a25bea856864c94c61697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 4c4b528b89ebe..80e0dc60a9205 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++	int terminating;
++
++	terminating = atomic_xchg(&assoc->terminating, 1);
++
++	/* if already terminating, do nothing */
++	if (terminating)
++		return;
++
+ 	nvmet_fc_tgtport_get(assoc->tgtport);
+ 	if (!queue_work(nvmet_wq, &assoc->del_work))
+ 		nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ 	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ 	unsigned long flags;
+-	int i, terminating;
+-
+-	terminating = atomic_xchg(&assoc->terminating, 1);
+-
+-	/* if already terminating, do nothing */
+-	if (terminating)
+-		return;
++	int i;
+ 
+ 	spin_lock_irqsave(&tgtport->lock, flags);
+ 	list_del_rcu(&assoc->a_list);
+-- 
+2.51.0
+
diff --git a/queue-5.15/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-5.15/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..07b32ff185
--- /dev/null
+++ b/queue-5.15/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From 6402554aec92ae39efe342a3ee6ef3d72f200582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 28f3fabc72e30..a72911e8ea82d 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 				break;
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-5.15/power-supply-sbs-charger-support-multiple-devices.patch b/queue-5.15/power-supply-sbs-charger-support-multiple-devices.patch
new file mode 100644
index 0000000000..03a25a79e9
--- /dev/null
+++ b/queue-5.15/power-supply-sbs-charger-support-multiple-devices.patch
@@ -0,0 +1,114 @@
+From fa22995cd383bc4b01d7560e5fe184b943c81f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[    8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[    8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G           O      5.10.147 #22
+[    8.151974] Hardware name: ALE AMB (DT)
+[    8.155828] Call trace:
+[    8.158292]  dump_backtrace+0x0/0x1d4
+[    8.161960]  show_stack+0x18/0x6c
+[    8.165280]  dump_stack+0xcc/0x128
+[    8.168687]  sysfs_warn_dup+0x60/0x7c
+[    8.172353]  sysfs_do_create_link_sd+0xf0/0x100
+[    8.176886]  sysfs_create_link+0x20/0x40
+[    8.180816]  device_add+0x270/0x7a4
+[    8.184311]  __power_supply_register+0x304/0x560
+[    8.188930]  devm_power_supply_register+0x54/0xa0
+[    8.193644]  sbs_probe+0xc0/0x214 [sbs_charger]
+[    8.198183]  i2c_device_probe+0x2dc/0x2f4
+[    8.202196]  really_probe+0xf0/0x510
+[    8.205774]  driver_probe_device+0xfc/0x160
+[    8.209960]  device_driver_attach+0xc0/0xcc
+[    8.214146]  __driver_attach+0xc0/0x170
+[    8.218002]  bus_for_each_dev+0x74/0xd4
+[    8.221862]  driver_attach+0x24/0x30
+[    8.225444]  bus_add_driver+0x148/0x250
+[    8.229283]  driver_register+0x78/0x130
+[    8.233140]  i2c_register_driver+0x4c/0xe0
+[    8.237250]  sbs_driver_init+0x20/0x1000 [sbs_charger]
+[    8.242424]  do_one_initcall+0x50/0x1b0
+[    8.242434]  do_init_module+0x44/0x230
+[    8.242438]  load_module+0x2200/0x27c0
+[    8.242442]  __do_sys_finit_module+0xa8/0x11c
+[    8.242447]  __arm64_sys_finit_module+0x20/0x30
+[    8.242457]  el0_svc_common.constprop.0+0x64/0x154
+[    8.242464]  do_el0_svc+0x24/0x8c
+[    8.242474]  el0_svc+0x10/0x20
+[    8.242481]  el0_sync_handler+0x108/0x114
+[    8.242485]  el0_sync+0x180/0x1c0
+[    8.243847] sbs-charger 20-0009: Failed to register power supply
+[    8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[    7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index bc927c0ddd343..7dfed22fbce3b 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ 	.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+ 
+-static const struct power_supply_desc sbs_desc = {
+-	.name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ 	.type = POWER_SUPPLY_TYPE_MAINS,
+ 	.properties = sbs_properties,
+ 	.num_properties = ARRAY_SIZE(sbs_properties),
+@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client,
+ 		     const struct i2c_device_id *id)
+ {
+ 	struct power_supply_config psy_cfg = {};
++	struct power_supply_desc *sbs_desc;
+ 	struct sbs_info *chip;
+ 	int ret, val;
+ 
++	sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++				sizeof(*sbs_desc), GFP_KERNEL);
++	if (!sbs_desc)
++		return -ENOMEM;
++
++	sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++					dev_name(&client->dev));
++	if (!sbs_desc->name)
++		return -ENOMEM;
++
+ 	chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ 	if (!chip)
+ 		return -ENOMEM;
+@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,
+ 		return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ 	chip->last_state = val;
+ 
+-	chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++	chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ 	if (IS_ERR(chip->power_supply))
+ 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ 				     "Failed to register power supply\n");
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-5.15/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..9fc5c771fe
--- /dev/null
+++ b/queue-5.15/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From 22c0b27982d77b5b79e57278d328f51c1ae08910 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.15/series b/queue-5.15/series
index 0dd5706414..716319827e 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -47,3 +47,40 @@ xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch
 x86-boot-compile-boot-code-with-std-gnu11-too.patch
 arch-back-to-std-gnu89-in-v5.18.patch
 revert-docs-process-howto-replace-c89-with-c11.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
diff --git a/queue-5.15/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch b/queue-5.15/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
new file mode 100644
index 0000000000..c97d35037a
--- /dev/null
+++ b/queue-5.15/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
@@ -0,0 +1,37 @@
+From 54d0b53249fa6fad9caa4d2690bdb62b0fb410f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ 	{ "AST2620", 0x05010203 },
+ 	{ "AST2605", 0x05030103 },
+ 	{ "AST2625", 0x05030403 },
++	/* AST2700 */
++	{ "AST2750", 0x06000003 },
++	{ "AST2700", 0x06000103 },
++	{ "AST2720", 0x06000203 },
+ };
+ 
+ static const char *siliconid_to_name(u32 siliconid)
+-- 
+2.51.0
+
diff --git a/queue-5.15/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-5.15/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..5d4cae55a2
--- /dev/null
+++ b/queue-5.15/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From 54bf9b87e3221bc62dd090e5e8679f7c532fadc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 4fb5aeeb08439..ec01cae7ffc8a 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -710,7 +710,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-5.15/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..a0cfeae5fe
--- /dev/null
+++ b/queue-5.15/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From 8d4471231acb0d9c5c6eb78daf571ddc46c18428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index b071d433d74f8..bfc8d39ae9efd 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ 	.clk_suspend_on = false,
+ };
+-- 
+2.51.0
+
diff --git a/queue-5.15/soc-ti-pruss-don-t-use-pk-through-printk.patch b/queue-5.15/soc-ti-pruss-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..8a115d2e9f
--- /dev/null
+++ b/queue-5.15/soc-ti-pruss-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 1e033b1b61704c0f6bf13e9dee04305145f0d6b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index b36779309e49b..84f992320c4d8 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev)
+ 		pruss->mem_regions[i].pa = res.start;
+ 		pruss->mem_regions[i].size = resource_size(&res);
+ 
+-		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ 			mem_names[i], &pruss->mem_regions[i].pa,
+ 			pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.15/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-5.15/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..9146f79f8a
--- /dev/null
+++ b/queue-5.15/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From b4be84e5a172b158fdb56305515d3dfda06fcddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 89fccb9da1b8e..556118c931092 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-5.15/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-5.15/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..eb33857508
--- /dev/null
+++ b/queue-5.15/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 05691b56d48374ab760b47e5c58b94524397e984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index a7e89c229fc51..f10089fadaf07 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -895,7 +895,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-5.15/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch b/queue-5.15/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
new file mode 100644
index 0000000000..583a10055a
--- /dev/null
+++ b/queue-5.15/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
@@ -0,0 +1,44 @@
+From e5b56d16ad9c7e5157c75a41b948b887a5550300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 3f7d0c0c50676..0e29365e23a59 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ 	if (numwritten < 1) {
+ 		perror(path);
+ 		close(fd);
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	close(fd);
+-- 
+2.51.0
+
diff --git a/queue-5.15/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-5.15/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..f268b4b0a5
--- /dev/null
+++ b/queue-5.15/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From 666989a9bae6ad66b987064e76ddf55c219d02ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-5.15/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-5.15/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..5727554dc8
--- /dev/null
+++ b/queue-5.15/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 30eaa2158130352a1278fbc70ebd732c11e082b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-5.15/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..2f3dd38343
--- /dev/null
+++ b/queue-5.15/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From 32552f05bd24a2ec526e433780a3b5c8f0c9f639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-5.15/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-5.15/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..d3ed3295cf
--- /dev/null
+++ b/queue-5.15/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From 230bf30df838dc4c0ff22d1f7bdd98a7b02ace17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-5.15/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-5.15/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..b1099bbdd2
--- /dev/null
+++ b/queue-5.15/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 3a1e3fc1619d19dd4b3ebfca53705be5f7f31da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index b37a6bde8a915..4e6ada6a11c7e 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2241,6 +2241,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-5.15/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..3ca762c044
--- /dev/null
+++ b/queue-5.15/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From 5e01a89d74394ca1eeb01b6f9dc8ad11a0d49976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-5.4/acpi-video-force-native-for-lenovo-82k8.patch b/queue-5.4/acpi-video-force-native-for-lenovo-82k8.patch
new file mode 100644
index 0000000000..ef4c9b8e30
--- /dev/null
+++ b/queue-5.4/acpi-video-force-native-for-lenovo-82k8.patch
@@ -0,0 +1,45 @@
+From 069d465ae71ef51caa1af89491cbfc5550fbc9cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index be9c70806b620..640e3fecd62d0 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -556,6 +556,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
+ 		},
+ 	},
++	/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++	{
++	 .callback = video_detect_force_native,
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-5.4/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..0be3108d7b
--- /dev/null
+++ b/queue-5.4/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 1e8720795b3be9684afa83415b8276e3c8be7e0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 203e9ee47fdb8..998bed6e54066 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-5.4/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-5.4/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..b55f847bd2
--- /dev/null
+++ b/queue-5.4/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From e5d28a9341a807ee2025699db3319562d3e0dcea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 50eb3f64a77c3..7d6afe5cdb7ac 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -371,6 +371,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)
+  */
+ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.4/bpf-don-t-use-pk-through-printk.patch b/queue-5.4/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..d09297fc2a
--- /dev/null
+++ b/queue-5.4/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 31c584e30ab4c6156863dd56f87a13490a9c36e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 0bec300b2e516..41ec70a74b2e0 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -980,7 +980,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-5.4/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-5.4/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..08ce5b3204
--- /dev/null
+++ b/queue-5.4/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From 03af67533006266a69cbc342a36a47c0ab8d913f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index fef0bb4e0c8c3..c37afdfb477f0 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -132,8 +132,8 @@ static struct irqaction pit_timer_irq = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(setup_irq(irq, &pit_timer_irq));
+ 
+@@ -189,7 +189,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-5.4/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-5.4/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..739eb34194
--- /dev/null
+++ b/queue-5.4/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From 8237e79d7662cf192b55296953a28ff9895a8761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 92d92e67ae0a1..a9887011f1fa1 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -956,6 +956,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-5.4/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-5.4/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..ecde7d0253
--- /dev/null
+++ b/queue-5.4/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From 0a1f216893df27d1227239a3f612c2102a25c6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 785e7a07bb291..51d0f5e88ebcf 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1016,6 +1016,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-5.4/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-5.4/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..7c50debbea
--- /dev/null
+++ b/queue-5.4/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From c57fb31d421aabfa168c231068aa1a4f5f004cd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 2468b285c77c2..1a209869b7f5b 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.4/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-5.4/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..27d542c672
--- /dev/null
+++ b/queue-5.4/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From ed378ef33a0f415a9ce56656224a1c4c72da3b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e24ab362e51a9..7b8483f8d6f4f 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-5.4/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-5.4/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..f3dedd214f
--- /dev/null
+++ b/queue-5.4/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 3953639791c6ade0199f030793b23f157d6bf12d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index 29540cbf75934..bfd116f5a58d0 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -431,7 +431,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -616,7 +616,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-5.4/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-5.4/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..35ca65e846
--- /dev/null
+++ b/queue-5.4/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From a2942308d06b3cf5b9927b0eb6bc90967fbe9969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index cd2f45257dc16..d52bb3ea7fb6f 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-5.4/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-5.4/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..beee9d6dab
--- /dev/null
+++ b/queue-5.4/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From 75a6a273eb0cea252f0b1bb1f1c9b65ff7079109 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 7f758fb60c1fa..70ca3fe4e99ee 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ int stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-5.4/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-5.4/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..247361ce9d
--- /dev/null
+++ b/queue-5.4/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From cf695cf3d89b83e1fb10ad40e5dac4eba4a20547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 23fd93407eced..0a79b718cf17c 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -185,7 +185,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-5.4/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..6807f2c934
--- /dev/null
+++ b/queue-5.4/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 0f7d7a86d77d3c38a1e0899fc3ba84d992722b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 5e6f6c951fd4e..23dda8b2b7f03 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -63,6 +63,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	(1 << 15)
+ #define CORE_IO_PAD_PWR_SWITCH  (1 << 16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1034,6 +1035,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1102,6 +1107,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1118,6 +1125,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-5.4/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..0b2b8f6466
--- /dev/null
+++ b/queue-5.4/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From 65e0e1cdce00d23745d49b6d017331a36bae202d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index fb5fd6841ef39..d63878bc2d5f9 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -73,7 +73,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.4/series b/queue-5.4/series
index abef3aa511..fdbd0265fc 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -21,3 +21,26 @@ can-gs_usb-increase-max-interface-to-u8_max.patch
 serial-8250_dw-use-devm_clk_get_optional-to-get-the-input-clock.patch
 serial-8250_dw-use-devm_add_action_or_reset.patch
 serial-8250_dw-handle-reset-control-deassert-error.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
diff --git a/queue-5.4/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-5.4/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..b398b324a3
--- /dev/null
+++ b/queue-5.4/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From f250d5ec745127e5085f61711754f10a03efdde1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 28c19bcb2f205..d2d62d2b378b4 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-5.4/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..3be0e6d83d
--- /dev/null
+++ b/queue-5.4/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From dde373a8d6dffbc13ddf06900dad5203f20437ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 0f571ff132377..3edcb5bf59f79 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -403,7 +403,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -413,15 +413,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -514,7 +514,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -652,7 +652,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-5.4/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-5.4/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..b04aacad03
--- /dev/null
+++ b/queue-5.4/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From b3c6cd880835ef1a80238d4e40d5e65adccd0bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index 357944bc73b19..28cbe4613ed91 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -722,7 +722,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-5.4/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-5.4/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..1502be2e36
--- /dev/null
+++ b/queue-5.4/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From 14bd691a70c308564da24564d556739b9dc72a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-5.4/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-5.4/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..9ec6bd8620
--- /dev/null
+++ b/queue-5.4/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 1bcdaf761ce66e497c355af141ada7ca9fcc23ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 165eb4da8a644..0cb17e13c002b 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1024,13 +1024,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.4/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-5.4/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..ceefce2ce8
--- /dev/null
+++ b/queue-5.4/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From d2a9f888c59f1d9539fb5ccf8aead7182ad20b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0cb17e13c002b..c878e2e1cabea 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -809,8 +810,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -865,6 +868,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -943,10 +948,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-5.4/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-5.4/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..70835e6f74
--- /dev/null
+++ b/queue-5.4/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From f6513f0dc8e981ebdaba0e4899f1dfcbcd719b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 6285674412f25..2b809bc849dd6 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-5.4/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..de54cb9d98
--- /dev/null
+++ b/queue-5.4/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From 8b96750acbdd77d46a59ef4e4701abe5664a9794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index e94932c69f540..80a4b12563c6f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -21,7 +21,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-6.1/acpi-prm-skip-handlers-with-null-handler_address-or-.patch b/queue-6.1/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
new file mode 100644
index 0000000000..97529abdef
--- /dev/null
+++ b/queue-6.1/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
@@ -0,0 +1,61 @@
+From 2cfee25e169e0d6505be17d6d7b9ccdf505734a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index 215ca8d60616f..22225bcda6f4c 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ 		th = &tm->handlers[cur_handler];
+ 
+ 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++		/*
++		 * Print an error message if handler_address is NULL, the parse of VA also
++		 * can be skipped.
++		 */
++		if (unlikely(!handler_info->handler_address)) {
++			pr_info("Skipping handler with NULL address for GUID: %pUL",
++					(guid_t *)handler_info->handler_guid);
++			continue;
++		}
++
+ 		th->handler_addr =
+ 			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ 		/*
+-		 * Print a warning message if handler_addr is zero which is not expected to
+-		 * ever happen.
++		 * Print a warning message and skip the parse of VA if handler_addr is zero
++		 * which is not expected to ever happen.
+ 		 */
+-		if (unlikely(!th->handler_addr))
++		if (unlikely(!th->handler_addr)) {
+ 			pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ 				&th->guid, handler_info->handler_address);
++			continue;
++		}
+ 
+ 		th->static_data_buffer_addr =
+ 			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+-- 
+2.51.0
+
diff --git a/queue-6.1/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch b/queue-6.1/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
new file mode 100644
index 0000000000..665fecd02f
--- /dev/null
+++ b/queue-6.1/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
@@ -0,0 +1,52 @@
+From 14c5a43948bc8d90414986e940d89403ba8ca682 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 293cdf486fd81..9e8f38e525893 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -785,6 +785,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ 	"PNP0D80", /* Windows-compatible System Power Management Controller */
+ 	"INT33BD", /* Intel Baytrail Mailbox Device */
++	"INTC10DE", /* Intel CVS LNL */
++	"INTC10E0", /* Intel CVS ARL */
+ 	"LATT2021", /* Lattice FW Update Client Driver */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.1/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-6.1/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..b3906a0578
--- /dev/null
+++ b/queue-6.1/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 1dc03b4f4970524f38794c8b9d402200059d9db0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 05fd1ec8de14e..c5ad377558645 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-6.1/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-6.1/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..c3813d1cf3
--- /dev/null
+++ b/queue-6.1/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From 56a81d91eb81a4a3e12daa7648efa1bcf60716e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+  */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch b/queue-6.1/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
new file mode 100644
index 0000000000..871aff80d5
--- /dev/null
+++ b/queue-6.1/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
@@ -0,0 +1,57 @@
+From 86acb64e88099802060afc2d63db9d59640ce77f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index 55dbc68bfffce..8a0a69f691595 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -110,6 +110,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ 	xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+ 
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++	xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 9b4254feefccd..786064ac889a1 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4118,6 +4118,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+ 
+ 	if (unlikely(!sinfo->nr_frags)) {
+ 		xdp_buff_clear_frags_flag(xdp);
++		xdp_buff_clear_frag_pfmemalloc(xdp);
+ 		xdp->data_end -= offset;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/bpf-don-t-use-pk-through-printk.patch b/queue-6.1/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..2655ddc00b
--- /dev/null
+++ b/queue-6.1/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From ce7f5ad421bda113989dd87416e014f6791f1188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index f3ef1a8965bb2..bbdae97d50c42 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1082,7 +1082,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-6.1/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch b/queue-6.1/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
new file mode 100644
index 0000000000..ee42823412
--- /dev/null
+++ b/queue-6.1/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
@@ -0,0 +1,61 @@
+From afc64c045edabdaa19d03f2163d73df655bbfa7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+   71 |         info.func_info = ptr_to_u64(&finfo);
+      |                                      ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 |         info.func_info = ptr_to_u64(&func_info);
+      |
+
+v2:
+  - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c       | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 19924b6ce796f..56100ad2fa0d2 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ 	__u32 info_len = sizeof(info);
+ 	const char *prog_name = NULL;
+ 	struct btf *prog_btf = NULL;
+-	struct bpf_func_info finfo;
++	struct bpf_func_info finfo = {};
+ 	__u32 finfo_rec_size;
+ 	char prog_str[1024];
+ 	int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 1c3dc1dae23f6..e158e010266d5 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2104,7 +2104,7 @@ static void profile_print_readings(void)
+ 
+ static char *profile_target_name(int tgt_fd)
+ {
+-	struct bpf_func_info func_info;
++	struct bpf_func_info func_info = {};
+ 	struct bpf_prog_info info = {};
+ 	__u32 info_len = sizeof(info);
+ 	const struct btf_type *t;
+-- 
+2.51.0
+
diff --git a/queue-6.1/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-6.1/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..633898f428
--- /dev/null
+++ b/queue-6.1/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From a404cd1b5557ae4ac8da73faa243e689d30fb71c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.1/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-6.1/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..cd89e19966
--- /dev/null
+++ b/queue-6.1/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From f0bbcea0a286e32605e66dfd2c50423732263f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 3e000e1a75c6c..9b6ec68753dde 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-6.1/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-6.1/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..2c19c0a601
--- /dev/null
+++ b/queue-6.1/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From b6d014090d652bf2103b3e8b1c41b59659598e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 6eceb19882430..fdd25271106a3 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -602,8 +602,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -615,7 +621,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-6.1/futex-don-t-leak-robust_list-pointer-on-exec-race.patch b/queue-6.1/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
new file mode 100644
index 0000000000..70215cb363
--- /dev/null
+++ b/queue-6.1/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
@@ -0,0 +1,199 @@
+From a9dd4b673e4c71c5c2086817ba46928cb7aa5e32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index a8074079b09e8..48feaa545b3c7 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ 	return 0;
+ }
+ 
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++	if (compat)
++		return p->compat_robust_list;
++#endif
++	return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++	struct task_struct *p = current;
++	void __user *head;
++	int ret;
++
++	scoped_guard(rcu) {
++		if (pid) {
++			p = find_task_by_vpid(pid);
++			if (!p)
++				return (void __user *)ERR_PTR(-ESRCH);
++		}
++		get_task_struct(p);
++	}
++
++	/*
++	 * Hold exec_update_lock to serialize with concurrent exec()
++	 * so ptrace_may_access() is checked against stable credentials
++	 */
++	ret = down_read_killable(&p->signal->exec_update_lock);
++	if (ret)
++		goto err_put;
++
++	ret = -EPERM;
++	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++		goto err_unlock;
++
++	head = futex_task_robust_list(p, compat);
++
++	up_read(&p->signal->exec_update_lock);
++	put_task_struct(p);
++
++	return head;
++
++err_unlock:
++	up_read(&p->signal->exec_update_lock);
++err_put:
++	put_task_struct(p);
++	return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+  * sys_get_robust_list() - Get the robust-futex list head of a task
+  * @pid:	pid of the process [zero for current task]
+@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 		struct robust_list_head __user * __user *, head_ptr,
+ 		size_t __user *, len_ptr)
+ {
+-	struct robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+ 
+-	head = p->robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(head, head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ 
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 			compat_uptr_t __user *, head_ptr,
+ 			compat_size_t __user *, len_ptr)
+ {
+-	struct compat_robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+ 
+-	head = p->compat_robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch b/queue-6.1/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
new file mode 100644
index 0000000000..f531b8cf3e
--- /dev/null
+++ b/queue-6.1/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
@@ -0,0 +1,38 @@
+From 57616bd5c321285050399e4ace2e99a3bc7e88c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 6f20b55f41f2e..c9222c83ba240 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+  */
+ #define ASUS_EC_MAX_BANK	3
+ 
+-#define ACPI_LOCK_DELAY_MS	500
++#define ACPI_LOCK_DELAY_MS	800
+ 
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX	"\\AMW0.ASMX"
+-- 
+2.51.0
+
diff --git a/queue-6.1/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-6.1/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..39fbcd4866
--- /dev/null
+++ b/queue-6.1/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From a9065612701cf69075ac0e06aef91dbc93b82df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index dbcb8f362061d..e13d545fbc570 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.1/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch b/queue-6.1/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
new file mode 100644
index 0000000000..1354fc0288
--- /dev/null
+++ b/queue-6.1/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
@@ -0,0 +1,140 @@
+From a04508345d67366da0664897f7c5caaf2b72a26a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index e35357c48b8e6..b2ef2ada4bfe2 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -15,6 +15,7 @@
+ #include <linux/mutex.h>
+ #include <linux/of_device.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+ 
+ /*
+  * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -30,8 +31,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC		0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC		0x14 /* RW */
+ 
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT	2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT	5
+ 
++#define SBTSI_TEMP_EXT_RANGE_ADJ	49000
++
+ #define SBTSI_TEMP_MIN	0
+ #define SBTSI_TEMP_MAX	255875
+ 
+@@ -39,6 +54,8 @@
+ struct sbtsi_data {
+ 	struct i2c_client *client;
+ 	struct mutex lock;
++	bool ext_range_mode;
++	bool read_order;
+ };
+ 
+ /*
+@@ -75,23 +92,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ 	struct sbtsi_data *data = dev_get_drvdata(dev);
+ 	s32 temp_int, temp_dec;
+-	int err;
+ 
+ 	switch (attr) {
+ 	case hwmon_temp_input:
+-		/*
+-		 * ReadOrder bit specifies the reading order of integer and
+-		 * decimal part of CPU temp for atomic reads. If bit == 0,
+-		 * reading integer part triggers latching of the decimal part,
+-		 * so integer part should be read first. If bit == 1, read
+-		 * order should be reversed.
+-		 */
+-		err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+-		if (err < 0)
+-			return err;
+-
+ 		mutex_lock(&data->lock);
+-		if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++		if (data->read_order) {
+ 			temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ 			temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ 		} else {
+@@ -123,6 +128,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ 		return temp_dec;
+ 
+ 	*val = sbtsi_reg_to_mc(temp_int, temp_dec);
++	if (data->ext_range_mode)
++		*val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+ 
+ 	return 0;
+ }
+@@ -147,6 +154,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ 		return -EINVAL;
+ 	}
+ 
++	if (data->ext_range_mode)
++		val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ 	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ 	sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+ 
+@@ -205,6 +214,7 @@ static int sbtsi_probe(struct i2c_client *client,
+ 	struct device *dev = &client->dev;
+ 	struct device *hwmon_dev;
+ 	struct sbtsi_data *data;
++	int err;
+ 
+ 	data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ 	if (!data)
+@@ -213,8 +223,14 @@ static int sbtsi_probe(struct i2c_client *client,
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+ 
+-	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+-							 NULL);
++	err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++	if (err < 0)
++		return err;
++	data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++	data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++							 &sbtsi_chip_info, NULL);
+ 
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/hwmon-sy7636a-add-alias.patch b/queue-6.1/hwmon-sy7636a-add-alias.patch
new file mode 100644
index 0000000000..2d90a6366f
--- /dev/null
+++ b/queue-6.1/hwmon-sy7636a-add-alias.patch
@@ -0,0 +1,31 @@
+From c89450c7ff83f19b8be31d63e29f6d3a60769e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index 6dd9c2a0f0e03..9fabd60e9a970 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+ 
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+-- 
+2.51.0
+
diff --git a/queue-6.1/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-6.1/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..878ff2437a
--- /dev/null
+++ b/queue-6.1/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From 5c899965c63649701359d30cdce8400ae4bf7d4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index c04f2481068bb..8aa28dfea6342 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -178,14 +178,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch b/queue-6.1/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
new file mode 100644
index 0000000000..84389c3bed
--- /dev/null
+++ b/queue-6.1/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
@@ -0,0 +1,69 @@
+From a1d17761d67ee3af5782385056f0ee679159bf80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index bf2324910a75c..c11c645cce525 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -176,8 +176,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ 		goto iounmap_base;
+ 	}
+ 
+-	priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+-					&pch_lpc_domain_ops, priv);
++	/*
++	 * The LPC interrupt controller is a legacy i8259-compatible device,
++	 * which requires a static 1:1 mapping for IRQs 0-15.
++	 * Use irq_domain_create_legacy to establish this static mapping early.
++	 */
++	priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++						    &pch_lpc_domain_ops, priv);
+ 	if (!priv->lpc_domain) {
+ 		pr_err("Failed to create IRQ domain\n");
+ 		goto free_irq_handle;
+-- 
+2.51.0
+
diff --git a/queue-6.1/irqchip-sifive-plic-respect-mask-state-when-setting-.patch b/queue-6.1/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
new file mode 100644
index 0000000000..8cbaf3bf41
--- /dev/null
+++ b/queue-6.1/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
@@ -0,0 +1,54 @@
+From 96aae9707f89767cccf80b8d9f7afd09eb0c8077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 164c3e71ea70c..36de764ee2b61 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -172,12 +172,14 @@ static int plic_set_affinity(struct irq_data *d,
+ 	if (cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+-	plic_irq_disable(d);
++	/* Invalidate the original routing entry */
++	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+ 
+ 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
++	/* Setting the new routing entry if irq is enabled */
+ 	if (!irqd_irq_disabled(d))
+-		plic_irq_enable(d);
++		plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-6.1/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..a076bafd88
--- /dev/null
+++ b/queue-6.1/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From a523ac18e1b85446a8b8f682a139188b771bffc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 9a2acf5c40143..fc9e6db3bb72b 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-6.1/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-6.1/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..eee59ccd6e
--- /dev/null
+++ b/queue-6.1/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From bb6cb26a59e79d86cab51270fbed3ad5e540f4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index 343ed6e96d87e..6e48348cff054 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-6.1/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-6.1/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..5a116f5e8b
--- /dev/null
+++ b/queue-6.1/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 6498908c6a3387fb72ff835b81487a0ea8a2b423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index a2abc0094def7..87797d77c9f0c 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -457,7 +457,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -671,7 +671,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-6.1/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-6.1/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..adaa35b74c
--- /dev/null
+++ b/queue-6.1/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From f69bb977ccacb215d38a6b33c74f0dc26d8103d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index 4d55494a97c4b..8c36b7d122856 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-6.1/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-6.1/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..fd5b4ad475
--- /dev/null
+++ b/queue-6.1/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From b37b3064b8a4bf624894fa06b86c142d110acdb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index aef29221d7c12..a23b3816eee37 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-6.1/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-6.1/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..7d15274ed4
--- /dev/null
+++ b/queue-6.1/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From 1ce73f97c0258be78f0810d204255c97c97fa06e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index d0a15645a0b8f..37c81cc076553 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-6.1/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..cd1c3a5610
--- /dev/null
+++ b/queue-6.1/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From ec34251414e95058cb2dcd8841b65fcf13d2289b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index f507fa491c58f..996ab8c760d35 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -79,6 +79,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1129,6 +1130,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1197,6 +1202,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1213,6 +1220,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-6.1/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-6.1/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..582f4fd2ca
--- /dev/null
+++ b/queue-6.1/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From b51ffba43121c5119d738ca647cdeefba8bb19d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 2b0f15de77111..786715e9eeb93 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3048,11 +3048,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-6.1/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch b/queue-6.1/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
new file mode 100644
index 0000000000..76fa996037
--- /dev/null
+++ b/queue-6.1/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
@@ -0,0 +1,52 @@
+From 345c414a5f05f5d02cd3bcb040745b3b9d53e455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 7d3759f875b23..938af571dc13e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -5131,8 +5131,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ 	 * checking that they started once before, hence are reconnecting back.
+ 	 */
+ 	if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+-	    nvme_discovery_ctrl(ctrl))
++	    nvme_discovery_ctrl(ctrl)) {
++		if (!ctrl->kato) {
++			nvme_stop_keep_alive(ctrl);
++			ctrl->kato = NVME_DEFAULT_KATO;
++			nvme_start_keep_alive(ctrl);
++		}
+ 		nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++	}
+ 
+ 	if (ctrl->queue_count > 1) {
+ 		nvme_queue_scan(ctrl);
+-- 
+2.51.0
+
diff --git a/queue-6.1/nvmet-fc-avoid-scheduling-association-deletion-twice.patch b/queue-6.1/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
new file mode 100644
index 0000000000..d7a63c55f2
--- /dev/null
+++ b/queue-6.1/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
@@ -0,0 +1,72 @@
+From 3a4235cb954e7f4017af5b8b6a1939abff796984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index a15e764bae35b..188b9f1bdaca1 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++	int terminating;
++
++	terminating = atomic_xchg(&assoc->terminating, 1);
++
++	/* if already terminating, do nothing */
++	if (terminating)
++		return;
++
+ 	nvmet_fc_tgtport_get(assoc->tgtport);
+ 	if (!queue_work(nvmet_wq, &assoc->del_work))
+ 		nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ 	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ 	unsigned long flags;
+-	int i, terminating;
+-
+-	terminating = atomic_xchg(&assoc->terminating, 1);
+-
+-	/* if already terminating, do nothing */
+-	if (terminating)
+-		return;
++	int i;
+ 
+ 	spin_lock_irqsave(&tgtport->lock, flags);
+ 	list_del_rcu(&assoc->a_list);
+-- 
+2.51.0
+
diff --git a/queue-6.1/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-6.1/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..aeb7ad6698
--- /dev/null
+++ b/queue-6.1/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From 688a8a6e212285cff401386f75cfdc7ec06b9a15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 28f3fabc72e30..a72911e8ea82d 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -588,8 +588,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 				break;
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-6.1/power-supply-sbs-charger-support-multiple-devices.patch b/queue-6.1/power-supply-sbs-charger-support-multiple-devices.patch
new file mode 100644
index 0000000000..d1c3ecdcd5
--- /dev/null
+++ b/queue-6.1/power-supply-sbs-charger-support-multiple-devices.patch
@@ -0,0 +1,114 @@
+From 9c143fd97fda4508c905350d3c6514cc9fe69cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[    8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[    8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G           O      5.10.147 #22
+[    8.151974] Hardware name: ALE AMB (DT)
+[    8.155828] Call trace:
+[    8.158292]  dump_backtrace+0x0/0x1d4
+[    8.161960]  show_stack+0x18/0x6c
+[    8.165280]  dump_stack+0xcc/0x128
+[    8.168687]  sysfs_warn_dup+0x60/0x7c
+[    8.172353]  sysfs_do_create_link_sd+0xf0/0x100
+[    8.176886]  sysfs_create_link+0x20/0x40
+[    8.180816]  device_add+0x270/0x7a4
+[    8.184311]  __power_supply_register+0x304/0x560
+[    8.188930]  devm_power_supply_register+0x54/0xa0
+[    8.193644]  sbs_probe+0xc0/0x214 [sbs_charger]
+[    8.198183]  i2c_device_probe+0x2dc/0x2f4
+[    8.202196]  really_probe+0xf0/0x510
+[    8.205774]  driver_probe_device+0xfc/0x160
+[    8.209960]  device_driver_attach+0xc0/0xcc
+[    8.214146]  __driver_attach+0xc0/0x170
+[    8.218002]  bus_for_each_dev+0x74/0xd4
+[    8.221862]  driver_attach+0x24/0x30
+[    8.225444]  bus_add_driver+0x148/0x250
+[    8.229283]  driver_register+0x78/0x130
+[    8.233140]  i2c_register_driver+0x4c/0xe0
+[    8.237250]  sbs_driver_init+0x20/0x1000 [sbs_charger]
+[    8.242424]  do_one_initcall+0x50/0x1b0
+[    8.242434]  do_init_module+0x44/0x230
+[    8.242438]  load_module+0x2200/0x27c0
+[    8.242442]  __do_sys_finit_module+0xa8/0x11c
+[    8.242447]  __arm64_sys_finit_module+0x20/0x30
+[    8.242457]  el0_svc_common.constprop.0+0x64/0x154
+[    8.242464]  do_el0_svc+0x24/0x8c
+[    8.242474]  el0_svc+0x10/0x20
+[    8.242481]  el0_sync_handler+0x108/0x114
+[    8.242485]  el0_sync+0x180/0x1c0
+[    8.243847] sbs-charger 20-0009: Failed to register power supply
+[    8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[    7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index bc927c0ddd343..7dfed22fbce3b 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ 	.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+ 
+-static const struct power_supply_desc sbs_desc = {
+-	.name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ 	.type = POWER_SUPPLY_TYPE_MAINS,
+ 	.properties = sbs_properties,
+ 	.num_properties = ARRAY_SIZE(sbs_properties),
+@@ -166,9 +165,20 @@ static int sbs_probe(struct i2c_client *client,
+ 		     const struct i2c_device_id *id)
+ {
+ 	struct power_supply_config psy_cfg = {};
++	struct power_supply_desc *sbs_desc;
+ 	struct sbs_info *chip;
+ 	int ret, val;
+ 
++	sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++				sizeof(*sbs_desc), GFP_KERNEL);
++	if (!sbs_desc)
++		return -ENOMEM;
++
++	sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++					dev_name(&client->dev));
++	if (!sbs_desc->name)
++		return -ENOMEM;
++
+ 	chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ 	if (!chip)
+ 		return -ENOMEM;
+@@ -192,7 +202,7 @@ static int sbs_probe(struct i2c_client *client,
+ 		return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ 	chip->last_state = val;
+ 
+-	chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++	chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ 	if (IS_ERR(chip->power_supply))
+ 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ 				     "Failed to register power supply\n");
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-6.1/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..36bf1ac6fd
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From 1bc55d27e505a664f093e490e4f2819ca9689bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch b/queue-6.1/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
new file mode 100644
index 0000000000..a4d861c731
--- /dev/null
+++ b/queue-6.1/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
@@ -0,0 +1,39 @@
+From ca3d5a5a0aa08f12538d477daeb705fc10892da3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 4e3ec38cbe68c..09788b847e89b 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -206,4 +206,6 @@ done
+ 
+ if [ $failures -eq 0 ]; then
+         echo "All tests successful!"
++else
++	exit 1
+ fi
+-- 
+2.51.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
index 3d0c4de805..ad7859a959 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -80,3 +80,49 @@ direct_write_fallback-on-error-revert-the-ki_pos-update-from-buffered-write.patc
 block-open-code-__generic_file_write_iter-for-blkdev-writes.patch
 block-fix-race-between-set_blocksize-and-read-paths.patch
 nilfs2-fix-deadlock-warnings-caused-by-lock-dependency-in-init_nilfs.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
diff --git a/queue-6.1/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch b/queue-6.1/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
new file mode 100644
index 0000000000..da6418f228
--- /dev/null
+++ b/queue-6.1/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
@@ -0,0 +1,37 @@
+From 80204d715b948239fc5e7a03a1157396fbd5d90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ 	{ "AST2620", 0x05010203 },
+ 	{ "AST2605", 0x05030103 },
+ 	{ "AST2625", 0x05030403 },
++	/* AST2700 */
++	{ "AST2750", 0x06000003 },
++	{ "AST2700", 0x06000103 },
++	{ "AST2720", 0x06000203 },
+ };
+ 
+ static const char *siliconid_to_name(u32 siliconid)
+-- 
+2.51.0
+
diff --git a/queue-6.1/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-6.1/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..9819bafd65
--- /dev/null
+++ b/queue-6.1/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From 8f3217732292e56ea88f1b5c979ba805520a4740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index af8d90efd91fa..e4e6c6d69bf55 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -810,7 +810,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-6.1/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..c80322ed90
--- /dev/null
+++ b/queue-6.1/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From a33b90f3941b1bf87a148d8a6cc74f9d178ad053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index f01d8a2547b6d..01f212057ee34 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ 	.clk_suspend_on = false,
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.1/soc-ti-pruss-don-t-use-pk-through-printk.patch b/queue-6.1/soc-ti-pruss-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..98d3095366
--- /dev/null
+++ b/queue-6.1/soc-ti-pruss-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From d415fab1e2458e602df4ad1f0a883e59f06ee916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 6882c86b3ce54..dd5d4675d26f4 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -270,7 +270,7 @@ static int pruss_probe(struct platform_device *pdev)
+ 		pruss->mem_regions[i].pa = res.start;
+ 		pruss->mem_regions[i].size = resource_size(&res);
+ 
+-		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ 			mem_names[i], &pruss->mem_regions[i].pa,
+ 			pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-6.1/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..a3bcfe43c8
--- /dev/null
+++ b/queue-6.1/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From 9bd557945981565694ce551ec5a8c6c8b6784745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index ab29ae463f677..c011a67ce2108 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -436,7 +436,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -446,15 +446,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -548,7 +548,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -686,7 +686,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-6.1/spi-rpc-if-add-resume-support-for-rz-g3e.patch b/queue-6.1/spi-rpc-if-add-resume-support-for-rz-g3e.patch
new file mode 100644
index 0000000000..c7da964f5d
--- /dev/null
+++ b/queue-6.1/spi-rpc-if-add-resume-support-for-rz-g3e.patch
@@ -0,0 +1,36 @@
+From 48b267c1743800dae4cf4faf1539dfd5e68327d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index ec0904faf3a10..b294ac56470a0 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -195,6 +195,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ 	struct spi_controller *ctlr = dev_get_drvdata(dev);
+ 
++	rpcif_hw_init(dev, false);
++
+ 	return spi_controller_resume(ctlr);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-6.1/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..b076178761
--- /dev/null
+++ b/queue-6.1/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 9dfac632da1dbd1f09563b86fe304f74efcb9025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index a9a893bc19fa4..a2feea6e16f38 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-6.1/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch b/queue-6.1/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
new file mode 100644
index 0000000000..8ab2ca4427
--- /dev/null
+++ b/queue-6.1/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
@@ -0,0 +1,44 @@
+From 41be47fb391d5e97a149d04c415da2446aa0af96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 3f7d0c0c50676..0e29365e23a59 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -48,7 +48,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ 	if (numwritten < 1) {
+ 		perror(path);
+ 		close(fd);
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	close(fd);
+-- 
+2.51.0
+
diff --git a/queue-6.1/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-6.1/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..57ea287fd3
--- /dev/null
+++ b/queue-6.1/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From 61f741267d2116d552c5fe49887ce774a63f612e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-6.1/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-6.1/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..0f3c14237a
--- /dev/null
+++ b/queue-6.1/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 60ebec3c03c4c4a6f2214b5f1c346e30532430ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-6.1/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..551f7a1f0e
--- /dev/null
+++ b/queue-6.1/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From 535ac5b91c7b995e76973f83f4e8d5a011504ab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-6.1/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-6.1/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..5b45518f01
--- /dev/null
+++ b/queue-6.1/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From 2b962397a00aec62e69041422c0322e9a7770167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-6.1/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-6.1/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..a9ed97fcd3
--- /dev/null
+++ b/queue-6.1/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 6e475e9cdfcdee190bd27b838dafece68e8ff77d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 4c8fc82fc27a0..29c0e7c6a6d24 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2248,6 +2248,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-6.1/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..96ea34e744
--- /dev/null
+++ b/queue-6.1/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From dd6043b798ccf2caa453d38e9d002743b9cf1c9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index bd0bdeae23a4f..7e6d252313b7d 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-prm-skip-handlers-with-null-handler_address-or-.patch b/queue-6.12/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
new file mode 100644
index 0000000000..fc03206b5a
--- /dev/null
+++ b/queue-6.12/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
@@ -0,0 +1,61 @@
+From 1ef2a397c14159d5dd55b6c33b669edc47a3bb2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index be033bbb126a4..6792d4385eee4 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ 		th = &tm->handlers[cur_handler];
+ 
+ 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++		/*
++		 * Print an error message if handler_address is NULL, the parse of VA also
++		 * can be skipped.
++		 */
++		if (unlikely(!handler_info->handler_address)) {
++			pr_info("Skipping handler with NULL address for GUID: %pUL",
++					(guid_t *)handler_info->handler_guid);
++			continue;
++		}
++
+ 		th->handler_addr =
+ 			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ 		/*
+-		 * Print a warning message if handler_addr is zero which is not expected to
+-		 * ever happen.
++		 * Print a warning message and skip the parse of VA if handler_addr is zero
++		 * which is not expected to ever happen.
+ 		 */
+-		if (unlikely(!th->handler_addr))
++		if (unlikely(!th->handler_addr)) {
+ 			pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ 				&th->guid, handler_info->handler_address);
++			continue;
++		}
+ 
+ 		th->static_data_buffer_addr =
+ 			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch b/queue-6.12/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
new file mode 100644
index 0000000000..5f8ac41fdf
--- /dev/null
+++ b/queue-6.12/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
@@ -0,0 +1,45 @@
+From 9aa8de2093749d57cce0236276a526593d2d1c9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 14:52:22 +0000
+Subject: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
+
+From: Sam van Kampen <sam@tehsvk.net>
+
+[ Upstream commit 3a351de0d9c86e23b9eca25838b19468aab02f38 ]
+
+Just like the other Vivobooks here, the N6506CU has its keyboard IRQ
+described as ActiveLow in the DSDT, which the kernel overrides to
+EdgeHigh, causing the internal keyboard not to work.
+
+Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Sam van Kampen <sam@tehsvk.net>
+Link: https://patch.msgid.link/20250829145221.2294784-2-sam@tehsvk.net
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 7d59c6c9185fc..4937032490689 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "N6506M"),
+ 		},
+ 	},
++	{
++		/* Asus Vivobook Pro N6506CU* */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++			DMI_MATCH(DMI_BOARD_NAME, "N6506CU"),
++		},
++	},
+ 	{
+ 		/* LG Electronics 17U70P */
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch b/queue-6.12/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
new file mode 100644
index 0000000000..bb51399e54
--- /dev/null
+++ b/queue-6.12/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
@@ -0,0 +1,52 @@
+From 9f49189a395132049c73753e7c9f319b76d61352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 7ecc401fb97f9..4ef94d06365fc 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -847,6 +847,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ 	"PNP0D80", /* Windows-compatible System Power Management Controller */
+ 	"INT33BD", /* Intel Baytrail Mailbox Device */
++	"INTC10DE", /* Intel CVS LNL */
++	"INTC10E0", /* Intel CVS ARL */
+ 	"LATT2021", /* Lattice FW Update Client Driver */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-spcr-support-precise-baud-rate-field.patch b/queue-6.12/acpi-spcr-support-precise-baud-rate-field.patch
new file mode 100644
index 0000000000..2bbc53eaca
--- /dev/null
+++ b/queue-6.12/acpi-spcr-support-precise-baud-rate-field.patch
@@ -0,0 +1,53 @@
+From 5712954e19fda55c914aedc28399bd3948ce0ce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:08:15 +0800
+Subject: ACPI: SPCR: Support Precise Baud Rate field
+
+From: Chen Pei <cp0613@linux.alibaba.com>
+
+[ Upstream commit 4d330fe54145ecfbb657ac01a554fdedf3c1927e ]
+
+The Microsoft Serial Port Console Redirection (SPCR) specification
+revision 1.09 comprises additional field: Precise Baud Rate [1].
+
+It is used to describe non-traditional baud rates (such as those
+used by high-speed UARTs).
+
+It contains a specific non-zero baud rate which overrides the value
+of the Configured Baud Rate field. If this field is zero or not
+present, Configured Baud Rate is used.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1]
+Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
+Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com
+[ rjw: Corrected typo in the subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/spcr.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
+index cd36a97b0ea2c..fa12e740386de 100644
+--- a/drivers/acpi/spcr.c
++++ b/drivers/acpi/spcr.c
+@@ -146,7 +146,15 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ 		goto done;
+ 	}
+ 
+-	switch (table->baud_rate) {
++	/*
++	 * SPCR 1.09 defines Precise Baud Rate Filed contains a specific
++	 * non-zero baud rate which overrides the value of the Configured
++	 * Baud Rate field. If this field is zero or not present, Configured
++	 * Baud Rate is used.
++	 */
++	if (table->precise_baudrate)
++		baud_rate = table->precise_baudrate;
++	else switch (table->baud_rate) {
+ 	case 0:
+ 		/*
+ 		 * SPCR 1.04 defines 0 as a preconfigured state of UART.
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch b/queue-6.12/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
new file mode 100644
index 0000000000..a18832bf89
--- /dev/null
+++ b/queue-6.12/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
@@ -0,0 +1,38 @@
+From 32135ced6bbe5a39a5a7558fc0b046b3d4e9ce61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:49:46 +0530
+Subject: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 149139ddcb99583fdec8d1eaf7dada41e5896101 ]
+
+Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(),
+it should be free with ACPI_FREE() rather than with kfree(), so use
+the former instead of the latter for freeing it.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Link: https://patch.msgid.link/20250822061946.472594-1-kaushlendra.kumar@intel.com
+[ rjw: Subject and changelog rewrite ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 3961fc47152c0..cd199fbe4dc90 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -464,7 +464,7 @@ static ssize_t description_show(struct device *dev,
+ 
+ 	buf[result++] = '\n';
+ 
+-	kfree(str_obj);
++	ACPI_FREE(str_obj);
+ 
+ 	return result;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-video-force-native-for-lenovo-82k8.patch b/queue-6.12/acpi-video-force-native-for-lenovo-82k8.patch
new file mode 100644
index 0000000000..54c5c087b1
--- /dev/null
+++ b/queue-6.12/acpi-video-force-native-for-lenovo-82k8.patch
@@ -0,0 +1,45 @@
+From 60ca94998c6f25875996b62c13e35f3bc88af329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index d507d5e084354..4cf74f173c785 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -948,6 +948,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ 		},
+ 	},
++	/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++	{
++	 .callback = video_detect_force_native,
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-6.12/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..8b756989fb
--- /dev/null
+++ b/queue-6.12/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 891c77aa3a5de5c386dbab9711fc5316c1597ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index a232746d150a7..dc53a5d700671 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-6.12/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-6.12/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..2d03542697
--- /dev/null
+++ b/queue-6.12/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From b73d94b38d1e69cc82501f06efebb3299ce4150d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+  */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/arm-tegra-p880-set-correct-touchscreen-clipping.patch b/queue-6.12/arm-tegra-p880-set-correct-touchscreen-clipping.patch
new file mode 100644
index 0000000000..aaaa899f5c
--- /dev/null
+++ b/queue-6.12/arm-tegra-p880-set-correct-touchscreen-clipping.patch
@@ -0,0 +1,41 @@
+From 62eddc7a3ac5961056daf048fcb524517a48457e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:19:46 +0300
+Subject: ARM: tegra: p880: set correct touchscreen clipping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+
+[ Upstream commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab ]
+
+Existing touchscreen clipping is too small and causes problems with
+touchscreen accuracy.
+
+Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+index 2f7754fd42a16..c6ef0a20c19f3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
++++ b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+@@ -108,8 +108,8 @@
+ 	i2c@7000c400 {
+ 		touchscreen@20 {
+ 			rmi4-f11@11 {
+-				syna,clip-x-high = <1110>;
+-				syna,clip-y-high = <1973>;
++				syna,clip-x-high = <1440>;
++				syna,clip-y-high = <2560>;
+ 
+ 				touchscreen-inverted-y;
+ 			};
+-- 
+2.51.0
+
diff --git a/queue-6.12/arm-tegra-transformer-20-add-missing-magnetometer-in.patch b/queue-6.12/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
new file mode 100644
index 0000000000..a4b4b20c1a
--- /dev/null
+++ b/queue-6.12/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
@@ -0,0 +1,37 @@
+From f1ecd97174b3c7bb56050053144233edc1ec138e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index e118809dc6d98..676ed51aa2cee 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ 			compatible = "asahi-kasei,ak8974";
+ 			reg = <0xe>;
+ 
++			interrupt-parent = <&gpio>;
++			interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ 			avdd-supply = <&vdd_3v3_sys>;
+ 			dvdd-supply = <&vdd_1v8_sys>;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch b/queue-6.12/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
new file mode 100644
index 0000000000..e69112980d
--- /dev/null
+++ b/queue-6.12/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
@@ -0,0 +1,37 @@
+From 9b30985eb79954f6ca0bdb4d218b2a04f83a737f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 676ed51aa2cee..f0e7284fa7c36 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ 			reg = <0x1a>;
+ 
+ 			interrupt-parent = <&gpio>;
+-			interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++			interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+ 
+ 			gpio-controller;
+ 			#gpio-cells = <2>;
+-- 
+2.51.0
+
diff --git a/queue-6.12/arm64-zynqmp-disable-coresight-by-default.patch b/queue-6.12/arm64-zynqmp-disable-coresight-by-default.patch
new file mode 100644
index 0000000000..5493888287
--- /dev/null
+++ b/queue-6.12/arm64-zynqmp-disable-coresight-by-default.patch
@@ -0,0 +1,59 @@
+From 252621e58d38a7210a28922336c3788f27b1804e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:18 +0200
+Subject: arm64: zynqmp: Disable coresight by default
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca ]
+
+When secure-boot mode of bootloader is enabled, the registers of
+coresight are not permitted to access that's why disable it by default.
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/7e308b8efe977c4912079b4d1b1ab3d24908559e.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index b1b31dcf6291b..e2ad5fb2cb0a4 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -450,6 +450,7 @@
+ 			reg = <0x0 0xfec10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu0>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu1_debug: debug@fed10000 {
+@@ -457,6 +458,7 @@
+ 			reg = <0x0 0xfed10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu1>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu2_debug: debug@fee10000 {
+@@ -464,6 +466,7 @@
+ 			reg = <0x0 0xfee10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu2>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu3_debug: debug@fef10000 {
+@@ -471,6 +474,7 @@
+ 			reg = <0x0 0xfef10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu3>;
++			status = "disabled";
+ 		};
+ 
+ 		/* GDMA */
+-- 
+2.51.0
+
diff --git a/queue-6.12/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch b/queue-6.12/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
new file mode 100644
index 0000000000..ce5b02dd8f
--- /dev/null
+++ b/queue-6.12/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
@@ -0,0 +1,45 @@
+From 58cb303afb558251b79ecb70ed6bade45cb518f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 7beedd730f940..9dd63cc384e6e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ 			pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ 			       "MIO60", "MIO61", "MIO62", "MIO63";
+ 			bias-disable;
+-			drive-strength = <4>;
+-			slew-rate = <SLEW_RATE_SLOW>;
++			drive-strength = <12>;
++			slew-rate = <SLEW_RATE_FAST>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch b/queue-6.12/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
new file mode 100644
index 0000000000..2ef292974a
--- /dev/null
+++ b/queue-6.12/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
@@ -0,0 +1,188 @@
+From f1be6bbf8078f5c9154248764968555bc01e6317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+       blk_queue_enter+0x40b/0x470
+       blkg_conf_prep+0x7b/0x3c0
+       tg_set_limit+0x10a/0x3e0
+       cgroup_file_write+0xc6/0x420
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       wbt_init+0x17e/0x280
+       wbt_enable_default+0xe9/0x140
+       blk_register_queue+0x1da/0x2e0
+       __add_disk+0x38c/0x5d0
+       add_disk_fwnode+0x89/0x250
+       device_add_disk+0x18/0x30
+       virtblk_probe+0x13a3/0x1800
+       virtio_dev_probe+0x389/0x610
+       really_probe+0x136/0x620
+       __driver_probe_device+0xb3/0x230
+       driver_probe_device+0x2f/0xe0
+       __driver_attach+0x158/0x250
+       bus_for_each_dev+0xa9/0x130
+       driver_attach+0x26/0x40
+       bus_add_driver+0x178/0x3d0
+       driver_register+0x7d/0x1c0
+       __register_virtio_driver+0x2c/0x60
+       virtio_blk_init+0x6f/0xe0
+       do_one_initcall+0x94/0x540
+       kernel_init_freeable+0x56a/0x7b0
+       kernel_init+0x2b/0x270
+       ret_from_fork+0x268/0x4c0
+       ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+       __lock_acquire+0x1835/0x2940
+       lock_acquire+0xf9/0x450
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       blk_unregister_queue+0x53/0x180
+       __del_gendisk+0x226/0x690
+       del_gendisk+0xba/0x110
+       sd_remove+0x49/0xb0 [sd_mod]
+       device_remove+0x87/0xb0
+       device_release_driver_internal+0x11e/0x230
+       device_release_driver+0x1a/0x30
+       bus_remove_device+0x14d/0x220
+       device_del+0x1e1/0x5a0
+       __scsi_remove_device+0x1ff/0x2f0
+       scsi_remove_device+0x37/0x60
+       sdev_store_delete+0x77/0x100
+       dev_attr_store+0x1f/0x40
+       sysfs_kf_write+0x65/0x90
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+  &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&q->q_usage_counter(queue)#3);
+                               lock(&q->rq_qos_mutex);
+                               lock(&q->q_usage_counter(queue)#3);
+  lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 643d6bf66522e..5a5525d10a5e5 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -847,14 +847,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	disk = ctx->bdev->bd_disk;
+ 	q = disk->queue;
+ 
+-	/*
+-	 * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+-	 * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+-	 */
+-	ret = blk_queue_enter(q, 0);
+-	if (ret)
+-		goto fail;
+-
++	/* Prevent concurrent with blkcg_deactivate_policy() */
++	mutex_lock(&q->blkcg_mutex);
+ 	spin_lock_irq(&q->queue_lock);
+ 
+ 	if (!blkcg_policy_enabled(q, pol)) {
+@@ -884,16 +878,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		/* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ 		spin_unlock_irq(&q->queue_lock);
+ 
+-		new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++		new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ 		if (unlikely(!new_blkg)) {
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		if (radix_tree_preload(GFP_KERNEL)) {
+ 			blkg_free(new_blkg);
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		spin_lock_irq(&q->queue_lock);
+@@ -921,7 +915,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 			goto success;
+ 	}
+ success:
+-	blk_queue_exit(q);
++	mutex_unlock(&q->blkcg_mutex);
+ 	ctx->blkg = blkg;
+ 	return 0;
+ 
+@@ -929,9 +923,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	radix_tree_preload_end();
+ fail_unlock:
+ 	spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+-	blk_queue_exit(q);
+-fail:
++fail_exit:
++	mutex_unlock(&q->blkcg_mutex);
+ 	/*
+ 	 * If queue was bypassing, we should retry.  Do so after a
+ 	 * short msleep().  It isn't strictly necessary but queue
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch b/queue-6.12/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
new file mode 100644
index 0000000000..424809be3f
--- /dev/null
+++ b/queue-6.12/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
@@ -0,0 +1,57 @@
+From c78c54a7646104684d441860a89fb2a93a31c0c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index e6770dd40c917..b80953f0affb0 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ 	xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+ 
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++	xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index fef4d85fee008..89ed625e14744 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4223,6 +4223,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+ 
+ 	if (unlikely(!sinfo->nr_frags)) {
+ 		xdp_buff_clear_frags_flag(xdp);
++		xdp_buff_clear_frag_pfmemalloc(xdp);
+ 		xdp->data_end -= offset;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch b/queue-6.12/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
new file mode 100644
index 0000000000..d463fd3c5f
--- /dev/null
+++ b/queue-6.12/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
@@ -0,0 +1,112 @@
+From 9ecaf7e0437c537c0577a4ddcd120a59165f93bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h |  1 +
+ kernel/bpf/helpers.c   |  2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index fc1324ed597d6..2a510dbbfe623 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -631,6 +631,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+ 
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+ 
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index a0bf39b7359aa..db4739951702e 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2455,7 +2455,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ 	struct cgroup *cgrp;
+ 
+-	cgrp = cgroup_get_from_id(cgid);
++	cgrp = __cgroup_get_from_id(cgid);
+ 	if (IS_ERR(cgrp))
+ 		return NULL;
+ 	return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 5fc2801ee921c..b8cde3d1cb7bc 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6343,15 +6343,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+ 
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+  * @id: cgroup id
+  * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+  */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ 	struct kernfs_node *kn;
+-	struct cgroup *cgrp, *root_cgrp;
++	struct cgroup *cgrp;
+ 
+ 	kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ 	if (!kn)
+@@ -6373,6 +6373,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+ 
+ 	if (!cgrp)
+ 		return ERR_PTR(-ENOENT);
++	return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++	struct cgroup *cgrp, *root_cgrp;
++
++	cgrp = __cgroup_get_from_id(id);
++	if (IS_ERR(cgrp))
++		return cgrp;
+ 
+ 	root_cgrp = current_cgns_cgroup_dfl();
+ 	if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpf-don-t-use-pk-through-printk.patch b/queue-6.12/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..ad0ec719e2
--- /dev/null
+++ b/queue-6.12/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 813982b278a6233b3930dcdb2f824ac011f2039a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 0477254bc2d30..aef18f0e9450e 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1263,7 +1263,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch b/queue-6.12/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
new file mode 100644
index 0000000000..18a708c535
--- /dev/null
+++ b/queue-6.12/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
@@ -0,0 +1,106 @@
+From cd5fa58a99fd09cc4a4d4b288f01d3f38031b736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:18:06 +0200
+Subject: bpf: Use tnums for JEQ/JNE is_branch_taken logic
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit f41345f47fb267a9c95ca710c33448f8d0d81d83 ]
+
+In the following toy program (reg states minimized for readability), R0
+and R1 always have different values at instruction 6. This is obvious
+when reading the program but cannot be guessed from ranges alone as
+they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).
+
+  0: call bpf_get_prandom_u32#7  ; R0_w=scalar()
+  1: w0 = w0                     ; R0_w=scalar(var_off=(0x0; 0xffffffff))
+  2: r0 >>= 30                   ; R0_w=scalar(var_off=(0x0; 0x3))
+  3: r0 <<= 30                   ; R0_w=scalar(var_off=(0x0; 0xc0000000))
+  4: r1 = r0                     ; R1_w=scalar(var_off=(0x0; 0xc0000000))
+  5: r1 += 1024                  ; R1_w=scalar(var_off=(0x400; 0xc0000000))
+  6: if r1 != r0 goto pc+1
+
+Looking at tnums however, we can deduce that R1 is always different from
+R0 because their tnums don't agree on known bits. This patch uses this
+logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.
+
+This change has a tiny impact on complexity, which was measured with
+the Cilium complexity CI test. That test covers 72 programs with
+various build and load time configurations for a total of 970 test
+cases. For 80% of test cases, the patch has no impact. On the other
+test cases, the patch decreases complexity by only 0.08% on average. In
+the best case, the verifier needs to walk 3% less instructions and, in
+the worst case, 1.5% more. Overall, the patch has a small positive
+impact, especially for our largest programs.
+
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tnum.h  | 3 +++
+ kernel/bpf/tnum.c     | 8 ++++++++
+ kernel/bpf/verifier.c | 4 ++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/include/linux/tnum.h b/include/linux/tnum.h
+index 3c13240077b87..191baf3a8d832 100644
+--- a/include/linux/tnum.h
++++ b/include/linux/tnum.h
+@@ -49,6 +49,9 @@ struct tnum tnum_xor(struct tnum a, struct tnum b);
+ /* Multiply two tnums, return @a * @b */
+ struct tnum tnum_mul(struct tnum a, struct tnum b);
+ 
++/* Return true if the known bits of both tnums have the same value */
++bool tnum_overlap(struct tnum a, struct tnum b);
++
+ /* Return a tnum representing numbers satisfying both @a and @b */
+ struct tnum tnum_intersect(struct tnum a, struct tnum b);
+ 
+diff --git a/kernel/bpf/tnum.c b/kernel/bpf/tnum.c
+index 9dbc31b25e3d0..8e6d0ac713731 100644
+--- a/kernel/bpf/tnum.c
++++ b/kernel/bpf/tnum.c
+@@ -138,6 +138,14 @@ struct tnum tnum_mul(struct tnum a, struct tnum b)
+ 	return tnum_add(TNUM(acc_v, 0), acc_m);
+ }
+ 
++bool tnum_overlap(struct tnum a, struct tnum b)
++{
++	u64 mu;
++
++	mu = ~a.mask & ~b.mask;
++	return (a.value & mu) == (b.value & mu);
++}
++
+ /* Note that if a and b disagree - i.e. one has a 'known 1' where the other has
+  * a 'known 0' - this will return a 'known 1' for that bit.
+  */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 709151d33e5e4..218c238d61398 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14772,6 +14772,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ 		 */
+ 		if (tnum_is_const(t1) && tnum_is_const(t2))
+ 			return t1.value == t2.value;
++		if (!tnum_overlap(t1, t2))
++			return 0;
+ 		/* non-overlapping ranges */
+ 		if (umin1 > umax2 || umax1 < umin2)
+ 			return 0;
+@@ -14796,6 +14798,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ 		 */
+ 		if (tnum_is_const(t1) && tnum_is_const(t2))
+ 			return t1.value != t2.value;
++		if (!tnum_overlap(t1, t2))
++			return 1;
+ 		/* non-overlapping ranges */
+ 		if (umin1 > umax2 || umax1 < umin2)
+ 			return 1;
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch b/queue-6.12/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
new file mode 100644
index 0000000000..60fc8afca4
--- /dev/null
+++ b/queue-6.12/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
@@ -0,0 +1,126 @@
+From 86078ae3096fc090675d53d2c9462a0720c797fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:11:07 +0100
+Subject: bpftool: Add CET-aware symbol matching for x86_64 architectures
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
+
+Adjust symbol matching logic to account for Control-flow Enforcement
+Technology (CET) on x86_64 systems. CET prefixes functions with
+a 4-byte 'endbr' instruction, shifting the actual hook entry point to
+symbol + 4.
+
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index 5cd503b763d72..9ce15febc6f25 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count)
+ 	return data;
+ }
+ 
++static bool is_x86_ibt_enabled(void)
++{
++#if defined(__x86_64__)
++	struct kernel_config_option options[] = {
++		{ "CONFIG_X86_KERNEL_IBT", },
++	};
++	char *values[ARRAY_SIZE(options)] = { };
++	bool ret;
++
++	if (read_kernel_config(options, ARRAY_SIZE(options), values, NULL))
++		return false;
++
++	ret = !!values[0];
++	free(values[0]);
++	return ret;
++#else
++	return false;
++#endif
++}
++
++static bool
++symbol_matches_target(__u64 sym_addr, __u64 target_addr, bool is_ibt_enabled)
++{
++	if (sym_addr == target_addr)
++		return true;
++
++	/*
++	 * On x86_64 architectures with CET (Control-flow Enforcement Technology),
++	 * function entry points have a 4-byte 'endbr' instruction prefix.
++	 * This causes kprobe hooks to target the address *after* 'endbr'
++	 * (symbol address + 4), preserving the CET instruction.
++	 * Here we check if the symbol address matches the hook target address
++	 * minus 4, indicating a CET-enabled function entry point.
++	 */
++	if (is_ibt_enabled && sym_addr == target_addr - 4)
++		return true;
++
++	return false;
++}
++
+ static void
+ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ {
+ 	struct addr_cookie *data;
+ 	__u32 i, j = 0;
++	bool is_ibt_enabled;
+ 
+ 	jsonw_bool_field(json_wtr, "retprobe",
+ 			 info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
+@@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ 	if (!dd.sym_count)
+ 		goto error;
+ 
++	is_ibt_enabled = is_x86_ibt_enabled();
+ 	for (i = 0; i < dd.sym_count; i++) {
+-		if (dd.sym_mapping[i].address != data[j].addr)
++		if (!symbol_matches_target(dd.sym_mapping[i].address,
++					   data[j].addr, is_ibt_enabled))
+ 			continue;
+ 		jsonw_start_object(json_wtr);
+-		jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
++		jsonw_uint_field(json_wtr, "addr", (unsigned long)data[j].addr);
+ 		jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
+ 		/* Print null if it is vmlinux */
+ 		if (dd.sym_mapping[i].module[0] == '\0') {
+@@ -716,6 +759,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ {
+ 	struct addr_cookie *data;
+ 	__u32 i, j = 0;
++	bool is_ibt_enabled;
+ 
+ 	if (!info->kprobe_multi.count)
+ 		return;
+@@ -739,12 +783,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ 	if (!dd.sym_count)
+ 		goto error;
+ 
++	is_ibt_enabled = is_x86_ibt_enabled();
+ 	printf("\n\t%-16s %-16s %s", "addr", "cookie", "func [module]");
+ 	for (i = 0; i < dd.sym_count; i++) {
+-		if (dd.sym_mapping[i].address != data[j].addr)
++		if (!symbol_matches_target(dd.sym_mapping[i].address,
++					   data[j].addr, is_ibt_enabled))
+ 			continue;
+ 		printf("\n\t%016lx %-16llx %s",
+-		       dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name);
++		       (unsigned long)data[j].addr, data[j].cookie, dd.sym_mapping[i].name);
+ 		if (dd.sym_mapping[i].module[0] != '\0')
+ 			printf(" [%s]  ", dd.sym_mapping[i].module);
+ 		else
+-- 
+2.51.0
+
diff --git a/queue-6.12/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch b/queue-6.12/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
new file mode 100644
index 0000000000..76e6e7b462
--- /dev/null
+++ b/queue-6.12/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
@@ -0,0 +1,61 @@
+From 51abe127425cf4766bdb411ae6500f30188ec305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+   71 |         info.func_info = ptr_to_u64(&finfo);
+      |                                      ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 |         info.func_info = ptr_to_u64(&func_info);
+      |
+
+v2:
+  - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c       | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 527fe867a8fbd..93995275c7f66 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ 	__u32 info_len = sizeof(info);
+ 	const char *prog_name = NULL;
+ 	struct btf *prog_btf = NULL;
+-	struct bpf_func_info finfo;
++	struct bpf_func_info finfo = {};
+ 	__u32 finfo_rec_size;
+ 	char prog_str[1024];
+ 	int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 52ffb74ae4e89..6e095a3afc046 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2207,7 +2207,7 @@ static void profile_print_readings(void)
+ 
+ static char *profile_target_name(int tgt_fd)
+ {
+-	struct bpf_func_info func_info;
++	struct bpf_func_info func_info = {};
+ 	struct bpf_prog_info info = {};
+ 	__u32 info_len = sizeof(info);
+ 	const struct btf_type *t;
+-- 
+2.51.0
+
diff --git a/queue-6.12/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch b/queue-6.12/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
new file mode 100644
index 0000000000..01345b9d7e
--- /dev/null
+++ b/queue-6.12/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
@@ -0,0 +1,70 @@
+From eb0b90797d77251bec96d458390dd5da846af677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:27 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit c445bffbf28f721e05d0ce06895045fc62aaff7c ]
+
+During normal operation the timers are reprogrammed including an
+interrupt acknowledgement. This has no effect as the whole timer
+is setup from scratch afterwards. Especially in an interrupt this
+has already been done by rttm_timer_interrupt().
+
+Change the behaviour as follows:
+
+- Use rttm_disable_timer() during reprogramming
+- Keep rttm_stop_timer() for all other use cases.
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8be45a11fb8b6..24c4aa6a30131 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -147,7 +147,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, delta);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -160,7 +160,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -173,7 +173,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_TIMER);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/clocksource-drivers-timer-rtl-otto-work-around-dying.patch b/queue-6.12/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
new file mode 100644
index 0000000000..5dba773c24
--- /dev/null
+++ b/queue-6.12/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
@@ -0,0 +1,113 @@
+From 71e3c7caf6a0681fdc8fbb874d5bd0da31b7aec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:25 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Work around dying timers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit e7a25106335041aeca4fdf50a84804c90142c886 ]
+
+The OpenWrt distribution has switched from kernel longterm 6.6 to
+6.12. Reports show that devices with the Realtek Otto switch platform
+die during operation and are rebooted by the watchdog. Sorting out
+other possible reasons the Otto timer is to blame. The platform
+currently consists of 4 targets with different hardware revisions.
+It is not 100% clear which devices and revisions are affected.
+
+Analysis shows:
+
+A more aggressive sched/deadline handling leads to more timer starts
+with small intervals. This increases the bug chances. See
+https://marc.info/?l=linux-kernel&m=175276556023276&w=2
+
+Focusing on the real issue a hardware limitation on some devices was
+found. There is a minimal chance that a timer ends without firing an
+interrupt if it is reprogrammed within the 5us before its expiration
+time. Work around this issue by introducing a bounce() function. It
+restarts the timer directly before the normal restart functions as
+follows:
+
+- Stop timer
+- Restart timer with a slow frequency.
+- Target time will be >5us
+- The subsequent normal restart is outside the critical window
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8a3068b36e752..8be45a11fb8b6 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -38,6 +38,7 @@
+ #define RTTM_BIT_COUNT		28
+ #define RTTM_MIN_DELTA		8
+ #define RTTM_MAX_DELTA		CLOCKSOURCE_MASK(28)
++#define RTTM_MAX_DIVISOR	GENMASK(15, 0)
+ 
+ /*
+  * Timers are derived from the LXB clock frequency. Usually this is a fixed
+@@ -112,6 +113,22 @@ static irqreturn_t rttm_timer_interrupt(int irq, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
++static void rttm_bounce_timer(void __iomem *base, u32 mode)
++{
++	/*
++	 * When a running timer has less than ~5us left, a stop/start sequence
++	 * might fail. While the details are unknown the most evident effect is
++	 * that the subsequent interrupt will not be fired.
++	 *
++	 * As a workaround issue an intermediate restart with a very slow
++	 * frequency of ~3kHz keeping the target counter (>=8). So the follow
++	 * up restart will always be issued outside the critical window.
++	 */
++
++	rttm_disable_timer(base);
++	rttm_enable_timer(base, mode, RTTM_MAX_DIVISOR);
++}
++
+ static void rttm_stop_timer(void __iomem *base)
+ {
+ 	rttm_disable_timer(base);
+@@ -129,6 +146,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, delta);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -141,6 +159,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -153,6 +172,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_TIMER);
+-- 
+2.51.0
+
diff --git a/queue-6.12/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-6.12/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..e46086ace3
--- /dev/null
+++ b/queue-6.12/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From 3cc1f3042aac83fb4ea86f9123dec69d56d6c322 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.12/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-6.12/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..bf9f3c6b02
--- /dev/null
+++ b/queue-6.12/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From b6438fe683e444cd40d820aab31ebb053389928b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index bd6fe8638d399..02767c1f9edef 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -954,6 +954,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-6.12/cpufreq-ondemand-update-the-efficient-idle-check-for.patch b/queue-6.12/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
new file mode 100644
index 0000000000..96a7bd9d87
--- /dev/null
+++ b/queue-6.12/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
@@ -0,0 +1,111 @@
+From dcaed5ecaaab85f1363a28252eb329be9eb525e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:06:55 -0700
+Subject: cpufreq: ondemand: Update the efficient idle check for Intel extended
+ Families
+
+From: Sohil Mehta <sohil.mehta@intel.com>
+
+[ Upstream commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d ]
+
+IO time is considered busy by default for modern Intel processors. The
+current check covers recent Family 6 models but excludes the brand new
+Families 18 and 19.
+
+According to Arjan van de Ven, the model check was mainly due to a lack
+of testing on systems before INTEL_CORE2_MEROM. He suggests considering
+all Intel processors as having an efficient idle.
+
+Extend the IO busy classification to all Intel processors starting with
+Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19.
+
+Use an x86 VFM check and move the function to the header file to avoid
+using arch-specific #ifdefs in the C file.
+
+Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
+Link: https://patch.msgid.link/20250908230655.2562440-1-sohil.mehta@intel.com
+[ rjw: Added empty line after #include ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_ondemand.c | 25 +------------------------
+ drivers/cpufreq/cpufreq_ondemand.h | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
+index 0e65d37c92311..a6ecc203f7b7f 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.c
++++ b/drivers/cpufreq/cpufreq_ondemand.c
+@@ -29,29 +29,6 @@ static struct od_ops od_ops;
+ 
+ static unsigned int default_powersave_bias;
+ 
+-/*
+- * Not all CPUs want IO time to be accounted as busy; this depends on how
+- * efficient idling at a higher frequency/voltage is.
+- * Pavel Machek says this is not so for various generations of AMD and old
+- * Intel systems.
+- * Mike Chan (android.com) claims this is also not true for ARM.
+- * Because of this, whitelist specific known (series) of CPUs by default, and
+- * leave all others up to the user.
+- */
+-static int should_io_be_busy(void)
+-{
+-#if defined(CONFIG_X86)
+-	/*
+-	 * For Intel, Core 2 (model 15) and later have an efficient idle.
+-	 */
+-	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+-			boot_cpu_data.x86 == 6 &&
+-			boot_cpu_data.x86_model >= 15)
+-		return 1;
+-#endif
+-	return 0;
+-}
+-
+ /*
+  * Find right freq to be set now with powersave_bias on.
+  * Returns the freq_hi to be used right now and will set freq_hi_delay_us,
+@@ -377,7 +354,7 @@ static int od_init(struct dbs_data *dbs_data)
+ 	dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+ 	dbs_data->ignore_nice_load = 0;
+ 	tuners->powersave_bias = default_powersave_bias;
+-	dbs_data->io_is_busy = should_io_be_busy();
++	dbs_data->io_is_busy = od_should_io_be_busy();
+ 
+ 	dbs_data->tuners = tuners;
+ 	return 0;
+diff --git a/drivers/cpufreq/cpufreq_ondemand.h b/drivers/cpufreq/cpufreq_ondemand.h
+index 1af8e5c4b86fd..2ca8f1aaf2e34 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.h
++++ b/drivers/cpufreq/cpufreq_ondemand.h
+@@ -24,3 +24,26 @@ static inline struct od_policy_dbs_info *to_dbs_info(struct policy_dbs_info *pol
+ struct od_dbs_tuners {
+ 	unsigned int powersave_bias;
+ };
++
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++
++/*
++ * Not all CPUs want IO time to be accounted as busy; this depends on
++ * how efficient idling at a higher frequency/voltage is.
++ *
++ * Pavel Machek says this is not so for various generations of AMD and
++ * old Intel systems. Mike Chan (android.com) claims this is also not
++ * true for ARM.
++ *
++ * Because of this, select a known series of Intel CPUs (Family 6 and
++ * later) by default, and leave all others up to the user.
++ */
++static inline bool od_should_io_be_busy(void)
++{
++	return (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
++		boot_cpu_data.x86_vfm >= INTEL_PENTIUM_PRO);
++}
++#else
++static inline bool od_should_io_be_busy(void) { return false; }
++#endif
+-- 
+2.51.0
+
diff --git a/queue-6.12/cpufreq-ti-add-support-for-am62d2.patch b/queue-6.12/cpufreq-ti-add-support-for-am62d2.patch
new file mode 100644
index 0000000000..4e8ef66125
--- /dev/null
+++ b/queue-6.12/cpufreq-ti-add-support-for-am62d2.patch
@@ -0,0 +1,43 @@
+From c1b71c118e8c62e7666a23381aea17f0b31186c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:03:31 +0530
+Subject: cpufreq: ti: Add support for AM62D2
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+[ Upstream commit b5af45302ebc141662b2b60c713c9202e88c943c ]
+
+Add support for TI K3 AM62D2 SoC to read speed and revision values
+from hardware and pass to OPP layer. AM62D shares the same configuations
+as AM62A so use existing am62a7_soc_data.
+
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/ti-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index ba621ce1cdda6..190e30b1c5532 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -308,6 +308,7 @@ static const struct soc_device_attribute k3_cpufreq_soc[] = {
+ 	{ .family = "AM62X", .revision = "SR1.0" },
+ 	{ .family = "AM62AX", .revision = "SR1.0" },
+ 	{ .family = "AM62PX", .revision = "SR1.0" },
++	{ .family = "AM62DX", .revision = "SR1.0" },
+ 	{ /* sentinel */ }
+ };
+ 
+@@ -453,6 +454,7 @@ static const struct of_device_id ti_cpufreq_of_match[]  __maybe_unused = {
+ 	{ .compatible = "ti,omap36xx", .data = &omap36xx_soc_data, },
+ 	{ .compatible = "ti,am625", .data = &am625_soc_data, },
+ 	{ .compatible = "ti,am62a7", .data = &am62a7_soc_data, },
++	{ .compatible = "ti,am62d2", .data = &am62a7_soc_data, },
+ 	{ .compatible = "ti,am62p5", .data = &am62p5_soc_data, },
+ 	/* legacy */
+ 	{ .compatible = "ti,omap3430", .data = &omap34xx_soc_data, },
+-- 
+2.51.0
+
diff --git a/queue-6.12/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-6.12/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..0077525ea8
--- /dev/null
+++ b/queue-6.12/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From 30841c61bbf186cc6647bd6afd407bb5f6b72932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 9e418aec17550..0e1bbc966135d 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -631,8 +631,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -644,7 +650,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-6.12/firewire-ohci-move-self_id_complete-tracepoint-after.patch b/queue-6.12/firewire-ohci-move-self_id_complete-tracepoint-after.patch
new file mode 100644
index 0000000000..dc35eb61c2
--- /dev/null
+++ b/queue-6.12/firewire-ohci-move-self_id_complete-tracepoint-after.patch
@@ -0,0 +1,55 @@
+From 1b5e3579bfdd8c570c8221a702ad62dbd239656e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 12:09:52 +0900
+Subject: firewire: ohci: move self_id_complete tracepoint after validating
+ register
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 696968262aeee51e1c0529c3c060ddd180702e02 ]
+
+The value of OHCI1394_SelfIDCount register includes an error-indicating
+bit. It is safer to place the tracepoint probe after validating the
+register value.
+
+Link: https://lore.kernel.org/r/20250823030954.268412-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/ohci.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 7ee55c2804ded..90fcab1f65bcd 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2060,6 +2060,9 @@ static void bus_reset_work(struct work_struct *work)
+ 		ohci_notice(ohci, "self ID receive error\n");
+ 		return;
+ 	}
++
++	trace_self_id_complete(ohci->card.index, reg, ohci->self_id, has_be_header_quirk(ohci));
++
+ 	/*
+ 	 * The count in the SelfIDCount register is the number of
+ 	 * bytes in the self ID receive buffer.  Since we also receive
+@@ -2228,15 +2231,8 @@ static irqreturn_t irq_handler(int irq, void *data)
+ 	if (event & OHCI1394_busReset)
+ 		reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
+ 
+-	if (event & OHCI1394_selfIDComplete) {
+-		if (trace_self_id_complete_enabled()) {
+-			u32 reg = reg_read(ohci, OHCI1394_SelfIDCount);
+-
+-			trace_self_id_complete(ohci->card.index, reg, ohci->self_id,
+-					       has_be_header_quirk(ohci));
+-		}
++	if (event & OHCI1394_selfIDComplete)
+ 		queue_work(selfid_workqueue, &ohci->bus_reset_work);
+-	}
+ 
+ 	if (event & OHCI1394_RQPkt)
+ 		tasklet_schedule(&ohci->ar_request_ctx.tasklet);
+-- 
+2.51.0
+
diff --git a/queue-6.12/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch b/queue-6.12/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
new file mode 100644
index 0000000000..4b961e60d6
--- /dev/null
+++ b/queue-6.12/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
@@ -0,0 +1,39 @@
+From c1de1166be07b60c5866dbeb06d709dda5735930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:14:51 +0530
+Subject: firmware: qcom: scm: preserve assign_mem() error return value
+
+From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+
+[ Upstream commit 121fcf3c871181edce0708a49d2397cedd6ad21f ]
+
+When qcom_scm_assign_mem() fails, the error value is currently being
+overwritten after it is logged, resulting in the loss of the original
+error code. Fix this by retaining and returning the original error value
+as intended.
+
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250807124451.2623019-1-mukesh.ojha@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 23aefbf6fca58..1da16bc79391c 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1093,7 +1093,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ 	if (ret) {
+ 		dev_err(__scm->dev,
+ 			"Assign memory protection call failed %d\n", ret);
+-		return -EINVAL;
++		return ret;
+ 	}
+ 
+ 	*srcvm = next_vm;
+-- 
+2.51.0
+
diff --git a/queue-6.12/firmware-qcom-tzmem-disable-sc7180-platform.patch b/queue-6.12/firmware-qcom-tzmem-disable-sc7180-platform.patch
new file mode 100644
index 0000000000..91859e58ce
--- /dev/null
+++ b/queue-6.12/firmware-qcom-tzmem-disable-sc7180-platform.patch
@@ -0,0 +1,38 @@
+From 3a76727ae7729218bb719f56725021970fe8437d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 18:28:03 +0500
+Subject: firmware: qcom: tzmem: disable sc7180 platform
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 ]
+
+When SHM bridge is enabled, assigning RMTFS memory causes the calling
+core to hang if the system is running in EL1.
+
+Disable SHM bridge on sc7180 devices to avoid that hang.
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250721-sc7180-shm-hang-v1-1-99ad9ffeb5b4@trvn.ru
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_tzmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
+index 92b3651782355..f8fef622e48fe 100644
+--- a/drivers/firmware/qcom/qcom_tzmem.c
++++ b/drivers/firmware/qcom/qcom_tzmem.c
+@@ -76,6 +76,7 @@ static bool qcom_tzmem_using_shm_bridge;
+ 
+ /* List of machines that are known to not support SHM bridge correctly. */
+ static const char *const qcom_tzmem_blacklist[] = {
++	"qcom,sc7180", /* hang in rmtfs memory assignment */
+ 	"qcom,sc8180x",
+ 	"qcom,sdm670", /* failure in GPU firmware loading */
+ 	"qcom,sdm845", /* reset in rmtfs memory assignment */
+-- 
+2.51.0
+
diff --git a/queue-6.12/futex-don-t-leak-robust_list-pointer-on-exec-race.patch b/queue-6.12/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
new file mode 100644
index 0000000000..561550c624
--- /dev/null
+++ b/queue-6.12/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
@@ -0,0 +1,199 @@
+From 8a9b1c9131015dadc23e0a091d78086a0c8462e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index 4b6da9116aa6c..880c9bf2f3150 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -39,6 +39,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ 	return 0;
+ }
+ 
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++	if (compat)
++		return p->compat_robust_list;
++#endif
++	return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++	struct task_struct *p = current;
++	void __user *head;
++	int ret;
++
++	scoped_guard(rcu) {
++		if (pid) {
++			p = find_task_by_vpid(pid);
++			if (!p)
++				return (void __user *)ERR_PTR(-ESRCH);
++		}
++		get_task_struct(p);
++	}
++
++	/*
++	 * Hold exec_update_lock to serialize with concurrent exec()
++	 * so ptrace_may_access() is checked against stable credentials
++	 */
++	ret = down_read_killable(&p->signal->exec_update_lock);
++	if (ret)
++		goto err_put;
++
++	ret = -EPERM;
++	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++		goto err_unlock;
++
++	head = futex_task_robust_list(p, compat);
++
++	up_read(&p->signal->exec_update_lock);
++	put_task_struct(p);
++
++	return head;
++
++err_unlock:
++	up_read(&p->signal->exec_update_lock);
++err_put:
++	put_task_struct(p);
++	return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+  * sys_get_robust_list() - Get the robust-futex list head of a task
+  * @pid:	pid of the process [zero for current task]
+@@ -49,36 +99,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 		struct robust_list_head __user * __user *, head_ptr,
+ 		size_t __user *, len_ptr)
+ {
+-	struct robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+ 
+-	head = p->robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(head, head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ 
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -455,36 +483,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 			compat_uptr_t __user *, head_ptr,
+ 			compat_size_t __user *, len_ptr)
+ {
+-	struct compat_robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+ 
+-	head = p->compat_robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch b/queue-6.12/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
new file mode 100644
index 0000000000..886412353c
--- /dev/null
+++ b/queue-6.12/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
@@ -0,0 +1,38 @@
+From 4f4bd7124a9a16eb9ea56565e4ba018c13d474ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index fdc157c7394d9..483dfb806cc51 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+  */
+ #define ASUS_EC_MAX_BANK	3
+ 
+-#define ACPI_LOCK_DELAY_MS	500
++#define ACPI_LOCK_DELAY_MS	800
+ 
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX	"\\AMW0.ASMX"
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch b/queue-6.12/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
new file mode 100644
index 0000000000..f864efab50
--- /dev/null
+++ b/queue-6.12/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
@@ -0,0 +1,68 @@
+From a0a2d968cd62ee37f98b67c5454c03f990cb7d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:33 +0200
+Subject: hwmon: (dell-smm) Remove Dell Precision 490 custom config data
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf ]
+
+It turns out the second fan on the Dell Precision 490 does not
+really support I8K_FAN_TURBO. Setting the fan state to 3 enables
+automatic fan control, just like on the other two fans.
+The reason why this was misinterpreted as turbo mode was that
+the second fan normally spins faster in automatic mode than
+in the previous fan states. Yet when in state 3, the fan speed
+reacts to heat exposure, exposing the automatic mode setting.
+
+Link: https://github.com/lm-sensors/lm-sensors/pull/383
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index b043fbd15c9da..f73f461937482 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1324,7 +1324,6 @@ struct i8k_config_data {
+ 
+ enum i8k_configs {
+ 	DELL_LATITUDE_D520,
+-	DELL_PRECISION_490,
+ 	DELL_STUDIO,
+ 	DELL_XPS,
+ };
+@@ -1334,10 +1333,6 @@ static const struct i8k_config_data i8k_config_data[] __initconst = {
+ 		.fan_mult = 1,
+ 		.fan_max = I8K_FAN_TURBO,
+ 	},
+-	[DELL_PRECISION_490] = {
+-		.fan_mult = 1,
+-		.fan_max = I8K_FAN_TURBO,
+-	},
+ 	[DELL_STUDIO] = {
+ 		.fan_mult = 1,
+ 		.fan_max = I8K_FAN_HIGH,
+@@ -1357,15 +1352,6 @@ static const struct dmi_system_id i8k_config_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
+ 	},
+-	{
+-		.ident = "Dell Precision 490",
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+-			DMI_MATCH(DMI_PRODUCT_NAME,
+-				  "Precision WorkStation 490"),
+-		},
+-		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+-	},
+ 	{
+ 		.ident = "Dell Studio",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-k10temp-add-device-id-for-strix-halo.patch b/queue-6.12/hwmon-k10temp-add-device-id-for-strix-halo.patch
new file mode 100644
index 0000000000..b5cb70d488
--- /dev/null
+++ b/queue-6.12/hwmon-k10temp-add-device-id-for-strix-halo.patch
@@ -0,0 +1,41 @@
+From 9cb78ef2dcedc74d0d609da7e4175d40c44bd77e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index c457ba4706197..ccf0e9e853acd 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -551,6 +551,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch b/queue-6.12/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
new file mode 100644
index 0000000000..931a666a8c
--- /dev/null
+++ b/queue-6.12/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
@@ -0,0 +1,50 @@
+From d84edc9012995d8096998ba5587fd98f8f4c9ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 7dc19c5d62ac3..c457ba4706197 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+  */
+ #define AMD_I3255_STR				"3255"
+ 
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3	0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3	0x127b
++
+ struct k10temp_data {
+ 	struct pci_dev *pdev;
+ 	void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -542,7 +549,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-lenovo-ec-sensors-update-p8-supprt.patch b/queue-6.12/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
new file mode 100644
index 0000000000..9340bcb2e5
--- /dev/null
+++ b/queue-6.12/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
@@ -0,0 +1,123 @@
+From aed085899a40271acc87a6148472ecbd9acf9fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 06:32:28 -0400
+Subject: hwmon: (lenovo-ec-sensors) Update P8 supprt
+
+From: David Ober <dober6023@gmail.com>
+
+[ Upstream commit 43c056ac85b60232861005765153707f1b0354b6 ]
+
+This fixes differences for the P8 system that was initially set to
+the same thermal values as the P7, also adds in the PSU sensor for
+all of the supported systems
+
+Signed-off-by: David Ober <dober@lenovo.com>
+Signed-off-by: David Ober <dober6023@gmail.com>
+Link: https://lore.kernel.org/r/20250807103228.10465-1-dober6023@gmail.com
+[groeck: Update subject]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lenovo-ec-sensors.c | 34 +++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/lenovo-ec-sensors.c b/drivers/hwmon/lenovo-ec-sensors.c
+index 143fb79713f7d..8681bbf6665b1 100644
+--- a/drivers/hwmon/lenovo-ec-sensors.c
++++ b/drivers/hwmon/lenovo-ec-sensors.c
+@@ -66,7 +66,7 @@ enum systems {
+ 	LENOVO_P8,
+ };
+ 
+-static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31, 32};
+ 
+ static const char * const lenovo_px_ec_temp_label[] = {
+ 	"CPU1",
+@@ -84,9 +84,29 @@ static const char * const lenovo_px_ec_temp_label[] = {
+ 	"PCI_Z3",
+ 	"PCI_Z4",
+ 	"AMB",
++	"PSU1",
++	"PSU2",
+ };
+ 
+-static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int p8_temp_map[] = {0, 1, 2, 8, 9, 13, 14, 15, 16, 17, 19, 20, 33};
++
++static const char * const lenovo_p8_ec_temp_label[] = {
++	"CPU1",
++	"CPU_DIMM_BANK1",
++	"CPU_DIMM_BANK2",
++	"M2_Z2R",
++	"M2_Z3R",
++	"DIMM_RIGHT",
++	"DIMM_LEFT",
++	"PCI_Z1",
++	"PCI_Z2",
++	"PCI_Z3",
++	"AMB",
++	"REAR_VR",
++	"PSU",
++};
++
++static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31};
+ 
+ static const char * const lenovo_gen_ec_temp_label[] = {
+ 	"CPU1",
+@@ -101,6 +121,7 @@ static const char * const lenovo_gen_ec_temp_label[] = {
+ 	"PCI_Z3",
+ 	"PCI_Z4",
+ 	"AMB",
++	"PSU",
+ };
+ 
+ static int px_fan_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
+@@ -293,6 +314,8 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_px[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -327,6 +350,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p8[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -359,6 +383,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p7[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -388,6 +413,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p5[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -545,9 +571,9 @@ static int lenovo_ec_probe(struct platform_device *pdev)
+ 		break;
+ 	case 3:
+ 		ec_data->fan_labels = p8_ec_fan_label;
+-		ec_data->temp_labels = lenovo_gen_ec_temp_label;
++		ec_data->temp_labels = lenovo_p8_ec_temp_label;
+ 		ec_data->fan_map = p8_fan_map;
+-		ec_data->temp_map = gen_temp_map;
++		ec_data->temp_map = p8_temp_map;
+ 		lenovo_ec_chip_info.info = lenovo_ec_hwmon_info_p8;
+ 		break;
+ 	default:
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch b/queue-6.12/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
new file mode 100644
index 0000000000..d01b219cb6
--- /dev/null
+++ b/queue-6.12/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
@@ -0,0 +1,140 @@
+From 65ef876a18d99c1d0409cbd558b158d1d3152bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index 3c839f56c4603..a6c439e376ff7 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+ 
+ /*
+  * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC		0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC		0x14 /* RW */
+ 
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT	2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT	5
+ 
++#define SBTSI_TEMP_EXT_RANGE_ADJ	49000
++
+ #define SBTSI_TEMP_MIN	0
+ #define SBTSI_TEMP_MAX	255875
+ 
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ 	struct i2c_client *client;
+ 	struct mutex lock;
++	bool ext_range_mode;
++	bool read_order;
+ };
+ 
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ 	struct sbtsi_data *data = dev_get_drvdata(dev);
+ 	s32 temp_int, temp_dec;
+-	int err;
+ 
+ 	switch (attr) {
+ 	case hwmon_temp_input:
+-		/*
+-		 * ReadOrder bit specifies the reading order of integer and
+-		 * decimal part of CPU temp for atomic reads. If bit == 0,
+-		 * reading integer part triggers latching of the decimal part,
+-		 * so integer part should be read first. If bit == 1, read
+-		 * order should be reversed.
+-		 */
+-		err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+-		if (err < 0)
+-			return err;
+-
+ 		mutex_lock(&data->lock);
+-		if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++		if (data->read_order) {
+ 			temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ 			temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ 		} else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ 		return temp_dec;
+ 
+ 	*val = sbtsi_reg_to_mc(temp_int, temp_dec);
++	if (data->ext_range_mode)
++		*val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+ 
+ 	return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ 		return -EINVAL;
+ 	}
+ 
++	if (data->ext_range_mode)
++		val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ 	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ 	sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+ 
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	struct device *dev = &client->dev;
+ 	struct device *hwmon_dev;
+ 	struct sbtsi_data *data;
++	int err;
+ 
+ 	data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ 	if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+ 
+-	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+-							 NULL);
++	err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++	if (err < 0)
++		return err;
++	data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++	data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++							 &sbtsi_chip_info, NULL);
+ 
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/hwmon-sy7636a-add-alias.patch b/queue-6.12/hwmon-sy7636a-add-alias.patch
new file mode 100644
index 0000000000..d935d13871
--- /dev/null
+++ b/queue-6.12/hwmon-sy7636a-add-alias.patch
@@ -0,0 +1,31 @@
+From 6064c18733a4ff905931c9b2839fb1a24b2ba957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+ 
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+-- 
+2.51.0
+
diff --git a/queue-6.12/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch b/queue-6.12/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
new file mode 100644
index 0000000000..98a3ce8a11
--- /dev/null
+++ b/queue-6.12/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
@@ -0,0 +1,37 @@
+From 88c7456f4f4cc88cd6db330486853123a194f4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 16:17:32 +0300
+Subject: i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit d515503f3c8a8475b2f78782534aad09722904e1 ]
+
+Add I3C controller PCI IDs on Intel Wildcat Lake-U.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250808131732.1213227-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+index c6c3a3ec11eae..08e6cbdf89cea 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
++++ b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+@@ -124,6 +124,9 @@ static void mipi_i3c_hci_pci_remove(struct pci_dev *pci)
+ }
+ 
+ static const struct pci_device_id mipi_i3c_hci_pci_devices[] = {
++	/* Wildcat Lake-U */
++	{ PCI_VDEVICE(INTEL, 0x4d7c), (kernel_ulong_t)&intel_info},
++	{ PCI_VDEVICE(INTEL, 0x4d6f), (kernel_ulong_t)&intel_info},
+ 	/* Panther Lake-H */
+ 	{ PCI_VDEVICE(INTEL, 0xe37c), (kernel_ulong_t)&intel_info},
+ 	{ PCI_VDEVICE(INTEL, 0xe36f), (kernel_ulong_t)&intel_info},
+-- 
+2.51.0
+
diff --git a/queue-6.12/io_uring-zctx-check-chained-notif-contexts.patch b/queue-6.12/io_uring-zctx-check-chained-notif-contexts.patch
new file mode 100644
index 0000000000..d56592b535
--- /dev/null
+++ b/queue-6.12/io_uring-zctx-check-chained-notif-contexts.patch
@@ -0,0 +1,44 @@
+From dec3e0c243355695cd200438ea08a51d33c97a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:40:57 +0100
+Subject: io_uring/zctx: check chained notif contexts
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit ab3ea6eac5f45669b091309f592c4ea324003053 ]
+
+Send zc only links ubuf_info for requests coming from the same context.
+There are some ambiguous syz reports, so let's check the assumption on
+notification completion.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index d4cf5a1328e63..f50964c7dab82 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -14,10 +14,15 @@ static const struct ubuf_info_ops io_ubuf_ops;
+ static void io_notif_tw_complete(struct io_kiocb *notif, struct io_tw_state *ts)
+ {
+ 	struct io_notif_data *nd = io_notif_to_data(notif);
++	struct io_ring_ctx *ctx = notif->ctx;
++
++	lockdep_assert_held(&ctx->uring_lock);
+ 
+ 	do {
+ 		notif = cmd_to_io_kiocb(nd);
+ 
++		if (WARN_ON_ONCE(ctx != notif->ctx))
++			return;
+ 		lockdep_assert(refcount_read(&nd->uarg.refcnt) == 0);
+ 
+ 		if (unlikely(nd->zc_report) && (nd->zc_copied || !nd->zc_used))
+-- 
+2.51.0
+
diff --git a/queue-6.12/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-6.12/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..85c3b4357c
--- /dev/null
+++ b/queue-6.12/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From dee879a99924da1b9c582a9fa7a1a745b8523956 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index a1e370d0200f1..b5479c552b776 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -156,14 +156,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch b/queue-6.12/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
new file mode 100644
index 0000000000..f6346d719d
--- /dev/null
+++ b/queue-6.12/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
@@ -0,0 +1,69 @@
+From ef33e9963b1daa03f7d06f79a48045352e6de35b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 2d4c3ec128b8f..912bf50a5c7ca 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -200,8 +200,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ 		goto iounmap_base;
+ 	}
+ 
+-	priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+-					&pch_lpc_domain_ops, priv);
++	/*
++	 * The LPC interrupt controller is a legacy i8259-compatible device,
++	 * which requires a static 1:1 mapping for IRQs 0-15.
++	 * Use irq_domain_create_legacy to establish this static mapping early.
++	 */
++	priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++						    &pch_lpc_domain_ops, priv);
+ 	if (!priv->lpc_domain) {
+ 		pr_err("Failed to create IRQ domain\n");
+ 		goto free_irq_handle;
+-- 
+2.51.0
+
diff --git a/queue-6.12/irqchip-sifive-plic-respect-mask-state-when-setting-.patch b/queue-6.12/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
new file mode 100644
index 0000000000..ce370dd90c
--- /dev/null
+++ b/queue-6.12/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
@@ -0,0 +1,54 @@
+From 9416e01a380e0dc5204692f6c6c3aa45aa366a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 9c4af7d588463..c0cf4fed13e09 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -179,12 +179,14 @@ static int plic_set_affinity(struct irq_data *d,
+ 	if (cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+-	plic_irq_disable(d);
++	/* Invalidate the original routing entry */
++	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+ 
+ 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
++	/* Setting the new routing entry if irq is enabled */
+ 	if (!irqd_irq_disabled(d))
+-		plic_irq_enable(d);
++		plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch b/queue-6.12/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
new file mode 100644
index 0000000000..de098f9889
--- /dev/null
+++ b/queue-6.12/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
@@ -0,0 +1,200 @@
+From 64659efd5bf927de0ca48ee480a566960061b5a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 05:31:27 +0000
+Subject: libbpf: Fix USDT SIB argument handling causing unrecognized register
+ error
+
+From: Jiawei Zhao <phoenix500526@163.com>
+
+[ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ]
+
+On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
+addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
+in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
+to fail with -ENOENT (unrecognized register).
+
+This patch fixes this by implementing the necessary changes:
+- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
+- add adaptive support to `__bpf_usdt_arg_type` and
+  `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
+
+Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++--
+ tools/lib/bpf/usdt.c     | 62 ++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 99 insertions(+), 7 deletions(-)
+
+diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
+index b811f754939f0..3e59a7704534b 100644
+--- a/tools/lib/bpf/usdt.bpf.h
++++ b/tools/lib/bpf/usdt.bpf.h
+@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
+ 	BPF_USDT_ARG_CONST,
+ 	BPF_USDT_ARG_REG,
+ 	BPF_USDT_ARG_REG_DEREF,
++	BPF_USDT_ARG_SIB,
+ };
+ 
++/*
++ * This struct layout is designed specifically to be backwards/forward
++ * compatible between libbpf versions for ARG_CONST, ARG_REG, and
++ * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
++ */
+ struct __bpf_usdt_arg_spec {
+ 	/* u64 scalar interpreted depending on arg_type, see below */
+ 	__u64 val_off;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ 	/* arg location case, see bpf_usdt_arg() for details */
+-	enum __bpf_usdt_arg_type arg_type;
++	enum __bpf_usdt_arg_type arg_type: 8;
++	/* index register offset within struct pt_regs */
++	__u16 idx_reg_off: 12;
++	/* scale factor for index register (1, 2, 4, or 8) */
++	__u16 scale_bitshift: 4;
++	/* reserved for future use, keeps reg_off offset stable */
++	__u8 __reserved: 8;
++#else
++	__u8 __reserved: 8;
++	__u16 idx_reg_off: 12;
++	__u16 scale_bitshift: 4;
++	enum __bpf_usdt_arg_type arg_type: 8;
++#endif
+ 	/* offset of referenced register within struct pt_regs */
+ 	short reg_off;
+ 	/* whether arg should be interpreted as signed value */
+@@ -117,7 +136,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ {
+ 	struct __bpf_usdt_spec *spec;
+ 	struct __bpf_usdt_arg_spec *arg_spec;
+-	unsigned long val;
++	unsigned long val, idx;
+ 	int err, spec_id;
+ 
+ 	*res = 0;
+@@ -170,6 +189,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ 			return err;
+ #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+ 		val >>= arg_spec->arg_bitshift;
++#endif
++		break;
++	case BPF_USDT_ARG_SIB:
++		/* Arg is in memory addressed by SIB (Scale-Index-Base) mode
++		 * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
++		 * fetch the base register contents and the index register
++		 * contents from pt_regs. Then we calculate the final address
++		 * as base + (index * scale) + offset, and do a user-space
++		 * probe read to fetch the argument value.
++		 */
++		err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);
++		if (err)
++			return err;
++		err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);
++		if (err)
++			return err;
++		err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off));
++		if (err)
++			return err;
++#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++		val >>= arg_spec->arg_bitshift;
+ #endif
+ 		break;
+ 	default:
+diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
+index 6ff28e7bf5e3d..76e7c5bf0cb2d 100644
+--- a/tools/lib/bpf/usdt.c
++++ b/tools/lib/bpf/usdt.c
+@@ -199,12 +199,23 @@ enum usdt_arg_type {
+ 	USDT_ARG_CONST,
+ 	USDT_ARG_REG,
+ 	USDT_ARG_REG_DEREF,
++	USDT_ARG_SIB,
+ };
+ 
+ /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
+ struct usdt_arg_spec {
+ 	__u64 val_off;
+-	enum usdt_arg_type arg_type;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++	enum usdt_arg_type arg_type: 8;
++	__u16	idx_reg_off: 12;
++	__u16	scale_bitshift: 4;
++	__u8 __reserved: 8;     /* keep reg_off offset stable */
++#else
++	__u8 __reserved: 8;     /* keep reg_off offset stable */
++	__u16	idx_reg_off: 12;
++	__u16	scale_bitshift: 4;
++	enum usdt_arg_type arg_type: 8;
++#endif
+ 	short reg_off;
+ 	bool arg_signed;
+ 	char arg_bitshift;
+@@ -1281,11 +1292,51 @@ static int calc_pt_regs_off(const char *reg_name)
+ 
+ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
+ {
+-	char reg_name[16];
+-	int len, reg_off;
+-	long off;
++	char reg_name[16] = {0}, idx_reg_name[16] = {0};
++	int len, reg_off, idx_reg_off, scale = 1;
++	long off = 0;
++
++	if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
++		   arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
++		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
++		       arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
++		sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
++		       arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
++		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
++		       arg_sz, reg_name, idx_reg_name, &len) == 3
++		) {
++		/*
++		 * Scale Index Base case:
++		 * 1@-96(%rbp,%rax,8)
++		 * 1@(%rbp,%rax,8)
++		 * 1@-96(%rbp,%rax)
++		 * 1@(%rbp,%rax)
++		 */
++		arg->arg_type = USDT_ARG_SIB;
++		arg->val_off = off;
+ 
+-	if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
++		reg_off = calc_pt_regs_off(reg_name);
++		if (reg_off < 0)
++			return reg_off;
++		arg->reg_off = reg_off;
++
++		idx_reg_off = calc_pt_regs_off(idx_reg_name);
++		if (idx_reg_off < 0)
++			return idx_reg_off;
++		arg->idx_reg_off = idx_reg_off;
++
++		/* validate scale factor and set fields directly */
++		switch (scale) {
++		case 1: arg->scale_bitshift = 0; break;
++		case 2: arg->scale_bitshift = 1; break;
++		case 4: arg->scale_bitshift = 2; break;
++		case 8: arg->scale_bitshift = 3; break;
++		default:
++			pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
++			return -EINVAL;
++		}
++	} else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
++				arg_sz, &off, reg_name, &len) == 3) {
+ 		/* Memory dereference case, e.g., -4@-20(%rbp) */
+ 		arg->arg_type = USDT_ARG_REG_DEREF;
+ 		arg->val_off = off;
+@@ -1304,6 +1355,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
+ 	} else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
+ 		/* Register read case, e.g., -4@%eax */
+ 		arg->arg_type = USDT_ARG_REG;
++		/* register read has no memory offset */
+ 		arg->val_off = 0;
+ 
+ 		reg_off = calc_pt_regs_off(reg_name);
+-- 
+2.51.0
+
diff --git a/queue-6.12/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-6.12/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..72acd884f1
--- /dev/null
+++ b/queue-6.12/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From 6e2a0bd6c44e2b779602eabbc237208e25732a10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 2fcc40aa96340..b9459c53c3ed3 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -366,7 +366,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -400,7 +402,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-core-increment-of_node-s-refcount-before-linking.patch b/queue-6.12/mfd-core-increment-of_node-s-refcount-before-linking.patch
new file mode 100644
index 0000000000..ee189bedc5
--- /dev/null
+++ b/queue-6.12/mfd-core-increment-of_node-s-refcount-before-linking.patch
@@ -0,0 +1,42 @@
+From 8dfe5d5260f0e1b5a8848775b362e30ebd0a09a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 16:21:13 +0200
+Subject: mfd: core: Increment of_node's refcount before linking it to the
+ platform device
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit 5f4bbee069836e51ed0b6d7e565a292f070ababc ]
+
+When an MFD device is added, a platform_device is allocated. If this
+device is linked to a DT description, the corresponding OF node is linked
+to the new platform device but the OF node's refcount isn't incremented.
+As of_node_put() is called during the platform device release, it leads
+to a refcount underflow.
+
+Call of_node_get() to increment the OF node's refcount when the node is
+linked to the newly created platform device.
+
+Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
+Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mfd-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 76bd316a50afc..7d14a1e7631ee 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -131,6 +131,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
+ 	of_entry->np = np;
+ 	list_add_tail(&of_entry->list, &mfd_of_node_list);
+ 
++	of_node_get(np);
+ 	device_set_node(&pdev->dev, of_fwnode_handle(np));
+ #endif
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-6.12/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..65efe345da
--- /dev/null
+++ b/queue-6.12/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From 2c56d5a3c1bcac6690db2ea58f0dc3a627c78c29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index c6235cd0dbdc4..1ec9ab56442df 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch b/queue-6.12/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
new file mode 100644
index 0000000000..002c81a8c1
--- /dev/null
+++ b/queue-6.12/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
@@ -0,0 +1,50 @@
+From 41baa6818d9dea7a5f6ed3244d60e99573da4302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:29:36 +0300
+Subject: mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit c91a0e4e549d0457c61f2199fcd84d699400bee1 ]
+
+Add Intel Wildcat Lake PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 1d8cdc4d5819b..5b1c13fb23468 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -367,6 +367,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x4b79), (kernel_ulong_t)&ehl_i2c_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4b7a), (kernel_ulong_t)&ehl_i2c_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4b7b), (kernel_ulong_t)&ehl_i2c_info },
++	/* WCL */
++	{ PCI_VDEVICE(INTEL, 0x4d25), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d26), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d27), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d30), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d46), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d50), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d51), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d52), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d78), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d79), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d7a), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d7b), (kernel_ulong_t)&ehl_i2c_info },
+ 	/* JSL */
+ 	{ PCI_VDEVICE(INTEL, 0x4da8), (kernel_ulong_t)&spt_uart_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4da9), (kernel_ulong_t)&spt_uart_info },
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-6.12/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..b66652018b
--- /dev/null
+++ b/queue-6.12/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 8f61a5793e6ade4cd98496d28d1f64c48d53a8fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-6.12/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..03001bcb99
--- /dev/null
+++ b/queue-6.12/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From cf5c6b84888c5c96965b572aad044a4c9afddd0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+ 
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-6.12/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-6.12/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..1f9db4a0b2
--- /dev/null
+++ b/queue-6.12/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From 40ba6e0c8eb6db97b1c980af17eff937e6c24f39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 9c3cf58457a7d..be6a84a3062cc 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-6.12/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-6.12/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..6f617c6b8e
--- /dev/null
+++ b/queue-6.12/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From cc2d9ab1b3d07900c8792cc27b1260f184bafd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 6ebb3d1eeb4d6..73e9c50968e1d 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-6.12/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..56377da673
--- /dev/null
+++ b/queue-6.12/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 182a9bcc76310de9da5dbeecbc0e66384661afec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index c2144a3efb308..74234ee5f6089 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-6.12/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-6.12/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..027ea951cc
--- /dev/null
+++ b/queue-6.12/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From 676ac6ac091c1fa943ca996f66f74cad1f5ab897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 7c13a400071e6..57c9491233860 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3026,11 +3026,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-6.12/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch b/queue-6.12/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
new file mode 100644
index 0000000000..e6375223a9
--- /dev/null
+++ b/queue-6.12/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
@@ -0,0 +1,52 @@
+From 823e144acf7093c9d269aef950724d8fd5efebfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 24d82d35041b5..a3b9f8ea235f7 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4740,8 +4740,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ 	 * checking that they started once before, hence are reconnecting back.
+ 	 */
+ 	if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+-	    nvme_discovery_ctrl(ctrl))
++	    nvme_discovery_ctrl(ctrl)) {
++		if (!ctrl->kato) {
++			nvme_stop_keep_alive(ctrl);
++			ctrl->kato = NVME_DEFAULT_KATO;
++			nvme_start_keep_alive(ctrl);
++		}
+ 		nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++	}
+ 
+ 	if (ctrl->queue_count > 1) {
+ 		nvme_queue_scan(ctrl);
+-- 
+2.51.0
+
diff --git a/queue-6.12/nvmet-fc-avoid-scheduling-association-deletion-twice.patch b/queue-6.12/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
new file mode 100644
index 0000000000..9c4dab569d
--- /dev/null
+++ b/queue-6.12/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
@@ -0,0 +1,72 @@
+From a5a68bcc431114320e8c215adea5a78bb1058eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 0ade23610ae64..67767e926b1bb 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1088,6 +1088,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++	int terminating;
++
++	terminating = atomic_xchg(&assoc->terminating, 1);
++
++	/* if already terminating, do nothing */
++	if (terminating)
++		return;
++
+ 	nvmet_fc_tgtport_get(assoc->tgtport);
+ 	if (!queue_work(nvmet_wq, &assoc->del_work))
+ 		nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1214,13 +1222,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ 	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ 	unsigned long flags;
+-	int i, terminating;
+-
+-	terminating = atomic_xchg(&assoc->terminating, 1);
+-
+-	/* if already terminating, do nothing */
+-	if (terminating)
+-		return;
++	int i;
+ 
+ 	spin_lock_irqsave(&tgtport->lock, flags);
+ 	list_del_rcu(&assoc->a_list);
+-- 
+2.51.0
+
diff --git a/queue-6.12/pinctrl-keembay-release-allocated-memory-in-detach-p.patch b/queue-6.12/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
new file mode 100644
index 0000000000..a3ce7ff6cb
--- /dev/null
+++ b/queue-6.12/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
@@ -0,0 +1,56 @@
+From 78a2b751e66acecb4d25979a8f65bfe6b26e2787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index b693f4787044c..b1124d3e50bff 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	 * being part of 8 (hw maximum) globally unique muxes.
+ 	 */
+ 	kpc->nfuncs = 0;
+-	keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++	keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++				     sizeof(*keembay_funcs), GFP_KERNEL);
+ 	if (!keembay_funcs)
+ 		return -ENOMEM;
+ 
+@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	}
+ 
+ 	/* Reallocate memory based on actual number of functions */
+-	new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++	new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++					kpc->nfuncs, sizeof(*new_funcs),
++					GFP_KERNEL);
+ 	if (!new_funcs) {
+ 		kfree(keembay_funcs);
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.12/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-6.12/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..ff4322c893
--- /dev/null
+++ b/queue-6.12/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From fbbe0e3da405e3c355407b027d16892627fb284b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 2ec599e383e4b..1df0a00ae1ee8 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -589,8 +589,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 			/* 4 parameters */
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-6.12/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch b/queue-6.12/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
new file mode 100644
index 0000000000..b846af737d
--- /dev/null
+++ b/queue-6.12/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
@@ -0,0 +1,41 @@
+From 282dbc64ea2dc5f754536356cd5ff6b19ec897b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index 9467235110f46..82c33cf727a82 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++	{ .compatible = "apple,t8103-pmgr-pwrstate" },
+ 	{ .compatible = "apple,pmgr-pwrstate" },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/power-supply-qcom_battmgr-add-ooi-chemistry.patch b/queue-6.12/power-supply-qcom_battmgr-add-ooi-chemistry.patch
new file mode 100644
index 0000000000..6e25dcc87c
--- /dev/null
+++ b/queue-6.12/power-supply-qcom_battmgr-add-ooi-chemistry.patch
@@ -0,0 +1,37 @@
+From 3666d5671aa74a7b04217c74942466f8239cb7d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index c2037b58fbcdf..dd89104cb1672 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -978,7 +978,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+ 
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+-	if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++	if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++	    (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ 		return POWER_SUPPLY_TECHNOLOGY_LION;
+ 	if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ 		return POWER_SUPPLY_TECHNOLOGY_LIPO;
+-- 
+2.51.0
+
diff --git a/queue-6.12/power-supply-qcom_battmgr-handle-charging-state-chan.patch b/queue-6.12/power-supply-qcom_battmgr-handle-charging-state-chan.patch
new file mode 100644
index 0000000000..520ea30dfe
--- /dev/null
+++ b/queue-6.12/power-supply-qcom_battmgr-handle-charging-state-chan.patch
@@ -0,0 +1,70 @@
+From 343384a01557cd2ef22424dcf021f764aacb4601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index dd89104cb1672..f8bea732ba7f2 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -29,8 +29,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY		0x30
+ #define NOTIF_USB_PROPERTY		0x32
+ #define NOTIF_WLS_PROPERTY		0x34
+-#define NOTIF_BAT_INFO			0x81
+ #define NOTIF_BAT_STATUS		0x80
++#define NOTIF_BAT_INFO			0x81
++#define NOTIF_BAT_CHARGING_STATE	0x83
+ 
+ #define BATTMGR_BAT_INFO		0x9
+ 
+@@ -943,12 +944,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ 	}
+ 
+ 	notification = le32_to_cpu(msg->notification);
++	notification &= 0xff;
+ 	switch (notification) {
+ 	case NOTIF_BAT_INFO:
+ 		battmgr->info.valid = false;
+ 		fallthrough;
+ 	case NOTIF_BAT_STATUS:
+ 	case NOTIF_BAT_PROPERTY:
++	case NOTIF_BAT_CHARGING_STATE:
+ 		power_supply_changed(battmgr->bat_psy);
+ 		break;
+ 	case NOTIF_USB_PROPERTY:
+-- 
+2.51.0
+
diff --git a/queue-6.12/power-supply-sbs-charger-support-multiple-devices.patch b/queue-6.12/power-supply-sbs-charger-support-multiple-devices.patch
new file mode 100644
index 0000000000..9bd59d2ca1
--- /dev/null
+++ b/queue-6.12/power-supply-sbs-charger-support-multiple-devices.patch
@@ -0,0 +1,114 @@
+From 7f27c6560d9fca7636d03584c78a8ba3d31e16a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[    8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[    8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G           O      5.10.147 #22
+[    8.151974] Hardware name: ALE AMB (DT)
+[    8.155828] Call trace:
+[    8.158292]  dump_backtrace+0x0/0x1d4
+[    8.161960]  show_stack+0x18/0x6c
+[    8.165280]  dump_stack+0xcc/0x128
+[    8.168687]  sysfs_warn_dup+0x60/0x7c
+[    8.172353]  sysfs_do_create_link_sd+0xf0/0x100
+[    8.176886]  sysfs_create_link+0x20/0x40
+[    8.180816]  device_add+0x270/0x7a4
+[    8.184311]  __power_supply_register+0x304/0x560
+[    8.188930]  devm_power_supply_register+0x54/0xa0
+[    8.193644]  sbs_probe+0xc0/0x214 [sbs_charger]
+[    8.198183]  i2c_device_probe+0x2dc/0x2f4
+[    8.202196]  really_probe+0xf0/0x510
+[    8.205774]  driver_probe_device+0xfc/0x160
+[    8.209960]  device_driver_attach+0xc0/0xcc
+[    8.214146]  __driver_attach+0xc0/0x170
+[    8.218002]  bus_for_each_dev+0x74/0xd4
+[    8.221862]  driver_attach+0x24/0x30
+[    8.225444]  bus_add_driver+0x148/0x250
+[    8.229283]  driver_register+0x78/0x130
+[    8.233140]  i2c_register_driver+0x4c/0xe0
+[    8.237250]  sbs_driver_init+0x20/0x1000 [sbs_charger]
+[    8.242424]  do_one_initcall+0x50/0x1b0
+[    8.242434]  do_init_module+0x44/0x230
+[    8.242438]  load_module+0x2200/0x27c0
+[    8.242442]  __do_sys_finit_module+0xa8/0x11c
+[    8.242447]  __arm64_sys_finit_module+0x20/0x30
+[    8.242457]  el0_svc_common.constprop.0+0x64/0x154
+[    8.242464]  do_el0_svc+0x24/0x8c
+[    8.242474]  el0_svc+0x10/0x20
+[    8.242481]  el0_sync_handler+0x108/0x114
+[    8.242485]  el0_sync+0x180/0x1c0
+[    8.243847] sbs-charger 20-0009: Failed to register power supply
+[    8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[    7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index ab3f095d90ea7..0ae7264491997 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ 	.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+ 
+-static const struct power_supply_desc sbs_desc = {
+-	.name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ 	.type = POWER_SUPPLY_TYPE_MAINS,
+ 	.properties = sbs_properties,
+ 	.num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ 	struct power_supply_config psy_cfg = {};
++	struct power_supply_desc *sbs_desc;
+ 	struct sbs_info *chip;
+ 	int ret, val;
+ 
++	sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++				sizeof(*sbs_desc), GFP_KERNEL);
++	if (!sbs_desc)
++		return -ENOMEM;
++
++	sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++					dev_name(&client->dev));
++	if (!sbs_desc->name)
++		return -ENOMEM;
++
+ 	chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ 	if (!chip)
+ 		return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ 		return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ 	chip->last_state = val;
+ 
+-	chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++	chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ 	if (IS_ERR(chip->power_supply))
+ 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ 				     "Failed to register power supply\n");
+-- 
+2.51.0
+
diff --git a/queue-6.12/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch b/queue-6.12/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
new file mode 100644
index 0000000000..d5784e51cd
--- /dev/null
+++ b/queue-6.12/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
@@ -0,0 +1,126 @@
+From 85c49a4fbe707a5144e2bfa30ec9faee9a56e921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:36:01 +0200
+Subject: pwm: pca9685: Use bulk write to atomicially update registers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit de5855613263b426ee697dd30224322f2e634dec ]
+
+The output of a PWM channel is configured by four register values. Write
+them in a single i2c transaction to ensure glitch free updates.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bfa8c0267c9ec059d0d77f146998d564654c75ca.1753784092.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 46 ++++++++++++++++++++++++---------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 1298b29183e55..e1b60756bb485 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -62,6 +62,8 @@
+ #define MODE1_SUB2		BIT(2)
+ #define MODE1_SUB1		BIT(3)
+ #define MODE1_SLEEP		BIT(4)
++#define MODE1_AI		BIT(5)
++
+ #define MODE2_INVRT		BIT(4)
+ #define MODE2_OUTDRV		BIT(2)
+ 
+@@ -132,6 +134,19 @@ static int pca9685_write_reg(struct pwm_chip *chip, unsigned int reg, unsigned i
+ 	return err;
+ }
+ 
++static int pca9685_write_4reg(struct pwm_chip *chip, unsigned int reg, u8 val[4])
++{
++	struct pca9685 *pca = to_pca(chip);
++	struct device *dev = pwmchip_parent(chip);
++	int err;
++
++	err = regmap_bulk_write(pca->regmap, reg, val, 4);
++	if (err)
++		dev_err(dev, "regmap_write to register 0x%x failed: %pe\n", reg, ERR_PTR(err));
++
++	return err;
++}
++
+ /* Helper function to set the duty cycle ratio to duty/4096 (e.g. duty=2048 -> 50%) */
+ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned int duty)
+ {
+@@ -144,12 +159,10 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ 		return;
+ 	} else if (duty >= PCA9685_COUNTER_RANGE) {
+ 		/* Set the full ON bit and clear the full OFF bit */
+-		pca9685_write_reg(chip, REG_ON_H(channel), LED_FULL);
+-		pca9685_write_reg(chip, REG_OFF_H(channel), 0);
++		pca9685_write_4reg(chip, REG_ON_L(channel), (u8[4]){ 0, LED_FULL, 0, 0 });
+ 		return;
+ 	}
+ 
+-
+ 	if (pwm->state.usage_power && channel < PCA9685_MAXCHAN) {
+ 		/*
+ 		 * If usage_power is set, the pca9685 driver will phase shift
+@@ -164,12 +177,9 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ 
+ 	off = (on + duty) % PCA9685_COUNTER_RANGE;
+ 
+-	/* Set ON time (clears full ON bit) */
+-	pca9685_write_reg(chip, REG_ON_L(channel), on & 0xff);
+-	pca9685_write_reg(chip, REG_ON_H(channel), (on >> 8) & 0xf);
+-	/* Set OFF time (clears full OFF bit) */
+-	pca9685_write_reg(chip, REG_OFF_L(channel), off & 0xff);
+-	pca9685_write_reg(chip, REG_OFF_H(channel), (off >> 8) & 0xf);
++	/* implicitly clear full ON and full OFF bit */
++	pca9685_write_4reg(chip, REG_ON_L(channel),
++			   (u8[4]){ on & 0xff, (on >> 8) & 0xf, off & 0xff, (off >> 8) & 0xf });
+ }
+ 
+ static unsigned int pca9685_pwm_get_duty(struct pwm_chip *chip, int channel)
+@@ -543,9 +553,8 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ 
+ 	mutex_init(&pca->lock);
+ 
+-	ret = pca9685_read_reg(chip, PCA9685_MODE2, &reg);
+-	if (ret)
+-		return ret;
++	/* clear MODE2_OCH */
++	reg = 0;
+ 
+ 	if (device_property_read_bool(&client->dev, "invert"))
+ 		reg |= MODE2_INVRT;
+@@ -561,16 +570,19 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions */
++	/*
++	 * Disable all LED ALLCALL and SUBx addresses to avoid bus collisions,
++	 * enable Auto-Increment.
++	 */
+ 	pca9685_read_reg(chip, PCA9685_MODE1, &reg);
+ 	reg &= ~(MODE1_ALLCALL | MODE1_SUB1 | MODE1_SUB2 | MODE1_SUB3);
++	reg |= MODE1_AI;
+ 	pca9685_write_reg(chip, PCA9685_MODE1, reg);
+ 
+ 	/* Reset OFF/ON registers to POR default */
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_L, 0);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_H, LED_FULL);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_ON_L, 0);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_ON_H, LED_FULL);
++	ret = pca9685_write_4reg(chip, PCA9685_ALL_LED_ON_L, (u8[]){ 0, LED_FULL, 0, LED_FULL });
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret, "Failed to reset ON/OFF registers\n");
+ 
+ 	chip->ops = &pca9685_pwm_ops;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/riscv-bpf-fix-uninitialized-symbol-retval_off.patch b/queue-6.12/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
new file mode 100644
index 0000000000..cb07635ee8
--- /dev/null
+++ b/queue-6.12/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
@@ -0,0 +1,48 @@
+From d82090c19a70c4d9e0145cc45dd338c02fe5431a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 497945aa3e2c4..5895c1b2be203 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -906,10 +906,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ 	stack_size += 16;
+ 
+ 	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+-	if (save_ret) {
++	if (save_ret)
+ 		stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+-		retval_off = stack_size;
+-	}
++	retval_off = stack_size;
+ 
+ 	stack_size += nr_arg_slots * 8;
+ 	args_off = stack_size;
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-6.12/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..fb2e7da109
--- /dev/null
+++ b/queue-6.12/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From ea56c7c1e70003061c5f15da03034ca3869f15e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch b/queue-6.12/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
new file mode 100644
index 0000000000..4e5186c2ca
--- /dev/null
+++ b/queue-6.12/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
@@ -0,0 +1,53 @@
+From b8116b887942dc74fa211b2c822f30679ad1203c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:52:30 +0100
+Subject: selftests/bpf: Fix flaky bpf_cookie selftest
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 ]
+
+bpf_cookie can fail on perf_event_open(), when it runs after the task_work
+selftest. The task_work test causes perf to lower
+sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq,
+which is validated against that sysctl. As a result,
+perf_event_open() rejects the attr if the (now tighter) limit is
+exceeded.
+
+>From perf_event_open():
+if (attr.freq) {
+	if (attr.sample_freq > sysctl_perf_event_sample_rate)
+		return -EINVAL;
+} else {
+	if (attr.sample_period & (1ULL << 63))
+		return -EINVAL;
+}
+
+Switch bpf_cookie to use sample_period, which is not checked against
+sysctl_perf_event_sample_rate.
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bpf_cookie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+index 6befa870434bc..f97f560bafb20 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
++++ b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+@@ -450,8 +450,7 @@ static void pe_subtest(struct test_bpf_cookie *skel)
+ 	attr.size = sizeof(attr);
+ 	attr.type = PERF_TYPE_SOFTWARE;
+ 	attr.config = PERF_COUNT_SW_CPU_CLOCK;
+-	attr.freq = 1;
+-	attr.sample_freq = 10000;
++	attr.sample_period = 100000;
+ 	pfd = syscall(__NR_perf_event_open, &attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC);
+ 	if (!ASSERT_GE(pfd, 0, "perf_fd"))
+ 		goto cleanup;
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch b/queue-6.12/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
new file mode 100644
index 0000000000..46123f4b78
--- /dev/null
+++ b/queue-6.12/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
@@ -0,0 +1,83 @@
+From 6119c4e4b5bc4fe83e94c0c8845f1fdf395d3a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 21:58:05 -0700
+Subject: selftests/bpf: Fix selftest verifier_arena_large failure
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 5a427fddec5e76360725a0f03df3a2a003efbe2e ]
+
+With latest llvm22, I got the following verification failure:
+
+  ...
+  ; int big_alloc2(void *ctx) @ verifier_arena_large.c:207
+  0: (b4) w6 = 1                        ; R6_w=1
+  ...
+  ; if (err) @ verifier_arena_large.c:233
+  53: (56) if w6 != 0x0 goto pc+62      ; R6=0
+  54: (b7) r7 = -4                      ; R7_w=-4
+  55: (18) r8 = 0x7f4000000000          ; R8_w=scalar()
+  57: (bf) r9 = addr_space_cast(r8, 0, 1)       ; R8_w=scalar() R9_w=arena
+  58: (b4) w6 = 5                       ; R6_w=5
+  ; pg = page[i]; @ verifier_arena_large.c:238
+  59: (bf) r1 = r7                      ; R1_w=-4 R7_w=-4
+  60: (07) r1 += 4                      ; R1_w=0
+  61: (79) r2 = *(u64 *)(r9 +0)         ; R2_w=scalar() R9_w=arena
+  ; if (*pg != i) @ verifier_arena_large.c:239
+  62: (bf) r3 = addr_space_cast(r2, 0, 1)       ; R2_w=scalar() R3_w=arena
+  63: (71) r3 = *(u8 *)(r3 +0)          ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+  64: (5d) if r1 != r3 goto pc+51       ; R1_w=0 R3_w=0
+  ; bpf_arena_free_pages(&arena, (void __arena *)pg, 2); @ verifier_arena_large.c:241
+  65: (18) r1 = 0xff11000114548000      ; R1_w=map_ptr(map=arena,ks=0,vs=0)
+  67: (b4) w3 = 2                       ; R3_w=2
+  68: (85) call bpf_arena_free_pages#72675      ;
+  69: (b7) r1 = 0                       ; R1_w=0
+  ; page[i + 1] = NULL; @ verifier_arena_large.c:243
+  70: (7b) *(u64 *)(r8 +8) = r1
+  R8 invalid mem access 'scalar'
+  processed 61 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 2
+  =============
+  #489/5   verifier_arena_large/big_alloc2:FAIL
+
+The main reason is that 'r8' in insn '70' is not an arena pointer.
+Further debugging at llvm side shows that llvm commit ([1]) caused
+the failure. For the original code:
+  page[i] = NULL;
+  page[i + 1] = NULL;
+the llvm transformed it to something like below at source level:
+  __builtin_memset(&page[i], 0, 16)
+Such transformation prevents llvm BPFCheckAndAdjustIR pass from
+generating proper addr_space_cast insns ([2]).
+
+Adding support in llvm BPFCheckAndAdjustIR pass should work, but
+not sure that such a pattern exists or not in real applications.
+At the same time, simply adding a memory barrier between two 'page'
+assignment can fix the issue.
+
+  [1] https://github.com/llvm/llvm-project/pull/155415
+  [2] https://github.com/llvm/llvm-project/pull/84410
+
+Cc: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250920045805.3288551-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/verifier_arena_large.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_large.c b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+index 758b09a5eb88b..394c98227e777 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_arena_large.c
++++ b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+@@ -142,6 +142,7 @@ int big_alloc2(void *ctx)
+ 			return 5;
+ 		bpf_arena_free_pages(&arena, (void __arena *)pg, 2);
+ 		page[i] = NULL;
++		barrier();
+ 		page[i + 1] = NULL;
+ 		cond_break;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch b/queue-6.12/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
new file mode 100644
index 0000000000..958ef6f7b0
--- /dev/null
+++ b/queue-6.12/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
@@ -0,0 +1,39 @@
+From d1165c8f176b86fcfed6a6704ed5a518305520fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 65aafe0003db0..62db060298a4a 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -241,4 +241,6 @@ done
+ 
+ if [ $failures -eq 0 ]; then
+         echo "All tests successful!"
++else
++	exit 1
+ fi
+-- 
+2.51.0
+
diff --git a/queue-6.12/series b/queue-6.12/series
index 5d8c9f8a31..33d930267e 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -78,3 +78,87 @@ sched_ext-mark-scx_bpf_dsq_move_set_-with-kf_rcu.patch
 cpuidle-governors-menu-rearrange-main-loop-in-menu_select.patch
 cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch
 mfd-kempld-switch-back-to-earlier-init-behavior.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+cpufreq-ti-add-support-for-am62d2.patch
+bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
+firewire-ohci-move-self_id_complete-tracepoint-after.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+io_uring-zctx-check-chained-notif-contexts.patch
+acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
+thermal-intel-selftests-workload_hint-mask-unsupport.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-lenovo-ec-sensors-update-p8-supprt.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+cpufreq-ondemand-update-the-efficient-idle-check-for.patch
+arm64-zynqmp-disable-coresight-by-default.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-p880-set-correct-touchscreen-clipping.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+firmware-qcom-tzmem-disable-sc7180-platform.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+acpi-spcr-support-precise-baud-rate-field.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+clocksource-drivers-timer-rtl-otto-work-around-dying.patch
+clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+mfd-core-increment-of_node-s-refcount-before-linking.patch
+mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
diff --git a/queue-6.12/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch b/queue-6.12/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
new file mode 100644
index 0000000000..75b371c4d2
--- /dev/null
+++ b/queue-6.12/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
@@ -0,0 +1,37 @@
+From 0a2e61ff5873b76b110d0a82f48c800c017684da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ 	{ "AST2620", 0x05010203 },
+ 	{ "AST2605", 0x05030103 },
+ 	{ "AST2625", 0x05030403 },
++	/* AST2700 */
++	{ "AST2750", 0x06000003 },
++	{ "AST2700", 0x06000103 },
++	{ "AST2720", 0x06000203 },
+ };
+ 
+ static const char *siliconid_to_name(u32 siliconid)
+-- 
+2.51.0
+
diff --git a/queue-6.12/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-6.12/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..4a417e99c3
--- /dev/null
+++ b/queue-6.12/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From 2002f20345bf19a4bbdbe6ec0514842f1e3c0ef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index e4411771f482f..db77642776f93 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -892,7 +892,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-6.12/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..f297575eca
--- /dev/null
+++ b/queue-6.12/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From 36683c4a1daa7de6f2dfb2f7abfc1c5c766623c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index e24ab5f7d2bf1..524fa1b0cd3d6 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ 	.clk_suspend_on = false,
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/soc-ti-pruss-don-t-use-pk-through-printk.patch b/queue-6.12/soc-ti-pruss-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..9d9c29d3f4
--- /dev/null
+++ b/queue-6.12/soc-ti-pruss-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 58563ef62d58fbfccec031d3a23407c86cf5fff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index 3ec758f50e248..f588153e8178d 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -449,7 +449,7 @@ static int pruss_of_setup_memories(struct device *dev, struct pruss *pruss)
+ 		pruss->mem_regions[i].pa = res.start;
+ 		pruss->mem_regions[i].size = resource_size(&res);
+ 
+-		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ 			mem_names[i], &pruss->mem_regions[i].pa,
+ 			pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-6.12/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..ca49c520c0
--- /dev/null
+++ b/queue-6.12/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From 67abd331bf828b9dab13239f4e609158fcbc55ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 7740f94847a88..c925cefaef448 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -446,7 +446,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -456,15 +456,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -558,7 +558,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -696,7 +696,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-6.12/spi-rpc-if-add-resume-support-for-rz-g3e.patch b/queue-6.12/spi-rpc-if-add-resume-support-for-rz-g3e.patch
new file mode 100644
index 0000000000..6f040f34d5
--- /dev/null
+++ b/queue-6.12/spi-rpc-if-add-resume-support-for-rz-g3e.patch
@@ -0,0 +1,36 @@
+From 50d018805c0f4f505c177340b45e64fb2d910f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index c24dad51a0e96..43e829251af59 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ 	struct spi_controller *ctlr = dev_get_drvdata(dev);
+ 
++	rpcif_hw_init(dev, false);
++
+ 	return spi_controller_resume(ctlr);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-6.12/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..b05eae31c4
--- /dev/null
+++ b/queue-6.12/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 79e60b58491a6f1f777b58ffa65be134ef445a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index acc7998758ad8..133447f250657 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-6.12/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch b/queue-6.12/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
new file mode 100644
index 0000000000..8f528a4f3c
--- /dev/null
+++ b/queue-6.12/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
@@ -0,0 +1,81 @@
+From d6ae0551e0a7243cf771f3d2d6d3991591f3d2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:31:53 +0200
+Subject: thermal: gov_step_wise: Allow cooling level to be reduced earlier
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2e82368359f63567862a0d438710ddffcb1ace83 ]
+
+The current behavior of the Step-wise thermal governor is to increase
+the cooling level one step at a time after trip point threshold passing
+by thermal zone temperature until the temperature stops to rise.  Then,
+nothing is done until the temperature decreases below the (possibly
+updated) trip point threshold, at which point the cooling level is
+reduced straight to the applicable minimum.
+
+While this generally works, it is not in agreement with the throttling
+logic description comment in step_wise_manage() any more after some
+relatively recent changes, and in the case of passive cooling, it may
+lead to undesirable performance oscillations between high and low
+levels.
+
+For this reason, modify the governor's cooling device state selection
+function, get_target_state(), to reduce cooling by one level even if
+the temperature is still above the thermal zone threshold, but the
+temperature has started to fall down.  However, ensure that the cooling
+level will remain above the applicable minimum in that case to pull
+the zone temperature further down, possibly until it falls below the
+trip threshold (which may now be equal to the low temperature of the
+trip).
+
+Doing so should help higher performance to be restored earlier in some
+cases which is desirable especially for passive trip points with
+relatively high hysteresis values.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/1947735.tdWV9SEqCh@rafael.j.wysocki
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/gov_step_wise.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/gov_step_wise.c b/drivers/thermal/gov_step_wise.c
+index ea4bf88d37f33..b038f042ed74e 100644
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -20,7 +20,9 @@
+  * If the temperature is higher than a trip point,
+  *    a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+  *       state for this trip point
+- *    b. if the trend is THERMAL_TREND_DROPPING, do nothing
++ *    b. if the trend is THERMAL_TREND_DROPPING, use a lower cooling state
++ *       for this trip point, but keep the cooling state above the applicable
++ *       minimum
+  * If the temperature is lower than a trip point,
+  *    a. if the trend is THERMAL_TREND_RAISING, do nothing
+  *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+@@ -51,6 +53,17 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ 	if (throttle) {
+ 		if (trend == THERMAL_TREND_RAISING)
+ 			return clamp(cur_state + 1, instance->lower, instance->upper);
++
++		/*
++		 * If the zone temperature is falling, the cooling level can
++		 * be reduced, but it should still be above the lower state of
++		 * the given thermal instance to pull the temperature further
++		 * down.
++		 */
++		if (trend == THERMAL_TREND_DROPPING)
++			return clamp(cur_state - 1,
++				     min(instance->lower + 1, instance->upper),
++				     instance->upper);
+ 	} else if (trend == THERMAL_TREND_DROPPING) {
+ 		if (cur_state <= instance->lower)
+ 			return THERMAL_NO_TARGET;
+-- 
+2.51.0
+
diff --git a/queue-6.12/thermal-intel-selftests-workload_hint-mask-unsupport.patch b/queue-6.12/thermal-intel-selftests-workload_hint-mask-unsupport.patch
new file mode 100644
index 0000000000..aa4eebd90a
--- /dev/null
+++ b/queue-6.12/thermal-intel-selftests-workload_hint-mask-unsupport.patch
@@ -0,0 +1,38 @@
+From 82016eadb11ce2a83bfacc1217e282c176c0ada0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:15:41 -0700
+Subject: thermal: intel: selftests: workload_hint: Mask unsupported types
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 0115d063559fa6d25e41751cf455dda40aa2c856 ]
+
+The workload hint may contain some other hints which are not defined.
+So mask out unsupported types. Currently only lower 4 bits of workload
+type hints are defined.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/20250828201541.931425-1-srinivas.pandruvada@linux.intel.com
+[ rjw: Subject cleanup ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/thermal/intel/workload_hint/workload_hint_test.c  | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+index 217c3a641c537..ecf8b06c1ddf6 100644
+--- a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
++++ b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+@@ -146,6 +146,8 @@ int main(int argc, char **argv)
+ 			ret = sscanf(index_str, "%d", &index);
+ 			if (ret < 0)
+ 				break;
++
++			index &= 0x0f;
+ 			if (index > WORKLOAD_TYPE_MAX_INDEX)
+ 				printf("Invalid workload type index\n");
+ 			else
+-- 
+2.51.0
+
diff --git a/queue-6.12/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch b/queue-6.12/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
new file mode 100644
index 0000000000..ffff028d70
--- /dev/null
+++ b/queue-6.12/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
@@ -0,0 +1,44 @@
+From 818a3f88d1f91d25d108f5418e88760d976f4c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 7a2ef691b20e1..c2a7af89a67bb 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ 	if (numwritten < 1) {
+ 		perror(path);
+ 		close(fd);
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	close(fd);
+-- 
+2.51.0
+
diff --git a/queue-6.12/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-6.12/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..c3b6bacb5a
--- /dev/null
+++ b/queue-6.12/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From 93867c4db04bd1904535c75202637e184f877722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 0ecac009273ce..f2c1139adf716 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -233,6 +233,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -241,10 +242,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-6.12/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-6.12/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..e47660554f
--- /dev/null
+++ b/queue-6.12/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 18ded11b2ff247dc37bf0f60cab2c3995dad1854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-6.12/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..f065b49351
--- /dev/null
+++ b/queue-6.12/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From a67903c6ccb08bb97ef61c4ec2e71e91da4578ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-6.12/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..d46aa7a20c
--- /dev/null
+++ b/queue-6.12/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From 6cfad46f4f54fbbc894f915bdc6c05ebe87ed308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-6.12/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-6.12/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..4fc0a94e37
--- /dev/null
+++ b/queue-6.12/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 2c3254ac3030a9aaa9ba740904b272ba3e585883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index c00981cc6fe5b..e30c4dd345f40 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2338,6 +2338,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-6.12/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..3f3b0f8cc4
--- /dev/null
+++ b/queue-6.12/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From b222c990c22ed57b1f5c0e71ecc09a93995a0045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-prm-skip-handlers-with-null-handler_address-or-.patch b/queue-6.17/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
new file mode 100644
index 0000000000..27164758a9
--- /dev/null
+++ b/queue-6.17/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
@@ -0,0 +1,61 @@
+From fe894d470079eeb5d1b312837e66daafe1f8a29e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index be033bbb126a4..6792d4385eee4 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ 		th = &tm->handlers[cur_handler];
+ 
+ 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++		/*
++		 * Print an error message if handler_address is NULL, the parse of VA also
++		 * can be skipped.
++		 */
++		if (unlikely(!handler_info->handler_address)) {
++			pr_info("Skipping handler with NULL address for GUID: %pUL",
++					(guid_t *)handler_info->handler_guid);
++			continue;
++		}
++
+ 		th->handler_addr =
+ 			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ 		/*
+-		 * Print a warning message if handler_addr is zero which is not expected to
+-		 * ever happen.
++		 * Print a warning message and skip the parse of VA if handler_addr is zero
++		 * which is not expected to ever happen.
+ 		 */
+-		if (unlikely(!th->handler_addr))
++		if (unlikely(!th->handler_addr)) {
+ 			pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ 				&th->guid, handler_info->handler_address);
++			continue;
++		}
+ 
+ 		th->static_data_buffer_addr =
+ 			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch b/queue-6.17/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
new file mode 100644
index 0000000000..b514092811
--- /dev/null
+++ b/queue-6.17/acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
@@ -0,0 +1,45 @@
+From b24dd82a51172052221452dae325da57b2a61f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 14:52:22 +0000
+Subject: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
+
+From: Sam van Kampen <sam@tehsvk.net>
+
+[ Upstream commit 3a351de0d9c86e23b9eca25838b19468aab02f38 ]
+
+Just like the other Vivobooks here, the N6506CU has its keyboard IRQ
+described as ActiveLow in the DSDT, which the kernel overrides to
+EdgeHigh, causing the internal keyboard not to work.
+
+Add the N6506CU to the irq1_level_low_skip_override[] quirk table to fix
+this.
+
+Signed-off-by: Sam van Kampen <sam@tehsvk.net>
+Link: https://patch.msgid.link/20250829145221.2294784-2-sam@tehsvk.net
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index b1ab192d7a080..ddedb6956a0df 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -510,6 +510,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "N6506M"),
+ 		},
+ 	},
++	{
++		/* Asus Vivobook Pro N6506CU* */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++			DMI_MATCH(DMI_BOARD_NAME, "N6506CU"),
++		},
++	},
+ 	{
+ 		/* LG Electronics 17U70P */
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch b/queue-6.17/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
new file mode 100644
index 0000000000..470295a2d8
--- /dev/null
+++ b/queue-6.17/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
@@ -0,0 +1,52 @@
+From eb8b2b5347a290960a9afebb6a2dd4741c93cecb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index fb1fe9f3b1a36..9865faa996b0d 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -845,6 +845,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ 	"PNP0D80", /* Windows-compatible System Power Management Controller */
+ 	"INT33BD", /* Intel Baytrail Mailbox Device */
++	"INTC10DE", /* Intel CVS LNL */
++	"INTC10E0", /* Intel CVS ARL */
+ 	"LATT2021", /* Lattice FW Update Client Driver */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-spcr-support-precise-baud-rate-field.patch b/queue-6.17/acpi-spcr-support-precise-baud-rate-field.patch
new file mode 100644
index 0000000000..5629595e83
--- /dev/null
+++ b/queue-6.17/acpi-spcr-support-precise-baud-rate-field.patch
@@ -0,0 +1,53 @@
+From b951d826325070caa751a40db12a545bb1065b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:08:15 +0800
+Subject: ACPI: SPCR: Support Precise Baud Rate field
+
+From: Chen Pei <cp0613@linux.alibaba.com>
+
+[ Upstream commit 4d330fe54145ecfbb657ac01a554fdedf3c1927e ]
+
+The Microsoft Serial Port Console Redirection (SPCR) specification
+revision 1.09 comprises additional field: Precise Baud Rate [1].
+
+It is used to describe non-traditional baud rates (such as those
+used by high-speed UARTs).
+
+It contains a specific non-zero baud rate which overrides the value
+of the Configured Baud Rate field. If this field is zero or not
+present, Configured Baud Rate is used.
+
+Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1]
+Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
+Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com
+[ rjw: Corrected typo in the subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/spcr.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
+index cd36a97b0ea2c..fa12e740386de 100644
+--- a/drivers/acpi/spcr.c
++++ b/drivers/acpi/spcr.c
+@@ -146,7 +146,15 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ 		goto done;
+ 	}
+ 
+-	switch (table->baud_rate) {
++	/*
++	 * SPCR 1.09 defines Precise Baud Rate Filed contains a specific
++	 * non-zero baud rate which overrides the value of the Configured
++	 * Baud Rate field. If this field is zero or not present, Configured
++	 * Baud Rate is used.
++	 */
++	if (table->precise_baudrate)
++		baud_rate = table->precise_baudrate;
++	else switch (table->baud_rate) {
+ 	case 0:
+ 		/*
+ 		 * SPCR 1.04 defines 0 as a preconfigured state of UART.
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch b/queue-6.17/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
new file mode 100644
index 0000000000..07ce8d066d
--- /dev/null
+++ b/queue-6.17/acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
@@ -0,0 +1,38 @@
+From c61a8df0a60eefeb53bdfa2d4b3724a7a047bddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:49:46 +0530
+Subject: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 149139ddcb99583fdec8d1eaf7dada41e5896101 ]
+
+Since str_obj is allocated by ACPICA in acpi_evaluate_object_typed(),
+it should be free with ACPI_FREE() rather than with kfree(), so use
+the former instead of the latter for freeing it.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Link: https://patch.msgid.link/20250822061946.472594-1-kaushlendra.kumar@intel.com
+[ rjw: Subject and changelog rewrite ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 3961fc47152c0..cd199fbe4dc90 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -464,7 +464,7 @@ static ssize_t description_show(struct device *dev,
+ 
+ 	buf[result++] = '\n';
+ 
+-	kfree(str_obj);
++	ACPI_FREE(str_obj);
+ 
+ 	return result;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-video-force-native-for-lenovo-82k8.patch b/queue-6.17/acpi-video-force-native-for-lenovo-82k8.patch
new file mode 100644
index 0000000000..9fb2d783cf
--- /dev/null
+++ b/queue-6.17/acpi-video-force-native-for-lenovo-82k8.patch
@@ -0,0 +1,45 @@
+From 2969e6962f4807942462eb779feeeffa5d9e2c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:09:26 -0500
+Subject: ACPI: video: force native for Lenovo 82K8
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
+
+Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
+Add a quirk to prevent using it.
+
+Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
+Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index d507d5e084354..4cf74f173c785 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -948,6 +948,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
+ 		},
+ 	},
++	/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
++	{
++	 .callback = video_detect_force_native,
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
++		},
++	},
+ 	{ },
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-6.17/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..46528ab4fe
--- /dev/null
+++ b/queue-6.17/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From c929014821534a1ddd7149575762ebad77888f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index fef6fb29ece4d..e707a70368026 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-6.17/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-6.17/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..d97040a31c
--- /dev/null
+++ b/queue-6.17/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From 25b800f641c511a369f409bb3149b7871a5956d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 5340c28713927..df894235fdbc6 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+  */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm-tegra-p880-set-correct-touchscreen-clipping.patch b/queue-6.17/arm-tegra-p880-set-correct-touchscreen-clipping.patch
new file mode 100644
index 0000000000..db42f54fed
--- /dev/null
+++ b/queue-6.17/arm-tegra-p880-set-correct-touchscreen-clipping.patch
@@ -0,0 +1,41 @@
+From 059cf5849f0f36013ea8f0afb12145245816bc8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:19:46 +0300
+Subject: ARM: tegra: p880: set correct touchscreen clipping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+
+[ Upstream commit b49a73a08100ab139e07cfa7ca36e9b15787d0ab ]
+
+Existing touchscreen clipping is too small and causes problems with
+touchscreen accuracy.
+
+Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de>
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+index 2f7754fd42a16..c6ef0a20c19f3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
++++ b/arch/arm/boot/dts/nvidia/tegra30-lg-p880.dts
+@@ -108,8 +108,8 @@
+ 	i2c@7000c400 {
+ 		touchscreen@20 {
+ 			rmi4-f11@11 {
+-				syna,clip-x-high = <1110>;
+-				syna,clip-y-high = <1973>;
++				syna,clip-x-high = <1440>;
++				syna,clip-y-high = <2560>;
+ 
+ 				touchscreen-inverted-y;
+ 			};
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm-tegra-transformer-20-add-missing-magnetometer-in.patch b/queue-6.17/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
new file mode 100644
index 0000000000..1c04d88750
--- /dev/null
+++ b/queue-6.17/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
@@ -0,0 +1,37 @@
+From 9dd4b73d5748ca6ba6743e7ad959b44e3af68cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 67764afeb0136..39008816fe5ee 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ 			compatible = "asahi-kasei,ak8974";
+ 			reg = <0xe>;
+ 
++			interrupt-parent = <&gpio>;
++			interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ 			avdd-supply = <&vdd_3v3_sys>;
+ 			dvdd-supply = <&vdd_1v8_sys>;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch b/queue-6.17/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
new file mode 100644
index 0000000000..f690c9cde9
--- /dev/null
+++ b/queue-6.17/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
@@ -0,0 +1,37 @@
+From 6c6445d335bcf75eb2463486922ecac52c5abd68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 39008816fe5ee..efd8838f9644f 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ 			reg = <0x1a>;
+ 
+ 			interrupt-parent = <&gpio>;
+-			interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++			interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+ 
+ 			gpio-controller;
+ 			#gpio-cells = <2>;
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm64-versal-net-update-rtc-calibration-value.patch b/queue-6.17/arm64-versal-net-update-rtc-calibration-value.patch
new file mode 100644
index 0000000000..b2fdfce2b9
--- /dev/null
+++ b/queue-6.17/arm64-versal-net-update-rtc-calibration-value.patch
@@ -0,0 +1,39 @@
+From 7785c06efc21a4cd8d329f924c1a08db320a9f6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 11:43:09 +0530
+Subject: arm64: versal-net: Update rtc calibration value
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit b60b74f82e3ed4910a5f96a412e89bdd44875842 ]
+
+As per the design specification
+"The 16-bit Seconds Calibration Value represents the number of
+Oscillator Ticks that are required to measure the largest time period
+that is less than or equal to 1 second.
+For an oscillator that is 32.768kHz, this value will be 0x7FFF."
+
+Signed-off-by: Harini T <harini.t@amd.com>
+Link: https://lore.kernel.org/r/20250710061309.25601-1-harini.t@amd.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/versal-net.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/versal-net.dtsi b/arch/arm64/boot/dts/xilinx/versal-net.dtsi
+index fc9f49e57385a..c037a78199670 100644
+--- a/arch/arm64/boot/dts/xilinx/versal-net.dtsi
++++ b/arch/arm64/boot/dts/xilinx/versal-net.dtsi
+@@ -556,7 +556,7 @@
+ 			reg = <0 0xf12a0000 0 0x100>;
+ 			interrupts = <0 200 4>, <0 201 4>;
+ 			interrupt-names = "alarm", "sec";
+-			calibration = <0x8000>;
++			calibration = <0x7FFF>;
+ 		};
+ 
+ 		sdhci0: mmc@f1040000 {
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm64-zynqmp-disable-coresight-by-default.patch b/queue-6.17/arm64-zynqmp-disable-coresight-by-default.patch
new file mode 100644
index 0000000000..cf1fed1bf3
--- /dev/null
+++ b/queue-6.17/arm64-zynqmp-disable-coresight-by-default.patch
@@ -0,0 +1,59 @@
+From 8f0bb4078b8d367d36c858907712545814f7fb1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:18 +0200
+Subject: arm64: zynqmp: Disable coresight by default
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 0e3f9140ad04dca9a6a93dd6a6decdc53fd665ca ]
+
+When secure-boot mode of bootloader is enabled, the registers of
+coresight are not permitted to access that's why disable it by default.
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/7e308b8efe977c4912079b4d1b1ab3d24908559e.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index e11d282462bd3..23d867c03263d 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -550,6 +550,7 @@
+ 			reg = <0x0 0xfec10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu0>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu1_debug: debug@fed10000 {
+@@ -557,6 +558,7 @@
+ 			reg = <0x0 0xfed10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu1>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu2_debug: debug@fee10000 {
+@@ -564,6 +566,7 @@
+ 			reg = <0x0 0xfee10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu2>;
++			status = "disabled";
+ 		};
+ 
+ 		cpu3_debug: debug@fef10000 {
+@@ -571,6 +574,7 @@
+ 			reg = <0x0 0xfef10000 0x0 0x1000>;
+ 			clock-names = "apb_pclk";
+ 			cpu = <&cpu3>;
++			status = "disabled";
+ 		};
+ 
+ 		/* GDMA */
+-- 
+2.51.0
+
diff --git a/queue-6.17/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch b/queue-6.17/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
new file mode 100644
index 0000000000..dc6e817b9f
--- /dev/null
+++ b/queue-6.17/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
@@ -0,0 +1,45 @@
+From 76331cba25c7e8102f28a95c8041f82cd6438ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 7beedd730f940..9dd63cc384e6e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ 			pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ 			       "MIO60", "MIO61", "MIO62", "MIO63";
+ 			bias-disable;
+-			drive-strength = <4>;
+-			slew-rate = <SLEW_RATE_SLOW>;
++			drive-strength = <12>;
++			slew-rate = <SLEW_RATE_FAST>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch b/queue-6.17/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
new file mode 100644
index 0000000000..7e61f0cb19
--- /dev/null
+++ b/queue-6.17/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
@@ -0,0 +1,188 @@
+From eda856857ce6739e785156ae62ad6c005a28aa39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+       blk_queue_enter+0x40b/0x470
+       blkg_conf_prep+0x7b/0x3c0
+       tg_set_limit+0x10a/0x3e0
+       cgroup_file_write+0xc6/0x420
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       wbt_init+0x17e/0x280
+       wbt_enable_default+0xe9/0x140
+       blk_register_queue+0x1da/0x2e0
+       __add_disk+0x38c/0x5d0
+       add_disk_fwnode+0x89/0x250
+       device_add_disk+0x18/0x30
+       virtblk_probe+0x13a3/0x1800
+       virtio_dev_probe+0x389/0x610
+       really_probe+0x136/0x620
+       __driver_probe_device+0xb3/0x230
+       driver_probe_device+0x2f/0xe0
+       __driver_attach+0x158/0x250
+       bus_for_each_dev+0xa9/0x130
+       driver_attach+0x26/0x40
+       bus_add_driver+0x178/0x3d0
+       driver_register+0x7d/0x1c0
+       __register_virtio_driver+0x2c/0x60
+       virtio_blk_init+0x6f/0xe0
+       do_one_initcall+0x94/0x540
+       kernel_init_freeable+0x56a/0x7b0
+       kernel_init+0x2b/0x270
+       ret_from_fork+0x268/0x4c0
+       ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+       __lock_acquire+0x1835/0x2940
+       lock_acquire+0xf9/0x450
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       blk_unregister_queue+0x53/0x180
+       __del_gendisk+0x226/0x690
+       del_gendisk+0xba/0x110
+       sd_remove+0x49/0xb0 [sd_mod]
+       device_remove+0x87/0xb0
+       device_release_driver_internal+0x11e/0x230
+       device_release_driver+0x1a/0x30
+       bus_remove_device+0x14d/0x220
+       device_del+0x1e1/0x5a0
+       __scsi_remove_device+0x1ff/0x2f0
+       scsi_remove_device+0x37/0x60
+       sdev_store_delete+0x77/0x100
+       dev_attr_store+0x1f/0x40
+       sysfs_kf_write+0x65/0x90
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+  &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&q->q_usage_counter(queue)#3);
+                               lock(&q->rq_qos_mutex);
+                               lock(&q->q_usage_counter(queue)#3);
+  lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 091e9623bc294..3cffb68ba5d87 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -874,14 +874,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	disk = ctx->bdev->bd_disk;
+ 	q = disk->queue;
+ 
+-	/*
+-	 * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+-	 * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+-	 */
+-	ret = blk_queue_enter(q, 0);
+-	if (ret)
+-		goto fail;
+-
++	/* Prevent concurrent with blkcg_deactivate_policy() */
++	mutex_lock(&q->blkcg_mutex);
+ 	spin_lock_irq(&q->queue_lock);
+ 
+ 	if (!blkcg_policy_enabled(q, pol)) {
+@@ -911,16 +905,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		/* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ 		spin_unlock_irq(&q->queue_lock);
+ 
+-		new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++		new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ 		if (unlikely(!new_blkg)) {
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		if (radix_tree_preload(GFP_KERNEL)) {
+ 			blkg_free(new_blkg);
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		spin_lock_irq(&q->queue_lock);
+@@ -948,7 +942,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 			goto success;
+ 	}
+ success:
+-	blk_queue_exit(q);
++	mutex_unlock(&q->blkcg_mutex);
+ 	ctx->blkg = blkg;
+ 	return 0;
+ 
+@@ -956,9 +950,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	radix_tree_preload_end();
+ fail_unlock:
+ 	spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+-	blk_queue_exit(q);
+-fail:
++fail_exit:
++	mutex_unlock(&q->blkcg_mutex);
+ 	/*
+ 	 * If queue was bypassing, we should retry.  Do so after a
+ 	 * short msleep().  It isn't strictly necessary but queue
+-- 
+2.51.0
+
diff --git a/queue-6.17/block-check-for-valid-bio-while-splitting.patch b/queue-6.17/block-check-for-valid-bio-while-splitting.patch
new file mode 100644
index 0000000000..79a022c850
--- /dev/null
+++ b/queue-6.17/block-check-for-valid-bio-while-splitting.patch
@@ -0,0 +1,139 @@
+From ad0aa980eebb74baa1151a8f5fd3de58338dda0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 07:12:51 -0700
+Subject: block: check for valid bio while splitting
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit fec2e705729dc93de5399d8b139e4746805c3d81 ]
+
+We're already iterating every segment, so check these for a valid IO
+lengths at the same time. Individual segment lengths will not be checked
+on passthrough commands. The read/write command segments must be sized
+to the dma alignment.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-map.c        |  2 +-
+ block/blk-merge.c      | 21 +++++++++++++++++----
+ include/linux/bio.h    |  4 ++--
+ include/linux/blkdev.h |  7 +++++++
+ 4 files changed, 27 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-map.c b/block/blk-map.c
+index 23e5d5ebe59ec..6d1268aa82715 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -443,7 +443,7 @@ int blk_rq_append_bio(struct request *rq, struct bio *bio)
+ 	int ret;
+ 
+ 	/* check that the data layout matches the hardware restrictions */
+-	ret = bio_split_rw_at(bio, lim, &nr_segs, max_bytes);
++	ret = bio_split_io_at(bio, lim, &nr_segs, max_bytes, 0);
+ 	if (ret) {
+ 		/* if we would have to split the bio, copy instead */
+ 		if (ret > 0)
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 77488f11a9441..37864c5d287ef 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -303,25 +303,30 @@ static unsigned int bio_split_alignment(struct bio *bio,
+ }
+ 
+ /**
+- * bio_split_rw_at - check if and where to split a read/write bio
++ * bio_split_io_at - check if and where to split a bio
+  * @bio:  [in] bio to be split
+  * @lim:  [in] queue limits to split based on
+  * @segs: [out] number of segments in the bio with the first half of the sectors
+  * @max_bytes: [in] maximum number of bytes per bio
++ * @len_align_mask: [in] length alignment mask for each vector
+  *
+  * Find out if @bio needs to be split to fit the queue limits in @lim and a
+  * maximum size of @max_bytes.  Returns a negative error number if @bio can't be
+  * split, 0 if the bio doesn't have to be split, or a positive sector offset if
+  * @bio needs to be split.
+  */
+-int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+-		unsigned *segs, unsigned max_bytes)
++int bio_split_io_at(struct bio *bio, const struct queue_limits *lim,
++		unsigned *segs, unsigned max_bytes, unsigned len_align_mask)
+ {
+ 	struct bio_vec bv, bvprv, *bvprvp = NULL;
+ 	struct bvec_iter iter;
+ 	unsigned nsegs = 0, bytes = 0;
+ 
+ 	bio_for_each_bvec(bv, bio, iter) {
++		if (bv.bv_offset & lim->dma_alignment ||
++		    bv.bv_len & len_align_mask)
++			return -EINVAL;
++
+ 		/*
+ 		 * If the queue doesn't support SG gaps and adding this
+ 		 * offset would create a gap, disallow it.
+@@ -363,8 +368,16 @@ int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+ 	 * Individual bvecs might not be logical block aligned. Round down the
+ 	 * split size so that each bio is properly block size aligned, even if
+ 	 * we do not use the full hardware limits.
++	 *
++	 * It is possible to submit a bio that can't be split into a valid io:
++	 * there may either be too many discontiguous vectors for the max
++	 * segments limit, or contain virtual boundary gaps without having a
++	 * valid block sized split. A zero byte result means one of those
++	 * conditions occured.
+ 	 */
+ 	bytes = ALIGN_DOWN(bytes, bio_split_alignment(bio, lim));
++	if (!bytes)
++		return -EINVAL;
+ 
+ 	/*
+ 	 * Bio splitting may cause subtle trouble such as hang when doing sync
+@@ -374,7 +387,7 @@ int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+ 	bio_clear_polled(bio);
+ 	return bytes >> SECTOR_SHIFT;
+ }
+-EXPORT_SYMBOL_GPL(bio_split_rw_at);
++EXPORT_SYMBOL_GPL(bio_split_io_at);
+ 
+ struct bio *bio_split_rw(struct bio *bio, const struct queue_limits *lim,
+ 		unsigned *nr_segs)
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 46ffac5caab78..519a1d59805f8 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -322,8 +322,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio)
+ void bio_trim(struct bio *bio, sector_t offset, sector_t size);
+ extern struct bio *bio_split(struct bio *bio, int sectors,
+ 			     gfp_t gfp, struct bio_set *bs);
+-int bio_split_rw_at(struct bio *bio, const struct queue_limits *lim,
+-		unsigned *segs, unsigned max_bytes);
++int bio_split_io_at(struct bio *bio, const struct queue_limits *lim,
++		unsigned *segs, unsigned max_bytes, unsigned len_align);
+ 
+ /**
+  * bio_next_split - get next @sectors from a bio, splitting if necessary
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index cc221318712e7..37fa7169fa9f4 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1872,6 +1872,13 @@ bdev_atomic_write_unit_max_bytes(struct block_device *bdev)
+ 	return queue_atomic_write_unit_max_bytes(bdev_get_queue(bdev));
+ }
+ 
++static inline int bio_split_rw_at(struct bio *bio,
++		const struct queue_limits *lim,
++		unsigned *segs, unsigned max_bytes)
++{
++	return bio_split_io_at(bio, lim, segs, max_bytes, lim->dma_alignment);
++}
++
+ #define DEFINE_IO_COMP_BATCH(name)	struct io_comp_batch name = { }
+ 
+ #endif /* _LINUX_BLKDEV_H */
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch b/queue-6.17/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
new file mode 100644
index 0000000000..f61bbc725b
--- /dev/null
+++ b/queue-6.17/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
@@ -0,0 +1,57 @@
+From d001adad8234acbd11c3ab94ad6e023d6549993b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index b40f1f96cb117..f288c348a6c13 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -115,6 +115,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ 	xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+ 
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++	xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c5cdf3b08341a..b20d5fecdbc95 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4212,6 +4212,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+ 
+ 	if (unlikely(!sinfo->nr_frags)) {
+ 		xdp_buff_clear_frags_flag(xdp);
++		xdp_buff_clear_frag_pfmemalloc(xdp);
+ 		xdp->data_end -= offset;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch b/queue-6.17/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
new file mode 100644
index 0000000000..2df45b3c28
--- /dev/null
+++ b/queue-6.17/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
@@ -0,0 +1,112 @@
+From 99137a4292c54b7a26af5d28268787a683df2c47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h |  1 +
+ kernel/bpf/helpers.c   |  2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index b18fb5fcb38e2..b08c8e62881cd 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -650,6 +650,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+ 
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+ 
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index a12f4fa444086..3eb02ce0dba3b 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2537,7 +2537,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ 	struct cgroup *cgrp;
+ 
+-	cgrp = cgroup_get_from_id(cgid);
++	cgrp = __cgroup_get_from_id(cgid);
+ 	if (IS_ERR(cgrp))
+ 		return NULL;
+ 	return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 77d02f87f3f12..c62b98f027f99 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6373,15 +6373,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+ 
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+  * @id: cgroup id
+  * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+  */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ 	struct kernfs_node *kn;
+-	struct cgroup *cgrp, *root_cgrp;
++	struct cgroup *cgrp;
+ 
+ 	kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ 	if (!kn)
+@@ -6403,6 +6403,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+ 
+ 	if (!cgrp)
+ 		return ERR_PTR(-ENOENT);
++	return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++	struct cgroup *cgrp, *root_cgrp;
++
++	cgrp = __cgroup_get_from_id(id);
++	if (IS_ERR(cgrp))
++		return cgrp;
+ 
+ 	root_cgrp = current_cgns_cgroup_dfl();
+ 	if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpf-don-t-use-pk-through-printk.patch b/queue-6.17/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..975bc95563
--- /dev/null
+++ b/queue-6.17/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 176e48fb708bea8501e8e44088bb6dfa529b3c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 1e7fd3ee759e0..52fecb7a1fe36 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1296,7 +1296,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch b/queue-6.17/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
new file mode 100644
index 0000000000..0711eb750a
--- /dev/null
+++ b/queue-6.17/bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
@@ -0,0 +1,106 @@
+From af3d9a670f2fb7149fe81657e52f3af5354ec09e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:18:06 +0200
+Subject: bpf: Use tnums for JEQ/JNE is_branch_taken logic
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit f41345f47fb267a9c95ca710c33448f8d0d81d83 ]
+
+In the following toy program (reg states minimized for readability), R0
+and R1 always have different values at instruction 6. This is obvious
+when reading the program but cannot be guessed from ranges alone as
+they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).
+
+  0: call bpf_get_prandom_u32#7  ; R0_w=scalar()
+  1: w0 = w0                     ; R0_w=scalar(var_off=(0x0; 0xffffffff))
+  2: r0 >>= 30                   ; R0_w=scalar(var_off=(0x0; 0x3))
+  3: r0 <<= 30                   ; R0_w=scalar(var_off=(0x0; 0xc0000000))
+  4: r1 = r0                     ; R1_w=scalar(var_off=(0x0; 0xc0000000))
+  5: r1 += 1024                  ; R1_w=scalar(var_off=(0x400; 0xc0000000))
+  6: if r1 != r0 goto pc+1
+
+Looking at tnums however, we can deduce that R1 is always different from
+R0 because their tnums don't agree on known bits. This patch uses this
+logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.
+
+This change has a tiny impact on complexity, which was measured with
+the Cilium complexity CI test. That test covers 72 programs with
+various build and load time configurations for a total of 970 test
+cases. For 80% of test cases, the patch has no impact. On the other
+test cases, the patch decreases complexity by only 0.08% on average. In
+the best case, the verifier needs to walk 3% less instructions and, in
+the worst case, 1.5% more. Overall, the patch has a small positive
+impact, especially for our largest programs.
+
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tnum.h  | 3 +++
+ kernel/bpf/tnum.c     | 8 ++++++++
+ kernel/bpf/verifier.c | 4 ++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/include/linux/tnum.h b/include/linux/tnum.h
+index 57ed3035cc309..0ffb77ffe0e87 100644
+--- a/include/linux/tnum.h
++++ b/include/linux/tnum.h
+@@ -51,6 +51,9 @@ struct tnum tnum_xor(struct tnum a, struct tnum b);
+ /* Multiply two tnums, return @a * @b */
+ struct tnum tnum_mul(struct tnum a, struct tnum b);
+ 
++/* Return true if the known bits of both tnums have the same value */
++bool tnum_overlap(struct tnum a, struct tnum b);
++
+ /* Return a tnum representing numbers satisfying both @a and @b */
+ struct tnum tnum_intersect(struct tnum a, struct tnum b);
+ 
+diff --git a/kernel/bpf/tnum.c b/kernel/bpf/tnum.c
+index fa353c5d550fc..d9328bbb3680b 100644
+--- a/kernel/bpf/tnum.c
++++ b/kernel/bpf/tnum.c
+@@ -143,6 +143,14 @@ struct tnum tnum_mul(struct tnum a, struct tnum b)
+ 	return tnum_add(TNUM(acc_v, 0), acc_m);
+ }
+ 
++bool tnum_overlap(struct tnum a, struct tnum b)
++{
++	u64 mu;
++
++	mu = ~a.mask & ~b.mask;
++	return (a.value & mu) == (b.value & mu);
++}
++
+ /* Note that if a and b disagree - i.e. one has a 'known 1' where the other has
+  * a 'known 0' - this will return a 'known 1' for that bit.
+  */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index ed1457c273409..2844adf4da61a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15906,6 +15906,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ 		 */
+ 		if (tnum_is_const(t1) && tnum_is_const(t2))
+ 			return t1.value == t2.value;
++		if (!tnum_overlap(t1, t2))
++			return 0;
+ 		/* non-overlapping ranges */
+ 		if (umin1 > umax2 || umax1 < umin2)
+ 			return 0;
+@@ -15930,6 +15932,8 @@ static int is_scalar_branch_taken(struct bpf_reg_state *reg1, struct bpf_reg_sta
+ 		 */
+ 		if (tnum_is_const(t1) && tnum_is_const(t2))
+ 			return t1.value != t2.value;
++		if (!tnum_overlap(t1, t2))
++			return 1;
+ 		/* non-overlapping ranges */
+ 		if (umin1 > umax2 || umax1 < umin2)
+ 			return 1;
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch b/queue-6.17/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
new file mode 100644
index 0000000000..dfe01eb2a7
--- /dev/null
+++ b/queue-6.17/bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
@@ -0,0 +1,126 @@
+From 38363fa867fbe7e039ca75eda7cc651bbcef15aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:11:07 +0100
+Subject: bpftool: Add CET-aware symbol matching for x86_64 architectures
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
+
+Adjust symbol matching logic to account for Control-flow Enforcement
+Technology (CET) on x86_64 systems. CET prefixes functions with
+a 4-byte 'endbr' instruction, shifting the actual hook entry point to
+symbol + 4.
+
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index a773e05d5ade4..bdcd717b0348f 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count)
+ 	return data;
+ }
+ 
++static bool is_x86_ibt_enabled(void)
++{
++#if defined(__x86_64__)
++	struct kernel_config_option options[] = {
++		{ "CONFIG_X86_KERNEL_IBT", },
++	};
++	char *values[ARRAY_SIZE(options)] = { };
++	bool ret;
++
++	if (read_kernel_config(options, ARRAY_SIZE(options), values, NULL))
++		return false;
++
++	ret = !!values[0];
++	free(values[0]);
++	return ret;
++#else
++	return false;
++#endif
++}
++
++static bool
++symbol_matches_target(__u64 sym_addr, __u64 target_addr, bool is_ibt_enabled)
++{
++	if (sym_addr == target_addr)
++		return true;
++
++	/*
++	 * On x86_64 architectures with CET (Control-flow Enforcement Technology),
++	 * function entry points have a 4-byte 'endbr' instruction prefix.
++	 * This causes kprobe hooks to target the address *after* 'endbr'
++	 * (symbol address + 4), preserving the CET instruction.
++	 * Here we check if the symbol address matches the hook target address
++	 * minus 4, indicating a CET-enabled function entry point.
++	 */
++	if (is_ibt_enabled && sym_addr == target_addr - 4)
++		return true;
++
++	return false;
++}
++
+ static void
+ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ {
+ 	struct addr_cookie *data;
+ 	__u32 i, j = 0;
++	bool is_ibt_enabled;
+ 
+ 	jsonw_bool_field(json_wtr, "retprobe",
+ 			 info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN);
+@@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
+ 	if (!dd.sym_count)
+ 		goto error;
+ 
++	is_ibt_enabled = is_x86_ibt_enabled();
+ 	for (i = 0; i < dd.sym_count; i++) {
+-		if (dd.sym_mapping[i].address != data[j].addr)
++		if (!symbol_matches_target(dd.sym_mapping[i].address,
++					   data[j].addr, is_ibt_enabled))
+ 			continue;
+ 		jsonw_start_object(json_wtr);
+-		jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
++		jsonw_uint_field(json_wtr, "addr", (unsigned long)data[j].addr);
+ 		jsonw_string_field(json_wtr, "func", dd.sym_mapping[i].name);
+ 		/* Print null if it is vmlinux */
+ 		if (dd.sym_mapping[i].module[0] == '\0') {
+@@ -719,6 +762,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ {
+ 	struct addr_cookie *data;
+ 	__u32 i, j = 0;
++	bool is_ibt_enabled;
+ 
+ 	if (!info->kprobe_multi.count)
+ 		return;
+@@ -742,12 +786,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info)
+ 	if (!dd.sym_count)
+ 		goto error;
+ 
++	is_ibt_enabled = is_x86_ibt_enabled();
+ 	printf("\n\t%-16s %-16s %s", "addr", "cookie", "func [module]");
+ 	for (i = 0; i < dd.sym_count; i++) {
+-		if (dd.sym_mapping[i].address != data[j].addr)
++		if (!symbol_matches_target(dd.sym_mapping[i].address,
++					   data[j].addr, is_ibt_enabled))
+ 			continue;
+ 		printf("\n\t%016lx %-16llx %s",
+-		       dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name);
++		       (unsigned long)data[j].addr, data[j].cookie, dd.sym_mapping[i].name);
+ 		if (dd.sym_mapping[i].module[0] != '\0')
+ 			printf(" [%s]  ", dd.sym_mapping[i].module);
+ 		else
+-- 
+2.51.0
+
diff --git a/queue-6.17/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch b/queue-6.17/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
new file mode 100644
index 0000000000..c0cba181c1
--- /dev/null
+++ b/queue-6.17/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
@@ -0,0 +1,61 @@
+From 87cb403b2fa7c787498fd0bd03071f94302b24a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+   71 |         info.func_info = ptr_to_u64(&finfo);
+      |                                      ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 |         info.func_info = ptr_to_u64(&func_info);
+      |
+
+v2:
+  - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c       | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 4e896d8a2416e..ff12628593aec 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ 	__u32 info_len = sizeof(info);
+ 	const char *prog_name = NULL;
+ 	struct btf *prog_btf = NULL;
+-	struct bpf_func_info finfo;
++	struct bpf_func_info finfo = {};
+ 	__u32 finfo_rec_size;
+ 	char prog_str[1024];
+ 	int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 9722d841abc05..a89629a9932b5 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2262,7 +2262,7 @@ static void profile_print_readings(void)
+ 
+ static char *profile_target_name(int tgt_fd)
+ {
+-	struct bpf_func_info func_info;
++	struct bpf_func_info func_info = {};
+ 	struct bpf_prog_info info = {};
+ 	__u32 info_len = sizeof(info);
+ 	const struct btf_type *t;
+-- 
+2.51.0
+
diff --git a/queue-6.17/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch b/queue-6.17/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
new file mode 100644
index 0000000000..7054fdc9c2
--- /dev/null
+++ b/queue-6.17/clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
@@ -0,0 +1,70 @@
+From dcb2dd50fa2e1e325560d91883295c6be6830254 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:27 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit c445bffbf28f721e05d0ce06895045fc62aaff7c ]
+
+During normal operation the timers are reprogrammed including an
+interrupt acknowledgement. This has no effect as the whole timer
+is setup from scratch afterwards. Especially in an interrupt this
+has already been done by rttm_timer_interrupt().
+
+Change the behaviour as follows:
+
+- Use rttm_disable_timer() during reprogramming
+- Keep rttm_stop_timer() for all other use cases.
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8be45a11fb8b6..24c4aa6a30131 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -147,7 +147,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, delta);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -160,7 +160,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -173,7 +173,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+ 	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_TIMER);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/clocksource-drivers-timer-rtl-otto-work-around-dying.patch b/queue-6.17/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
new file mode 100644
index 0000000000..b8919303ef
--- /dev/null
+++ b/queue-6.17/clocksource-drivers-timer-rtl-otto-work-around-dying.patch
@@ -0,0 +1,113 @@
+From fbc0494f847969d81c1f087117dca462c816bedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 04:03:25 -0400
+Subject: clocksource/drivers/timer-rtl-otto: Work around dying timers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit e7a25106335041aeca4fdf50a84804c90142c886 ]
+
+The OpenWrt distribution has switched from kernel longterm 6.6 to
+6.12. Reports show that devices with the Realtek Otto switch platform
+die during operation and are rebooted by the watchdog. Sorting out
+other possible reasons the Otto timer is to blame. The platform
+currently consists of 4 targets with different hardware revisions.
+It is not 100% clear which devices and revisions are affected.
+
+Analysis shows:
+
+A more aggressive sched/deadline handling leads to more timer starts
+with small intervals. This increases the bug chances. See
+https://marc.info/?l=linux-kernel&m=175276556023276&w=2
+
+Focusing on the real issue a hardware limitation on some devices was
+found. There is a minimal chance that a timer ends without firing an
+interrupt if it is reprogrammed within the 5us before its expiration
+time. Work around this issue by introducing a bounce() function. It
+restarts the timer directly before the normal restart functions as
+follows:
+
+- Stop timer
+- Restart timer with a slow frequency.
+- Target time will be >5us
+- The subsequent normal restart is outside the critical window
+
+Downstream has already tested and confirmed a patch. See
+https://github.com/openwrt/openwrt/pull/19468
+https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Tested-by: Stephen Howell <howels@allthatwemight.be>
+Tested-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-rtl-otto.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clocksource/timer-rtl-otto.c b/drivers/clocksource/timer-rtl-otto.c
+index 8a3068b36e752..8be45a11fb8b6 100644
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -38,6 +38,7 @@
+ #define RTTM_BIT_COUNT		28
+ #define RTTM_MIN_DELTA		8
+ #define RTTM_MAX_DELTA		CLOCKSOURCE_MASK(28)
++#define RTTM_MAX_DIVISOR	GENMASK(15, 0)
+ 
+ /*
+  * Timers are derived from the LXB clock frequency. Usually this is a fixed
+@@ -112,6 +113,22 @@ static irqreturn_t rttm_timer_interrupt(int irq, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
++static void rttm_bounce_timer(void __iomem *base, u32 mode)
++{
++	/*
++	 * When a running timer has less than ~5us left, a stop/start sequence
++	 * might fail. While the details are unknown the most evident effect is
++	 * that the subsequent interrupt will not be fired.
++	 *
++	 * As a workaround issue an intermediate restart with a very slow
++	 * frequency of ~3kHz keeping the target counter (>=8). So the follow
++	 * up restart will always be issued outside the critical window.
++	 */
++
++	rttm_disable_timer(base);
++	rttm_enable_timer(base, mode, RTTM_MAX_DIVISOR);
++}
++
+ static void rttm_stop_timer(void __iomem *base)
+ {
+ 	rttm_disable_timer(base);
+@@ -129,6 +146,7 @@ static int rttm_next_event(unsigned long delta, struct clock_event_device *clkev
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, delta);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -141,6 +159,7 @@ static int rttm_state_oneshot(struct clock_event_device *clkevt)
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+@@ -153,6 +172,7 @@ static int rttm_state_periodic(struct clock_event_device *clkevt)
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
+ 	rttm_stop_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_TIMER);
+-- 
+2.51.0
+
diff --git a/queue-6.17/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-6.17/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..d5372b317c
--- /dev/null
+++ b/queue-6.17/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From 6479869240018176a7de2885fb04842036e41d49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.17/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-6.17/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..721d1c3cd2
--- /dev/null
+++ b/queue-6.17/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From 5ecbee1470fd109e85897c6320f31c10aa2d6128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index ba0e08c8486a6..49e76b44468aa 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-6.17/cpufreq-ondemand-update-the-efficient-idle-check-for.patch b/queue-6.17/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
new file mode 100644
index 0000000000..b7eac22a2c
--- /dev/null
+++ b/queue-6.17/cpufreq-ondemand-update-the-efficient-idle-check-for.patch
@@ -0,0 +1,111 @@
+From 026977edc683a41e1586e298fadd49ec9f7f24ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:06:55 -0700
+Subject: cpufreq: ondemand: Update the efficient idle check for Intel extended
+ Families
+
+From: Sohil Mehta <sohil.mehta@intel.com>
+
+[ Upstream commit 7f3cfb7943d27a7b61bdac8db739cf0bdc28e87d ]
+
+IO time is considered busy by default for modern Intel processors. The
+current check covers recent Family 6 models but excludes the brand new
+Families 18 and 19.
+
+According to Arjan van de Ven, the model check was mainly due to a lack
+of testing on systems before INTEL_CORE2_MEROM. He suggests considering
+all Intel processors as having an efficient idle.
+
+Extend the IO busy classification to all Intel processors starting with
+Family 6, including Family 15 (Pentium 4s) and upcoming Families 18/19.
+
+Use an x86 VFM check and move the function to the header file to avoid
+using arch-specific #ifdefs in the C file.
+
+Signed-off-by: Sohil Mehta <sohil.mehta@intel.com>
+Link: https://patch.msgid.link/20250908230655.2562440-1-sohil.mehta@intel.com
+[ rjw: Added empty line after #include ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_ondemand.c | 25 +------------------------
+ drivers/cpufreq/cpufreq_ondemand.h | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
+index 0e65d37c92311..a6ecc203f7b7f 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.c
++++ b/drivers/cpufreq/cpufreq_ondemand.c
+@@ -29,29 +29,6 @@ static struct od_ops od_ops;
+ 
+ static unsigned int default_powersave_bias;
+ 
+-/*
+- * Not all CPUs want IO time to be accounted as busy; this depends on how
+- * efficient idling at a higher frequency/voltage is.
+- * Pavel Machek says this is not so for various generations of AMD and old
+- * Intel systems.
+- * Mike Chan (android.com) claims this is also not true for ARM.
+- * Because of this, whitelist specific known (series) of CPUs by default, and
+- * leave all others up to the user.
+- */
+-static int should_io_be_busy(void)
+-{
+-#if defined(CONFIG_X86)
+-	/*
+-	 * For Intel, Core 2 (model 15) and later have an efficient idle.
+-	 */
+-	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+-			boot_cpu_data.x86 == 6 &&
+-			boot_cpu_data.x86_model >= 15)
+-		return 1;
+-#endif
+-	return 0;
+-}
+-
+ /*
+  * Find right freq to be set now with powersave_bias on.
+  * Returns the freq_hi to be used right now and will set freq_hi_delay_us,
+@@ -377,7 +354,7 @@ static int od_init(struct dbs_data *dbs_data)
+ 	dbs_data->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
+ 	dbs_data->ignore_nice_load = 0;
+ 	tuners->powersave_bias = default_powersave_bias;
+-	dbs_data->io_is_busy = should_io_be_busy();
++	dbs_data->io_is_busy = od_should_io_be_busy();
+ 
+ 	dbs_data->tuners = tuners;
+ 	return 0;
+diff --git a/drivers/cpufreq/cpufreq_ondemand.h b/drivers/cpufreq/cpufreq_ondemand.h
+index 1af8e5c4b86fd..2ca8f1aaf2e34 100644
+--- a/drivers/cpufreq/cpufreq_ondemand.h
++++ b/drivers/cpufreq/cpufreq_ondemand.h
+@@ -24,3 +24,26 @@ static inline struct od_policy_dbs_info *to_dbs_info(struct policy_dbs_info *pol
+ struct od_dbs_tuners {
+ 	unsigned int powersave_bias;
+ };
++
++#ifdef CONFIG_X86
++#include <asm/cpu_device_id.h>
++
++/*
++ * Not all CPUs want IO time to be accounted as busy; this depends on
++ * how efficient idling at a higher frequency/voltage is.
++ *
++ * Pavel Machek says this is not so for various generations of AMD and
++ * old Intel systems. Mike Chan (android.com) claims this is also not
++ * true for ARM.
++ *
++ * Because of this, select a known series of Intel CPUs (Family 6 and
++ * later) by default, and leave all others up to the user.
++ */
++static inline bool od_should_io_be_busy(void)
++{
++	return (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
++		boot_cpu_data.x86_vfm >= INTEL_PENTIUM_PRO);
++}
++#else
++static inline bool od_should_io_be_busy(void) { return false; }
++#endif
+-- 
+2.51.0
+
diff --git a/queue-6.17/cpufreq-ti-add-support-for-am62d2.patch b/queue-6.17/cpufreq-ti-add-support-for-am62d2.patch
new file mode 100644
index 0000000000..b66eb325ad
--- /dev/null
+++ b/queue-6.17/cpufreq-ti-add-support-for-am62d2.patch
@@ -0,0 +1,43 @@
+From b0d8baf6abe1e27be28f62c1c4cde322edf69767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:03:31 +0530
+Subject: cpufreq: ti: Add support for AM62D2
+
+From: Paresh Bhagat <p-bhagat@ti.com>
+
+[ Upstream commit b5af45302ebc141662b2b60c713c9202e88c943c ]
+
+Add support for TI K3 AM62D2 SoC to read speed and revision values
+from hardware and pass to OPP layer. AM62D shares the same configuations
+as AM62A so use existing am62a7_soc_data.
+
+Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/ti-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index 5a5147277cd0a..9a912d3093153 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -310,6 +310,7 @@ static const struct soc_device_attribute k3_cpufreq_soc[] = {
+ 	{ .family = "AM62X", .revision = "SR1.0" },
+ 	{ .family = "AM62AX", .revision = "SR1.0" },
+ 	{ .family = "AM62PX", .revision = "SR1.0" },
++	{ .family = "AM62DX", .revision = "SR1.0" },
+ 	{ /* sentinel */ }
+ };
+ 
+@@ -457,6 +458,7 @@ static const struct of_device_id ti_cpufreq_of_match[]  __maybe_unused = {
+ 	{ .compatible = "ti,omap36xx", .data = &omap36xx_soc_data, },
+ 	{ .compatible = "ti,am625", .data = &am625_soc_data, },
+ 	{ .compatible = "ti,am62a7", .data = &am62a7_soc_data, },
++	{ .compatible = "ti,am62d2", .data = &am62a7_soc_data, },
+ 	{ .compatible = "ti,am62p5", .data = &am62p5_soc_data, },
+ 	/* legacy */
+ 	{ .compatible = "ti,omap3430", .data = &omap34xx_soc_data, },
+-- 
+2.51.0
+
diff --git a/queue-6.17/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-6.17/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..3021cfaed1
--- /dev/null
+++ b/queue-6.17/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From 9c97958068473df33005d24f1f23268061eca0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 0835da449db8b..56132e843c991 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -635,8 +635,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -648,7 +654,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-6.17/firewire-ohci-move-self_id_complete-tracepoint-after.patch b/queue-6.17/firewire-ohci-move-self_id_complete-tracepoint-after.patch
new file mode 100644
index 0000000000..d0728afe2f
--- /dev/null
+++ b/queue-6.17/firewire-ohci-move-self_id_complete-tracepoint-after.patch
@@ -0,0 +1,55 @@
+From 4ad1c602e5d35b22f31fd96f3fb4fecc74106da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 12:09:52 +0900
+Subject: firewire: ohci: move self_id_complete tracepoint after validating
+ register
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 696968262aeee51e1c0529c3c060ddd180702e02 ]
+
+The value of OHCI1394_SelfIDCount register includes an error-indicating
+bit. It is safer to place the tracepoint probe after validating the
+register value.
+
+Link: https://lore.kernel.org/r/20250823030954.268412-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/ohci.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 5d8301b0f3aa8..421cf87e93c1f 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2063,6 +2063,9 @@ static void bus_reset_work(struct work_struct *work)
+ 		ohci_notice(ohci, "self ID receive error\n");
+ 		return;
+ 	}
++
++	trace_self_id_complete(ohci->card.index, reg, ohci->self_id, has_be_header_quirk(ohci));
++
+ 	/*
+ 	 * The count in the SelfIDCount register is the number of
+ 	 * bytes in the self ID receive buffer.  Since we also receive
+@@ -2231,15 +2234,8 @@ static irqreturn_t irq_handler(int irq, void *data)
+ 	if (event & OHCI1394_busReset)
+ 		reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
+ 
+-	if (event & OHCI1394_selfIDComplete) {
+-		if (trace_self_id_complete_enabled()) {
+-			u32 reg = reg_read(ohci, OHCI1394_SelfIDCount);
+-
+-			trace_self_id_complete(ohci->card.index, reg, ohci->self_id,
+-					       has_be_header_quirk(ohci));
+-		}
++	if (event & OHCI1394_selfIDComplete)
+ 		queue_work(selfid_workqueue, &ohci->bus_reset_work);
+-	}
+ 
+ 	if (event & OHCI1394_RQPkt)
+ 		queue_work(ohci->card.async_wq, &ohci->ar_request_ctx.work);
+-- 
+2.51.0
+
diff --git a/queue-6.17/firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch b/queue-6.17/firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch
new file mode 100644
index 0000000000..3ff456ee3f
--- /dev/null
+++ b/queue-6.17/firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch
@@ -0,0 +1,38 @@
+From 3b6888c9c6e588cc3be83eb8c9bfb364d156b8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 21:27:00 -0300
+Subject: firmware: qcom: scm: Allow QSEECOM on Dell Inspiron 7441 / Latitude
+ 7455
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit 30ee285f1e3cdc88ec7010abeaba0cbed800bdcd ]
+
+Allow these machines to access efivars through qseecom/uefisecapp.
+
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: Laurentiu Tudor <laurentiu.tudor1@dell.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20250716003139.18543-5-val@packett.cool
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 5243d5abbbe99..7f43f12e4e1b2 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1994,6 +1994,8 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
+ 	{ .compatible = "asus,vivobook-s15" },
+ 	{ .compatible = "asus,zenbook-a14-ux3407qa" },
+ 	{ .compatible = "asus,zenbook-a14-ux3407ra" },
++	{ .compatible = "dell,inspiron-14-plus-7441" },
++	{ .compatible = "dell,latitude-7455" },
+ 	{ .compatible = "dell,xps13-9345" },
+ 	{ .compatible = "hp,elitebook-ultra-g1q" },
+ 	{ .compatible = "hp,omnibook-x14" },
+-- 
+2.51.0
+
diff --git a/queue-6.17/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch b/queue-6.17/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
new file mode 100644
index 0000000000..f4cc230cdb
--- /dev/null
+++ b/queue-6.17/firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
@@ -0,0 +1,39 @@
+From d2d5f07f712c44212ab60bc501b3df200f03273b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:14:51 +0530
+Subject: firmware: qcom: scm: preserve assign_mem() error return value
+
+From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+
+[ Upstream commit 121fcf3c871181edce0708a49d2397cedd6ad21f ]
+
+When qcom_scm_assign_mem() fails, the error value is currently being
+overwritten after it is logged, resulting in the loss of the original
+error code. Fix this by retaining and returning the original error value
+as intended.
+
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250807124451.2623019-1-mukesh.ojha@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 26cd0458aacd6..5243d5abbbe99 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1119,7 +1119,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ 	if (ret) {
+ 		dev_err(__scm->dev,
+ 			"Assign memory protection call failed %d\n", ret);
+-		return -EINVAL;
++		return ret;
+ 	}
+ 
+ 	*srcvm = next_vm;
+-- 
+2.51.0
+
diff --git a/queue-6.17/firmware-qcom-tzmem-disable-sc7180-platform.patch b/queue-6.17/firmware-qcom-tzmem-disable-sc7180-platform.patch
new file mode 100644
index 0000000000..0c5407cee9
--- /dev/null
+++ b/queue-6.17/firmware-qcom-tzmem-disable-sc7180-platform.patch
@@ -0,0 +1,38 @@
+From b0c6a1228a8d08720c619517fe5966878b75716f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 18:28:03 +0500
+Subject: firmware: qcom: tzmem: disable sc7180 platform
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 3cc9a8cadaf66e1a53e5fee48f8bcdb0a3fd5075 ]
+
+When SHM bridge is enabled, assigning RMTFS memory causes the calling
+core to hang if the system is running in EL1.
+
+Disable SHM bridge on sc7180 devices to avoid that hang.
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250721-sc7180-shm-hang-v1-1-99ad9ffeb5b4@trvn.ru
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_tzmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
+index ea0a353556570..12e448669b8bd 100644
+--- a/drivers/firmware/qcom/qcom_tzmem.c
++++ b/drivers/firmware/qcom/qcom_tzmem.c
+@@ -77,6 +77,7 @@ static bool qcom_tzmem_using_shm_bridge;
+ 
+ /* List of machines that are known to not support SHM bridge correctly. */
+ static const char *const qcom_tzmem_blacklist[] = {
++	"qcom,sc7180", /* hang in rmtfs memory assignment */
+ 	"qcom,sc8180x",
+ 	"qcom,sdm670", /* failure in GPU firmware loading */
+ 	"qcom,sdm845", /* reset in rmtfs memory assignment */
+-- 
+2.51.0
+
diff --git a/queue-6.17/firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch b/queue-6.17/firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch
new file mode 100644
index 0000000000..f954fa78bc
--- /dev/null
+++ b/queue-6.17/firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch
@@ -0,0 +1,155 @@
+From ed0a2e2a6197e844ebef295a5f14b79fe39d6f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 14:54:53 -0500
+Subject: firmware: ti_sci: Enable abort handling of entry to LPM
+
+From: Kendall Willis <k-willis@ti.com>
+
+[ Upstream commit 0fdd3240fe5a9bf4785e40506bf86b7e16546b83 ]
+
+The PM co-processor (device manager or DM) adds the ability to abort
+entry to a low power mode by clearing the mode selection in the
+latest version of its firmware (11.01.09) [1].
+
+Enable the ti_sci driver to support the LPM abort call which clears the
+low power mode selection of the DM. This fixes an issue where failed
+system suspend attempts would cause subsequent suspends to fail.
+
+After system suspend completes, regardless of if system suspend succeeds
+or fails, the ->complete() hook in TI SCI will be called. In the
+->complete() hook, a message will be sent to the DM to clear the current
+low power mode selection. Clearing the low power mode selection
+unconditionally will not cause any error in the DM.
+
+[1] https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html
+
+Signed-off-by: Kendall Willis <k-willis@ti.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/20250819195453.1094520-1-k-willis@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/ti_sci.c | 57 +++++++++++++++++++++++++++++++++++++--
+ drivers/firmware/ti_sci.h |  3 +++
+ 2 files changed, 58 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index ae5fd1936ad32..49fd2ae01055d 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -2015,6 +2015,47 @@ static int ti_sci_cmd_set_latency_constraint(const struct ti_sci_handle *handle,
+ 	return ret;
+ }
+ 
++/**
++ * ti_sci_cmd_lpm_abort() - Abort entry to LPM by clearing selection of LPM to enter
++ * @dev:	Device pointer corresponding to the SCI entity
++ *
++ * Return: 0 if all went well, else returns appropriate error value.
++ */
++static int ti_sci_cmd_lpm_abort(struct device *dev)
++{
++	struct ti_sci_info *info = dev_get_drvdata(dev);
++	struct ti_sci_msg_hdr *req;
++	struct ti_sci_msg_hdr *resp;
++	struct ti_sci_xfer *xfer;
++	int ret = 0;
++
++	xfer = ti_sci_get_one_xfer(info, TI_SCI_MSG_LPM_ABORT,
++				   TI_SCI_FLAG_REQ_ACK_ON_PROCESSED,
++				   sizeof(*req), sizeof(*resp));
++	if (IS_ERR(xfer)) {
++		ret = PTR_ERR(xfer);
++		dev_err(dev, "Message alloc failed(%d)\n", ret);
++		return ret;
++	}
++	req = (struct ti_sci_msg_hdr *)xfer->xfer_buf;
++
++	ret = ti_sci_do_xfer(info, xfer);
++	if (ret) {
++		dev_err(dev, "Mbox send fail %d\n", ret);
++		goto fail;
++	}
++
++	resp = (struct ti_sci_msg_hdr *)xfer->xfer_buf;
++
++	if (!ti_sci_is_response_ack(resp))
++		ret = -ENODEV;
++
++fail:
++	ti_sci_put_one_xfer(&info->minfo, xfer);
++
++	return ret;
++}
++
+ static int ti_sci_cmd_core_reboot(const struct ti_sci_handle *handle)
+ {
+ 	struct ti_sci_info *info;
+@@ -3739,11 +3780,22 @@ static int __maybe_unused ti_sci_resume_noirq(struct device *dev)
+ 	return 0;
+ }
+ 
++static void __maybe_unused ti_sci_pm_complete(struct device *dev)
++{
++	struct ti_sci_info *info = dev_get_drvdata(dev);
++
++	if (info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT) {
++		if (ti_sci_cmd_lpm_abort(dev))
++			dev_err(dev, "LPM clear selection failed.\n");
++	}
++}
++
+ static const struct dev_pm_ops ti_sci_pm_ops = {
+ #ifdef CONFIG_PM_SLEEP
+ 	.suspend = ti_sci_suspend,
+ 	.suspend_noirq = ti_sci_suspend_noirq,
+ 	.resume_noirq = ti_sci_resume_noirq,
++	.complete = ti_sci_pm_complete,
+ #endif
+ };
+ 
+@@ -3876,10 +3928,11 @@ static int ti_sci_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	ti_sci_msg_cmd_query_fw_caps(&info->handle, &info->fw_caps);
+-	dev_dbg(dev, "Detected firmware capabilities: %s%s%s\n",
++	dev_dbg(dev, "Detected firmware capabilities: %s%s%s%s\n",
+ 		info->fw_caps & MSG_FLAG_CAPS_GENERIC ? "Generic" : "",
+ 		info->fw_caps & MSG_FLAG_CAPS_LPM_PARTIAL_IO ? " Partial-IO" : "",
+-		info->fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED ? " DM-Managed" : ""
++		info->fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED ? " DM-Managed" : "",
++		info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT ? " LPM-Abort" : ""
+ 	);
+ 
+ 	ti_sci_setup_ops(info);
+diff --git a/drivers/firmware/ti_sci.h b/drivers/firmware/ti_sci.h
+index 053387d7baa06..701c416b2e78f 100644
+--- a/drivers/firmware/ti_sci.h
++++ b/drivers/firmware/ti_sci.h
+@@ -42,6 +42,7 @@
+ #define TI_SCI_MSG_SET_IO_ISOLATION	0x0307
+ #define TI_SCI_MSG_LPM_SET_DEVICE_CONSTRAINT	0x0309
+ #define TI_SCI_MSG_LPM_SET_LATENCY_CONSTRAINT	0x030A
++#define TI_SCI_MSG_LPM_ABORT	0x0311
+ 
+ /* Resource Management Requests */
+ #define TI_SCI_MSG_GET_RESOURCE_RANGE	0x1500
+@@ -147,6 +148,7 @@ struct ti_sci_msg_req_reboot {
+  *		MSG_FLAG_CAPS_GENERIC: Generic capability (LPM not supported)
+  *		MSG_FLAG_CAPS_LPM_PARTIAL_IO: Partial IO in LPM
+  *		MSG_FLAG_CAPS_LPM_DM_MANAGED: LPM can be managed by DM
++ *		MSG_FLAG_CAPS_LPM_ABORT: Abort entry to LPM
+  *
+  * Response to a generic message with message type TI_SCI_MSG_QUERY_FW_CAPS
+  * providing currently available SOC/firmware capabilities. SoC that don't
+@@ -157,6 +159,7 @@ struct ti_sci_msg_resp_query_fw_caps {
+ #define MSG_FLAG_CAPS_GENERIC		TI_SCI_MSG_FLAG(0)
+ #define MSG_FLAG_CAPS_LPM_PARTIAL_IO	TI_SCI_MSG_FLAG(4)
+ #define MSG_FLAG_CAPS_LPM_DM_MANAGED	TI_SCI_MSG_FLAG(5)
++#define MSG_FLAG_CAPS_LPM_ABORT		TI_SCI_MSG_FLAG(9)
+ #define MSG_MASK_CAPS_LPM		GENMASK_ULL(4, 1)
+ 	u64 fw_caps;
+ } __packed;
+-- 
+2.51.0
+
diff --git a/queue-6.17/futex-don-t-leak-robust_list-pointer-on-exec-race.patch b/queue-6.17/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
new file mode 100644
index 0000000000..b4057db046
--- /dev/null
+++ b/queue-6.17/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
@@ -0,0 +1,199 @@
+From a88ce395258540ac2e24d87ec275c341578bcacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index 4b6da9116aa6c..880c9bf2f3150 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -39,6 +39,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ 	return 0;
+ }
+ 
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++	if (compat)
++		return p->compat_robust_list;
++#endif
++	return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++	struct task_struct *p = current;
++	void __user *head;
++	int ret;
++
++	scoped_guard(rcu) {
++		if (pid) {
++			p = find_task_by_vpid(pid);
++			if (!p)
++				return (void __user *)ERR_PTR(-ESRCH);
++		}
++		get_task_struct(p);
++	}
++
++	/*
++	 * Hold exec_update_lock to serialize with concurrent exec()
++	 * so ptrace_may_access() is checked against stable credentials
++	 */
++	ret = down_read_killable(&p->signal->exec_update_lock);
++	if (ret)
++		goto err_put;
++
++	ret = -EPERM;
++	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++		goto err_unlock;
++
++	head = futex_task_robust_list(p, compat);
++
++	up_read(&p->signal->exec_update_lock);
++	put_task_struct(p);
++
++	return head;
++
++err_unlock:
++	up_read(&p->signal->exec_update_lock);
++err_put:
++	put_task_struct(p);
++	return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+  * sys_get_robust_list() - Get the robust-futex list head of a task
+  * @pid:	pid of the process [zero for current task]
+@@ -49,36 +99,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 		struct robust_list_head __user * __user *, head_ptr,
+ 		size_t __user *, len_ptr)
+ {
+-	struct robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+ 
+-	head = p->robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(head, head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ 
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -455,36 +483,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 			compat_uptr_t __user *, head_ptr,
+ 			compat_size_t __user *, len_ptr)
+ {
+-	struct compat_robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+ 
+-	head = p->compat_robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch b/queue-6.17/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
new file mode 100644
index 0000000000..83b040f172
--- /dev/null
+++ b/queue-6.17/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
@@ -0,0 +1,38 @@
+From d264322d91952528a0aef4b2b8f0fb7e09c97628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index f43efb80aabf3..94eb02e6be326 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+  */
+ #define ASUS_EC_MAX_BANK	3
+ 
+-#define ACPI_LOCK_DELAY_MS	500
++#define ACPI_LOCK_DELAY_MS	800
+ 
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX	"\\AMW0.ASMX"
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-6.17/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..8bc3f483e3
--- /dev/null
+++ b/queue-6.17/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From 2b20146208caa068d3602ff6c0ddf7269bbb9c4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 3f61b2d7935e4..5801128e16c3c 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1280,6 +1280,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7050"),
+ 		},
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch b/queue-6.17/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
new file mode 100644
index 0000000000..a86a46d85a
--- /dev/null
+++ b/queue-6.17/hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
@@ -0,0 +1,68 @@
+From 60133cc6197861c2deb10b191657acd99e10e55f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:33 +0200
+Subject: hwmon: (dell-smm) Remove Dell Precision 490 custom config data
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf ]
+
+It turns out the second fan on the Dell Precision 490 does not
+really support I8K_FAN_TURBO. Setting the fan state to 3 enables
+automatic fan control, just like on the other two fans.
+The reason why this was misinterpreted as turbo mode was that
+the second fan normally spins faster in automatic mode than
+in the previous fan states. Yet when in state 3, the fan speed
+reacts to heat exposure, exposing the automatic mode setting.
+
+Link: https://github.com/lm-sensors/lm-sensors/pull/383
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 1e2c8e2840015..3f61b2d7935e4 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1331,7 +1331,6 @@ struct i8k_config_data {
+ 
+ enum i8k_configs {
+ 	DELL_LATITUDE_D520,
+-	DELL_PRECISION_490,
+ 	DELL_STUDIO,
+ 	DELL_XPS,
+ };
+@@ -1341,10 +1340,6 @@ static const struct i8k_config_data i8k_config_data[] __initconst = {
+ 		.fan_mult = 1,
+ 		.fan_max = I8K_FAN_TURBO,
+ 	},
+-	[DELL_PRECISION_490] = {
+-		.fan_mult = 1,
+-		.fan_max = I8K_FAN_TURBO,
+-	},
+ 	[DELL_STUDIO] = {
+ 		.fan_mult = 1,
+ 		.fan_max = I8K_FAN_HIGH,
+@@ -1364,15 +1359,6 @@ static const struct dmi_system_id i8k_config_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_LATITUDE_D520],
+ 	},
+-	{
+-		.ident = "Dell Precision 490",
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+-			DMI_MATCH(DMI_PRODUCT_NAME,
+-				  "Precision WorkStation 490"),
+-		},
+-		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+-	},
+ 	{
+ 		.ident = "Dell Studio",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-k10temp-add-device-id-for-strix-halo.patch b/queue-6.17/hwmon-k10temp-add-device-id-for-strix-halo.patch
new file mode 100644
index 0000000000..8a46f7af74
--- /dev/null
+++ b/queue-6.17/hwmon-k10temp-add-device-id-for-strix-halo.patch
@@ -0,0 +1,41 @@
+From e99f6970f43a335f5d32b2e61d9c3a39dd71a2f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 2f90a2e9ad496..b98d5ec72c4ff 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -565,6 +565,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch b/queue-6.17/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
new file mode 100644
index 0000000000..32fb58f095
--- /dev/null
+++ b/queue-6.17/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
@@ -0,0 +1,50 @@
+From 3239f2917bb12850de8a955f9fde35bf36dffeb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index babf2413d666f..2f90a2e9ad496 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+  */
+ #define AMD_I3255_STR				"3255"
+ 
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3	0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3	0x127b
++
+ struct k10temp_data {
+ 	struct pci_dev *pdev;
+ 	void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -556,7 +563,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-lenovo-ec-sensors-update-p8-supprt.patch b/queue-6.17/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
new file mode 100644
index 0000000000..8ef8af3459
--- /dev/null
+++ b/queue-6.17/hwmon-lenovo-ec-sensors-update-p8-supprt.patch
@@ -0,0 +1,123 @@
+From 220e5c9597189e71d814e829c759364c10ae511d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 06:32:28 -0400
+Subject: hwmon: (lenovo-ec-sensors) Update P8 supprt
+
+From: David Ober <dober6023@gmail.com>
+
+[ Upstream commit 43c056ac85b60232861005765153707f1b0354b6 ]
+
+This fixes differences for the P8 system that was initially set to
+the same thermal values as the P7, also adds in the PSU sensor for
+all of the supported systems
+
+Signed-off-by: David Ober <dober@lenovo.com>
+Signed-off-by: David Ober <dober6023@gmail.com>
+Link: https://lore.kernel.org/r/20250807103228.10465-1-dober6023@gmail.com
+[groeck: Update subject]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lenovo-ec-sensors.c | 34 +++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/lenovo-ec-sensors.c b/drivers/hwmon/lenovo-ec-sensors.c
+index 143fb79713f7d..8681bbf6665b1 100644
+--- a/drivers/hwmon/lenovo-ec-sensors.c
++++ b/drivers/hwmon/lenovo-ec-sensors.c
+@@ -66,7 +66,7 @@ enum systems {
+ 	LENOVO_P8,
+ };
+ 
+-static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int px_temp_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31, 32};
+ 
+ static const char * const lenovo_px_ec_temp_label[] = {
+ 	"CPU1",
+@@ -84,9 +84,29 @@ static const char * const lenovo_px_ec_temp_label[] = {
+ 	"PCI_Z3",
+ 	"PCI_Z4",
+ 	"AMB",
++	"PSU1",
++	"PSU2",
+ };
+ 
+-static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
++static int p8_temp_map[] = {0, 1, 2, 8, 9, 13, 14, 15, 16, 17, 19, 20, 33};
++
++static const char * const lenovo_p8_ec_temp_label[] = {
++	"CPU1",
++	"CPU_DIMM_BANK1",
++	"CPU_DIMM_BANK2",
++	"M2_Z2R",
++	"M2_Z3R",
++	"DIMM_RIGHT",
++	"DIMM_LEFT",
++	"PCI_Z1",
++	"PCI_Z2",
++	"PCI_Z3",
++	"AMB",
++	"REAR_VR",
++	"PSU",
++};
++
++static int gen_temp_map[] = {0, 2, 3, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31};
+ 
+ static const char * const lenovo_gen_ec_temp_label[] = {
+ 	"CPU1",
+@@ -101,6 +121,7 @@ static const char * const lenovo_gen_ec_temp_label[] = {
+ 	"PCI_Z3",
+ 	"PCI_Z4",
+ 	"AMB",
++	"PSU",
+ };
+ 
+ static int px_fan_map[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15};
+@@ -293,6 +314,8 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_px[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -327,6 +350,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p8[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -359,6 +383,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p7[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -388,6 +413,7 @@ static const struct hwmon_channel_info *lenovo_ec_hwmon_info_p5[] = {
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL,
++			   HWMON_T_INPUT | HWMON_T_LABEL,
+ 			   HWMON_T_INPUT | HWMON_T_LABEL),
+ 	HWMON_CHANNEL_INFO(fan,
+ 			   HWMON_F_INPUT | HWMON_F_LABEL | HWMON_F_MAX,
+@@ -545,9 +571,9 @@ static int lenovo_ec_probe(struct platform_device *pdev)
+ 		break;
+ 	case 3:
+ 		ec_data->fan_labels = p8_ec_fan_label;
+-		ec_data->temp_labels = lenovo_gen_ec_temp_label;
++		ec_data->temp_labels = lenovo_p8_ec_temp_label;
+ 		ec_data->fan_map = p8_fan_map;
+-		ec_data->temp_map = gen_temp_map;
++		ec_data->temp_map = p8_temp_map;
+ 		lenovo_ec_chip_info.info = lenovo_ec_hwmon_info_p8;
+ 		break;
+ 	default:
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch b/queue-6.17/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
new file mode 100644
index 0000000000..4422a8df4d
--- /dev/null
+++ b/queue-6.17/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
@@ -0,0 +1,140 @@
+From ff2b9ad475a88fe5be2c0e529730df1d9f3c8733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index 3c839f56c4603..a6c439e376ff7 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+ 
+ /*
+  * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC		0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC		0x14 /* RW */
+ 
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT	2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT	5
+ 
++#define SBTSI_TEMP_EXT_RANGE_ADJ	49000
++
+ #define SBTSI_TEMP_MIN	0
+ #define SBTSI_TEMP_MAX	255875
+ 
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ 	struct i2c_client *client;
+ 	struct mutex lock;
++	bool ext_range_mode;
++	bool read_order;
+ };
+ 
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ 	struct sbtsi_data *data = dev_get_drvdata(dev);
+ 	s32 temp_int, temp_dec;
+-	int err;
+ 
+ 	switch (attr) {
+ 	case hwmon_temp_input:
+-		/*
+-		 * ReadOrder bit specifies the reading order of integer and
+-		 * decimal part of CPU temp for atomic reads. If bit == 0,
+-		 * reading integer part triggers latching of the decimal part,
+-		 * so integer part should be read first. If bit == 1, read
+-		 * order should be reversed.
+-		 */
+-		err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+-		if (err < 0)
+-			return err;
+-
+ 		mutex_lock(&data->lock);
+-		if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++		if (data->read_order) {
+ 			temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ 			temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ 		} else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ 		return temp_dec;
+ 
+ 	*val = sbtsi_reg_to_mc(temp_int, temp_dec);
++	if (data->ext_range_mode)
++		*val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+ 
+ 	return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ 		return -EINVAL;
+ 	}
+ 
++	if (data->ext_range_mode)
++		val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ 	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ 	sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+ 
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	struct device *dev = &client->dev;
+ 	struct device *hwmon_dev;
+ 	struct sbtsi_data *data;
++	int err;
+ 
+ 	data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ 	if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+ 
+-	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+-							 NULL);
++	err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++	if (err < 0)
++		return err;
++	data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++	data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++							 &sbtsi_chip_info, NULL);
+ 
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwmon-sy7636a-add-alias.patch b/queue-6.17/hwmon-sy7636a-add-alias.patch
new file mode 100644
index 0000000000..e6aa36005d
--- /dev/null
+++ b/queue-6.17/hwmon-sy7636a-add-alias.patch
@@ -0,0 +1,31 @@
+From bc8a330321d4fe2d1e32b0cd6b7a305a6da6274b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+ 
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+-- 
+2.51.0
+
diff --git a/queue-6.17/i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch b/queue-6.17/i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch
new file mode 100644
index 0000000000..4e4b307724
--- /dev/null
+++ b/queue-6.17/i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch
@@ -0,0 +1,67 @@
+From 6acc01f60e6482f763cdf765feac949147256ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 20:42:07 +0530
+Subject: i3c: dw: Add shutdown support to dw_i3c_master driver
+
+From: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+
+[ Upstream commit 17e163f3d7a5449fe9065030048e28c4087b24ce ]
+
+Add shutdown handler to the Synopsys DesignWare I3C master driver,
+ensuring the device is gracefully disabled during system shutdown.
+
+The shutdown handler cancels any pending hot-join work and disables
+interrupts.
+
+Signed-off-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Link: https://lore.kernel.org/r/20250730151207.4113708-1-manikanta.guntupalli@amd.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/dw-i3c-master.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
+index 974122b2d20ee..9ceedf09c3b6a 100644
+--- a/drivers/i3c/master/dw-i3c-master.c
++++ b/drivers/i3c/master/dw-i3c-master.c
+@@ -1737,6 +1737,28 @@ static const struct dev_pm_ops dw_i3c_pm_ops = {
+ 	SET_RUNTIME_PM_OPS(dw_i3c_master_runtime_suspend, dw_i3c_master_runtime_resume, NULL)
+ };
+ 
++static void dw_i3c_shutdown(struct platform_device *pdev)
++{
++	struct dw_i3c_master *master = platform_get_drvdata(pdev);
++	int ret;
++
++	ret = pm_runtime_resume_and_get(master->dev);
++	if (ret < 0) {
++		dev_err(master->dev,
++			"<%s> cannot resume i3c bus master, err: %d\n",
++			__func__, ret);
++		return;
++	}
++
++	cancel_work_sync(&master->hj_work);
++
++	/* Disable interrupts */
++	writel((u32)~INTR_ALL, master->regs + INTR_STATUS_EN);
++	writel((u32)~INTR_ALL, master->regs + INTR_SIGNAL_EN);
++
++	pm_runtime_put_autosuspend(master->dev);
++}
++
+ static const struct of_device_id dw_i3c_master_of_match[] = {
+ 	{ .compatible = "snps,dw-i3c-master-1.00a", },
+ 	{},
+@@ -1752,6 +1774,7 @@ MODULE_DEVICE_TABLE(acpi, amd_i3c_device_match);
+ static struct platform_driver dw_i3c_driver = {
+ 	.probe = dw_i3c_probe,
+ 	.remove = dw_i3c_remove,
++	.shutdown = dw_i3c_shutdown,
+ 	.driver = {
+ 		.name = "dw-i3c-master",
+ 		.of_match_table = dw_i3c_master_of_match,
+-- 
+2.51.0
+
diff --git a/queue-6.17/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch b/queue-6.17/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
new file mode 100644
index 0000000000..bc0319ac3f
--- /dev/null
+++ b/queue-6.17/i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
@@ -0,0 +1,37 @@
+From a0c521c654bbb096b42ce7b948aff93504dc2167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 16:17:32 +0300
+Subject: i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit d515503f3c8a8475b2f78782534aad09722904e1 ]
+
+Add I3C controller PCI IDs on Intel Wildcat Lake-U.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250808131732.1213227-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+index c6c3a3ec11eae..08e6cbdf89cea 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
++++ b/drivers/i3c/master/mipi-i3c-hci/mipi-i3c-hci-pci.c
+@@ -124,6 +124,9 @@ static void mipi_i3c_hci_pci_remove(struct pci_dev *pci)
+ }
+ 
+ static const struct pci_device_id mipi_i3c_hci_pci_devices[] = {
++	/* Wildcat Lake-U */
++	{ PCI_VDEVICE(INTEL, 0x4d7c), (kernel_ulong_t)&intel_info},
++	{ PCI_VDEVICE(INTEL, 0x4d6f), (kernel_ulong_t)&intel_info},
+ 	/* Panther Lake-H */
+ 	{ PCI_VDEVICE(INTEL, 0xe37c), (kernel_ulong_t)&intel_info},
+ 	{ PCI_VDEVICE(INTEL, 0xe36f), (kernel_ulong_t)&intel_info},
+-- 
+2.51.0
+
diff --git a/queue-6.17/io_uring-rsrc-respect-submitter_task-in-io_register_.patch b/queue-6.17/io_uring-rsrc-respect-submitter_task-in-io_register_.patch
new file mode 100644
index 0000000000..4f4ba0ae27
--- /dev/null
+++ b/queue-6.17/io_uring-rsrc-respect-submitter_task-in-io_register_.patch
@@ -0,0 +1,55 @@
+From 0bb4c46b5ec3c3c779f85bb039e37318bc8d9a05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:08:59 -0600
+Subject: io_uring/rsrc: respect submitter_task in io_register_clone_buffers()
+
+From: Caleb Sander Mateos <csander@purestorage.com>
+
+[ Upstream commit 2f076a453f75de691a081c89bce31b530153d53b ]
+
+io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed
+a single task submitting to the ctx. Although the documentation only
+mentions this restriction applying to io_uring_enter() syscalls,
+commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER")
+extends it to io_uring_register(). Ensuring only one task interacts
+with the io_ring_ctx will be important to allow this task to avoid
+taking the uring_lock.
+There is, however, one gap in these checks: io_register_clone_buffers()
+may take the uring_lock on a second (source) io_ring_ctx, but
+__io_uring_register() only checks the current thread against the
+*destination* io_ring_ctx's submitter_task. Fail the
+IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has
+a registered submitter_task other than the current task.
+
+Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index f75f5e43fa4aa..e1e5f0fb0f56d 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg)
+ 	if (src_ctx != ctx) {
+ 		mutex_unlock(&ctx->uring_lock);
+ 		lock_two_rings(ctx, src_ctx);
++
++		if (src_ctx->submitter_task &&
++		    src_ctx->submitter_task != current) {
++			ret = -EEXIST;
++			goto out;
++		}
+ 	}
+ 
+ 	ret = io_clone_buffers(ctx, src_ctx, &buf);
+ 
++out:
+ 	if (src_ctx != ctx)
+ 		mutex_unlock(&src_ctx->uring_lock);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/io_uring-zcrx-account-niov-arrays-to-cgroup.patch b/queue-6.17/io_uring-zcrx-account-niov-arrays-to-cgroup.patch
new file mode 100644
index 0000000000..b0d9cf507c
--- /dev/null
+++ b/queue-6.17/io_uring-zcrx-account-niov-arrays-to-cgroup.patch
@@ -0,0 +1,47 @@
+From 02ecd4c135d5d184518b3951c6ad38463c3e133c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:28:03 +0100
+Subject: io_uring/zcrx: account niov arrays to cgroup
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 31bf77dcc3810e08bcc7d15470e92cdfffb7f7f1 ]
+
+net_iov / freelist / etc. arrays can be quite long, make sure they're
+accounted.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/zcrx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
+index 23ffc95caa427..e3953ea740c03 100644
+--- a/io_uring/zcrx.c
++++ b/io_uring/zcrx.c
+@@ -426,17 +426,17 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
+ 
+ 	ret = -ENOMEM;
+ 	area->nia.niovs = kvmalloc_array(nr_iovs, sizeof(area->nia.niovs[0]),
+-					 GFP_KERNEL | __GFP_ZERO);
++					 GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ 	if (!area->nia.niovs)
+ 		goto err;
+ 
+ 	area->freelist = kvmalloc_array(nr_iovs, sizeof(area->freelist[0]),
+-					GFP_KERNEL | __GFP_ZERO);
++					GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ 	if (!area->freelist)
+ 		goto err;
+ 
+ 	area->user_refs = kvmalloc_array(nr_iovs, sizeof(area->user_refs[0]),
+-					GFP_KERNEL | __GFP_ZERO);
++					GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+ 	if (!area->user_refs)
+ 		goto err;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch b/queue-6.17/io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch
new file mode 100644
index 0000000000..b9b3b72cc4
--- /dev/null
+++ b/queue-6.17/io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch
@@ -0,0 +1,36 @@
+From d1947d252a71709fa5ff98ab412df7450f10c912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:27:50 +0100
+Subject: io_uring/zcrx: check all niovs filled with dma addresses
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit d7ae46b454eb05e3df0d46c2ac9c61416a4d9057 ]
+
+Add a warning if io_populate_area_dma() can't fill in all net_iovs, it
+should never happen.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/zcrx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
+index 2035c77a16357..23ffc95caa427 100644
+--- a/io_uring/zcrx.c
++++ b/io_uring/zcrx.c
+@@ -75,6 +75,9 @@ static int io_populate_area_dma(struct io_zcrx_ifq *ifq,
+ 			niov_idx++;
+ 		}
+ 	}
++
++	if (WARN_ON_ONCE(niov_idx != area->nia.num_niovs))
++		return -EFAULT;
+ 	return 0;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/io_uring-zctx-check-chained-notif-contexts.patch b/queue-6.17/io_uring-zctx-check-chained-notif-contexts.patch
new file mode 100644
index 0000000000..52bf10259a
--- /dev/null
+++ b/queue-6.17/io_uring-zctx-check-chained-notif-contexts.patch
@@ -0,0 +1,44 @@
+From 290e07a316e745624ea9ccb89a69337318ae0da4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:40:57 +0100
+Subject: io_uring/zctx: check chained notif contexts
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit ab3ea6eac5f45669b091309f592c4ea324003053 ]
+
+Send zc only links ubuf_info for requests coming from the same context.
+There are some ambiguous syz reports, so let's check the assumption on
+notification completion.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index ea9c0116cec2d..d8ba1165c9494 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -14,10 +14,15 @@ static const struct ubuf_info_ops io_ubuf_ops;
+ static void io_notif_tw_complete(struct io_kiocb *notif, io_tw_token_t tw)
+ {
+ 	struct io_notif_data *nd = io_notif_to_data(notif);
++	struct io_ring_ctx *ctx = notif->ctx;
++
++	lockdep_assert_held(&ctx->uring_lock);
+ 
+ 	do {
+ 		notif = cmd_to_io_kiocb(nd);
+ 
++		if (WARN_ON_ONCE(ctx != notif->ctx))
++			return;
+ 		lockdep_assert(refcount_read(&nd->uarg.refcnt) == 0);
+ 
+ 		if (unlikely(nd->zc_report) && (nd->zc_copied || !nd->zc_used))
+-- 
+2.51.0
+
diff --git a/queue-6.17/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-6.17/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..6f905db81b
--- /dev/null
+++ b/queue-6.17/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From 786c4236b0e92fe1baab6b9446985271fe936bdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 24ef5af569fe4..8a3410c2b7b57 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -153,14 +153,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/irqchip-loongson-eiointc-route-interrupt-parsed-from.patch b/queue-6.17/irqchip-loongson-eiointc-route-interrupt-parsed-from.patch
new file mode 100644
index 0000000000..3f2a303b67
--- /dev/null
+++ b/queue-6.17/irqchip-loongson-eiointc-route-interrupt-parsed-from.patch
@@ -0,0 +1,100 @@
+From 971b860f97a6a4432b75742721e93b533c65c30d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:19:45 +0800
+Subject: irqchip/loongson-eiointc: Route interrupt parsed from bios table
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+[ Upstream commit 7fb83eb664e9b3a0438dd28859e9f0fd49d4c165 ]
+
+Interrupt controller eiointc routes interrupts to CPU interface IP0 - IP7.
+
+It is currently hard-coded that eiointc routes interrupts to the CPU
+starting from IP1, but it should base that decision on the parent
+interrupt, which is provided by ACPI or DTS.
+
+Retrieve the parent's hardware interrupt number and store it in the
+descriptor of the eointc instance, so that the routing function can utilize
+it for the correct route settings.
+
+[ tglx: Massaged change log ]
+
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250804081946.1456573-2-maobibo@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-eiointc.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
+index b2860eb2d32c5..baa406904de55 100644
+--- a/drivers/irqchip/irq-loongson-eiointc.c
++++ b/drivers/irqchip/irq-loongson-eiointc.c
+@@ -68,6 +68,7 @@ struct eiointc_priv {
+ 	struct fwnode_handle	*domain_handle;
+ 	struct irq_domain	*eiointc_domain;
+ 	int			flags;
++	irq_hw_number_t		parent_hwirq;
+ };
+ 
+ static struct eiointc_priv *eiointc_priv[MAX_IO_PICS];
+@@ -211,7 +212,12 @@ static int eiointc_router_init(unsigned int cpu)
+ 		}
+ 
+ 		for (i = 0; i < eiointc_priv[0]->vec_count / 32 / 4; i++) {
+-			bit = BIT(1 + index); /* Route to IP[1 + index] */
++			/*
++			 * Route to interrupt pin, relative offset used here
++			 * Offset 0 means routing to IP0 and so on
++			 * Every 32 vector routing to one interrupt pin
++			 */
++			bit = BIT(eiointc_priv[index]->parent_hwirq - INT_HWI0);
+ 			data = bit | (bit << 8) | (bit << 16) | (bit << 24);
+ 			iocsr_write32(data, EIOINTC_REG_IPMAP + i * 4);
+ 		}
+@@ -495,7 +501,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent,
+ 
+ 	priv->vec_count = VEC_COUNT;
+ 	priv->node = acpi_eiointc->node;
+-
++	priv->parent_hwirq = acpi_eiointc->cascade;
+ 	parent_irq = irq_create_mapping(parent, acpi_eiointc->cascade);
+ 
+ 	ret = eiointc_init(priv, parent_irq, acpi_eiointc->node_map);
+@@ -527,8 +533,9 @@ int __init eiointc_acpi_init(struct irq_domain *parent,
+ static int __init eiointc_of_init(struct device_node *of_node,
+ 				  struct device_node *parent)
+ {
+-	int parent_irq, ret;
+ 	struct eiointc_priv *priv;
++	struct irq_data *irq_data;
++	int parent_irq, ret;
+ 
+ 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -544,6 +551,12 @@ static int __init eiointc_of_init(struct device_node *of_node,
+ 	if (ret < 0)
+ 		goto out_free_priv;
+ 
++	irq_data = irq_get_irq_data(parent_irq);
++	if (!irq_data) {
++		ret = -ENODEV;
++		goto out_free_priv;
++	}
++
+ 	/*
+ 	 * In particular, the number of devices supported by the LS2K0500
+ 	 * extended I/O interrupt vector is 128.
+@@ -552,7 +565,7 @@ static int __init eiointc_of_init(struct device_node *of_node,
+ 		priv->vec_count = 128;
+ 	else
+ 		priv->vec_count = VEC_COUNT;
+-
++	priv->parent_hwirq = irqd_to_hwirq(irq_data);
+ 	priv->node = 0;
+ 	priv->domain_handle = of_fwnode_handle(of_node);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch b/queue-6.17/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
new file mode 100644
index 0000000000..2cfb6d6005
--- /dev/null
+++ b/queue-6.17/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
@@ -0,0 +1,69 @@
+From 6d1850ee03915c709a73096e1fdd235bb205677f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 2d4c3ec128b8f..912bf50a5c7ca 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -200,8 +200,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ 		goto iounmap_base;
+ 	}
+ 
+-	priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+-					&pch_lpc_domain_ops, priv);
++	/*
++	 * The LPC interrupt controller is a legacy i8259-compatible device,
++	 * which requires a static 1:1 mapping for IRQs 0-15.
++	 * Use irq_domain_create_legacy to establish this static mapping early.
++	 */
++	priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++						    &pch_lpc_domain_ops, priv);
+ 	if (!priv->lpc_domain) {
+ 		pr_err("Failed to create IRQ domain\n");
+ 		goto free_irq_handle;
+-- 
+2.51.0
+
diff --git a/queue-6.17/irqchip-sifive-plic-respect-mask-state-when-setting-.patch b/queue-6.17/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
new file mode 100644
index 0000000000..3db557b78d
--- /dev/null
+++ b/queue-6.17/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
@@ -0,0 +1,54 @@
+From 420279402a137293356da1e4cd89ec2212e6f4da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 9c4af7d588463..c0cf4fed13e09 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -179,12 +179,14 @@ static int plic_set_affinity(struct irq_data *d,
+ 	if (cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+-	plic_irq_disable(d);
++	/* Invalidate the original routing entry */
++	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+ 
+ 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
++	/* Setting the new routing entry if irq is enabled */
+ 	if (!irqd_irq_disabled(d))
+-		plic_irq_enable(d);
++		plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch b/queue-6.17/kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch
new file mode 100644
index 0000000000..fd2a22648a
--- /dev/null
+++ b/queue-6.17/kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch
@@ -0,0 +1,52 @@
+From 5ce266ab9b29bb6737f71432dfaeea8615df208c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:40:37 +0200
+Subject: kselftest/arm64: tpidr2: Switch to waitpid() over wait4()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 61a3cf7934b6da3c926cd9961860dd94eb7192ba ]
+
+wait4() is deprecated, non-standard and about to be removed from nolibc.
+
+Switch to the equivalent waitpid() call.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/20250821-nolibc-enosys-v1-6-4b63f2caaa89@weissschuh.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/abi/tpidr2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c
+index 4c89ab0f10101..1703543fb7c76 100644
+--- a/tools/testing/selftests/arm64/abi/tpidr2.c
++++ b/tools/testing/selftests/arm64/abi/tpidr2.c
+@@ -182,16 +182,16 @@ static int write_clone_read(void)
+ 	}
+ 
+ 	for (;;) {
+-		waiting = wait4(ret, &status, __WCLONE, NULL);
++		waiting = waitpid(ret, &status, __WCLONE);
+ 
+ 		if (waiting < 0) {
+ 			if (errno == EINTR)
+ 				continue;
+-			ksft_print_msg("wait4() failed: %d\n", errno);
++			ksft_print_msg("waitpid() failed: %d\n", errno);
+ 			return 0;
+ 		}
+ 		if (waiting != ret) {
+-			ksft_print_msg("wait4() returned wrong PID %d\n",
++			ksft_print_msg("waitpid() returned wrong PID %d\n",
+ 				       waiting);
+ 			return 0;
+ 		}
+-- 
+2.51.0
+
diff --git a/queue-6.17/kunit-enable-pci-on-uml-without-triggering-warn.patch b/queue-6.17/kunit-enable-pci-on-uml-without-triggering-warn.patch
new file mode 100644
index 0000000000..fe2699a3a8
--- /dev/null
+++ b/queue-6.17/kunit-enable-pci-on-uml-without-triggering-warn.patch
@@ -0,0 +1,78 @@
+From ee803ecde38d7812445434e9db7a8c57cf66c438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 09:03:38 +0200
+Subject: kunit: Enable PCI on UML without triggering WARN()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 031cdd3bc3f369553933c1b0f4cb18000162c8ff ]
+
+Various KUnit tests require PCI infrastructure to work. All normal
+platforms enable PCI by default, but UML does not. Enabling PCI from
+.kunitconfig files is problematic as it would not be portable. So in
+commit 6fc3a8636a7b ("kunit: tool: Enable virtio/PCI by default on UML")
+PCI was enabled by way of CONFIG_UML_PCI_OVER_VIRTIO=y. However
+CONFIG_UML_PCI_OVER_VIRTIO requires additional configuration of
+CONFIG_UML_PCI_OVER_VIRTIO_DEVICE_ID or will otherwise trigger a WARN() in
+virtio_pcidev_init(). However there is no one correct value for
+UML_PCI_OVER_VIRTIO_DEVICE_ID which could be used by default.
+
+This warning is confusing when debugging test failures.
+
+On the other hand, the functionality of CONFIG_UML_PCI_OVER_VIRTIO is not
+used at all, given that it is completely non-functional as indicated by
+the WARN() in question. Instead it is only used as a way to enable
+CONFIG_UML_PCI which itself is not directly configurable.
+
+Instead of going through CONFIG_UML_PCI_OVER_VIRTIO, introduce a custom
+configuration option which enables CONFIG_UML_PCI without triggering
+warnings or building dead code.
+
+Link: https://lore.kernel.org/r/20250908-kunit-uml-pci-v2-1-d8eba5f73c9d@linutronix.de
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/Kconfig                           | 7 +++++++
+ tools/testing/kunit/configs/arch_uml.config | 5 ++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/kunit/Kconfig b/lib/kunit/Kconfig
+index c10ede4b1d220..1823539e96da3 100644
+--- a/lib/kunit/Kconfig
++++ b/lib/kunit/Kconfig
+@@ -106,4 +106,11 @@ config KUNIT_DEFAULT_TIMEOUT
+ 	  If unsure, the default timeout of 300 seconds is suitable for most
+ 	  cases.
+ 
++config KUNIT_UML_PCI
++	bool "KUnit UML PCI Support"
++	depends on UML
++	select UML_PCI
++	help
++	  Enables the PCI subsystem on UML for use by KUnit tests.
++
+ endif # KUNIT
+diff --git a/tools/testing/kunit/configs/arch_uml.config b/tools/testing/kunit/configs/arch_uml.config
+index 54ad8972681a2..28edf816aa70e 100644
+--- a/tools/testing/kunit/configs/arch_uml.config
++++ b/tools/testing/kunit/configs/arch_uml.config
+@@ -1,8 +1,7 @@
+ # Config options which are added to UML builds by default
+ 
+-# Enable virtio/pci, as a lot of tests require it.
+-CONFIG_VIRTIO_UML=y
+-CONFIG_UML_PCI_OVER_VIRTIO=y
++# Enable pci, as a lot of tests require it.
++CONFIG_KUNIT_UML_PCI=y
+ 
+ # Enable FORTIFY_SOURCE for wider checking.
+ CONFIG_FORTIFY_SOURCE=y
+-- 
+2.51.0
+
diff --git a/queue-6.17/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch b/queue-6.17/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
new file mode 100644
index 0000000000..2cea54c488
--- /dev/null
+++ b/queue-6.17/libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
@@ -0,0 +1,200 @@
+From 7bf0f5f706ef6101912a655118deef6dac95b8ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 05:31:27 +0000
+Subject: libbpf: Fix USDT SIB argument handling causing unrecognized register
+ error
+
+From: Jiawei Zhao <phoenix500526@163.com>
+
+[ Upstream commit 758acb9ccfdbf854b55abaceaf1f3f229cde3d19 ]
+
+On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
+addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
+in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
+to fail with -ENOENT (unrecognized register).
+
+This patch fixes this by implementing the necessary changes:
+- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
+- add adaptive support to `__bpf_usdt_arg_type` and
+  `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
+
+Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250827053128.1301287-2-phoenix500526@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/usdt.bpf.h | 44 ++++++++++++++++++++++++++--
+ tools/lib/bpf/usdt.c     | 62 ++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 99 insertions(+), 7 deletions(-)
+
+diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
+index 2a7865c8e3fe3..43deb05a51970 100644
+--- a/tools/lib/bpf/usdt.bpf.h
++++ b/tools/lib/bpf/usdt.bpf.h
+@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
+ 	BPF_USDT_ARG_CONST,
+ 	BPF_USDT_ARG_REG,
+ 	BPF_USDT_ARG_REG_DEREF,
++	BPF_USDT_ARG_SIB,
+ };
+ 
++/*
++ * This struct layout is designed specifically to be backwards/forward
++ * compatible between libbpf versions for ARG_CONST, ARG_REG, and
++ * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
++ */
+ struct __bpf_usdt_arg_spec {
+ 	/* u64 scalar interpreted depending on arg_type, see below */
+ 	__u64 val_off;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ 	/* arg location case, see bpf_usdt_arg() for details */
+-	enum __bpf_usdt_arg_type arg_type;
++	enum __bpf_usdt_arg_type arg_type: 8;
++	/* index register offset within struct pt_regs */
++	__u16 idx_reg_off: 12;
++	/* scale factor for index register (1, 2, 4, or 8) */
++	__u16 scale_bitshift: 4;
++	/* reserved for future use, keeps reg_off offset stable */
++	__u8 __reserved: 8;
++#else
++	__u8 __reserved: 8;
++	__u16 idx_reg_off: 12;
++	__u16 scale_bitshift: 4;
++	enum __bpf_usdt_arg_type arg_type: 8;
++#endif
+ 	/* offset of referenced register within struct pt_regs */
+ 	short reg_off;
+ 	/* whether arg should be interpreted as signed value */
+@@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ {
+ 	struct __bpf_usdt_spec *spec;
+ 	struct __bpf_usdt_arg_spec *arg_spec;
+-	unsigned long val;
++	unsigned long val, idx;
+ 	int err, spec_id;
+ 
+ 	*res = 0;
+@@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
+ 			return err;
+ #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+ 		val >>= arg_spec->arg_bitshift;
++#endif
++		break;
++	case BPF_USDT_ARG_SIB:
++		/* Arg is in memory addressed by SIB (Scale-Index-Base) mode
++		 * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
++		 * fetch the base register contents and the index register
++		 * contents from pt_regs. Then we calculate the final address
++		 * as base + (index * scale) + offset, and do a user-space
++		 * probe read to fetch the argument value.
++		 */
++		err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);
++		if (err)
++			return err;
++		err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);
++		if (err)
++			return err;
++		err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off));
++		if (err)
++			return err;
++#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
++		val >>= arg_spec->arg_bitshift;
+ #endif
+ 		break;
+ 	default:
+diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
+index 3373b9d45ac44..867bff6b06990 100644
+--- a/tools/lib/bpf/usdt.c
++++ b/tools/lib/bpf/usdt.c
+@@ -200,12 +200,23 @@ enum usdt_arg_type {
+ 	USDT_ARG_CONST,
+ 	USDT_ARG_REG,
+ 	USDT_ARG_REG_DEREF,
++	USDT_ARG_SIB,
+ };
+ 
+ /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
+ struct usdt_arg_spec {
+ 	__u64 val_off;
+-	enum usdt_arg_type arg_type;
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++	enum usdt_arg_type arg_type: 8;
++	__u16	idx_reg_off: 12;
++	__u16	scale_bitshift: 4;
++	__u8 __reserved: 8;     /* keep reg_off offset stable */
++#else
++	__u8 __reserved: 8;     /* keep reg_off offset stable */
++	__u16	idx_reg_off: 12;
++	__u16	scale_bitshift: 4;
++	enum usdt_arg_type arg_type: 8;
++#endif
+ 	short reg_off;
+ 	bool arg_signed;
+ 	char arg_bitshift;
+@@ -1283,11 +1294,51 @@ static int calc_pt_regs_off(const char *reg_name)
+ 
+ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
+ {
+-	char reg_name[16];
+-	int len, reg_off;
+-	long off;
++	char reg_name[16] = {0}, idx_reg_name[16] = {0};
++	int len, reg_off, idx_reg_off, scale = 1;
++	long off = 0;
++
++	if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
++		   arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
++		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
++		       arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
++		sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
++		       arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
++		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
++		       arg_sz, reg_name, idx_reg_name, &len) == 3
++		) {
++		/*
++		 * Scale Index Base case:
++		 * 1@-96(%rbp,%rax,8)
++		 * 1@(%rbp,%rax,8)
++		 * 1@-96(%rbp,%rax)
++		 * 1@(%rbp,%rax)
++		 */
++		arg->arg_type = USDT_ARG_SIB;
++		arg->val_off = off;
+ 
+-	if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
++		reg_off = calc_pt_regs_off(reg_name);
++		if (reg_off < 0)
++			return reg_off;
++		arg->reg_off = reg_off;
++
++		idx_reg_off = calc_pt_regs_off(idx_reg_name);
++		if (idx_reg_off < 0)
++			return idx_reg_off;
++		arg->idx_reg_off = idx_reg_off;
++
++		/* validate scale factor and set fields directly */
++		switch (scale) {
++		case 1: arg->scale_bitshift = 0; break;
++		case 2: arg->scale_bitshift = 1; break;
++		case 4: arg->scale_bitshift = 2; break;
++		case 8: arg->scale_bitshift = 3; break;
++		default:
++			pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
++			return -EINVAL;
++		}
++	} else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
++				arg_sz, &off, reg_name, &len) == 3) {
+ 		/* Memory dereference case, e.g., -4@-20(%rbp) */
+ 		arg->arg_type = USDT_ARG_REG_DEREF;
+ 		arg->val_off = off;
+@@ -1306,6 +1357,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
+ 	} else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
+ 		/* Register read case, e.g., -4@%eax */
+ 		arg->arg_type = USDT_ARG_REG;
++		/* register read has no memory offset */
+ 		arg->val_off = 0;
+ 
+ 		reg_off = calc_pt_regs_off(reg_name);
+-- 
+2.51.0
+
diff --git a/queue-6.17/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-6.17/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..afb2ecb229
--- /dev/null
+++ b/queue-6.17/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From 6ff53bbd73b5769eec049daa1758e207048bf65e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e4275f8ee5db8..acafc910bbacc 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -370,7 +370,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -404,7 +406,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-core-increment-of_node-s-refcount-before-linking.patch b/queue-6.17/mfd-core-increment-of_node-s-refcount-before-linking.patch
new file mode 100644
index 0000000000..dcde8cff30
--- /dev/null
+++ b/queue-6.17/mfd-core-increment-of_node-s-refcount-before-linking.patch
@@ -0,0 +1,42 @@
+From 4a71b01f863cda63c55dbba5c8cdb72fcde7b365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 16:21:13 +0200
+Subject: mfd: core: Increment of_node's refcount before linking it to the
+ platform device
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit 5f4bbee069836e51ed0b6d7e565a292f070ababc ]
+
+When an MFD device is added, a platform_device is allocated. If this
+device is linked to a DT description, the corresponding OF node is linked
+to the new platform device but the OF node's refcount isn't incremented.
+As of_node_put() is called during the platform device release, it leads
+to a refcount underflow.
+
+Call of_node_get() to increment the OF node's refcount when the node is
+linked to the newly created platform device.
+
+Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
+Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mfd-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 76bd316a50afc..7d14a1e7631ee 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -131,6 +131,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
+ 	of_entry->np = np;
+ 	list_add_tail(&of_entry->list, &mfd_of_node_list);
+ 
++	of_node_get(np);
+ 	device_set_node(&pdev->dev, of_fwnode_handle(np));
+ #endif
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch b/queue-6.17/mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
new file mode 100644
index 0000000000..cbeff51c52
--- /dev/null
+++ b/queue-6.17/mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
@@ -0,0 +1,66 @@
+From 8691abdd3ef437beec243e96cd37f57a1fcbcf8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:45:48 +0100
+Subject: mfd: cs42l43: Move IRQ enable/disable to encompass force suspend
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 62aec8a0a5b61f149bbe518c636e38e484812499 ]
+
+As pm_runtime_force_suspend() will force the device state to suspend,
+the driver needs to ensure no IRQ handlers are currently running. If not
+those handlers may find they are now running on suspended hardware
+despite holding a PM runtime reference. disable_irq() will sync any
+currently running handlers, so move the IRQ disabling to cover the whole
+of the forced suspend state to avoid such race conditions.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250903094549.271068-6-ckeepax@opensource.cirrus.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cs42l43.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
+index 07c8f1b8183ee..959298c8232f4 100644
+--- a/drivers/mfd/cs42l43.c
++++ b/drivers/mfd/cs42l43.c
+@@ -1151,6 +1151,8 @@ static int cs42l43_suspend(struct device *dev)
+ 		return ret;
+ 	}
+ 
++	disable_irq(cs42l43->irq);
++
+ 	ret = pm_runtime_force_suspend(dev);
+ 	if (ret) {
+ 		dev_err(cs42l43->dev, "Failed to force suspend: %d\n", ret);
+@@ -1164,8 +1166,6 @@ static int cs42l43_suspend(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	disable_irq(cs42l43->irq);
+-
+ 	return 0;
+ }
+ 
+@@ -1196,14 +1196,14 @@ static int cs42l43_resume(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	enable_irq(cs42l43->irq);
+-
+ 	ret = pm_runtime_force_resume(dev);
+ 	if (ret) {
+ 		dev_err(cs42l43->dev, "Failed to force resume: %d\n", ret);
+ 		return ret;
+ 	}
+ 
++	enable_irq(cs42l43->irq);
++
+ 	return 0;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-6.17/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..6769b1fb70
--- /dev/null
+++ b/queue-6.17/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From b3c9593c98898741823bee68b82968b4d5634194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index c6235cd0dbdc4..1ec9ab56442df 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch b/queue-6.17/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
new file mode 100644
index 0000000000..71c6f6b720
--- /dev/null
+++ b/queue-6.17/mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
@@ -0,0 +1,50 @@
+From 1b9fab425045ca2475464c42e2aee0ef550d84fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:29:36 +0300
+Subject: mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit c91a0e4e549d0457c61f2199fcd84d699400bee1 ]
+
+Add Intel Wildcat Lake PCI IDs.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 1a5b8b13f8d0b..8d92c895d3aef 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -367,6 +367,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x4b79), (kernel_ulong_t)&ehl_i2c_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4b7a), (kernel_ulong_t)&ehl_i2c_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4b7b), (kernel_ulong_t)&ehl_i2c_info },
++	/* WCL */
++	{ PCI_VDEVICE(INTEL, 0x4d25), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d26), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d27), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d30), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d46), (kernel_ulong_t)&tgl_spi_info },
++	{ PCI_VDEVICE(INTEL, 0x4d50), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d51), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d52), (kernel_ulong_t)&bxt_uart_info },
++	{ PCI_VDEVICE(INTEL, 0x4d78), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d79), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d7a), (kernel_ulong_t)&ehl_i2c_info },
++	{ PCI_VDEVICE(INTEL, 0x4d7b), (kernel_ulong_t)&ehl_i2c_info },
+ 	/* JSL */
+ 	{ PCI_VDEVICE(INTEL, 0x4da8), (kernel_ulong_t)&spt_uart_info },
+ 	{ PCI_VDEVICE(INTEL, 0x4da9), (kernel_ulong_t)&spt_uart_info },
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-macsmc-add-apple-t8103-smc-compatible.patch b/queue-6.17/mfd-macsmc-add-apple-t8103-smc-compatible.patch
new file mode 100644
index 0000000000..bf6c344134
--- /dev/null
+++ b/queue-6.17/mfd-macsmc-add-apple-t8103-smc-compatible.patch
@@ -0,0 +1,39 @@
+From 41e452554c9016fd101686f21de6d5dd564970b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:37 +0200
+Subject: mfd: macsmc: Add "apple,t8103-smc" compatible
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 9b959e525fa7e8518e57554b6e17849942938dfc ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,smc" anymore [1]. Use
+"apple,t8103-smc" as base compatible as it is the SoC the driver and
+bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250828-dt-apple-t6020-v1-18-507ba4c4b98e@jannau.net
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/macsmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/macsmc.c b/drivers/mfd/macsmc.c
+index 870c8b2028a8f..a5e0b99484830 100644
+--- a/drivers/mfd/macsmc.c
++++ b/drivers/mfd/macsmc.c
+@@ -478,6 +478,7 @@ static int apple_smc_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id apple_smc_of_match[] = {
++	{ .compatible = "apple,t8103-smc" },
+ 	{ .compatible = "apple,smc" },
+ 	{},
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-6.17/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..f366c96525
--- /dev/null
+++ b/queue-6.17/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From 0593f426dc9b07059406cb6b50ba9831116cde34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch b/queue-6.17/mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch
new file mode 100644
index 0000000000..790107fb02
--- /dev/null
+++ b/queue-6.17/mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch
@@ -0,0 +1,40 @@
+From 1a157ebb607a89bbd3c02865283cca6f27bbdf57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:07:24 +0200
+Subject: mfd: qnap-mcu: Handle errors returned from qnap_mcu_write
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit bf2de43060d528e52e372c63182a94b95c80d305 ]
+
+qnap_mcu_write can return errors and those were not checked before.
+So do that now.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250804130726.3180806-3-heiko@sntech.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/qnap-mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/qnap-mcu.c b/drivers/mfd/qnap-mcu.c
+index 89a8a1913d42d..9d3edc3e7d93b 100644
+--- a/drivers/mfd/qnap-mcu.c
++++ b/drivers/mfd/qnap-mcu.c
+@@ -163,7 +163,11 @@ int qnap_mcu_exec(struct qnap_mcu *mcu,
+ 	reply->received = 0;
+ 	reinit_completion(&reply->done);
+ 
+-	qnap_mcu_write(mcu, cmd_data, cmd_data_size);
++	ret = qnap_mcu_write(mcu, cmd_data, cmd_data_size);
++	if (ret < 0) {
++		mutex_unlock(&mcu->bus_lock);
++		return ret;
++	}
+ 
+ 	serdev_device_wait_until_sent(mcu->serdev, msecs_to_jiffies(QNAP_MCU_TIMEOUT_MS));
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch b/queue-6.17/mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch
new file mode 100644
index 0000000000..b1cb343974
--- /dev/null
+++ b/queue-6.17/mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch
@@ -0,0 +1,48 @@
+From 514669c8ee0c67591967f4562d27f80204d3f641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:07:23 +0200
+Subject: mfd: qnap-mcu: Include linux/types.h in qnap-mcu.h shared header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 5e1c88679174e4bfe5d152060b06d370bd85de80 ]
+
+Relying on other components to include those basic types is unreliable
+and may cause compile errors like:
+
+../include/linux/mfd/qnap-mcu.h:13:9: error: unknown type name ‘u32’
+   13 |         u32 baud_rate;
+      |         ^~~
+../include/linux/mfd/qnap-mcu.h:17:9: error: unknown type name ‘bool’
+   17 |         bool usb_led;
+      |         ^~~~
+
+So make sure, the types used in the header are available.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250804130726.3180806-2-heiko@sntech.de
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mfd/qnap-mcu.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mfd/qnap-mcu.h b/include/linux/mfd/qnap-mcu.h
+index 8d48c212fd444..42bf523f9a5b0 100644
+--- a/include/linux/mfd/qnap-mcu.h
++++ b/include/linux/mfd/qnap-mcu.h
+@@ -7,6 +7,8 @@
+ #ifndef _LINUX_QNAP_MCU_H_
+ #define _LINUX_QNAP_MCU_H_
+ 
++#include <linux/types.h>
++
+ struct qnap_mcu;
+ 
+ struct qnap_mcu_variant {
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch b/queue-6.17/mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch
new file mode 100644
index 0000000000..41d04e0c7b
--- /dev/null
+++ b/queue-6.17/mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch
@@ -0,0 +1,39 @@
+From 7f63ddca4887c64b27dca567ee36f451eeafd85b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 18:31:20 +0300
+Subject: mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 81a2c31257411296862487aaade98b7d9e25dc72 ]
+
+The QIXIS FPGA found on Layerscape boards such as LX2160AQDS, LS1028AQDS
+etc deals with power-on-reset timing, muxing etc. Use the simple-mfd-i2c
+as its core driver by adding its compatible string (already found in
+some dt files). By using the simple-mfd-i2c driver, any child device
+will have access to the i2c regmap created by it.
+
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20250707153120.1371719-1-ioana.ciornei@nxp.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/simple-mfd-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/simple-mfd-i2c.c b/drivers/mfd/simple-mfd-i2c.c
+index 22159913bea03..f7798bd922224 100644
+--- a/drivers/mfd/simple-mfd-i2c.c
++++ b/drivers/mfd/simple-mfd-i2c.c
+@@ -99,6 +99,8 @@ static const struct of_device_id simple_mfd_i2c_of_match[] = {
+ 	{ .compatible = "maxim,max5970", .data = &maxim_max5970},
+ 	{ .compatible = "maxim,max5978", .data = &maxim_max5970},
+ 	{ .compatible = "maxim,max77705-battery", .data = &maxim_mon_max77705},
++	{ .compatible = "fsl,lx2160aqds-fpga" },
++	{ .compatible = "fsl,ls1028aqds-fpga" },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, simple_mfd_i2c_of_match);
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-6.17/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..8a58797e0c
--- /dev/null
+++ b/queue-6.17/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From 133186d173ffd92ad1ad65d7f09fb60404689591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+ 
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-6.17/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-6.17/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..4a796fbe4d
--- /dev/null
+++ b/queue-6.17/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From 99989eeeda43950c906db42759f51655c9f7b292 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 819d19dc9b4a9..e1165f63aedae 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-6.17/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-6.17/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..d9189c6467
--- /dev/null
+++ b/queue-6.17/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From 88078163a314d4c2c9a64f264d9de31bc4b3ad66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index fb8ca03f661d7..a41291a28e9bd 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -222,7 +222,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch b/queue-6.17/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch
new file mode 100644
index 0000000000..7b05e44595
--- /dev/null
+++ b/queue-6.17/mmc-sdhci-disable-sd-card-clock-before-changing-para.patch
@@ -0,0 +1,67 @@
+From 84f69e3d4a31b584561a277807d325a741936319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:53:54 -0500
+Subject: mmc: sdhci: Disable SD card clock before changing parameters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erick Shepherd <erick.shepherd@ni.com>
+
+[ Upstream commit 5f755ba95ae10fd4fa28d64345056ffc18d12c5a ]
+
+Per the SD Host Controller Simplified Specification v4.20 §3.2.3, change
+the SD card clock parameters only after first disabling the external card
+clock. Doing this fixes a spurious clock pulse on Baytrail and Apollo Lake
+SD controllers which otherwise breaks voltage switching with a specific
+Swissbit SD card. This change is limited to Intel host controllers to
+avoid an issue reported on ARM64 devices.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Brad Mouring <brad.mouring@ni.com>
+Signed-off-by: Erick Shepherd <erick.shepherd@ni.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250724185354.815888-1-erick.shepherd@ni.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 826958992dfe2..47a0a738862b5 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -679,8 +679,19 @@ static int intel_start_signal_voltage_switch(struct mmc_host *mmc,
+ 	return 0;
+ }
+ 
++static void sdhci_intel_set_clock(struct sdhci_host *host, unsigned int clock)
++{
++	u16 clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++
++	/* Stop card clock separately to avoid glitches on clock line */
++	if (clk & SDHCI_CLOCK_CARD_EN)
++		sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, SDHCI_CLOCK_CONTROL);
++
++	sdhci_set_clock(host, clock);
++}
++
+ static const struct sdhci_ops sdhci_intel_byt_ops = {
+-	.set_clock		= sdhci_set_clock,
++	.set_clock		= sdhci_intel_set_clock,
+ 	.set_power		= sdhci_intel_set_power,
+ 	.enable_dma		= sdhci_pci_enable_dma,
+ 	.set_bus_width		= sdhci_set_bus_width,
+@@ -690,7 +701,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
+ };
+ 
+ static const struct sdhci_ops sdhci_intel_glk_ops = {
+-	.set_clock		= sdhci_set_clock,
++	.set_clock		= sdhci_intel_set_clock,
+ 	.set_power		= sdhci_intel_set_power,
+ 	.enable_dma		= sdhci_pci_enable_dma,
+ 	.set_bus_width		= sdhci_set_bus_width,
+-- 
+2.51.0
+
diff --git a/queue-6.17/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-6.17/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..20083c1823
--- /dev/null
+++ b/queue-6.17/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 040398de795d1161c2a955812a11f85b4737bc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 9d8e20dc8ca11..e7df864bdcaf6 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-6.17/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-6.17/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..f07b86dc78
--- /dev/null
+++ b/queue-6.17/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From d3bef6e922fefb75fbd7f542d1c9082ed87d6571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3e12d4683ac72..03987f497a5b5 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3032,11 +3032,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-6.17/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch b/queue-6.17/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
new file mode 100644
index 0000000000..62619c50bd
--- /dev/null
+++ b/queue-6.17/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
@@ -0,0 +1,52 @@
+From 83a57d79c21f7f9fa06562893c0acb523c6e3fcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 6b7493934535a..5714d49932822 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4990,8 +4990,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ 	 * checking that they started once before, hence are reconnecting back.
+ 	 */
+ 	if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+-	    nvme_discovery_ctrl(ctrl))
++	    nvme_discovery_ctrl(ctrl)) {
++		if (!ctrl->kato) {
++			nvme_stop_keep_alive(ctrl);
++			ctrl->kato = NVME_DEFAULT_KATO;
++			nvme_start_keep_alive(ctrl);
++		}
+ 		nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++	}
+ 
+ 	if (ctrl->queue_count > 1) {
+ 		nvme_queue_scan(ctrl);
+-- 
+2.51.0
+
diff --git a/queue-6.17/nvmet-fc-avoid-scheduling-association-deletion-twice.patch b/queue-6.17/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
new file mode 100644
index 0000000000..39617fafd4
--- /dev/null
+++ b/queue-6.17/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
@@ -0,0 +1,72 @@
+From 35b4b9a517244fb0d027373f598c88a4a052722a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 6725c34dd7c90..7d84527d5a43e 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1075,6 +1075,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++	int terminating;
++
++	terminating = atomic_xchg(&assoc->terminating, 1);
++
++	/* if already terminating, do nothing */
++	if (terminating)
++		return;
++
+ 	nvmet_fc_tgtport_get(assoc->tgtport);
+ 	if (!queue_work(nvmet_wq, &assoc->del_work))
+ 		nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1202,13 +1210,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ 	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ 	unsigned long flags;
+-	int i, terminating;
+-
+-	terminating = atomic_xchg(&assoc->terminating, 1);
+-
+-	/* if already terminating, do nothing */
+-	if (terminating)
+-		return;
++	int i;
+ 
+ 	spin_lock_irqsave(&tgtport->lock, flags);
+ 	list_del_rcu(&assoc->a_list);
+-- 
+2.51.0
+
diff --git a/queue-6.17/pinctrl-keembay-release-allocated-memory-in-detach-p.patch b/queue-6.17/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
new file mode 100644
index 0000000000..1f9ff7372e
--- /dev/null
+++ b/queue-6.17/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
@@ -0,0 +1,56 @@
+From 8c3b5959d251d4d259bafbb6a86e149270cda3ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index 60cf017498b32..6aefcbc313099 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1603,7 +1603,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	 * being part of 8 (hw maximum) globally unique muxes.
+ 	 */
+ 	kpc->nfuncs = 0;
+-	keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++	keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++				     sizeof(*keembay_funcs), GFP_KERNEL);
+ 	if (!keembay_funcs)
+ 		return -ENOMEM;
+ 
+@@ -1634,7 +1635,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	}
+ 
+ 	/* Reallocate memory based on actual number of functions */
+-	new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++	new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++					kpc->nfuncs, sizeof(*new_funcs),
++					GFP_KERNEL);
+ 	if (!new_funcs) {
+ 		kfree(keembay_funcs);
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.17/pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch b/queue-6.17/pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch
new file mode 100644
index 0000000000..9c961f1240
--- /dev/null
+++ b/queue-6.17/pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch
@@ -0,0 +1,87 @@
+From df645a033541df5a742ad9a36e14e8c2a03ecd1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:40:20 +0100
+Subject: pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt
+ control registers
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 837afa592c6234be82acb5d23e0a39e9befdaa85 ]
+
+Renesas RZ/G3E supports a power-saving mode where power to most of the
+SoC components is lost, including the PIN controller.  Save and restore
+the Schmitt control register contents to ensure the functionality is
+preserved after a suspend/resume cycle.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> # on RZ/G3S
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250819084022.20512-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 22bc5b8f65fde..289917a0e8725 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -320,6 +320,7 @@ struct rzg2l_pinctrl_pin_settings {
+  * @iolh: IOLH registers cache
+  * @pupd: PUPD registers cache
+  * @ien: IEN registers cache
++ * @smt: SMT registers cache
+  * @sd_ch: SD_CH registers cache
+  * @eth_poc: ET_POC registers cache
+  * @eth_mode: ETH_MODE register cache
+@@ -333,6 +334,7 @@ struct rzg2l_pinctrl_reg_cache {
+ 	u32	*iolh[2];
+ 	u32	*ien[2];
+ 	u32	*pupd[2];
++	u32	*smt;
+ 	u8	sd_ch[2];
+ 	u8	eth_poc[2];
+ 	u8	eth_mode;
+@@ -2719,6 +2721,10 @@ static int rzg2l_pinctrl_reg_cache_alloc(struct rzg2l_pinctrl *pctrl)
+ 	if (!cache->pfc)
+ 		return -ENOMEM;
+ 
++	cache->smt = devm_kcalloc(pctrl->dev, nports, sizeof(*cache->smt), GFP_KERNEL);
++	if (!cache->smt)
++		return -ENOMEM;
++
+ 	for (u8 i = 0; i < 2; i++) {
+ 		u32 n_dedicated_pins = pctrl->data->n_dedicated_pins;
+ 
+@@ -2980,7 +2986,7 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ 	struct rzg2l_pinctrl_reg_cache *cache = pctrl->cache;
+ 
+ 	for (u32 port = 0; port < nports; port++) {
+-		bool has_iolh, has_ien, has_pupd;
++		bool has_iolh, has_ien, has_pupd, has_smt;
+ 		u32 off, caps;
+ 		u8 pincnt;
+ 		u64 cfg;
+@@ -2993,6 +2999,7 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ 		has_iolh = !!(caps & (PIN_CFG_IOLH_A | PIN_CFG_IOLH_B | PIN_CFG_IOLH_C));
+ 		has_ien = !!(caps & PIN_CFG_IEN);
+ 		has_pupd = !!(caps & PIN_CFG_PUPD);
++		has_smt = !!(caps & PIN_CFG_SMT);
+ 
+ 		if (suspend)
+ 			RZG2L_PCTRL_REG_ACCESS32(suspend, pctrl->base + PFC(off), cache->pfc[port]);
+@@ -3031,6 +3038,9 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
+ 							 cache->ien[1][port]);
+ 			}
+ 		}
++
++		if (has_smt)
++			RZG2L_PCTRL_REG_ACCESS32(suspend, pctrl->base + SMT(off), cache->smt[port]);
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-6.17/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..f8f1451dc0
--- /dev/null
+++ b/queue-6.17/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From 22c2d6fb22eb124ef7519abe2582fd8a4985a461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 5cda6201b60f5..8aedee2720bcb 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -589,8 +589,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 			/* 4 parameters */
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-6.17/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch b/queue-6.17/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
new file mode 100644
index 0000000000..766a4a3b72
--- /dev/null
+++ b/queue-6.17/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
@@ -0,0 +1,41 @@
+From ff3f99833d5fe70ef671cb3cdd94eb20620f6bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index 9467235110f46..82c33cf727a82 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++	{ .compatible = "apple,t8103-pmgr-pwrstate" },
+ 	{ .compatible = "apple,pmgr-pwrstate" },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/power-supply-qcom_battmgr-add-ooi-chemistry.patch b/queue-6.17/power-supply-qcom_battmgr-add-ooi-chemistry.patch
new file mode 100644
index 0000000000..187004dd29
--- /dev/null
+++ b/queue-6.17/power-supply-qcom_battmgr-add-ooi-chemistry.patch
@@ -0,0 +1,37 @@
+From 266dca3fd4acdef62b5578a1489e4afa945bf0f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index 99808ea9851f6..fdb2d1b883fc5 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -982,7 +982,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+ 
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+-	if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++	if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++	    (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ 		return POWER_SUPPLY_TECHNOLOGY_LION;
+ 	if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ 		return POWER_SUPPLY_TECHNOLOGY_LIPO;
+-- 
+2.51.0
+
diff --git a/queue-6.17/power-supply-qcom_battmgr-handle-charging-state-chan.patch b/queue-6.17/power-supply-qcom_battmgr-handle-charging-state-chan.patch
new file mode 100644
index 0000000000..edf73e17f6
--- /dev/null
+++ b/queue-6.17/power-supply-qcom_battmgr-handle-charging-state-chan.patch
@@ -0,0 +1,70 @@
+From 4b3bc64fbdd361161a53194993258f2ad135842a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index fdb2d1b883fc5..c9dc8b378aa1e 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -30,8 +30,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY		0x30
+ #define NOTIF_USB_PROPERTY		0x32
+ #define NOTIF_WLS_PROPERTY		0x34
+-#define NOTIF_BAT_INFO			0x81
+ #define NOTIF_BAT_STATUS		0x80
++#define NOTIF_BAT_INFO			0x81
++#define NOTIF_BAT_CHARGING_STATE	0x83
+ 
+ #define BATTMGR_BAT_INFO		0x9
+ 
+@@ -947,12 +948,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ 	}
+ 
+ 	notification = le32_to_cpu(msg->notification);
++	notification &= 0xff;
+ 	switch (notification) {
+ 	case NOTIF_BAT_INFO:
+ 		battmgr->info.valid = false;
+ 		fallthrough;
+ 	case NOTIF_BAT_STATUS:
+ 	case NOTIF_BAT_PROPERTY:
++	case NOTIF_BAT_CHARGING_STATE:
+ 		power_supply_changed(battmgr->bat_psy);
+ 		break;
+ 	case NOTIF_USB_PROPERTY:
+-- 
+2.51.0
+
diff --git a/queue-6.17/power-supply-sbs-charger-support-multiple-devices.patch b/queue-6.17/power-supply-sbs-charger-support-multiple-devices.patch
new file mode 100644
index 0000000000..031e2a8b9a
--- /dev/null
+++ b/queue-6.17/power-supply-sbs-charger-support-multiple-devices.patch
@@ -0,0 +1,114 @@
+From e0daa27ee6dca896fd2b4462dbbe2f84c987500b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[    8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[    8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G           O      5.10.147 #22
+[    8.151974] Hardware name: ALE AMB (DT)
+[    8.155828] Call trace:
+[    8.158292]  dump_backtrace+0x0/0x1d4
+[    8.161960]  show_stack+0x18/0x6c
+[    8.165280]  dump_stack+0xcc/0x128
+[    8.168687]  sysfs_warn_dup+0x60/0x7c
+[    8.172353]  sysfs_do_create_link_sd+0xf0/0x100
+[    8.176886]  sysfs_create_link+0x20/0x40
+[    8.180816]  device_add+0x270/0x7a4
+[    8.184311]  __power_supply_register+0x304/0x560
+[    8.188930]  devm_power_supply_register+0x54/0xa0
+[    8.193644]  sbs_probe+0xc0/0x214 [sbs_charger]
+[    8.198183]  i2c_device_probe+0x2dc/0x2f4
+[    8.202196]  really_probe+0xf0/0x510
+[    8.205774]  driver_probe_device+0xfc/0x160
+[    8.209960]  device_driver_attach+0xc0/0xcc
+[    8.214146]  __driver_attach+0xc0/0x170
+[    8.218002]  bus_for_each_dev+0x74/0xd4
+[    8.221862]  driver_attach+0x24/0x30
+[    8.225444]  bus_add_driver+0x148/0x250
+[    8.229283]  driver_register+0x78/0x130
+[    8.233140]  i2c_register_driver+0x4c/0xe0
+[    8.237250]  sbs_driver_init+0x20/0x1000 [sbs_charger]
+[    8.242424]  do_one_initcall+0x50/0x1b0
+[    8.242434]  do_init_module+0x44/0x230
+[    8.242438]  load_module+0x2200/0x27c0
+[    8.242442]  __do_sys_finit_module+0xa8/0x11c
+[    8.242447]  __arm64_sys_finit_module+0x20/0x30
+[    8.242457]  el0_svc_common.constprop.0+0x64/0x154
+[    8.242464]  do_el0_svc+0x24/0x8c
+[    8.242474]  el0_svc+0x10/0x20
+[    8.242481]  el0_sync_handler+0x108/0x114
+[    8.242485]  el0_sync+0x180/0x1c0
+[    8.243847] sbs-charger 20-0009: Failed to register power supply
+[    8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[    7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index 27764123b929e..7d5e676205805 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ 	.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+ 
+-static const struct power_supply_desc sbs_desc = {
+-	.name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ 	.type = POWER_SUPPLY_TYPE_MAINS,
+ 	.properties = sbs_properties,
+ 	.num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ 	struct power_supply_config psy_cfg = {};
++	struct power_supply_desc *sbs_desc;
+ 	struct sbs_info *chip;
+ 	int ret, val;
+ 
++	sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++				sizeof(*sbs_desc), GFP_KERNEL);
++	if (!sbs_desc)
++		return -ENOMEM;
++
++	sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++					dev_name(&client->dev));
++	if (!sbs_desc->name)
++		return -ENOMEM;
++
+ 	chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ 	if (!chip)
+ 		return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ 		return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ 	chip->last_state = val;
+ 
+-	chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++	chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ 	if (IS_ERR(chip->power_supply))
+ 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ 				     "Failed to register power supply\n");
+-- 
+2.51.0
+
diff --git a/queue-6.17/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch b/queue-6.17/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
new file mode 100644
index 0000000000..fd92d7a112
--- /dev/null
+++ b/queue-6.17/pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
@@ -0,0 +1,126 @@
+From 2abe0896b5a77a672d53444a9ae3aa9a40831e9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:36:01 +0200
+Subject: pwm: pca9685: Use bulk write to atomicially update registers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit de5855613263b426ee697dd30224322f2e634dec ]
+
+The output of a PWM channel is configured by four register values. Write
+them in a single i2c transaction to ensure glitch free updates.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bfa8c0267c9ec059d0d77f146998d564654c75ca.1753784092.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 46 ++++++++++++++++++++++++---------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 9ce75704a15f8..91f96b28ce1b5 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -61,6 +61,8 @@
+ #define MODE1_SUB2		BIT(2)
+ #define MODE1_SUB1		BIT(3)
+ #define MODE1_SLEEP		BIT(4)
++#define MODE1_AI		BIT(5)
++
+ #define MODE2_INVRT		BIT(4)
+ #define MODE2_OUTDRV		BIT(2)
+ 
+@@ -131,6 +133,19 @@ static int pca9685_write_reg(struct pwm_chip *chip, unsigned int reg, unsigned i
+ 	return err;
+ }
+ 
++static int pca9685_write_4reg(struct pwm_chip *chip, unsigned int reg, u8 val[4])
++{
++	struct pca9685 *pca = to_pca(chip);
++	struct device *dev = pwmchip_parent(chip);
++	int err;
++
++	err = regmap_bulk_write(pca->regmap, reg, val, 4);
++	if (err)
++		dev_err(dev, "regmap_write to register 0x%x failed: %pe\n", reg, ERR_PTR(err));
++
++	return err;
++}
++
+ /* Helper function to set the duty cycle ratio to duty/4096 (e.g. duty=2048 -> 50%) */
+ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned int duty)
+ {
+@@ -143,12 +158,10 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ 		return;
+ 	} else if (duty >= PCA9685_COUNTER_RANGE) {
+ 		/* Set the full ON bit and clear the full OFF bit */
+-		pca9685_write_reg(chip, REG_ON_H(channel), LED_FULL);
+-		pca9685_write_reg(chip, REG_OFF_H(channel), 0);
++		pca9685_write_4reg(chip, REG_ON_L(channel), (u8[4]){ 0, LED_FULL, 0, 0 });
+ 		return;
+ 	}
+ 
+-
+ 	if (pwm->state.usage_power && channel < PCA9685_MAXCHAN) {
+ 		/*
+ 		 * If usage_power is set, the pca9685 driver will phase shift
+@@ -163,12 +176,9 @@ static void pca9685_pwm_set_duty(struct pwm_chip *chip, int channel, unsigned in
+ 
+ 	off = (on + duty) % PCA9685_COUNTER_RANGE;
+ 
+-	/* Set ON time (clears full ON bit) */
+-	pca9685_write_reg(chip, REG_ON_L(channel), on & 0xff);
+-	pca9685_write_reg(chip, REG_ON_H(channel), (on >> 8) & 0xf);
+-	/* Set OFF time (clears full OFF bit) */
+-	pca9685_write_reg(chip, REG_OFF_L(channel), off & 0xff);
+-	pca9685_write_reg(chip, REG_OFF_H(channel), (off >> 8) & 0xf);
++	/* implicitly clear full ON and full OFF bit */
++	pca9685_write_4reg(chip, REG_ON_L(channel),
++			   (u8[4]){ on & 0xff, (on >> 8) & 0xf, off & 0xff, (off >> 8) & 0xf });
+ }
+ 
+ static unsigned int pca9685_pwm_get_duty(struct pwm_chip *chip, int channel)
+@@ -544,9 +554,8 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ 
+ 	mutex_init(&pca->lock);
+ 
+-	ret = pca9685_read_reg(chip, PCA9685_MODE2, &reg);
+-	if (ret)
+-		return ret;
++	/* clear MODE2_OCH */
++	reg = 0;
+ 
+ 	if (device_property_read_bool(&client->dev, "invert"))
+ 		reg |= MODE2_INVRT;
+@@ -562,16 +571,19 @@ static int pca9685_pwm_probe(struct i2c_client *client)
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Disable all LED ALLCALL and SUBx addresses to avoid bus collisions */
++	/*
++	 * Disable all LED ALLCALL and SUBx addresses to avoid bus collisions,
++	 * enable Auto-Increment.
++	 */
+ 	pca9685_read_reg(chip, PCA9685_MODE1, &reg);
+ 	reg &= ~(MODE1_ALLCALL | MODE1_SUB1 | MODE1_SUB2 | MODE1_SUB3);
++	reg |= MODE1_AI;
+ 	pca9685_write_reg(chip, PCA9685_MODE1, reg);
+ 
+ 	/* Reset OFF/ON registers to POR default */
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_L, 0);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_OFF_H, LED_FULL);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_ON_L, 0);
+-	pca9685_write_reg(chip, PCA9685_ALL_LED_ON_H, LED_FULL);
++	ret = pca9685_write_4reg(chip, PCA9685_ALL_LED_ON_L, (u8[]){ 0, LED_FULL, 0, LED_FULL });
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret, "Failed to reset ON/OFF registers\n");
+ 
+ 	chip->ops = &pca9685_pwm_ops;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/riscv-bpf-fix-uninitialized-symbol-retval_off.patch b/queue-6.17/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
new file mode 100644
index 0000000000..877726b520
--- /dev/null
+++ b/queue-6.17/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
@@ -0,0 +1,48 @@
+From 943c3ffdef77e03f12a1aeab4ed87f9a5ee462f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index f1efa4d6b27f3..bad8c47ed4a7f 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -1112,10 +1112,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ 	stack_size += 16;
+ 
+ 	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+-	if (save_ret) {
++	if (save_ret)
+ 		stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+-		retval_off = stack_size;
+-	}
++	retval_off = stack_size;
+ 
+ 	stack_size += nr_arg_slots * 8;
+ 	args_off = stack_size;
+-- 
+2.51.0
+
diff --git a/queue-6.17/rust-kunit-allow-cfg-on-test-s.patch b/queue-6.17/rust-kunit-allow-cfg-on-test-s.patch
new file mode 100644
index 0000000000..4bea2bcd24
--- /dev/null
+++ b/queue-6.17/rust-kunit-allow-cfg-on-test-s.patch
@@ -0,0 +1,139 @@
+From 0b340691cf9bfb70e32b5818c3d00d8b5593e687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 22:12:56 -0400
+Subject: rust: kunit: allow `cfg` on `test`s
+
+From: Kaibo Ma <ent3rm4n@gmail.com>
+
+[ Upstream commit c652dc44192d96820d73a7ecd89d275ca7e4355d ]
+
+The `kunit_test` proc macro only checks for the `test` attribute
+immediately preceding a `fn`. If the function is disabled via a `cfg`,
+the generated code would result in a compile error referencing a
+non-existent function [1].
+
+This collects attributes and specifically cherry-picks `cfg` attributes
+to be duplicated inside KUnit wrapper functions such that a test function
+disabled via `cfg` compiles and is marked as skipped in KUnit correctly.
+
+Link: https://lore.kernel.org/r/20250916021259.115578-1-ent3rm4n@gmail.com
+Link: https://lore.kernel.org/rust-for-linux/CANiq72==48=69hYiDo1321pCzgn_n1_jg=ez5UYXX91c+g5JVQ@mail.gmail.com/ [1]
+Closes: https://github.com/Rust-for-Linux/linux/issues/1185
+Suggested-by: Miguel Ojeda <ojeda@kernel.org>
+Suggested-by: David Gow <davidgow@google.com>
+Signed-off-by: Kaibo Ma <ent3rm4n@gmail.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/kunit.rs |  7 +++++++
+ rust/macros/kunit.rs | 48 +++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 43 insertions(+), 12 deletions(-)
+
+diff --git a/rust/kernel/kunit.rs b/rust/kernel/kunit.rs
+index 41efd87595d6e..32640dfc968fe 100644
+--- a/rust/kernel/kunit.rs
++++ b/rust/kernel/kunit.rs
+@@ -357,4 +357,11 @@ mod tests {
+     fn rust_test_kunit_in_kunit_test() {
+         assert!(in_kunit_test());
+     }
++
++    #[test]
++    #[cfg(not(all()))]
++    fn rust_test_kunit_always_disabled_test() {
++        // This test should never run because of the `cfg`.
++        assert!(false);
++    }
+ }
+diff --git a/rust/macros/kunit.rs b/rust/macros/kunit.rs
+index 81d18149a0cc9..b395bb0536959 100644
+--- a/rust/macros/kunit.rs
++++ b/rust/macros/kunit.rs
+@@ -5,6 +5,7 @@
+ //! Copyright (c) 2023 José Expósito <jose.exposito89@gmail.com>
+ 
+ use proc_macro::{Delimiter, Group, TokenStream, TokenTree};
++use std::collections::HashMap;
+ use std::fmt::Write;
+ 
+ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+@@ -41,20 +42,32 @@ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+     // Get the functions set as tests. Search for `[test]` -> `fn`.
+     let mut body_it = body.stream().into_iter();
+     let mut tests = Vec::new();
++    let mut attributes: HashMap<String, TokenStream> = HashMap::new();
+     while let Some(token) = body_it.next() {
+         match token {
+-            TokenTree::Group(ident) if ident.to_string() == "[test]" => match body_it.next() {
+-                Some(TokenTree::Ident(ident)) if ident.to_string() == "fn" => {
+-                    let test_name = match body_it.next() {
+-                        Some(TokenTree::Ident(ident)) => ident.to_string(),
+-                        _ => continue,
+-                    };
+-                    tests.push(test_name);
++            TokenTree::Punct(ref p) if p.as_char() == '#' => match body_it.next() {
++                Some(TokenTree::Group(g)) if g.delimiter() == Delimiter::Bracket => {
++                    if let Some(TokenTree::Ident(name)) = g.stream().into_iter().next() {
++                        // Collect attributes because we need to find which are tests. We also
++                        // need to copy `cfg` attributes so tests can be conditionally enabled.
++                        attributes
++                            .entry(name.to_string())
++                            .or_default()
++                            .extend([token, TokenTree::Group(g)]);
++                    }
++                    continue;
+                 }
+-                _ => continue,
++                _ => (),
+             },
++            TokenTree::Ident(i) if i.to_string() == "fn" && attributes.contains_key("test") => {
++                if let Some(TokenTree::Ident(test_name)) = body_it.next() {
++                    tests.push((test_name, attributes.remove("cfg").unwrap_or_default()))
++                }
++            }
++
+             _ => (),
+         }
++        attributes.clear();
+     }
+ 
+     // Add `#[cfg(CONFIG_KUNIT="y")]` before the module declaration.
+@@ -100,11 +113,22 @@ pub(crate) fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
+     let mut test_cases = "".to_owned();
+     let mut assert_macros = "".to_owned();
+     let path = crate::helpers::file();
+-    for test in &tests {
++    let num_tests = tests.len();
++    for (test, cfg_attr) in tests {
+         let kunit_wrapper_fn_name = format!("kunit_rust_wrapper_{test}");
+-        // An extra `use` is used here to reduce the length of the message.
++        // Append any `cfg` attributes the user might have written on their tests so we don't
++        // attempt to call them when they are `cfg`'d out. An extra `use` is used here to reduce
++        // the length of the assert message.
+         let kunit_wrapper = format!(
+-            "unsafe extern \"C\" fn {kunit_wrapper_fn_name}(_test: *mut ::kernel::bindings::kunit) {{ use ::kernel::kunit::is_test_result_ok; assert!(is_test_result_ok({test}())); }}",
++            r#"unsafe extern "C" fn {kunit_wrapper_fn_name}(_test: *mut ::kernel::bindings::kunit)
++            {{
++                (*_test).status = ::kernel::bindings::kunit_status_KUNIT_SKIPPED;
++                {cfg_attr} {{
++                    (*_test).status = ::kernel::bindings::kunit_status_KUNIT_SUCCESS;
++                    use ::kernel::kunit::is_test_result_ok;
++                    assert!(is_test_result_ok({test}()));
++                }}
++            }}"#,
+         );
+         writeln!(kunit_macros, "{kunit_wrapper}").unwrap();
+         writeln!(
+@@ -139,7 +163,7 @@ macro_rules! assert_eq {{
+     writeln!(
+         kunit_macros,
+         "static mut TEST_CASES: [::kernel::bindings::kunit_case; {}] = [\n{test_cases}    ::kernel::kunit::kunit_case_null(),\n];",
+-        tests.len() + 1
++        num_tests + 1
+     )
+     .unwrap();
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-fix-arena_spin_lock-selftest-failure.patch b/queue-6.17/selftests-bpf-fix-arena_spin_lock-selftest-failure.patch
new file mode 100644
index 0000000000..1fff9ad2dc
--- /dev/null
+++ b/queue-6.17/selftests-bpf-fix-arena_spin_lock-selftest-failure.patch
@@ -0,0 +1,86 @@
+From 0f341401bb6516b8354fa597491f7c6abb77a3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 14:43:37 +0530
+Subject: selftests/bpf: Fix arena_spin_lock selftest failure
+
+From: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+
+[ Upstream commit a9d4e9f0e871352a48a82da11a50df7196fe567a ]
+
+For systems having CONFIG_NR_CPUS set to > 1024 in kernel config
+the selftest fails as arena_spin_lock_irqsave() returns EOPNOTSUPP.
+(eg - incase of powerpc default value for CONFIG_NR_CPUS is 8192)
+
+The selftest is skipped incase bpf program returns EOPNOTSUPP,
+with a descriptive message logged.
+
+Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
+Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+Link: https://lore.kernel.org/r/20250913091337.1841916-1-skb99@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/arena_spin_lock.c      | 13 +++++++++++++
+ tools/testing/selftests/bpf/progs/arena_spin_lock.c |  5 ++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c b/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
+index 0223fce4db2bc..693fd86fbde62 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
++++ b/tools/testing/selftests/bpf/prog_tests/arena_spin_lock.c
+@@ -40,8 +40,13 @@ static void *spin_lock_thread(void *arg)
+ 
+ 	err = bpf_prog_test_run_opts(prog_fd, &topts);
+ 	ASSERT_OK(err, "test_run err");
++
++	if (topts.retval == -EOPNOTSUPP)
++		goto end;
++
+ 	ASSERT_EQ((int)topts.retval, 0, "test_run retval");
+ 
++end:
+ 	pthread_exit(arg);
+ }
+ 
+@@ -63,6 +68,7 @@ static void test_arena_spin_lock_size(int size)
+ 	skel = arena_spin_lock__open_and_load();
+ 	if (!ASSERT_OK_PTR(skel, "arena_spin_lock__open_and_load"))
+ 		return;
++
+ 	if (skel->data->test_skip == 2) {
+ 		test__skip();
+ 		goto end;
+@@ -86,6 +92,13 @@ static void test_arena_spin_lock_size(int size)
+ 			goto end_barrier;
+ 	}
+ 
++	if (skel->data->test_skip == 3) {
++		printf("%s:SKIP: CONFIG_NR_CPUS exceed the maximum supported by arena spinlock\n",
++		       __func__);
++		test__skip();
++		goto end_barrier;
++	}
++
+ 	ASSERT_EQ(skel->bss->counter, repeat * nthreads, "check counter value");
+ 
+ end_barrier:
+diff --git a/tools/testing/selftests/bpf/progs/arena_spin_lock.c b/tools/testing/selftests/bpf/progs/arena_spin_lock.c
+index c4500c37f85e0..086b57a426cf5 100644
+--- a/tools/testing/selftests/bpf/progs/arena_spin_lock.c
++++ b/tools/testing/selftests/bpf/progs/arena_spin_lock.c
+@@ -37,8 +37,11 @@ int prog(void *ctx)
+ #if defined(ENABLE_ATOMICS_TESTS) && defined(__BPF_FEATURE_ADDR_SPACE_CAST)
+ 	unsigned long flags;
+ 
+-	if ((ret = arena_spin_lock_irqsave(&lock, flags)))
++	if ((ret = arena_spin_lock_irqsave(&lock, flags))) {
++		if (ret == -EOPNOTSUPP)
++			test_skip = 3;
+ 		return ret;
++	}
+ 	if (counter != limit)
+ 		counter++;
+ 	bpf_repeat(cs_count);
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-6.17/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..02ca2f0b4e
--- /dev/null
+++ b/queue-6.17/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From 6abae000c05cdfb9b9a5464c089be38ff59ddfca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch b/queue-6.17/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
new file mode 100644
index 0000000000..d7ecd8544a
--- /dev/null
+++ b/queue-6.17/selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
@@ -0,0 +1,53 @@
+From 1de6427bfd12ecb0864a0b5566cc14df6f440526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:52:30 +0100
+Subject: selftests/bpf: Fix flaky bpf_cookie selftest
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 ]
+
+bpf_cookie can fail on perf_event_open(), when it runs after the task_work
+selftest. The task_work test causes perf to lower
+sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq,
+which is validated against that sysctl. As a result,
+perf_event_open() rejects the attr if the (now tighter) limit is
+exceeded.
+
+>From perf_event_open():
+if (attr.freq) {
+	if (attr.sample_freq > sysctl_perf_event_sample_rate)
+		return -EINVAL;
+} else {
+	if (attr.sample_period & (1ULL << 63))
+		return -EINVAL;
+}
+
+Switch bpf_cookie to use sample_period, which is not checked against
+sysctl_perf_event_sample_rate.
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bpf_cookie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+index 4a0670c056bad..75f4dff7d0422 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
++++ b/tools/testing/selftests/bpf/prog_tests/bpf_cookie.c
+@@ -450,8 +450,7 @@ static void pe_subtest(struct test_bpf_cookie *skel)
+ 	attr.size = sizeof(attr);
+ 	attr.type = PERF_TYPE_SOFTWARE;
+ 	attr.config = PERF_COUNT_SW_CPU_CLOCK;
+-	attr.freq = 1;
+-	attr.sample_freq = 10000;
++	attr.sample_period = 100000;
+ 	pfd = syscall(__NR_perf_event_open, &attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC);
+ 	if (!ASSERT_GE(pfd, 0, "perf_fd"))
+ 		goto cleanup;
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-fix-incorrect-array-size-calculation.patch b/queue-6.17/selftests-bpf-fix-incorrect-array-size-calculation.patch
new file mode 100644
index 0000000000..0fdd2ac61e
--- /dev/null
+++ b/queue-6.17/selftests-bpf-fix-incorrect-array-size-calculation.patch
@@ -0,0 +1,59 @@
+From ea050ec9cc0da7c0ecb8e1981e3a9f765a32c3d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:47:04 +0800
+Subject: selftests/bpf: Fix incorrect array size calculation
+
+From: Jiayuan Chen <jiayuan.chen@linux.dev>
+
+[ Upstream commit f85981327a90c51e76f60e073cb6648b2f167226 ]
+
+The loop in bench_sockmap_prog_destroy() has two issues:
+
+1. Using 'sizeof(ctx.fds)' as the loop bound results in the number of
+   bytes, not the number of file descriptors, causing the loop to iterate
+   far more times than intended.
+
+2. The condition 'ctx.fds[0] > 0' incorrectly checks only the first fd for
+   all iterations, potentially leaving file descriptors unclosed. Change
+   it to 'ctx.fds[i] > 0' to check each fd properly.
+
+These fixes ensure correct cleanup of all file descriptors when the
+benchmark exits.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250909124721.191555-1-jiayuan.chen@linux.dev
+
+Closes: https://lore.kernel.org/bpf/aLqfWuRR9R_KTe5e@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/benchs/bench_sockmap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/benchs/bench_sockmap.c b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
+index 8ebf563a67a2b..cfc072aa7fff7 100644
+--- a/tools/testing/selftests/bpf/benchs/bench_sockmap.c
++++ b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
+@@ -10,6 +10,7 @@
+ #include <argp.h>
+ #include "bench.h"
+ #include "bench_sockmap_prog.skel.h"
++#include "bpf_util.h"
+ 
+ #define FILE_SIZE (128 * 1024)
+ #define DATA_REPEAT_SIZE 10
+@@ -124,8 +125,8 @@ static void bench_sockmap_prog_destroy(void)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < sizeof(ctx.fds); i++) {
+-		if (ctx.fds[0] > 0)
++	for (i = 0; i < ARRAY_SIZE(ctx.fds); i++) {
++		if (ctx.fds[i] > 0)
+ 			close(ctx.fds[i]);
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch b/queue-6.17/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
new file mode 100644
index 0000000000..52da09b479
--- /dev/null
+++ b/queue-6.17/selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
@@ -0,0 +1,83 @@
+From 36e913c8d03ead9017aa615ff3a3c147cce5e0ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 21:58:05 -0700
+Subject: selftests/bpf: Fix selftest verifier_arena_large failure
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 5a427fddec5e76360725a0f03df3a2a003efbe2e ]
+
+With latest llvm22, I got the following verification failure:
+
+  ...
+  ; int big_alloc2(void *ctx) @ verifier_arena_large.c:207
+  0: (b4) w6 = 1                        ; R6_w=1
+  ...
+  ; if (err) @ verifier_arena_large.c:233
+  53: (56) if w6 != 0x0 goto pc+62      ; R6=0
+  54: (b7) r7 = -4                      ; R7_w=-4
+  55: (18) r8 = 0x7f4000000000          ; R8_w=scalar()
+  57: (bf) r9 = addr_space_cast(r8, 0, 1)       ; R8_w=scalar() R9_w=arena
+  58: (b4) w6 = 5                       ; R6_w=5
+  ; pg = page[i]; @ verifier_arena_large.c:238
+  59: (bf) r1 = r7                      ; R1_w=-4 R7_w=-4
+  60: (07) r1 += 4                      ; R1_w=0
+  61: (79) r2 = *(u64 *)(r9 +0)         ; R2_w=scalar() R9_w=arena
+  ; if (*pg != i) @ verifier_arena_large.c:239
+  62: (bf) r3 = addr_space_cast(r2, 0, 1)       ; R2_w=scalar() R3_w=arena
+  63: (71) r3 = *(u8 *)(r3 +0)          ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+  64: (5d) if r1 != r3 goto pc+51       ; R1_w=0 R3_w=0
+  ; bpf_arena_free_pages(&arena, (void __arena *)pg, 2); @ verifier_arena_large.c:241
+  65: (18) r1 = 0xff11000114548000      ; R1_w=map_ptr(map=arena,ks=0,vs=0)
+  67: (b4) w3 = 2                       ; R3_w=2
+  68: (85) call bpf_arena_free_pages#72675      ;
+  69: (b7) r1 = 0                       ; R1_w=0
+  ; page[i + 1] = NULL; @ verifier_arena_large.c:243
+  70: (7b) *(u64 *)(r8 +8) = r1
+  R8 invalid mem access 'scalar'
+  processed 61 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 2
+  =============
+  #489/5   verifier_arena_large/big_alloc2:FAIL
+
+The main reason is that 'r8' in insn '70' is not an arena pointer.
+Further debugging at llvm side shows that llvm commit ([1]) caused
+the failure. For the original code:
+  page[i] = NULL;
+  page[i + 1] = NULL;
+the llvm transformed it to something like below at source level:
+  __builtin_memset(&page[i], 0, 16)
+Such transformation prevents llvm BPFCheckAndAdjustIR pass from
+generating proper addr_space_cast insns ([2]).
+
+Adding support in llvm BPFCheckAndAdjustIR pass should work, but
+not sure that such a pattern exists or not in real applications.
+At the same time, simply adding a memory barrier between two 'page'
+assignment can fix the issue.
+
+  [1] https://github.com/llvm/llvm-project/pull/155415
+  [2] https://github.com/llvm/llvm-project/pull/84410
+
+Cc: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250920045805.3288551-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/verifier_arena_large.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_large.c b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+index 9dbdf123542d3..f19e15400b3e1 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_arena_large.c
++++ b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+@@ -240,6 +240,7 @@ int big_alloc2(void *ctx)
+ 			return 5;
+ 		bpf_arena_free_pages(&arena, (void __arena *)pg, 2);
+ 		page[i] = NULL;
++		barrier();
+ 		page[i + 1] = NULL;
+ 		cond_break;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch b/queue-6.17/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
new file mode 100644
index 0000000000..5911c267d6
--- /dev/null
+++ b/queue-6.17/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
@@ -0,0 +1,39 @@
+From b7d0d1bef69dd48c4b269303ae17aed18ef490db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 65aafe0003db0..62db060298a4a 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -241,4 +241,6 @@ done
+ 
+ if [ $failures -eq 0 ]; then
+         echo "All tests successful!"
++else
++	exit 1
+ fi
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-pull-data-before-parsing-headers.patch b/queue-6.17/selftests-drv-net-pull-data-before-parsing-headers.patch
new file mode 100644
index 0000000000..d39364697e
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-pull-data-before-parsing-headers.patch
@@ -0,0 +1,185 @@
+From 9499c8be493162c70ef641056286d761785ab27b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:56 -0700
+Subject: selftests: drv-net: Pull data before parsing headers
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit efec2e55bdefb889639a6e7fe1f1f2431cdddc6a ]
+
+It is possible for drivers to generate xdp packets with data residing
+entirely in fragments. To keep parsing headers using direct packet
+access, call bpf_xdp_pull_data() to pull headers into the linear data
+area.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20250922233356.3356453-9-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/lib/xdp_native.bpf.c        | 89 +++++++++++++++----
+ 1 file changed, 74 insertions(+), 15 deletions(-)
+
+diff --git a/tools/testing/selftests/net/lib/xdp_native.bpf.c b/tools/testing/selftests/net/lib/xdp_native.bpf.c
+index 521ba38f2ddda..df4eea5c192b3 100644
+--- a/tools/testing/selftests/net/lib/xdp_native.bpf.c
++++ b/tools/testing/selftests/net/lib/xdp_native.bpf.c
+@@ -14,6 +14,8 @@
+ #define MAX_PAYLOAD_LEN 5000
+ #define MAX_HDR_LEN 64
+ 
++extern int bpf_xdp_pull_data(struct xdp_md *xdp, __u32 len) __ksym __weak;
++
+ enum {
+ 	XDP_MODE = 0,
+ 	XDP_PORT = 1,
+@@ -68,30 +70,57 @@ static void record_stats(struct xdp_md *ctx, __u32 stat_type)
+ 
+ static struct udphdr *filter_udphdr(struct xdp_md *ctx, __u16 port)
+ {
+-	void *data_end = (void *)(long)ctx->data_end;
+-	void *data = (void *)(long)ctx->data;
+ 	struct udphdr *udph = NULL;
+-	struct ethhdr *eth = data;
++	void *data, *data_end;
++	struct ethhdr *eth;
++	int err;
++
++	err = bpf_xdp_pull_data(ctx, sizeof(*eth));
++	if (err)
++		return NULL;
++
++	data_end = (void *)(long)ctx->data_end;
++	data = eth = (void *)(long)ctx->data;
+ 
+ 	if (data + sizeof(*eth) > data_end)
+ 		return NULL;
+ 
+ 	if (eth->h_proto == bpf_htons(ETH_P_IP)) {
+-		struct iphdr *iph = data + sizeof(*eth);
++		struct iphdr *iph;
++
++		err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*iph) +
++					     sizeof(*udph));
++		if (err)
++			return NULL;
++
++		data_end = (void *)(long)ctx->data_end;
++		data = (void *)(long)ctx->data;
++
++		iph = data + sizeof(*eth);
+ 
+ 		if (iph + 1 > (struct iphdr *)data_end ||
+ 		    iph->protocol != IPPROTO_UDP)
+ 			return NULL;
+ 
+-		udph = (void *)eth + sizeof(*iph) + sizeof(*eth);
+-	} else if (eth->h_proto  == bpf_htons(ETH_P_IPV6)) {
+-		struct ipv6hdr *ipv6h = data + sizeof(*eth);
++		udph = data + sizeof(*iph) + sizeof(*eth);
++	} else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
++		struct ipv6hdr *ipv6h;
++
++		err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*ipv6h) +
++					     sizeof(*udph));
++		if (err)
++			return NULL;
++
++		data_end = (void *)(long)ctx->data_end;
++		data = (void *)(long)ctx->data;
++
++		ipv6h = data + sizeof(*eth);
+ 
+ 		if (ipv6h + 1 > (struct ipv6hdr *)data_end ||
+ 		    ipv6h->nexthdr != IPPROTO_UDP)
+ 			return NULL;
+ 
+-		udph = (void *)eth + sizeof(*ipv6h) + sizeof(*eth);
++		udph = data + sizeof(*ipv6h) + sizeof(*eth);
+ 	} else {
+ 		return NULL;
+ 	}
+@@ -145,17 +174,34 @@ static void swap_machdr(void *data)
+ 
+ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ {
+-	void *data_end = (void *)(long)ctx->data_end;
+-	void *data = (void *)(long)ctx->data;
+ 	struct udphdr *udph = NULL;
+-	struct ethhdr *eth = data;
++	void *data, *data_end;
++	struct ethhdr *eth;
++	int err;
++
++	err = bpf_xdp_pull_data(ctx, sizeof(*eth));
++	if (err)
++		return XDP_PASS;
++
++	data_end = (void *)(long)ctx->data_end;
++	data = eth = (void *)(long)ctx->data;
+ 
+ 	if (data + sizeof(*eth) > data_end)
+ 		return XDP_PASS;
+ 
+ 	if (eth->h_proto == bpf_htons(ETH_P_IP)) {
+-		struct iphdr *iph = data + sizeof(*eth);
+-		__be32 tmp_ip = iph->saddr;
++		struct iphdr *iph;
++		__be32 tmp_ip;
++
++		err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*iph) +
++					     sizeof(*udph));
++		if (err)
++			return XDP_PASS;
++
++		data_end = (void *)(long)ctx->data_end;
++		data = (void *)(long)ctx->data;
++
++		iph = data + sizeof(*eth);
+ 
+ 		if (iph + 1 > (struct iphdr *)data_end ||
+ 		    iph->protocol != IPPROTO_UDP)
+@@ -169,8 +215,10 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ 			return XDP_PASS;
+ 
+ 		record_stats(ctx, STATS_RX);
++		eth = data;
+ 		swap_machdr((void *)eth);
+ 
++		tmp_ip = iph->saddr;
+ 		iph->saddr = iph->daddr;
+ 		iph->daddr = tmp_ip;
+ 
+@@ -178,9 +226,19 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ 
+ 		return XDP_TX;
+ 
+-	} else if (eth->h_proto  == bpf_htons(ETH_P_IPV6)) {
+-		struct ipv6hdr *ipv6h = data + sizeof(*eth);
++	} else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {
+ 		struct in6_addr tmp_ipv6;
++		struct ipv6hdr *ipv6h;
++
++		err = bpf_xdp_pull_data(ctx, sizeof(*eth) + sizeof(*ipv6h) +
++					     sizeof(*udph));
++		if (err)
++			return XDP_PASS;
++
++		data_end = (void *)(long)ctx->data_end;
++		data = (void *)(long)ctx->data;
++
++		ipv6h = data + sizeof(*eth);
+ 
+ 		if (ipv6h + 1 > (struct ipv6hdr *)data_end ||
+ 		    ipv6h->nexthdr != IPPROTO_UDP)
+@@ -194,6 +252,7 @@ static int xdp_mode_tx_handler(struct xdp_md *ctx, __u16 port)
+ 			return XDP_PASS;
+ 
+ 		record_stats(ctx, STATS_RX);
++		eth = data;
+ 		swap_machdr((void *)eth);
+ 
+ 		__builtin_memcpy(&tmp_ipv6, &ipv6h->saddr, sizeof(tmp_ipv6));
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-ublk-fix-behavior-when-fio-is-not-installe.patch b/queue-6.17/selftests-ublk-fix-behavior-when-fio-is-not-installe.patch
new file mode 100644
index 0000000000..6db9f4a7f5
--- /dev/null
+++ b/queue-6.17/selftests-ublk-fix-behavior-when-fio-is-not-installe.patch
@@ -0,0 +1,131 @@
+From 465b042f303f1156ece10d0a2fe932c3e2617427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 18:42:52 -0600
+Subject: selftests: ublk: fix behavior when fio is not installed
+
+From: Uday Shankar <ushankar@purestorage.com>
+
+[ Upstream commit a3835a44107fcbf05f183b5e8b60a8e4605b15ea ]
+
+Some ublk selftests have strange behavior when fio is not installed.
+While most tests behave correctly (run if they don't need fio, or skip
+if they need fio), the following tests have different behavior:
+
+- test_null_01, test_null_02, test_generic_01, test_generic_02, and
+  test_generic_12 try to run fio without checking if it exists first,
+  and fail on any failure of the fio command (including "fio command
+  not found"). So these tests fail when they should skip.
+- test_stress_05 runs fio without checking if it exists first, but
+  doesn't fail on fio command failure. This test passes, but that pass
+  is misleading as the test doesn't do anything useful without fio
+  installed. So this test passes when it should skip.
+
+Fix these issues by adding _have_program fio checks to the top of all of
+these tests.
+
+Signed-off-by: Uday Shankar <ushankar@purestorage.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ublk/test_generic_01.sh | 4 ++++
+ tools/testing/selftests/ublk/test_generic_02.sh | 4 ++++
+ tools/testing/selftests/ublk/test_generic_12.sh | 4 ++++
+ tools/testing/selftests/ublk/test_null_01.sh    | 4 ++++
+ tools/testing/selftests/ublk/test_null_02.sh    | 4 ++++
+ tools/testing/selftests/ublk/test_stress_05.sh  | 4 ++++
+ 6 files changed, 24 insertions(+)
+
+diff --git a/tools/testing/selftests/ublk/test_generic_01.sh b/tools/testing/selftests/ublk/test_generic_01.sh
+index 9227a208ba531..21a31cd5491aa 100755
+--- a/tools/testing/selftests/ublk/test_generic_01.sh
++++ b/tools/testing/selftests/ublk/test_generic_01.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ 	exit "$UBLK_SKIP_CODE"
+ fi
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "sequential io order"
+ 
+ dev_id=$(_add_ublk_dev -t null)
+diff --git a/tools/testing/selftests/ublk/test_generic_02.sh b/tools/testing/selftests/ublk/test_generic_02.sh
+index 3e80121e3bf5e..12920768b1a08 100755
+--- a/tools/testing/selftests/ublk/test_generic_02.sh
++++ b/tools/testing/selftests/ublk/test_generic_02.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ 	exit "$UBLK_SKIP_CODE"
+ fi
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "sequential io order for MQ"
+ 
+ dev_id=$(_add_ublk_dev -t null -q 2)
+diff --git a/tools/testing/selftests/ublk/test_generic_12.sh b/tools/testing/selftests/ublk/test_generic_12.sh
+index 7abbb00d251df..b4046201b4d99 100755
+--- a/tools/testing/selftests/ublk/test_generic_12.sh
++++ b/tools/testing/selftests/ublk/test_generic_12.sh
+@@ -10,6 +10,10 @@ if ! _have_program bpftrace; then
+ 	exit "$UBLK_SKIP_CODE"
+ fi
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "do imbalanced load, it should be balanced over I/O threads"
+ 
+ NTHREADS=6
+diff --git a/tools/testing/selftests/ublk/test_null_01.sh b/tools/testing/selftests/ublk/test_null_01.sh
+index a34203f726685..c2cb8f7a09fe3 100755
+--- a/tools/testing/selftests/ublk/test_null_01.sh
++++ b/tools/testing/selftests/ublk/test_null_01.sh
+@@ -6,6 +6,10 @@
+ TID="null_01"
+ ERR_CODE=0
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "basic IO test"
+ 
+ dev_id=$(_add_ublk_dev -t null)
+diff --git a/tools/testing/selftests/ublk/test_null_02.sh b/tools/testing/selftests/ublk/test_null_02.sh
+index 5633ca8766554..8accd35beb55c 100755
+--- a/tools/testing/selftests/ublk/test_null_02.sh
++++ b/tools/testing/selftests/ublk/test_null_02.sh
+@@ -6,6 +6,10 @@
+ TID="null_02"
+ ERR_CODE=0
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ _prep_test "null" "basic IO test with zero copy"
+ 
+ dev_id=$(_add_ublk_dev -t null -z)
+diff --git a/tools/testing/selftests/ublk/test_stress_05.sh b/tools/testing/selftests/ublk/test_stress_05.sh
+index 566cfd90d192c..274295061042e 100755
+--- a/tools/testing/selftests/ublk/test_stress_05.sh
++++ b/tools/testing/selftests/ublk/test_stress_05.sh
+@@ -5,6 +5,10 @@
+ TID="stress_05"
+ ERR_CODE=0
+ 
++if ! _have_program fio; then
++	exit "$UBLK_SKIP_CODE"
++fi
++
+ run_io_and_remove()
+ {
+ 	local size=$1
+-- 
+2.51.0
+
diff --git a/queue-6.17/series b/queue-6.17/series
index af69859b43..10196f94fc 100644
--- a/queue-6.17/series
+++ b/queue-6.17/series
@@ -114,3 +114,114 @@ cpuidle-governors-menu-select-polling-state-in-some-more-cases.patch
 pm-hibernate-combine-return-paths-in-power_down.patch
 pm-sleep-allow-pm_restrict_gfp_mask-stacking.patch
 mfd-kempld-switch-back-to-earlier-init-behavior.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+firmware-qcom-scm-preserve-assign_mem-error-return-v.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch
+soc-ti-pruss-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+mmc-sdhci-disable-sd-card-clock-before-changing-para.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+cpufreq-ti-add-support-for-am62d2.patch
+bpf-use-tnums-for-jeq-jne-is_branch_taken-logic.patch
+firmware-ti_sci-enable-abort-handling-of-entry-to-lp.patch
+firewire-ohci-move-self_id_complete-tracepoint-after.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+irqchip-loongson-eiointc-route-interrupt-parsed-from.patch
+io_uring-zctx-check-chained-notif-contexts.patch
+acpi-sysfs-use-acpi_free-for-freeing-an-acpi-object.patch
+acpi-video-force-native-for-lenovo-82k8.patch
+libbpf-fix-usdt-sib-argument-handling-causing-unreco.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+arm64-versal-net-update-rtc-calibration-value.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+firmware-qcom-scm-allow-qseecom-on-dell-inspiron-744.patch
+kselftest-arm64-tpidr2-switch-to-waitpid-over-wait4.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+bpftool-add-cet-aware-symbol-matching-for-x86_64-arc.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-pro.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
+thermal-intel-selftests-workload_hint-mask-unsupport.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-lenovo-ec-sensors-update-p8-supprt.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-renesas-rzg2l-add-suspend-resume-support-for.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+io_uring-rsrc-respect-submitter_task-in-io_register_.patch
+hwmon-sy7636a-add-alias.patch
+selftests-bpf-fix-incorrect-array-size-calculation.patch
+block-check-for-valid-bio-while-splitting.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+cpufreq-ondemand-update-the-efficient-idle-check-for.patch
+arm64-zynqmp-disable-coresight-by-default.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-p880-set-correct-touchscreen-clipping.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+firmware-qcom-tzmem-disable-sc7180-platform.patch
+soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+pwm-pca9685-use-bulk-write-to-atomicially-update-reg.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+kunit-enable-pci-on-uml-without-triggering-warn.patch
+selftests-bpf-fix-arena_spin_lock-selftest-failure.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+i3c-mipi-i3c-hci-pci-add-support-for-intel-wildcat-l.patch
+rust-kunit-allow-cfg-on-test-s.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+i3c-dw-add-shutdown-support-to-dw_i3c_master-driver.patch
+io_uring-zcrx-check-all-niovs-filled-with-dma-addres.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+io_uring-zcrx-account-niov-arrays-to-cgroup.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+selftests-bpf-fix-selftest-verifier_arena_large-fail.patch
+selftests-ublk-fix-behavior-when-fio-is-not-installe.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+acpi-spcr-support-precise-baud-rate-field.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+clocksource-drivers-timer-rtl-otto-work-around-dying.patch
+clocksource-drivers-timer-rtl-otto-do-not-interfere-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+selftests-drv-net-pull-data-before-parsing-headers.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-remove-dell-precision-490-custom-conf.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+selftests-bpf-fix-flaky-bpf_cookie-selftest.patch
+tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-simple-mfd-i2c-add-compatible-strings-for-layers.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-qnap-mcu-handle-errors-returned-from-qnap_mcu_wr.patch
+mfd-qnap-mcu-include-linux-types.h-in-qnap-mcu.h-sha.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+mfd-macsmc-add-apple-t8103-smc-compatible.patch
+mfd-core-increment-of_node-s-refcount-before-linking.patch
+mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
+mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
diff --git a/queue-6.17/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch b/queue-6.17/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
new file mode 100644
index 0000000000..dfc0517c81
--- /dev/null
+++ b/queue-6.17/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
@@ -0,0 +1,37 @@
+From 994c541a2b3bb11af71ae8fe6534dc105aaef7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ 	{ "AST2620", 0x05010203 },
+ 	{ "AST2605", 0x05030103 },
+ 	{ "AST2625", 0x05030403 },
++	/* AST2700 */
++	{ "AST2750", 0x06000003 },
++	{ "AST2700", 0x06000103 },
++	{ "AST2720", 0x06000203 },
+ };
+ 
+ static const char *siliconid_to_name(u32 siliconid)
+-- 
+2.51.0
+
diff --git a/queue-6.17/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-6.17/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..e47ffe33cd
--- /dev/null
+++ b/queue-6.17/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From 35f5f8e1e21b757ec36b922f6e72002d6884dabc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index cf425930539e4..c4c45f15dca4f 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -898,7 +898,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-6.17/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..da4df18313
--- /dev/null
+++ b/queue-6.17/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From 78b7d472472d55a445114467ae63f09d0245f430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index e24ab5f7d2bf1..524fa1b0cd3d6 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ 	.clk_suspend_on = false,
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch b/queue-6.17/soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch
new file mode 100644
index 0000000000..9eeca55a2e
--- /dev/null
+++ b/queue-6.17/soc-ti-k3-socinfo-add-information-for-am62l-sr1.1.patch
@@ -0,0 +1,53 @@
+From 0d3c4c5cf868556a623d940829b685e7d17b62cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:15:28 -0500
+Subject: soc: ti: k3-socinfo: Add information for AM62L SR1.1
+
+From: Bryan Brattlof <bb@ti.com>
+
+[ Upstream commit 037e496038f6e4cfb3642a0ffc2db19838d564dd ]
+
+The second silicon revision for the AM62L was mainly a ROM revision
+and therefore this silicon revision is labeled SR1.1
+
+Add a new decode array to properly identify this revision as SR1.1
+
+Signed-off-by: Bryan Brattlof <bb@ti.com>
+Link: https://patch.msgid.link/20250908-62l-chipid-v1-1-9c7194148140@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/k3-socinfo.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/soc/ti/k3-socinfo.c b/drivers/soc/ti/k3-socinfo.c
+index d716be113c84f..50c170a995f90 100644
+--- a/drivers/soc/ti/k3-socinfo.c
++++ b/drivers/soc/ti/k3-socinfo.c
+@@ -66,6 +66,10 @@ static const char * const j721e_rev_string_map[] = {
+ 	"1.0", "1.1", "2.0",
+ };
+ 
++static const char * const am62lx_rev_string_map[] = {
++	"1.0", "1.1",
++};
++
+ static int
+ k3_chipinfo_partno_to_names(unsigned int partno,
+ 			    struct soc_device_attribute *soc_dev_attr)
+@@ -92,6 +96,12 @@ k3_chipinfo_variant_to_sr(unsigned int partno, unsigned int variant,
+ 		soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%s",
+ 						   j721e_rev_string_map[variant]);
+ 		break;
++	case JTAG_ID_PARTNO_AM62LX:
++		if (variant >= ARRAY_SIZE(am62lx_rev_string_map))
++			goto err_unknown_variant;
++		soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%s",
++						   am62lx_rev_string_map[variant]);
++		break;
+ 	default:
+ 		variant++;
+ 		soc_dev_attr->revision = kasprintf(GFP_KERNEL, "SR%x.0",
+-- 
+2.51.0
+
diff --git a/queue-6.17/soc-ti-pruss-don-t-use-pk-through-printk.patch b/queue-6.17/soc-ti-pruss-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..7fb8eadbdb
--- /dev/null
+++ b/queue-6.17/soc-ti-pruss-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 9035563db51e43b49adee935ca63279946099d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 09:48:30 +0200
+Subject: soc: ti: pruss: don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pruss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
+index d7634bf5413a3..038576805bfa0 100644
+--- a/drivers/soc/ti/pruss.c
++++ b/drivers/soc/ti/pruss.c
+@@ -449,7 +449,7 @@ static int pruss_of_setup_memories(struct device *dev, struct pruss *pruss)
+ 		pruss->mem_regions[i].pa = res.start;
+ 		pruss->mem_regions[i].size = resource_size(&res);
+ 
+-		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
++		dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
+ 			mem_names[i], &pruss->mem_regions[i].pa,
+ 			pruss->mem_regions[i].size, pruss->mem_regions[i].va);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-6.17/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..25c4263acf
--- /dev/null
+++ b/queue-6.17/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From 569aa8a80a90c781a3bfda6a4a079510f029a1b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 7dd92deffe3fb..e0b131aa29b62 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -446,7 +446,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -456,15 +456,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -558,7 +558,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -696,7 +696,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-6.17/spi-rpc-if-add-resume-support-for-rz-g3e.patch b/queue-6.17/spi-rpc-if-add-resume-support-for-rz-g3e.patch
new file mode 100644
index 0000000000..6549652115
--- /dev/null
+++ b/queue-6.17/spi-rpc-if-add-resume-support-for-rz-g3e.patch
@@ -0,0 +1,36 @@
+From b2f8b5f76e152fdc04c69e1d10889ab10420fcb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index 627cffea5d5c7..300a7c10b3d40 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -207,6 +207,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ 	struct spi_controller *ctlr = dev_get_drvdata(dev);
+ 
++	rpcif_hw_init(dev, false);
++
+ 	return spi_controller_resume(ctlr);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch b/queue-6.17/spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch
new file mode 100644
index 0000000000..4f34026e09
--- /dev/null
+++ b/queue-6.17/spi-spi-qpic-snand-handle-use_ecc-parameter-of-qcom_.patch
@@ -0,0 +1,56 @@
+From a8262584421444d1864455ce2e5568a87ecc05f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 19:15:01 +0200
+Subject: spi: spi-qpic-snand: handle 'use_ecc' parameter of
+ qcom_spi_config_cw_read()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 9c45f95222beecd6a284fd1284d54dd7a772cf59 ]
+
+During raw read, neither the status of the ECC correction nor the erased
+state of the codeword gets checked by the qcom_spi_read_cw_raw() function,
+so in case of raw access reading the corresponding registers via DMA is
+superfluous.
+
+Extend the qcom_spi_config_cw_read() function to evaluate the existing
+(but actually unused) 'use_ecc' parameter, and configure reading only
+the flash status register when ECC is not used.
+
+With the change, the code gets in line with the corresponding part of
+the config_nand_cw_read() function in the qcom_nandc driver.
+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250808-qpic-snand-handle-use_ecc-v1-1-67289fbb5e2f@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qpic-snand.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
+index 780abb967822a..5a247eebde4d9 100644
+--- a/drivers/spi/spi-qpic-snand.c
++++ b/drivers/spi/spi-qpic-snand.c
+@@ -494,9 +494,14 @@ qcom_spi_config_cw_read(struct qcom_nand_controller *snandc, bool use_ecc, int c
+ 	qcom_write_reg_dma(snandc, &snandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
+ 	qcom_write_reg_dma(snandc, &snandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL);
+ 
+-	qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 2, 0);
+-	qcom_read_reg_dma(snandc, NAND_ERASED_CW_DETECT_STATUS, 1,
+-			  NAND_BAM_NEXT_SGL);
++	if (use_ecc) {
++		qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 2, 0);
++		qcom_read_reg_dma(snandc, NAND_ERASED_CW_DETECT_STATUS, 1,
++				  NAND_BAM_NEXT_SGL);
++	} else {
++		qcom_read_reg_dma(snandc, NAND_FLASH_STATUS, 1,
++				  NAND_BAM_NEXT_SGL);
++	}
+ }
+ 
+ static int qcom_spi_block_erase(struct qcom_nand_controller *snandc)
+-- 
+2.51.0
+
diff --git a/queue-6.17/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-6.17/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..cc65d539dc
--- /dev/null
+++ b/queue-6.17/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 5272e45f842886a6178c2cedf92ee2f815a9ed78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index acc7998758ad8..133447f250657 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-6.17/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch b/queue-6.17/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
new file mode 100644
index 0000000000..cc46527cdd
--- /dev/null
+++ b/queue-6.17/thermal-gov_step_wise-allow-cooling-level-to-be-redu.patch
@@ -0,0 +1,81 @@
+From 7dada54e27afc26d973bbdeb9bd84d8f2b9927e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:31:53 +0200
+Subject: thermal: gov_step_wise: Allow cooling level to be reduced earlier
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2e82368359f63567862a0d438710ddffcb1ace83 ]
+
+The current behavior of the Step-wise thermal governor is to increase
+the cooling level one step at a time after trip point threshold passing
+by thermal zone temperature until the temperature stops to rise.  Then,
+nothing is done until the temperature decreases below the (possibly
+updated) trip point threshold, at which point the cooling level is
+reduced straight to the applicable minimum.
+
+While this generally works, it is not in agreement with the throttling
+logic description comment in step_wise_manage() any more after some
+relatively recent changes, and in the case of passive cooling, it may
+lead to undesirable performance oscillations between high and low
+levels.
+
+For this reason, modify the governor's cooling device state selection
+function, get_target_state(), to reduce cooling by one level even if
+the temperature is still above the thermal zone threshold, but the
+temperature has started to fall down.  However, ensure that the cooling
+level will remain above the applicable minimum in that case to pull
+the zone temperature further down, possibly until it falls below the
+trip threshold (which may now be equal to the low temperature of the
+trip).
+
+Doing so should help higher performance to be restored earlier in some
+cases which is desirable especially for passive trip points with
+relatively high hysteresis values.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/1947735.tdWV9SEqCh@rafael.j.wysocki
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/gov_step_wise.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/gov_step_wise.c b/drivers/thermal/gov_step_wise.c
+index d1bb59f1dfbd3..b7938bddd9a6a 100644
+--- a/drivers/thermal/gov_step_wise.c
++++ b/drivers/thermal/gov_step_wise.c
+@@ -20,7 +20,9 @@
+  * If the temperature is higher than a trip point,
+  *    a. if the trend is THERMAL_TREND_RAISING, use higher cooling
+  *       state for this trip point
+- *    b. if the trend is THERMAL_TREND_DROPPING, do nothing
++ *    b. if the trend is THERMAL_TREND_DROPPING, use a lower cooling state
++ *       for this trip point, but keep the cooling state above the applicable
++ *       minimum
+  * If the temperature is lower than a trip point,
+  *    a. if the trend is THERMAL_TREND_RAISING, do nothing
+  *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
+@@ -51,6 +53,17 @@ static unsigned long get_target_state(struct thermal_instance *instance,
+ 	if (throttle) {
+ 		if (trend == THERMAL_TREND_RAISING)
+ 			return clamp(cur_state + 1, instance->lower, instance->upper);
++
++		/*
++		 * If the zone temperature is falling, the cooling level can
++		 * be reduced, but it should still be above the lower state of
++		 * the given thermal instance to pull the temperature further
++		 * down.
++		 */
++		if (trend == THERMAL_TREND_DROPPING)
++			return clamp(cur_state - 1,
++				     min(instance->lower + 1, instance->upper),
++				     instance->upper);
+ 	} else if (trend == THERMAL_TREND_DROPPING) {
+ 		if (cur_state <= instance->lower)
+ 			return THERMAL_NO_TARGET;
+-- 
+2.51.0
+
diff --git a/queue-6.17/thermal-intel-selftests-workload_hint-mask-unsupport.patch b/queue-6.17/thermal-intel-selftests-workload_hint-mask-unsupport.patch
new file mode 100644
index 0000000000..d019b09284
--- /dev/null
+++ b/queue-6.17/thermal-intel-selftests-workload_hint-mask-unsupport.patch
@@ -0,0 +1,38 @@
+From f27c6cd3154202376e6bcaf546badfe41f88351a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:15:41 -0700
+Subject: thermal: intel: selftests: workload_hint: Mask unsupported types
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 0115d063559fa6d25e41751cf455dda40aa2c856 ]
+
+The workload hint may contain some other hints which are not defined.
+So mask out unsupported types. Currently only lower 4 bits of workload
+type hints are defined.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/20250828201541.931425-1-srinivas.pandruvada@linux.intel.com
+[ rjw: Subject cleanup ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/thermal/intel/workload_hint/workload_hint_test.c  | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+index ba58589a11454..ca2bd03154e4d 100644
+--- a/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
++++ b/tools/testing/selftests/thermal/intel/workload_hint/workload_hint_test.c
+@@ -144,6 +144,8 @@ int main(int argc, char **argv)
+ 			ret = sscanf(index_str, "%d", &index);
+ 			if (ret < 0)
+ 				break;
++
++			index &= 0x0f;
+ 			if (index > WORKLOAD_TYPE_MAX_INDEX)
+ 				printf("Invalid workload type index\n");
+ 			else
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch b/queue-6.17/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
new file mode 100644
index 0000000000..5876502d5c
--- /dev/null
+++ b/queue-6.17/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
@@ -0,0 +1,44 @@
+From c7af5235532adf49a77286cd5596fe8188a392d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index ce8dfb8e46abd..d7f7ec6f151c2 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -56,7 +56,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ 	if (numwritten < 1) {
+ 		perror(path);
+ 		close(fd);
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	close(fd);
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-6.17/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..eb1d20b5ce
--- /dev/null
+++ b/queue-6.17/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From cfa0031690f85c690b626ded5d0c72a6eac547f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 0ecac009273ce..f2c1139adf716 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -233,6 +233,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -241,10 +242,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch b/queue-6.17/tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch
new file mode 100644
index 0000000000..f7815b36ad
--- /dev/null
+++ b/queue-6.17/tools-power-turbostat-fix-incorrect-sorting-of-pmt-t.patch
@@ -0,0 +1,43 @@
+From aed698fc42348df0c74672f96e4da0997e36c180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 10:35:15 +0530
+Subject: tools/power turbostat: Fix incorrect sorting of PMT telemetry
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit cafb47be3f38ad81306bf894e743bebc2ccf66ab ]
+
+The pmt_telemdir_sort() comparison function was returning a boolean
+value (0 or 1) instead of the required negative, zero, or positive
+value for proper sorting. This caused unpredictable and incorrect
+ordering of telemetry directories named telem0, telem1, ..., telemN.
+Update the comparison logic to return -1, 0, or 1 based on the
+numerical value extracted from the directory name, ensuring correct
+numerical ordering when using scandir.
+
+This change improves stability and correctness when iterating PMT
+telemetry directories.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 72a280e7a9d59..931bad99277fe 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1890,7 +1890,7 @@ int pmt_telemdir_sort(const struct dirent **a, const struct dirent **b)
+ 	sscanf((*a)->d_name, "telem%u", &aidx);
+ 	sscanf((*b)->d_name, "telem%u", &bidx);
+ 
+-	return aidx >= bidx;
++	return (aidx > bidx) ? 1 : (aidx < bidx) ? -1 : 0;
+ }
+ 
+ const struct dirent *pmt_diriter_next(struct pmt_diriter_t *iter)
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-6.17/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..7156d30923
--- /dev/null
+++ b/queue-6.17/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 126c2f54d9d3b414fe34bac71fc92774de825e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-6.17/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..fec12ac99a
--- /dev/null
+++ b/queue-6.17/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From 80f47705172a36daec72557205d45a38b099d364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-6.17/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..e11274b284
--- /dev/null
+++ b/queue-6.17/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From b72fd27c0d1eb36ae41643baeaa09fd9a1e50e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-6.17/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-6.17/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..0dfe905a78
--- /dev/null
+++ b/queue-6.17/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 163794aa733505acf938b1152e2810e7decbf8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 4b97d16f731c1..109276c68ecba 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2741,6 +2741,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-6.17/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..2527a5a804
--- /dev/null
+++ b/queue-6.17/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From 86e50fdd0f600ff365f5d21c507c5fca5ee3e002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
diff --git a/queue-6.6/acpi-prm-skip-handlers-with-null-handler_address-or-.patch b/queue-6.6/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
new file mode 100644
index 0000000000..ebbbdef3c1
--- /dev/null
+++ b/queue-6.6/acpi-prm-skip-handlers-with-null-handler_address-or-.patch
@@ -0,0 +1,61 @@
+From 31c4005dba57398aa22fd6a5e0e9292198d07563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:02:29 -0400
+Subject: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
+
+From: Shang song (Lenovo) <shangsong2@foxmail.com>
+
+[ Upstream commit 311942ce763e21dacef7e53996d5a1e19b8adab1 ]
+
+If handler_address or mapped VA is NULL, the related buffer address and
+VA can be ignored, so make acpi_parse_prmt() skip the current handler
+in those cases.
+
+Signed-off-by: Shang song (Lenovo) <shangsong2@foxmail.com>
+Link: https://patch.msgid.link/20250826030229.834901-1-shangsong2@foxmail.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index eb8f2a1ce1388..6efaeda01d166 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -150,15 +150,28 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ 		th = &tm->handlers[cur_handler];
+ 
+ 		guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
++
++		/*
++		 * Print an error message if handler_address is NULL, the parse of VA also
++		 * can be skipped.
++		 */
++		if (unlikely(!handler_info->handler_address)) {
++			pr_info("Skipping handler with NULL address for GUID: %pUL",
++					(guid_t *)handler_info->handler_guid);
++			continue;
++		}
++
+ 		th->handler_addr =
+ 			(void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
+ 		/*
+-		 * Print a warning message if handler_addr is zero which is not expected to
+-		 * ever happen.
++		 * Print a warning message and skip the parse of VA if handler_addr is zero
++		 * which is not expected to ever happen.
+ 		 */
+-		if (unlikely(!th->handler_addr))
++		if (unlikely(!th->handler_addr)) {
+ 			pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
+ 				&th->guid, handler_info->handler_address);
++			continue;
++		}
+ 
+ 		th->static_data_buffer_addr =
+ 			efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
+-- 
+2.51.0
+
diff --git a/queue-6.6/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch b/queue-6.6/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
new file mode 100644
index 0000000000..e549d9ebb8
--- /dev/null
+++ b/queue-6.6/acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
@@ -0,0 +1,52 @@
+From 9adab9b153613cb388b1e53ead98c139fc39d384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:27:48 +0200
+Subject: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 4405a214df146775338a1e6232701a29024b82e1 ]
+
+Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
+device in the _DEP dependency list of the ACPI devices for the camera-
+sensors (which have flags.honor_deps set).
+
+These devices are for an Intel Vision CVS chip for which an out of tree
+driver is available [1].
+
+The camera sensor works fine without a driver being loaded for this
+ACPI device on the 2 laptops this was tested on:
+
+ThinkPad X1 Carbon Gen 12 (Meteor Lake)
+ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)
+
+For now add these HIDs to acpi_ignore_dep_ids[] so that
+acpi_dev_ready_for_enumeration() will return true once the other _DEP
+dependencies are met and an i2c_client for the camera sensor will get
+instantiated.
+
+Link: https://github.com/intel/vision-drivers/ [1]
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index c0c5c5c58ae1e..5b5986e10c2d7 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -784,6 +784,8 @@ static bool acpi_info_matches_ids(struct acpi_device_info *info,
+ static const char * const acpi_ignore_dep_ids[] = {
+ 	"PNP0D80", /* Windows-compatible System Power Management Controller */
+ 	"INT33BD", /* Intel Baytrail Mailbox Device */
++	"INTC10DE", /* Intel CVS LNL */
++	"INTC10E0", /* Intel CVS ARL */
+ 	"LATT2021", /* Lattice FW Update Client Driver */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.6/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch b/queue-6.6/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
new file mode 100644
index 0000000000..9db78263df
--- /dev/null
+++ b/queue-6.6/acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
@@ -0,0 +1,50 @@
+From 0c1c585192f2793afc16a41a884ee491f91d47eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:00:17 +0200
+Subject: ACPICA: dispatcher: Use acpi_ds_clear_operands() in
+ acpi_ds_call_control_method()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
+
+When deleting the previous walkstate operand stack
+acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
+operands. But Method.param_count does not necessarily match
+this_walk_state->num_operands, it may be either less or more.
+
+After correcting the for loop to check `i < this_walk_state->num_operands`
+the code is identical to acpi_ds_clear_operands(), so just outright
+replace the code with acpi_ds_clear_operands() to fix this.
+
+Link: https://github.com/acpica/acpica/commit/53fc0220
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index a232746d150a7..dc53a5d700671 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	 * Delete the operands on the previous walkstate operand stack
+ 	 * (they were copied to new objects)
+ 	 */
+-	for (i = 0; i < obj_desc->method.param_count; i++) {
+-		acpi_ut_remove_reference(this_walk_state->operands[i]);
+-		this_walk_state->operands[i] = NULL;
+-	}
+-
+-	/* Clear the operand stack */
+-
+-	this_walk_state->num_operands = 0;
++	acpi_ds_clear_operands(this_walk_state);
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
+ 			  "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
+-- 
+2.51.0
+
diff --git a/queue-6.6/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch b/queue-6.6/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
new file mode 100644
index 0000000000..9df6606d40
--- /dev/null
+++ b/queue-6.6/arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
@@ -0,0 +1,61 @@
+From cbed37fd52d4df7724e698176a0bd46d86091d60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 19:23:53 -0700
+Subject: arc: Fix __fls() const-foldability via __builtin_clzl()
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
+
+While tracking down a problem where constant expressions used by
+BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
+initializer was convincing the compiler that it couldn't track the state
+of the prior statically initialized value. Tracing this down found that
+ffs() was used in the initializer macro, but since it wasn't marked with
+__attribute__const__, the compiler had to assume the function might
+change variable states as a side-effect (which is not true for ffs(),
+which provides deterministic math results).
+
+For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
+uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
+compile-time constant folding, and KUnit testing of ffs/fls fails on
+arc[3]. A patch[2] to GCC to solve this has been sent.
+
+Add a fix for this by handling compile-time constants with the standard
+__builtin_clzl() builtin (which has const attribute) while preserving
+the optimized arc-specific builtin for runtime cases. This has the added
+benefit of skipping runtime calculation of compile-time constant values.
+Even with the GCC bug fixed (which is about "attribute const") this is a
+good change to avoid needless runtime costs, and should be done
+regardless of the state of GCC's bug.
+
+Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
+
+Link: https://github.com/KSPP/linux/issues/364 [1]
+Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index f5a936496f060..24981bba974d3 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -133,6 +133,8 @@ static inline __attribute__ ((const)) int fls(unsigned int x)
+  */
+ static inline __attribute__ ((const)) unsigned long __fls(unsigned long x)
+ {
++	if (__builtin_constant_p(x))
++		return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
+ 	/* FLS insn has exactly same semantics as the API */
+ 	return	__builtin_arc_fls(x);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/arm-tegra-transformer-20-add-missing-magnetometer-in.patch b/queue-6.6/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
new file mode 100644
index 0000000000..3ec91be25c
--- /dev/null
+++ b/queue-6.6/arm-tegra-transformer-20-add-missing-magnetometer-in.patch
@@ -0,0 +1,37 @@
+From 9371ee6a79be9c41ad28a33275cf13c530cf009d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:31 +0300
+Subject: ARM: tegra: transformer-20: add missing magnetometer interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit cca41614d15ce2bbc2c661362d3eafe53c9990af ]
+
+Add missing interrupt to magnetometer node.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index a3757b7daeda4..408cec997adb3 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -502,6 +502,9 @@
+ 			compatible = "asahi-kasei,ak8974";
+ 			reg = <0xe>;
+ 
++			interrupt-parent = <&gpio>;
++			interrupts = <TEGRA_GPIO(N, 5) IRQ_TYPE_EDGE_RISING>;
++
+ 			avdd-supply = <&vdd_3v3_sys>;
+ 			dvdd-supply = <&vdd_1v8_sys>;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch b/queue-6.6/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
new file mode 100644
index 0000000000..13dbc93916
--- /dev/null
+++ b/queue-6.6/arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
@@ -0,0 +1,37 @@
+From 876d5ec8dfe33857601db06f5db8e3c5f4225933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:29:32 +0300
+Subject: ARM: tegra: transformer-20: fix audio-codec interrupt
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 3f973d78d176768fa7456def97f0b9824235024f ]
+
+Correct audio-codec interrupt should be PX3 while PX1 is used for external
+microphone detection.
+
+Tested-by: Winona Schroeer-Smith <wolfizen@wolfizen.net> # ASUS SL101
+Tested-by: Antoni Aloy Torrens <aaloytorrens@gmail.com> # ASUS TF101
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+index 408cec997adb3..071a31191ec27 100644
+--- a/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
++++ b/arch/arm/boot/dts/nvidia/tegra20-asus-tf101.dts
+@@ -518,7 +518,7 @@
+ 			reg = <0x1a>;
+ 
+ 			interrupt-parent = <&gpio>;
+-			interrupts = <TEGRA_GPIO(X, 1) IRQ_TYPE_EDGE_BOTH>;
++			interrupts = <TEGRA_GPIO(X, 3) IRQ_TYPE_EDGE_BOTH>;
+ 
+ 			gpio-controller;
+ 			#gpio-cells = <2>;
+-- 
+2.51.0
+
diff --git a/queue-6.6/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch b/queue-6.6/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
new file mode 100644
index 0000000000..beeeb07f6c
--- /dev/null
+++ b/queue-6.6/arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
@@ -0,0 +1,45 @@
+From f9ab3c4a98e81d9d69e0c3a378df5641ae8164a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:56:19 +0200
+Subject: arm64: zynqmp: Revert usb node drive strength and slew rate for
+ zcu106
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 767ecf9da7b31e5c0c22c273001cb2784705fe8c ]
+
+On a few zcu106 boards USB devices (Dell MS116 USB Optical Mouse, Dell USB
+Entry Keyboard) are not enumerated on linux boot due to commit
+'b8745e7eb488 ("arm64: zynqmp: Fix usb node drive strength and slew
+rate")'.
+
+To fix it as a workaround revert to working version and then investigate
+at board level why drive strength from 12mA to 4mA and slew from fast to
+slow is not working.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/85a70cb014ec1f07972fccb60b875596eeaa6b5c.1756799774.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 50c384aa253e4..8c3f9735e563b 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -808,8 +808,8 @@
+ 			pins = "MIO54", "MIO56", "MIO57", "MIO58", "MIO59",
+ 			       "MIO60", "MIO61", "MIO62", "MIO63";
+ 			bias-disable;
+-			drive-strength = <4>;
+-			slew-rate = <SLEW_RATE_SLOW>;
++			drive-strength = <12>;
++			slew-rate = <SLEW_RATE_FAST>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch b/queue-6.6/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
new file mode 100644
index 0000000000..feea0f7641
--- /dev/null
+++ b/queue-6.6/blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
@@ -0,0 +1,188 @@
+From a1ea974420e2643fe7668852cf5eb8b15c31ef84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 15:55:20 +0800
+Subject: blk-cgroup: fix possible deadlock while configuring policy
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d726c4dbeeddef612e6bed27edd29733f4d13af ]
+
+Following deadlock can be triggered easily by lockdep:
+
+WARNING: possible circular locking dependency detected
+6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted
+------------------------------------------------------
+check/1334 is trying to acquire lock:
+ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180
+
+but task is already holding lock:
+ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}:
+       blk_queue_enter+0x40b/0x470
+       blkg_conf_prep+0x7b/0x3c0
+       tg_set_limit+0x10a/0x3e0
+       cgroup_file_write+0xc6/0x420
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+-> #1 (&q->rq_qos_mutex){+.+.}-{4:4}:
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       wbt_init+0x17e/0x280
+       wbt_enable_default+0xe9/0x140
+       blk_register_queue+0x1da/0x2e0
+       __add_disk+0x38c/0x5d0
+       add_disk_fwnode+0x89/0x250
+       device_add_disk+0x18/0x30
+       virtblk_probe+0x13a3/0x1800
+       virtio_dev_probe+0x389/0x610
+       really_probe+0x136/0x620
+       __driver_probe_device+0xb3/0x230
+       driver_probe_device+0x2f/0xe0
+       __driver_attach+0x158/0x250
+       bus_for_each_dev+0xa9/0x130
+       driver_attach+0x26/0x40
+       bus_add_driver+0x178/0x3d0
+       driver_register+0x7d/0x1c0
+       __register_virtio_driver+0x2c/0x60
+       virtio_blk_init+0x6f/0xe0
+       do_one_initcall+0x94/0x540
+       kernel_init_freeable+0x56a/0x7b0
+       kernel_init+0x2b/0x270
+       ret_from_fork+0x268/0x4c0
+       ret_from_fork_asm+0x1a/0x30
+
+-> #0 (&q->sysfs_lock){+.+.}-{4:4}:
+       __lock_acquire+0x1835/0x2940
+       lock_acquire+0xf9/0x450
+       __mutex_lock+0xd8/0xf50
+       mutex_lock_nested+0x2b/0x40
+       blk_unregister_queue+0x53/0x180
+       __del_gendisk+0x226/0x690
+       del_gendisk+0xba/0x110
+       sd_remove+0x49/0xb0 [sd_mod]
+       device_remove+0x87/0xb0
+       device_release_driver_internal+0x11e/0x230
+       device_release_driver+0x1a/0x30
+       bus_remove_device+0x14d/0x220
+       device_del+0x1e1/0x5a0
+       __scsi_remove_device+0x1ff/0x2f0
+       scsi_remove_device+0x37/0x60
+       sdev_store_delete+0x77/0x100
+       dev_attr_store+0x1f/0x40
+       sysfs_kf_write+0x65/0x90
+       kernfs_fop_write_iter+0x189/0x280
+       vfs_write+0x256/0x490
+       ksys_write+0x83/0x190
+       __x64_sys_write+0x21/0x30
+       x64_sys_call+0x4608/0x4630
+       do_syscall_64+0xdb/0x6b0
+       entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+other info that might help us debug this:
+
+Chain exists of:
+  &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&q->q_usage_counter(queue)#3);
+                               lock(&q->rq_qos_mutex);
+                               lock(&q->q_usage_counter(queue)#3);
+  lock(&q->sysfs_lock);
+
+Root cause is that queue_usage_counter is grabbed with rq_qos_mutex
+held in blkg_conf_prep(), while queue should be freezed before
+rq_qos_mutex from other context.
+
+The blk_queue_enter() from blkg_conf_prep() is used to protect against
+policy deactivation, which is already protected with blkcg_mutex, hence
+convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,
+consider that blkcg_mutex is held after queue is freezed from policy
+deactivation, also convert blkg_alloc() to use GFP_NOIO.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 64551b0aa51e6..75e9d5a9d707c 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -848,14 +848,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	disk = ctx->bdev->bd_disk;
+ 	q = disk->queue;
+ 
+-	/*
+-	 * blkcg_deactivate_policy() requires queue to be frozen, we can grab
+-	 * q_usage_counter to prevent concurrent with blkcg_deactivate_policy().
+-	 */
+-	ret = blk_queue_enter(q, 0);
+-	if (ret)
+-		goto fail;
+-
++	/* Prevent concurrent with blkcg_deactivate_policy() */
++	mutex_lock(&q->blkcg_mutex);
+ 	spin_lock_irq(&q->queue_lock);
+ 
+ 	if (!blkcg_policy_enabled(q, pol)) {
+@@ -885,16 +879,16 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		/* Drop locks to do new blkg allocation with GFP_KERNEL. */
+ 		spin_unlock_irq(&q->queue_lock);
+ 
+-		new_blkg = blkg_alloc(pos, disk, GFP_KERNEL);
++		new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
+ 		if (unlikely(!new_blkg)) {
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		if (radix_tree_preload(GFP_KERNEL)) {
+ 			blkg_free(new_blkg);
+ 			ret = -ENOMEM;
+-			goto fail_exit_queue;
++			goto fail_exit;
+ 		}
+ 
+ 		spin_lock_irq(&q->queue_lock);
+@@ -922,7 +916,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 			goto success;
+ 	}
+ success:
+-	blk_queue_exit(q);
++	mutex_unlock(&q->blkcg_mutex);
+ 	ctx->blkg = blkg;
+ 	return 0;
+ 
+@@ -930,9 +924,8 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 	radix_tree_preload_end();
+ fail_unlock:
+ 	spin_unlock_irq(&q->queue_lock);
+-fail_exit_queue:
+-	blk_queue_exit(q);
+-fail:
++fail_exit:
++	mutex_unlock(&q->blkcg_mutex);
+ 	/*
+ 	 * If queue was bypassing, we should retry.  Do so after a
+ 	 * short msleep().  It isn't strictly necessary but queue
+-- 
+2.51.0
+
diff --git a/queue-6.6/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch b/queue-6.6/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
new file mode 100644
index 0000000000..a4ebe60b69
--- /dev/null
+++ b/queue-6.6/bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
@@ -0,0 +1,57 @@
+From 69e7cc2912c620d6d3b14dcd434b5fb595f936eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:33:49 -0700
+Subject: bpf: Clear pfmemalloc flag when freeing all fragments
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c ]
+
+It is possible for bpf_xdp_adjust_tail() to free all fragments. The
+kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not
+XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when
+building sk_buff from xdp_buff since all readers of xdp_buff->flags
+use the flag only when there are fragments. Clear the
+XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct.
+
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xdp.h | 5 +++++
+ net/core/filter.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/net/xdp.h b/include/net/xdp.h
+index b39ac83618a55..3d8989096b5d2 100644
+--- a/include/net/xdp.h
++++ b/include/net/xdp.h
+@@ -113,6 +113,11 @@ static __always_inline void xdp_buff_set_frag_pfmemalloc(struct xdp_buff *xdp)
+ 	xdp->flags |= XDP_FLAGS_FRAGS_PF_MEMALLOC;
+ }
+ 
++static __always_inline void xdp_buff_clear_frag_pfmemalloc(struct xdp_buff *xdp)
++{
++	xdp->flags &= ~XDP_FLAGS_FRAGS_PF_MEMALLOC;
++}
++
+ static __always_inline void
+ xdp_init_buff(struct xdp_buff *xdp, u32 frame_sz, struct xdp_rxq_info *rxq)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c2e888ea54abb..0564ee6ac8731 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4203,6 +4203,7 @@ static int bpf_xdp_frags_shrink_tail(struct xdp_buff *xdp, int offset)
+ 
+ 	if (unlikely(!sinfo->nr_frags)) {
+ 		xdp_buff_clear_frags_flag(xdp);
++		xdp_buff_clear_frag_pfmemalloc(xdp);
+ 		xdp->data_end -= offset;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch b/queue-6.6/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
new file mode 100644
index 0000000000..ff405fc3f0
--- /dev/null
+++ b/queue-6.6/bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
@@ -0,0 +1,112 @@
+From eb73e5ac70ed0a6714d2c817aec2dd2a99695d13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 03:26:17 +0000
+Subject: bpf: Do not limit bpf_cgroup_from_id to current's namespace
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 2c895133950646f45e5cf3900b168c952c8dbee8 ]
+
+The bpf_cgroup_from_id kfunc relies on cgroup_get_from_id to obtain the
+cgroup corresponding to a given cgroup ID. This helper can be called in
+a lot of contexts where the current thread can be random. A recent
+example was its use in sched_ext's ops.tick(), to obtain the root cgroup
+pointer. Since the current task can be whatever random user space task
+preempted by the timer tick, this makes the behavior of the helper
+unreliable.
+
+Refactor out __cgroup_get_from_id as the non-namespace aware version of
+cgroup_get_from_id, and change bpf_cgroup_from_id to make use of it.
+
+There is no compatibility breakage here, since changing the namespace
+against which the lookup is being done to the root cgroup namespace only
+permits a wider set of lookups to succeed now. The cgroup IDs across
+namespaces are globally unique, and thus don't need to be retranslated.
+
+Reported-by: Dan Schatzberg <dschatzberg@meta.com>
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20250915032618.1551762-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cgroup.h |  1 +
+ kernel/bpf/helpers.c   |  2 +-
+ kernel/cgroup/cgroup.c | 24 ++++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index b307013b9c6c9..fa87b6a15082c 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -633,6 +633,7 @@ static inline void cgroup_kthread_ready(void)
+ }
+ 
+ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen);
++struct cgroup *__cgroup_get_from_id(u64 id);
+ struct cgroup *cgroup_get_from_id(u64 id);
+ #else /* !CONFIG_CGROUPS */
+ 
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 90c281e1379ee..2cfbc48b82425 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2276,7 +2276,7 @@ __bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
+ {
+ 	struct cgroup *cgrp;
+ 
+-	cgrp = cgroup_get_from_id(cgid);
++	cgrp = __cgroup_get_from_id(cgid);
+ 	if (IS_ERR(cgrp))
+ 		return NULL;
+ 	return cgrp;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 5135838b5899f..476be99dbcf1b 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6220,15 +6220,15 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
+ }
+ 
+ /*
+- * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * __cgroup_get_from_id : get the cgroup associated with cgroup id
+  * @id: cgroup id
+  * On success return the cgrp or ERR_PTR on failure
+- * Only cgroups within current task's cgroup NS are valid.
++ * There are no cgroup NS restrictions.
+  */
+-struct cgroup *cgroup_get_from_id(u64 id)
++struct cgroup *__cgroup_get_from_id(u64 id)
+ {
+ 	struct kernfs_node *kn;
+-	struct cgroup *cgrp, *root_cgrp;
++	struct cgroup *cgrp;
+ 
+ 	kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);
+ 	if (!kn)
+@@ -6250,6 +6250,22 @@ struct cgroup *cgroup_get_from_id(u64 id)
+ 
+ 	if (!cgrp)
+ 		return ERR_PTR(-ENOENT);
++	return cgrp;
++}
++
++/*
++ * cgroup_get_from_id : get the cgroup associated with cgroup id
++ * @id: cgroup id
++ * On success return the cgrp or ERR_PTR on failure
++ * Only cgroups within current task's cgroup NS are valid.
++ */
++struct cgroup *cgroup_get_from_id(u64 id)
++{
++	struct cgroup *cgrp, *root_cgrp;
++
++	cgrp = __cgroup_get_from_id(id);
++	if (IS_ERR(cgrp))
++		return cgrp;
+ 
+ 	root_cgrp = current_cgns_cgroup_dfl();
+ 	if (!cgroup_is_descendant(cgrp, root_cgrp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/bpf-don-t-use-pk-through-printk.patch b/queue-6.6/bpf-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..a74cdad83b
--- /dev/null
+++ b/queue-6.6/bpf-don-t-use-pk-through-printk.patch
@@ -0,0 +1,47 @@
+From 1f424d5766f987614994696a6e74d74071ffa672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:08:04 +0200
+Subject: bpf: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index adf65eacade06..4ffea87e6fb64 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -1065,7 +1065,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
+ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
+ 				u32 pass, void *image)
+ {
+-	pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
++	pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
+ 	       proglen, pass, image, current->comm, task_pid_nr(current));
+ 
+ 	if (image)
+-- 
+2.51.0
+
diff --git a/queue-6.6/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch b/queue-6.6/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
new file mode 100644
index 0000000000..e2a4327213
--- /dev/null
+++ b/queue-6.6/bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
@@ -0,0 +1,61 @@
+From cf9e507dea74f334ecefe0ef7777d85273a2d007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:38:47 -0700
+Subject: bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
+
+From: Tom Stellard <tstellar@redhat.com>
+
+[ Upstream commit 5612ea8b554375d45c14cbb0f8ea93ec5d172891 ]
+
+This fixes the build with -Werror -Wall.
+
+btf_dumper.c:71:31: error: variable 'finfo' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+   71 |         info.func_info = ptr_to_u64(&finfo);
+      |                                      ^~~~~
+
+prog.c:2294:31: error: variable 'func_info' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 2294 |         info.func_info = ptr_to_u64(&func_info);
+      |
+
+v2:
+  - Initialize instead of using memset.
+
+Signed-off-by: Tom Stellard <tstellar@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250917183847.318163-1-tstellar@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 2 +-
+ tools/bpf/bpftool/prog.c       | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 1b7f697146041..42c7b70f6996c 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -38,7 +38,7 @@ static int dump_prog_id_as_func_ptr(const struct btf_dumper *d,
+ 	__u32 info_len = sizeof(info);
+ 	const char *prog_name = NULL;
+ 	struct btf *prog_btf = NULL;
+-	struct bpf_func_info finfo;
++	struct bpf_func_info finfo = {};
+ 	__u32 finfo_rec_size;
+ 	char prog_str[1024];
+ 	int err;
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 174e076e56af2..90fa7a8d0f4b3 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2203,7 +2203,7 @@ static void profile_print_readings(void)
+ 
+ static char *profile_target_name(int tgt_fd)
+ {
+-	struct bpf_func_info func_info;
++	struct bpf_func_info func_info = {};
+ 	struct bpf_prog_info info = {};
+ 	__u32 info_len = sizeof(info);
+ 	const struct btf_type *t;
+-- 
+2.51.0
+
diff --git a/queue-6.6/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch b/queue-6.6/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
new file mode 100644
index 0000000000..743d6fa335
--- /dev/null
+++ b/queue-6.6/clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
@@ -0,0 +1,97 @@
+From 462556d6e1140e03119476e982dab0a9b71589da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 17:23:19 +0200
+Subject: clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
+
+The driver uses the raw_readl() and raw_writel() functions. Those are
+not for MMIO devices. Replace them with readl() and writel()
+
+[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+index 911c92146eca6..8041a8f62d1fa 100644
+--- a/drivers/clocksource/timer-vf-pit.c
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
+ 
+ static inline void pit_timer_enable(void)
+ {
+-	__raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++	writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_timer_disable(void)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
++	writel(0, clkevt_base + PITTCTRL);
+ }
+ 
+ static inline void pit_irq_acknowledge(void)
+ {
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ }
+ 
+ static u64 notrace pit_read_sched_clock(void)
+ {
+-	return ~__raw_readl(clksrc_base + PITCVAL);
++	return ~readl(clksrc_base + PITCVAL);
+ }
+ 
+ static int __init pit_clocksource_init(unsigned long rate)
+ {
+ 	/* set the max load value and start the clock source counter */
+-	__raw_writel(0, clksrc_base + PITTCTRL);
+-	__raw_writel(~0UL, clksrc_base + PITLDVAL);
+-	__raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++	writel(0, clksrc_base + PITTCTRL);
++	writel(~0UL, clksrc_base + PITLDVAL);
++	writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ 
+ 	sched_clock_register(pit_read_sched_clock, 32, rate);
+ 	return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
+ 	 * hardware requirement.
+ 	 */
+ 	pit_timer_disable();
+-	__raw_writel(delta - 1, clkevt_base + PITLDVAL);
++	writel(delta - 1, clkevt_base + PITLDVAL);
+ 	pit_timer_enable();
+ 
+ 	return 0;
+@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
+ 
+ static int __init pit_clockevent_init(unsigned long rate, int irq)
+ {
+-	__raw_writel(0, clkevt_base + PITTCTRL);
+-	__raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++	writel(0, clkevt_base + PITTCTRL);
++	writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ 
+ 	BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
+ 			   "VF pit timer", &clockevent_pit));
+@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
+ 	cycle_per_jiffy = clk_rate / (HZ);
+ 
+ 	/* enable the pit module */
+-	__raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++	writel(~PITMCR_MDIS, timer_base + PITMCR);
+ 
+ 	ret = pit_clocksource_init(clk_rate);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.6/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch b/queue-6.6/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
new file mode 100644
index 0000000000..6a01d8c93a
--- /dev/null
+++ b/queue-6.6/cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
@@ -0,0 +1,42 @@
+From a5f11ac9afe4e43241b75e0a7c33ab99da238b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:43:59 +0200
+Subject: cpufreq/longhaul: handle NULL policy in longhaul_exit
+
+From: Dennis Beier <nanovim@gmail.com>
+
+[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
+
+longhaul_exit() was calling cpufreq_cpu_get(0) without checking
+for a NULL policy pointer. On some systems, this could lead to a
+NULL dereference and a kernel warning or panic.
+
+This patch adds a check using unlikely() and returns early if the
+policy is NULL.
+
+Bugzilla: #219962
+
+Signed-off-by: Dennis Beier <nanovim@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/longhaul.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index 4c57c6725c134..1412d4617a04a 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -953,6 +953,9 @@ static void __exit longhaul_exit(void)
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(0);
+ 	int i;
+ 
++	if (unlikely(!policy))
++		return;
++
+ 	for (i = 0; i < numscales; i++) {
+ 		if (mults[i] == maxmult) {
+ 			struct cpufreq_freqs freqs;
+-- 
+2.51.0
+
diff --git a/queue-6.6/cpuidle-fail-cpuidle-device-registration-if-there-is.patch b/queue-6.6/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
new file mode 100644
index 0000000000..bbe482e438
--- /dev/null
+++ b/queue-6.6/cpuidle-fail-cpuidle-device-registration-if-there-is.patch
@@ -0,0 +1,53 @@
+From 9077aeec8700e49db42840cc3755c6d0527540e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:22:20 +0200
+Subject: cpuidle: Fail cpuidle device registration if there is one already
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
+
+Refuse to register a cpuidle device if the given CPU has a cpuidle
+device already and print a message regarding it.
+
+Without this, an attempt to register a new cpuidle device without
+unregistering the existing one leads to the removal of the existing
+cpuidle device without removing its sysfs interface.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 737a026ef58a3..6704d610573ad 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -634,8 +634,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
+ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ {
+ 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
++	unsigned int cpu = dev->cpu;
+ 	int i, ret;
+ 
++	if (per_cpu(cpuidle_devices, cpu)) {
++		pr_info("CPU%d: cpuidle device already registered\n", cpu);
++		return -EEXIST;
++	}
++
+ 	if (!try_module_get(drv->owner))
+ 		return -EINVAL;
+ 
+@@ -647,7 +653,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 			dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
+ 	}
+ 
+-	per_cpu(cpuidle_devices, dev->cpu) = dev;
++	per_cpu(cpuidle_devices, cpu) = dev;
+ 	list_add(&dev->device_list, &cpuidle_detected_devices);
+ 
+ 	ret = cpuidle_coupled_register_device(dev);
+-- 
+2.51.0
+
diff --git a/queue-6.6/futex-don-t-leak-robust_list-pointer-on-exec-race.patch b/queue-6.6/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
new file mode 100644
index 0000000000..f56eb12d7a
--- /dev/null
+++ b/queue-6.6/futex-don-t-leak-robust_list-pointer-on-exec-race.patch
@@ -0,0 +1,199 @@
+From 47402c2ce6f6188fa4d4d09e142d21907d12c9c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:51:54 +0530
+Subject: futex: Don't leak robust_list pointer on exec race
+
+From: Pranav Tyagi <pranav.tyagi03@gmail.com>
+
+[ Upstream commit 6b54082c3ed4dc9821cdf0edb17302355cc5bb45 ]
+
+sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
+to check if the calling task is allowed to access another task's
+robust_list pointer. This check is racy against a concurrent exec() in the
+target process.
+
+During exec(), a task may transition from a non-privileged binary to a
+privileged one (e.g., setuid binary) and its credentials/memory mappings
+may change. If get_robust_list() performs ptrace_may_access() before
+this transition, it may erroneously allow access to sensitive information
+after the target becomes privileged.
+
+A racy access allows an attacker to exploit a window during which
+ptrace_may_access() passes before a target process transitions to a
+privileged state via exec().
+
+For example, consider a non-privileged task T that is about to execute a
+setuid-root binary. An attacker task A calls get_robust_list(T) while T
+is still unprivileged. Since ptrace_may_access() checks permissions
+based on current credentials, it succeeds. However, if T begins exec
+immediately afterwards, it becomes privileged and may change its memory
+mappings. Because get_robust_list() proceeds to access T->robust_list
+without synchronizing with exec() it may read user-space pointers from a
+now-privileged process.
+
+This violates the intended post-exec access restrictions and could
+expose sensitive memory addresses or be used as a primitive in a larger
+exploit chain. Consequently, the race can lead to unauthorized
+disclosure of information across privilege boundaries and poses a
+potential security risk.
+
+Take a read lock on signal->exec_update_lock prior to invoking
+ptrace_may_access() and accessing the robust_list/compat_robust_list.
+This ensures that the target task's exec state remains stable during the
+check, allowing for consistent and synchronized validation of
+credentials.
+
+Suggested-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/linux-fsdevel/1477863998-3298-5-git-send-email-jann@thejh.net/
+Link: https://github.com/KSPP/linux/issues/119
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex/syscalls.c | 106 +++++++++++++++++++++-------------------
+ 1 file changed, 56 insertions(+), 50 deletions(-)
+
+diff --git a/kernel/futex/syscalls.c b/kernel/futex/syscalls.c
+index a8074079b09e8..48feaa545b3c7 100644
+--- a/kernel/futex/syscalls.c
++++ b/kernel/futex/syscalls.c
+@@ -40,6 +40,56 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ 	return 0;
+ }
+ 
++static inline void __user *futex_task_robust_list(struct task_struct *p, bool compat)
++{
++#ifdef CONFIG_COMPAT
++	if (compat)
++		return p->compat_robust_list;
++#endif
++	return p->robust_list;
++}
++
++static void __user *futex_get_robust_list_common(int pid, bool compat)
++{
++	struct task_struct *p = current;
++	void __user *head;
++	int ret;
++
++	scoped_guard(rcu) {
++		if (pid) {
++			p = find_task_by_vpid(pid);
++			if (!p)
++				return (void __user *)ERR_PTR(-ESRCH);
++		}
++		get_task_struct(p);
++	}
++
++	/*
++	 * Hold exec_update_lock to serialize with concurrent exec()
++	 * so ptrace_may_access() is checked against stable credentials
++	 */
++	ret = down_read_killable(&p->signal->exec_update_lock);
++	if (ret)
++		goto err_put;
++
++	ret = -EPERM;
++	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++		goto err_unlock;
++
++	head = futex_task_robust_list(p, compat);
++
++	up_read(&p->signal->exec_update_lock);
++	put_task_struct(p);
++
++	return head;
++
++err_unlock:
++	up_read(&p->signal->exec_update_lock);
++err_put:
++	put_task_struct(p);
++	return (void __user *)ERR_PTR(ret);
++}
++
+ /**
+  * sys_get_robust_list() - Get the robust-futex list head of a task
+  * @pid:	pid of the process [zero for current task]
+@@ -50,36 +100,14 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 		struct robust_list_head __user * __user *, head_ptr,
+ 		size_t __user *, len_ptr)
+ {
+-	struct robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct robust_list_head __user *head = futex_get_robust_list_common(pid, false);
+ 
+-	head = p->robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(head, head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ 
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -322,36 +350,14 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 			compat_uptr_t __user *, head_ptr,
+ 			compat_size_t __user *, len_ptr)
+ {
+-	struct compat_robust_list_head __user *head;
+-	unsigned long ret;
+-	struct task_struct *p;
+-
+-	rcu_read_lock();
+-
+-	ret = -ESRCH;
+-	if (!pid)
+-		p = current;
+-	else {
+-		p = find_task_by_vpid(pid);
+-		if (!p)
+-			goto err_unlock;
+-	}
+-
+-	ret = -EPERM;
+-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+-		goto err_unlock;
++	struct compat_robust_list_head __user *head = futex_get_robust_list_common(pid, true);
+ 
+-	head = p->compat_robust_list;
+-	rcu_read_unlock();
++	if (IS_ERR(head))
++		return PTR_ERR(head);
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+ 		return -EFAULT;
+ 	return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+-	rcu_read_unlock();
+-
+-	return ret;
+ }
+ #endif /* CONFIG_COMPAT */
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch b/queue-6.6/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
new file mode 100644
index 0000000000..4a9daa86bf
--- /dev/null
+++ b/queue-6.6/hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
@@ -0,0 +1,38 @@
+From a7e8aa2606b51670a7910d4d35702b4b2a5d2d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 21:26:56 +0200
+Subject: hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
+
+From: Ben Copeland <ben.copeland@linaro.org>
+
+[ Upstream commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 ]
+
+Some motherboards require more time to acquire the ACPI mutex,
+causing "Failed to acquire mutex" messages to appear in the kernel log.
+Increase the timeout from 500ms to 800ms to accommodate these cases.
+
+Signed-off-by: Ben Copeland <ben.copeland@linaro.org>
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index ce2f14a62754e..bc2197f1dfb7f 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -49,7 +49,7 @@ static char *mutex_path_override;
+  */
+ #define ASUS_EC_MAX_BANK	3
+ 
+-#define ACPI_LOCK_DELAY_MS	500
++#define ACPI_LOCK_DELAY_MS	800
+ 
+ /* ACPI mutex for locking access to the EC for the firmware */
+ #define ASUS_HW_ACCESS_MUTEX_ASMX	"\\AMW0.ASMX"
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch b/queue-6.6/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
new file mode 100644
index 0000000000..e50e8cb2fa
--- /dev/null
+++ b/queue-6.6/hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
@@ -0,0 +1,43 @@
+From a6599b26c200e2a036c4d21c351f63f12b313e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 20:10:36 +0200
+Subject: hwmon: (dell-smm) Add support for Dell OptiPlex 7040
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
+
+The Dell OptiPlex 7040 supports the legacy SMM interface for reading
+sensors and performing fan control. Whitelist this machine so that
+this driver loads automatically.
+
+Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 8d94ecc3cc468..9844843bdfadc 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1158,6 +1158,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
+ 	},
++	{
++		.ident = "Dell OptiPlex 7040",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
++		},
++	},
+ 	{
+ 		.ident = "Dell Precision",
+ 		.matches = {
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-k10temp-add-device-id-for-strix-halo.patch b/queue-6.6/hwmon-k10temp-add-device-id-for-strix-halo.patch
new file mode 100644
index 0000000000..96102a7c08
--- /dev/null
+++ b/queue-6.6/hwmon-k10temp-add-device-id-for-strix-halo.patch
@@ -0,0 +1,41 @@
+From bc57df92fb55f1a88ac3ceb2210fff249f25eca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 02:04:41 +0800
+Subject: hwmon: (k10temp) Add device ID for Strix Halo
+
+From: Rong Zhang <i@rong.moe>
+
+[ Upstream commit e5d1e313d7b6272d6dfda983906d99f97ad9062b ]
+
+The device ID of Strix Halo Data Fabric Function 3 has been in the tree
+since commit 0e640f0a47d8 ("x86/amd_nb: Add new PCI IDs for AMD family
+0x1a"), but is somehow missing from k10temp_id_table.
+
+Add it so that it works out of the box.
+
+Tested on Beelink GTR9 Pro Mini PC.
+
+Signed-off-by: Rong Zhang <i@rong.moe>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250823180443.85512-1-i@rong.moe
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 759855412e50d..dc82e33d59c5f 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -554,6 +554,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch b/queue-6.6/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
new file mode 100644
index 0000000000..c63d80f6f0
--- /dev/null
+++ b/queue-6.6/hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
@@ -0,0 +1,50 @@
+From fb852a2e8f19401b40cf3bf1e746ccd154c080b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 00:15:43 +0000
+Subject: hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
+
+From: Avadhut Naik <avadhut.naik@amd.com>
+
+[ Upstream commit f116af2eb51ed9df24911537fda32a033f1c58da ]
+
+Add thermal info support for newer AMD Family 1Ah-based models.
+
+Signed-off-by: Avadhut Naik <avadhut.naik@amd.com>
+Link: https://lore.kernel.org/r/20250729001644.257645-1-avadhut.naik@amd.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index c906731c6c2d3..759855412e50d 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -84,6 +84,13 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+  */
+ #define AMD_I3255_STR				"3255"
+ 
++/*
++ * PCI Device IDs for AMD's Family 1Ah-based SOCs.
++ * Defining locally as IDs are not shared.
++ */
++#define PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3	0x12cb
++#define PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3	0x127b
++
+ struct k10temp_data {
+ 	struct pci_dev *pdev;
+ 	void (*read_htcreg)(struct pci_dev *pdev, u32 *regval);
+@@ -545,7 +552,9 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M50H_DF_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_1AH_M90H_DF_F3) },
+ 	{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch b/queue-6.6/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
new file mode 100644
index 0000000000..fcae6f9dd4
--- /dev/null
+++ b/queue-6.6/hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
@@ -0,0 +1,140 @@
+From 6723a7ba95cbab785d3fd14b8b9e3d5f166b08f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:39:40 +0800
+Subject: hwmon: (sbtsi_temp) AMD CPU extended temperature range support
+
+From: Chuande Chen <chuachen@cisco.com>
+
+[ Upstream commit d9d61f1da35038793156c04bb13f0a1350709121 ]
+
+Many AMD CPUs can support this feature now. We would get a wrong CPU DIE
+temperature if don't consider this. In low-temperature environments,
+the CPU die temperature can drop below zero. So many platforms would like
+to make extended temperature range as their default configuration.
+Default temperature range (0C to 255.875C).
+Extended temperature range (-49C to +206.875C).
+Ref Doc: AMD V3000 PPR (Doc ID #56558).
+
+Signed-off-by: Chuande Chen <chuachen@cisco.com>
+Link: https://lore.kernel.org/r/20250814053940.96764-1-chenchuande@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sbtsi_temp.c | 46 +++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwmon/sbtsi_temp.c b/drivers/hwmon/sbtsi_temp.c
+index dd85cf89f008a..7c49fcf864143 100644
+--- a/drivers/hwmon/sbtsi_temp.c
++++ b/drivers/hwmon/sbtsi_temp.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/bitfield.h>
+ 
+ /*
+  * SB-TSI registers only support SMBus byte data access. "_INT" registers are
+@@ -29,8 +30,22 @@
+ #define SBTSI_REG_TEMP_HIGH_DEC		0x13 /* RW */
+ #define SBTSI_REG_TEMP_LOW_DEC		0x14 /* RW */
+ 
++/*
++ * Bit for reporting value with temperature measurement range.
++ * bit == 0: Use default temperature range (0C to 255.875C).
++ * bit == 1: Use extended temperature range (-49C to +206.875C).
++ */
++#define SBTSI_CONFIG_EXT_RANGE_SHIFT	2
++/*
++ * ReadOrder bit specifies the reading order of integer and decimal part of
++ * CPU temperature for atomic reads. If bit == 0, reading integer part triggers
++ * latching of the decimal part, so integer part should be read first.
++ * If bit == 1, read order should be reversed.
++ */
+ #define SBTSI_CONFIG_READ_ORDER_SHIFT	5
+ 
++#define SBTSI_TEMP_EXT_RANGE_ADJ	49000
++
+ #define SBTSI_TEMP_MIN	0
+ #define SBTSI_TEMP_MAX	255875
+ 
+@@ -38,6 +53,8 @@
+ struct sbtsi_data {
+ 	struct i2c_client *client;
+ 	struct mutex lock;
++	bool ext_range_mode;
++	bool read_order;
+ };
+ 
+ /*
+@@ -74,23 +91,11 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ {
+ 	struct sbtsi_data *data = dev_get_drvdata(dev);
+ 	s32 temp_int, temp_dec;
+-	int err;
+ 
+ 	switch (attr) {
+ 	case hwmon_temp_input:
+-		/*
+-		 * ReadOrder bit specifies the reading order of integer and
+-		 * decimal part of CPU temp for atomic reads. If bit == 0,
+-		 * reading integer part triggers latching of the decimal part,
+-		 * so integer part should be read first. If bit == 1, read
+-		 * order should be reversed.
+-		 */
+-		err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
+-		if (err < 0)
+-			return err;
+-
+ 		mutex_lock(&data->lock);
+-		if (err & BIT(SBTSI_CONFIG_READ_ORDER_SHIFT)) {
++		if (data->read_order) {
+ 			temp_dec = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_DEC);
+ 			temp_int = i2c_smbus_read_byte_data(data->client, SBTSI_REG_TEMP_INT);
+ 		} else {
+@@ -122,6 +127,8 @@ static int sbtsi_read(struct device *dev, enum hwmon_sensor_types type,
+ 		return temp_dec;
+ 
+ 	*val = sbtsi_reg_to_mc(temp_int, temp_dec);
++	if (data->ext_range_mode)
++		*val -= SBTSI_TEMP_EXT_RANGE_ADJ;
+ 
+ 	return 0;
+ }
+@@ -146,6 +153,8 @@ static int sbtsi_write(struct device *dev, enum hwmon_sensor_types type,
+ 		return -EINVAL;
+ 	}
+ 
++	if (data->ext_range_mode)
++		val += SBTSI_TEMP_EXT_RANGE_ADJ;
+ 	val = clamp_val(val, SBTSI_TEMP_MIN, SBTSI_TEMP_MAX);
+ 	sbtsi_mc_to_reg(val, &temp_int, &temp_dec);
+ 
+@@ -203,6 +212,7 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	struct device *dev = &client->dev;
+ 	struct device *hwmon_dev;
+ 	struct sbtsi_data *data;
++	int err;
+ 
+ 	data = devm_kzalloc(dev, sizeof(struct sbtsi_data), GFP_KERNEL);
+ 	if (!data)
+@@ -211,8 +221,14 @@ static int sbtsi_probe(struct i2c_client *client)
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+ 
+-	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data, &sbtsi_chip_info,
+-							 NULL);
++	err = i2c_smbus_read_byte_data(data->client, SBTSI_REG_CONFIG);
++	if (err < 0)
++		return err;
++	data->ext_range_mode = FIELD_GET(BIT(SBTSI_CONFIG_EXT_RANGE_SHIFT), err);
++	data->read_order = FIELD_GET(BIT(SBTSI_CONFIG_READ_ORDER_SHIFT), err);
++
++	hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name, data,
++							 &sbtsi_chip_info, NULL);
+ 
+ 	return PTR_ERR_OR_ZERO(hwmon_dev);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/hwmon-sy7636a-add-alias.patch b/queue-6.6/hwmon-sy7636a-add-alias.patch
new file mode 100644
index 0000000000..d9c7838c52
--- /dev/null
+++ b/queue-6.6/hwmon-sy7636a-add-alias.patch
@@ -0,0 +1,31 @@
+From a530cfa43309a152147c4f9bda51ad48fd053d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:02:49 +0200
+Subject: hwmon: sy7636a: add alias
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 80038a758b7fc0cdb6987532cbbf3f75b13e0826 ]
+
+Add module alias to have it autoloaded.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20250909080249.30656-1-andreas@kemnade.info
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sy7636a-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
+index ed110884786b4..a12fc0ce70e76 100644
+--- a/drivers/hwmon/sy7636a-hwmon.c
++++ b/drivers/hwmon/sy7636a-hwmon.c
+@@ -104,3 +104,4 @@ module_platform_driver(sy7636a_sensor_driver);
+ 
+ MODULE_DESCRIPTION("SY7636A sensor driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:sy7636a-temperature");
+-- 
+2.51.0
+
diff --git a/queue-6.6/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch b/queue-6.6/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
new file mode 100644
index 0000000000..4ffb9349b9
--- /dev/null
+++ b/queue-6.6/irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
@@ -0,0 +1,61 @@
+From a67950932fe731a7947a051e148885e86085809f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:10:45 +0200
+Subject: irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
+
+The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
+low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
+numbers in the log2(nr_irqs) bits for the domain.
+
+The problem arises if the base vector (GICV2m base spi) is not aligned with
+nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
+vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
+to be identified.
+
+To fix this, use bitmap_find_next_zero_area_off() instead of
+bitmap_find_free_region() to align the initial base vector with nr_irqs.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 683e8721e3b49..4bce475824171 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ 	msi_alloc_info_t *info = args;
+ 	struct v2m_data *v2m = NULL, *tmp;
+-	int hwirq, offset, i, err = 0;
++	int hwirq, i, err = 0;
++	unsigned long offset;
++	unsigned long align_mask = nr_irqs - 1;
+ 
+ 	spin_lock(&v2m_lock);
+ 	list_for_each_entry(tmp, &v2m_nodes, entry) {
+-		offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+-						 get_count_order(nr_irqs));
+-		if (offset >= 0) {
++		unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
++
++		offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
++							nr_irqs, align_mask, align_off);
++		if (offset < tmp->nr_spis) {
+ 			v2m = tmp;
++			bitmap_set(v2m->bm, offset, nr_irqs);
+ 			break;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch b/queue-6.6/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
new file mode 100644
index 0000000000..2f3caa051b
--- /dev/null
+++ b/queue-6.6/irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
@@ -0,0 +1,69 @@
+From 9f873f6d7fcb66cde0e02d7c3dc6ee07a58f2202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:40 +0800
+Subject: irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ
+ controller
+
+From: Ming Wang <wangming01@loongson.cn>
+
+[ Upstream commit c33c43f71bda362b292a6e57ac41b64342dc87b3 ]
+
+On certain Loongson platforms, drivers attempting to request a legacy
+ISA IRQ directly via request_irq() (e.g., IRQ 4) may fail. The
+virtual IRQ descriptor is not fully initialized and lacks a valid irqchip.
+
+This issue does not affect ACPI-enumerated devices described in DSDT,
+as their interrupts are properly mapped via the GSI translation path.
+This indicates the LPC irqdomain itself is functional but is not correctly
+handling direct VIRQ-to-HWIRQ mappings.
+
+The root cause is the use of irq_domain_create_linear(). This API sets
+up a domain for dynamic, on-demand mapping, typically triggered by a GSI
+request. It does not pre-populate the mappings for the legacy VIRQ range
+(0-15). Consequently, if no ACPI device claims a specific GSI
+(e.g., GSI 4), the corresponding VIRQ (e.g., VIRQ 4) is never mapped to
+the LPC domain. A direct call to request_irq(4, ...) then fails because
+the kernel cannot resolve this VIRQ to a hardware interrupt managed by
+the LPC controller.
+
+The PCH-LPC interrupt controller is an i8259-compatible legacy device
+that requires a deterministic, static 1-to-1 mapping for IRQs 0-15 to
+support legacy drivers.
+
+Fix this by replacing irq_domain_create_linear() with
+irq_domain_create_legacy(). This API is specifically designed for such
+controllers. It establishes the required static 1-to-1 VIRQ-to-HWIRQ
+mapping for the entire legacy range (0-15) immediately upon domain
+creation. This ensures that any VIRQ in this range is always resolvable,
+making direct calls to request_irq() for legacy IRQs function correctly.
+
+Signed-off-by: Ming Wang <wangming01@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-lpc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-lpc.c b/drivers/irqchip/irq-loongson-pch-lpc.c
+index 9b35492fb6be9..1e9fcea1826f8 100644
+--- a/drivers/irqchip/irq-loongson-pch-lpc.c
++++ b/drivers/irqchip/irq-loongson-pch-lpc.c
+@@ -198,8 +198,13 @@ int __init pch_lpc_acpi_init(struct irq_domain *parent,
+ 		goto iounmap_base;
+ 	}
+ 
+-	priv->lpc_domain = irq_domain_create_linear(irq_handle, LPC_COUNT,
+-					&pch_lpc_domain_ops, priv);
++	/*
++	 * The LPC interrupt controller is a legacy i8259-compatible device,
++	 * which requires a static 1:1 mapping for IRQs 0-15.
++	 * Use irq_domain_create_legacy to establish this static mapping early.
++	 */
++	priv->lpc_domain = irq_domain_create_legacy(irq_handle, LPC_COUNT, 0, 0,
++						    &pch_lpc_domain_ops, priv);
+ 	if (!priv->lpc_domain) {
+ 		pr_err("Failed to create IRQ domain\n");
+ 		goto free_irq_handle;
+-- 
+2.51.0
+
diff --git a/queue-6.6/irqchip-sifive-plic-respect-mask-state-when-setting-.patch b/queue-6.6/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
new file mode 100644
index 0000000000..2a1d4de096
--- /dev/null
+++ b/queue-6.6/irqchip-sifive-plic-respect-mask-state-when-setting-.patch
@@ -0,0 +1,54 @@
+From 4a56ba564bdeaa0d1a53669cec7304f9448f167f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:26:32 +0800
+Subject: irqchip/sifive-plic: Respect mask state when setting affinity
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit adecf78df945f4c7a1d29111b0002827f487df51 ]
+
+plic_set_affinity() always calls plic_irq_enable(), which clears up the
+priority setting even the interrupt is only masked. This unmasks the
+interrupt unexpectly.
+
+Replace the plic_irq_enable/disable() with plic_irq_toggle() to avoid
+changing the priority setting.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nam Cao <namcao@linutronix.de> # VisionFive 2
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250811002633.55275-1-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 2d20cf9d84cea..a8f5cfad16f7d 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -176,12 +176,14 @@ static int plic_set_affinity(struct irq_data *d,
+ 	if (cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+-	plic_irq_disable(d);
++	/* Invalidate the original routing entry */
++	plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+ 
+ 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
++	/* Setting the new routing entry if irq is enabled */
+ 	if (!irqd_irq_disabled(d))
+-		plic_irq_enable(d);
++		plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/memstick-add-timeout-to-prevent-indefinite-waiting.patch b/queue-6.6/memstick-add-timeout-to-prevent-indefinite-waiting.patch
new file mode 100644
index 0000000000..e6922c53c3
--- /dev/null
+++ b/queue-6.6/memstick-add-timeout-to-prevent-indefinite-waiting.patch
@@ -0,0 +1,50 @@
+From 73d5301dcc7559a38db80b949120bfade2cb7dcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 10:48:25 +0800
+Subject: memstick: Add timeout to prevent indefinite waiting
+
+From: Jiayi Li <lijiayi@kylinos.cn>
+
+[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
+
+Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
+and memstick_alloc_card() to prevent indefinite blocking in case of
+hardware or communication failures.
+
+Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
+Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index e0895e979e35b..65af43201b693 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -367,7 +367,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
+ {
+ 	card->next_request = h_memstick_set_rw_addr;
+ 	memstick_new_req(card->host);
+-	wait_for_completion(&card->mrq_complete);
++	if (!wait_for_completion_timeout(&card->mrq_complete,
++			msecs_to_jiffies(500)))
++		card->current_mrq.error = -ETIMEDOUT;
+ 
+ 	return card->current_mrq.error;
+ }
+@@ -401,7 +403,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ 
+ 		card->next_request = h_memstick_read_dev_id;
+ 		memstick_new_req(host);
+-		wait_for_completion(&card->mrq_complete);
++		if (!wait_for_completion_timeout(&card->mrq_complete,
++				msecs_to_jiffies(500)))
++			card->current_mrq.error = -ETIMEDOUT;
+ 
+ 		if (card->current_mrq.error)
+ 			goto err_out;
+-- 
+2.51.0
+
diff --git a/queue-6.6/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch b/queue-6.6/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
new file mode 100644
index 0000000000..ee8f43e1e1
--- /dev/null
+++ b/queue-6.6/mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
@@ -0,0 +1,92 @@
+From 69c81f3676cfc2d7bcd4c92b3f3f73beee65713c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 15:37:54 +0200
+Subject: mfd: da9063: Split chip variant reading in two bus transactions
+
+From: Jens Kehne <jens.kehne@agilent.com>
+
+[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
+
+We observed the initial probe of the da9063 failing in
+da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
+board. The problem originates in da9063_i2c_blockreg_read, which uses
+a single bus transaction to turn the register page and then read a
+register. On the bus, this should translate to a write to register 0,
+followed by a read to the target register, separated by a repeated
+start. However, we found that after the write to register 0, the
+controller sometimes continues directly with the register address of
+the read request, without sending the chip address or a repeated start
+in between, which makes the read request invalid.
+
+To fix this, separate turning the page and reading the register into
+two separate transactions. This brings the initialization code in line
+with the rest of the driver, which uses register maps (which to my
+knowledge do not use repeated starts after turning the page). This has
+been included in our kernel for several months and was recently
+included in a shipped product. For us, it reliably fixes the issue,
+and we have not observed any new issues.
+
+While the underlying problem is probably with the i2c controller or
+its driver, I still propose a change here in the interest of
+robustness: First, I'm not sure this issue can be fixed on the
+controller side, since there are other issues related to repeated
+start which can't (AR# 60695, AR# 61664). Second, similar problems
+might exist with other controllers.
+
+Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
+Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
+index d715cf9a9e688..7b829bfe04bc7 100644
+--- a/drivers/mfd/da9063-i2c.c
++++ b/drivers/mfd/da9063-i2c.c
+@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
+ 	DA9063_PAGE_SEL_BUF_SIZE,
+ };
+ 
++enum da9063_page_sel_msgs {
++	DA9063_PAGE_SEL_MSG = 0,
++	DA9063_PAGE_SEL_CNT,
++};
++
+ enum da9063_paged_read_msgs {
+-	DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
+-	DA9063_PAGED_READ_MSG_REG_SEL,
++	DA9063_PAGED_READ_MSG_REG_SEL = 0,
+ 	DA9063_PAGED_READ_MSG_DATA,
+ 	DA9063_PAGED_READ_MSG_CNT,
+ };
+@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
+ 		(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
+ 
+ 	/* Write reg address, page selection */
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
+-	xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
++	xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
++	xfer[DA9063_PAGE_SEL_MSG].flags = 0;
++	xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
++	xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
++
++	ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
++	if (ret < 0) {
++		dev_err(&client->dev, "Page switch failed: %d\n", ret);
++		return ret;
++	}
++
++	if (ret != DA9063_PAGE_SEL_CNT) {
++		dev_err(&client->dev, "Page switch failed to complete\n");
++		return -EIO;
++	}
+ 
+ 	/* Select register address */
+ 	xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
+-- 
+2.51.0
+
diff --git a/queue-6.6/mfd-madera-work-around-false-positive-wininitialized.patch b/queue-6.6/mfd-madera-work-around-false-positive-wininitialized.patch
new file mode 100644
index 0000000000..c89efef11b
--- /dev/null
+++ b/queue-6.6/mfd-madera-work-around-false-positive-wininitialized.patch
@@ -0,0 +1,61 @@
+From f44454e0822969688f93a2b7e07bab686fe036a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:19:28 +0200
+Subject: mfd: madera: Work around false-positive -Wininitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
+
+clang-21 warns about one uninitialized variable getting dereferenced
+in madera_dev_init:
+
+drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
+  739 |                               mfd_devs, n_devs,
+      |                               ^~~~~~~~
+drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
+  459 |         const struct mfd_cell *mfd_devs;
+      |                                        ^
+      |                                         = NULL
+
+The code is actually correct here because n_devs is only nonzero
+when mfd_devs is a valid pointer, but this is impossible for the
+compiler to see reliably.
+
+Change the logic to check for the pointer as well, to make this easier
+for the compiler to follow.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/madera-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index bdbd5bfc97145..2f74a8c644a32 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -456,7 +456,7 @@ int madera_dev_init(struct madera *madera)
+ 	struct device *dev = madera->dev;
+ 	unsigned int hwid;
+ 	int (*patch_fn)(struct madera *) = NULL;
+-	const struct mfd_cell *mfd_devs;
++	const struct mfd_cell *mfd_devs = NULL;
+ 	int n_devs = 0;
+ 	int i, ret;
+ 
+@@ -670,7 +670,7 @@ int madera_dev_init(struct madera *madera)
+ 		goto err_reset;
+ 	}
+ 
+-	if (!n_devs) {
++	if (!n_devs || !mfd_devs) {
+ 		dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
+ 			madera->type_name);
+ 		ret = -ENODEV;
+-- 
+2.51.0
+
diff --git a/queue-6.6/mfd-stmpe-i2c-add-missing-module_license.patch b/queue-6.6/mfd-stmpe-i2c-add-missing-module_license.patch
new file mode 100644
index 0000000000..eb4d598399
--- /dev/null
+++ b/queue-6.6/mfd-stmpe-i2c-add-missing-module_license.patch
@@ -0,0 +1,31 @@
+From e105a5c606ec0e597c6eb82fd335a882ef53d7fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:11:50 +0200
+Subject: mfd: stmpe-i2c: Add missing MODULE_LICENSE
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
+
+This driver is licensed GPL-2.0-only, so add the corresponding module flag.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe-i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index fe018bedab983..7e2ca39758825 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -137,3 +137,4 @@ module_exit(stmpe_exit);
+ 
+ MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
+ MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
++MODULE_LICENSE("GPL");
+-- 
+2.51.0
+
diff --git a/queue-6.6/mfd-stmpe-remove-irq-domain-upon-removal.patch b/queue-6.6/mfd-stmpe-remove-irq-domain-upon-removal.patch
new file mode 100644
index 0000000000..6d87dd20e5
--- /dev/null
+++ b/queue-6.6/mfd-stmpe-remove-irq-domain-upon-removal.patch
@@ -0,0 +1,37 @@
+From a85b51cc3b73d0fcd9d18b4045ed22eaae33851d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:07:48 +0200
+Subject: mfd: stmpe: Remove IRQ domain upon removal
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
+
+The IRQ domain is (optionally) added during stmpe_probe, but never removed.
+Add the call to stmpe_remove.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmpe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 9c3cf58457a7d..be6a84a3062cc 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1485,6 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+ 
+ void stmpe_remove(struct stmpe *stmpe)
+ {
++	if (stmpe->domain)
++		irq_domain_remove(stmpe->domain);
++
+ 	if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ 		regulator_disable(stmpe->vio);
+ 	if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+-- 
+2.51.0
+
diff --git a/queue-6.6/mmc-host-renesas_sdhi-fix-the-actual-clock.patch b/queue-6.6/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
new file mode 100644
index 0000000000..67437a18af
--- /dev/null
+++ b/queue-6.6/mmc-host-renesas_sdhi-fix-the-actual-clock.patch
@@ -0,0 +1,49 @@
+From 9b7024ee1315a4389a311584fa368a332ba7dbd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 21:38:56 +0100
+Subject: mmc: host: renesas_sdhi: Fix the actual clock
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
+
+Wrong actual clock reported, if the SD clock division ratio is other
+than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
+
+On high speed mode, cat /sys/kernel/debug/mmc1/ios
+Without the patch:
+clock:          50000000 Hz
+actual clock:   200000000 Hz
+
+After the fix:
+clock:          50000000 Hz
+actual clock:   50000000 Hz
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 597b00e8c9539..cffacf4434b55 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -220,7 +220,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
+ 			clk &= ~0xff;
+ 	}
+ 
+-	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++	clock = clk & CLK_CTL_DIV_MASK;
++	if (clock != 0xff)
++		host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
++
++	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
+ 	if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+ 		usleep_range(10000, 11000);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch b/queue-6.6/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
new file mode 100644
index 0000000000..0a08d905cb
--- /dev/null
+++ b/queue-6.6/mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
@@ -0,0 +1,74 @@
+From 91b04308d60d3a6c0aaf36f828ef3cb24499eccc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 16:11:19 +0530
+Subject: mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
+
+For Qualcomm SoCs which needs level shifter for SD card, extra delay is
+seen on receiver data path.
+
+To compensate this delay enable tuning for SDR50 mode for targets which
+has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
+with level shifter on Qualcomm SOC's.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index c2144a3efb308..74234ee5f6089 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -81,6 +81,7 @@
+ #define CORE_IO_PAD_PWR_SWITCH_EN	BIT(15)
+ #define CORE_IO_PAD_PWR_SWITCH	BIT(16)
+ #define CORE_HC_SELECT_IN_EN	BIT(18)
++#define CORE_HC_SELECT_IN_SDR50	(4 << 19)
+ #define CORE_HC_SELECT_IN_HS400	(6 << 19)
+ #define CORE_HC_SELECT_IN_MASK	(7 << 19)
+ 
+@@ -1133,6 +1134,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
+ {
+ 	struct mmc_ios *ios = &host->mmc->ios;
+ 
++	if (ios->timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING)
++		return true;
++
+ 	/*
+ 	 * Tuning is required for SDR104, HS200 and HS400 cards and
+ 	 * if clock frequency is greater than 100MHz in these modes.
+@@ -1201,6 +1206,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	struct mmc_ios ios = host->mmc->ios;
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++	const struct sdhci_msm_offset *msm_offset = msm_host->offset;
++	u32 config;
+ 
+ 	if (!sdhci_msm_is_tuning_needed(host)) {
+ 		msm_host->use_cdr = false;
+@@ -1217,6 +1224,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 */
+ 	msm_host->tuning_done = 0;
+ 
++	if (ios.timing == MMC_TIMING_UHS_SDR50 &&
++	    host->flags & SDHCI_SDR50_NEEDS_TUNING) {
++		config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
++		config &= ~CORE_HC_SELECT_IN_MASK;
++		config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
++		writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
++	}
++
+ 	/*
+ 	 * For HS400 tuning in HS200 timing requires:
+ 	 * - select MCLK/2 in VENDOR_SPEC
+-- 
+2.51.0
+
diff --git a/queue-6.6/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch b/queue-6.6/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
new file mode 100644
index 0000000000..c6a1baf7ff
--- /dev/null
+++ b/queue-6.6/nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
@@ -0,0 +1,52 @@
+From 2c7e83cba3d84549dda3a27a433b073e77898301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:03 +0200
+Subject: nvme-fc: use lock accessing port_state and rport state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
+
+nvme_fc_unregister_remote removes the remote port on a lport object at
+any point in time when there is no active association. This races with
+with the reconnect logic, because nvme_fc_create_association is not
+taking a lock to check the port_state and atomically increase the
+active count on the rport.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3e0da2422b334..bf9ab07257642 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3024,11 +3024,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
+ 
+ 	++ctrl->ctrl.nr_reconnects;
+ 
+-	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
++	spin_lock_irqsave(&ctrl->rport->lock, flags);
++	if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENODEV;
++	}
+ 
+-	if (nvme_fc_ctlr_active_on_rport(ctrl))
++	if (nvme_fc_ctlr_active_on_rport(ctrl)) {
++		spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 		return -ENOTUNIQ;
++	}
++	spin_unlock_irqrestore(&ctrl->rport->lock, flags);
+ 
+ 	dev_info(ctrl->ctrl.device,
+ 		"NVME-FC{%d}: create association : host wwpn 0x%016llx "
+-- 
+2.51.0
+
diff --git a/queue-6.6/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch b/queue-6.6/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
new file mode 100644
index 0000000000..46cd9140b5
--- /dev/null
+++ b/queue-6.6/nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
@@ -0,0 +1,52 @@
+From 0e5d8ac9a2717dd7d657d9c536dbfa5295b8a481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:52:11 +1000
+Subject: nvme: Use non zero KATO for persistent discovery connections
+
+From: Alistair Francis <alistair.francis@wdc.com>
+
+[ Upstream commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 ]
+
+The NVMe Base Specification 2.1 states that:
+
+"""
+A host requests an explicit persistent connection ... by specifying a
+non-zero Keep Alive Timer value in the Connect command.
+"""
+
+As such if we are starting a persistent connection to a discovery
+controller and the KATO is currently 0 we need to update KATO to a non
+zero value to avoid continuous timeouts on the target.
+
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 13221cc0d17d4..78d00e25a1790 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4414,8 +4414,14 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ 	 * checking that they started once before, hence are reconnecting back.
+ 	 */
+ 	if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+-	    nvme_discovery_ctrl(ctrl))
++	    nvme_discovery_ctrl(ctrl)) {
++		if (!ctrl->kato) {
++			nvme_stop_keep_alive(ctrl);
++			ctrl->kato = NVME_DEFAULT_KATO;
++			nvme_start_keep_alive(ctrl);
++		}
+ 		nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
++	}
+ 
+ 	if (ctrl->queue_count > 1) {
+ 		nvme_queue_scan(ctrl);
+-- 
+2.51.0
+
diff --git a/queue-6.6/nvmet-fc-avoid-scheduling-association-deletion-twice.patch b/queue-6.6/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
new file mode 100644
index 0000000000..9728606a67
--- /dev/null
+++ b/queue-6.6/nvmet-fc-avoid-scheduling-association-deletion-twice.patch
@@ -0,0 +1,72 @@
+From 9b04736a59dc4ea221d9108d592ff40172d8c7a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:01 +0200
+Subject: nvmet-fc: avoid scheduling association deletion twice
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit f2537be4f8421f6495edfa0bc284d722f253841d ]
+
+When forcefully shutting down a port via the configfs interface,
+nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
+then nvmet_disable_port(). Both functions will eventually schedule all
+remaining associations for deletion.
+
+The current implementation checks whether an association is about to be
+removed, but only after the work item has already been scheduled. As a
+result, it is possible for the first scheduled work item to free all
+resources, and then for the same work item to be scheduled again for
+deletion.
+
+Because the association list is an RCU list, it is not possible to take
+a lock and remove the list entry directly, so it cannot be looked up
+again. Instead, a flag (terminating) must be used to determine whether
+the association is already in the process of being deleted.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Closes: https://lore.kernel.org/all/rsdinhafrtlguauhesmrrzkybpnvwantwmyfq2ih5aregghax5@mhr7v3eryci3/
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index a15e764bae35b..188b9f1bdaca1 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1090,6 +1090,14 @@ nvmet_fc_delete_assoc_work(struct work_struct *work)
+ static void
+ nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
++	int terminating;
++
++	terminating = atomic_xchg(&assoc->terminating, 1);
++
++	/* if already terminating, do nothing */
++	if (terminating)
++		return;
++
+ 	nvmet_fc_tgtport_get(assoc->tgtport);
+ 	if (!queue_work(nvmet_wq, &assoc->del_work))
+ 		nvmet_fc_tgtport_put(assoc->tgtport);
+@@ -1209,13 +1217,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
+ {
+ 	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;
+ 	unsigned long flags;
+-	int i, terminating;
+-
+-	terminating = atomic_xchg(&assoc->terminating, 1);
+-
+-	/* if already terminating, do nothing */
+-	if (terminating)
+-		return;
++	int i;
+ 
+ 	spin_lock_irqsave(&tgtport->lock, flags);
+ 	list_del_rcu(&assoc->a_list);
+-- 
+2.51.0
+
diff --git a/queue-6.6/pinctrl-keembay-release-allocated-memory-in-detach-p.patch b/queue-6.6/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
new file mode 100644
index 0000000000..6bd30531ab
--- /dev/null
+++ b/queue-6.6/pinctrl-keembay-release-allocated-memory-in-detach-p.patch
@@ -0,0 +1,56 @@
+From 884e6c08990c6be74c51d614c9cc4a4f516987cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:59:17 +0200
+Subject: pinctrl: keembay: release allocated memory in detach path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit aae7a2876c3b39d07aa7655ea082af8e7862f3a5 ]
+
+Unlike all the other allocations in this driver, the memory for storing
+the pin function descriptions allocated with kcalloc() and later resized
+with krealloc() is never freed. Use devres like elsewhere to handle
+that. While at it - replace krealloc() with more suitable
+devm_krealloc_array().
+
+Note: the logic in this module is pretty convoluted and could probably
+use some revisiting, we should probably be able to calculate the exact
+amount of memory needed in advance or even skip the allocation
+altogether and just add each function to the radix tree separately.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-keembay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
+index 152c35bce8ecc..94b11a23829f6 100644
+--- a/drivers/pinctrl/pinctrl-keembay.c
++++ b/drivers/pinctrl/pinctrl-keembay.c
+@@ -1606,7 +1606,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	 * being part of 8 (hw maximum) globally unique muxes.
+ 	 */
+ 	kpc->nfuncs = 0;
+-	keembay_funcs = kcalloc(kpc->npins * 8, sizeof(*keembay_funcs), GFP_KERNEL);
++	keembay_funcs = devm_kcalloc(kpc->dev, kpc->npins * 8,
++				     sizeof(*keembay_funcs), GFP_KERNEL);
+ 	if (!keembay_funcs)
+ 		return -ENOMEM;
+ 
+@@ -1637,7 +1638,9 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
+ 	}
+ 
+ 	/* Reallocate memory based on actual number of functions */
+-	new_funcs = krealloc(keembay_funcs, kpc->nfuncs * sizeof(*new_funcs), GFP_KERNEL);
++	new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
++					kpc->nfuncs, sizeof(*new_funcs),
++					GFP_KERNEL);
+ 	if (!new_funcs) {
+ 		kfree(keembay_funcs);
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.6/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch b/queue-6.6/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
new file mode 100644
index 0000000000..ce637656bc
--- /dev/null
+++ b/queue-6.6/pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
@@ -0,0 +1,48 @@
+From b4e239c5293f864a09c62b9691cf90495e01c748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 14:20:38 +0800
+Subject: pinctrl: single: fix bias pull up/down handling in pin_config_set
+
+From: Chi Zhang <chizhang@asrmicro.com>
+
+[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
+
+In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
+PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
+which writes the register. However, the subsequent operations continue
+using the stale 'data' value from before the register write, effectively
+causing the bias clear operation to be overwritten and not take effect.
+
+Fix this by reading the 'data' value from the register after calling
+pcs_pinconf_clear_bias().
+
+This bug seems to have existed when this code was first merged in commit
+9dddb4df90d1 ("pinctrl: single: support generic pinconf").
+
+Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
+Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 6c670203b3ac2..7684039be10cb 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -587,8 +587,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
+ 				break;
+ 			case PIN_CONFIG_BIAS_PULL_DOWN:
+ 			case PIN_CONFIG_BIAS_PULL_UP:
+-				if (arg)
++				if (arg) {
+ 					pcs_pinconf_clear_bias(pctldev, pin);
++					data = pcs->read(pcs->base + offset);
++				}
+ 				fallthrough;
+ 			case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+ 				data &= ~func->conf[i].mask;
+-- 
+2.51.0
+
diff --git a/queue-6.6/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch b/queue-6.6/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
new file mode 100644
index 0000000000..d3d7e72cfe
--- /dev/null
+++ b/queue-6.6/pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
@@ -0,0 +1,41 @@
+From b1e0b08e4a9821bb380cbfcaee67aafd3ab7a0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:01:22 +0200
+Subject: pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 442816f97a4f84cb321d3359177a3b9b0ce48a60 ]
+
+After discussion with the devicetree maintainers we agreed to not extend
+lists with the generic compatible "apple,pmgr-pwrstate" anymore [1]. Use
+"apple,t8103-pmgr-pwrstate" as base compatible as it is the SoC the
+driver and bindings were written for.
+
+[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
+
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/apple/pmgr-pwrstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pmdomain/apple/pmgr-pwrstate.c b/drivers/pmdomain/apple/pmgr-pwrstate.c
+index d62a776c89a12..e592f819c8fa0 100644
+--- a/drivers/pmdomain/apple/pmgr-pwrstate.c
++++ b/drivers/pmdomain/apple/pmgr-pwrstate.c
+@@ -306,6 +306,7 @@ static int apple_pmgr_ps_probe(struct platform_device *pdev)
+ }
+ 
+ static const struct of_device_id apple_pmgr_ps_of_match[] = {
++	{ .compatible = "apple,t8103-pmgr-pwrstate" },
+ 	{ .compatible = "apple,pmgr-pwrstate" },
+ 	{}
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.6/power-supply-qcom_battmgr-add-ooi-chemistry.patch b/queue-6.6/power-supply-qcom_battmgr-add-ooi-chemistry.patch
new file mode 100644
index 0000000000..5a941345d8
--- /dev/null
+++ b/queue-6.6/power-supply-qcom_battmgr-add-ooi-chemistry.patch
@@ -0,0 +1,37 @@
+From 347c5eb58602e60b42d63f5652ead0c5ca39b179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:22:09 +0200
+Subject: power: supply: qcom_battmgr: add OOI chemistry
+
+From: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit fee0904441325d83e7578ca457ec65a9d3f21264 ]
+
+The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
+update the detection and return the appropriate type.
+
+Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index 190e8a4cfa97f..c1cb338e54bbc 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -975,7 +975,8 @@ static void qcom_battmgr_sc8280xp_strcpy(char *dest, const char *src)
+ 
+ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry)
+ {
+-	if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
++	if ((!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN)) ||
++	    (!strncmp(chemistry, "OOI", BATTMGR_CHEMISTRY_LEN)))
+ 		return POWER_SUPPLY_TECHNOLOGY_LION;
+ 	if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
+ 		return POWER_SUPPLY_TECHNOLOGY_LIPO;
+-- 
+2.51.0
+
diff --git a/queue-6.6/power-supply-qcom_battmgr-handle-charging-state-chan.patch b/queue-6.6/power-supply-qcom_battmgr-handle-charging-state-chan.patch
new file mode 100644
index 0000000000..b99b4bbea9
--- /dev/null
+++ b/queue-6.6/power-supply-qcom_battmgr-handle-charging-state-chan.patch
@@ -0,0 +1,70 @@
+From 73eb60e0224f928e02c76c9d31cc82ecd6f15b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 11:18:51 +0800
+Subject: power: supply: qcom_battmgr: handle charging state change
+ notifications
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 41307ec7df057239aae3d0f089cc35a0d735cdf8 ]
+
+The X1E80100 battery management firmware sends a notification with
+code 0x83 when the battery charging state changes, such as switching
+between fast charge, taper charge, end of charge, or any other error
+charging states.
+
+The same notification code is used with bit[8] set when charging stops
+because the charge control end threshold is reached. Additionally,
+a 2-bit value is included in bit[10:9] with the same code to indicate
+the charging source capability, which is determined by the calculated
+power from voltage and current readings from PDOs: 2 means a strong
+charger over 60W, 1 indicates a weak charger, and 0 means there is no
+charging source.
+
+These 3-MSB [10:8] in the notification code is not much useful for now,
+hence just ignore them and trigger a power supply change event whenever
+0x83 notification code is received. This helps to eliminate the unknown
+notification error messages.
+
+Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Closes: https://lore.kernel.org/all/r65idyc4of5obo6untebw4iqfj2zteiggnnzabrqtlcinvtddx@xc4aig5abesu/
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index c1cb338e54bbc..0c993780d3ef2 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -29,8 +29,9 @@ enum qcom_battmgr_variant {
+ #define NOTIF_BAT_PROPERTY		0x30
+ #define NOTIF_USB_PROPERTY		0x32
+ #define NOTIF_WLS_PROPERTY		0x34
+-#define NOTIF_BAT_INFO			0x81
+ #define NOTIF_BAT_STATUS		0x80
++#define NOTIF_BAT_INFO			0x81
++#define NOTIF_BAT_CHARGING_STATE	0x83
+ 
+ #define BATTMGR_BAT_INFO		0x9
+ 
+@@ -940,12 +941,14 @@ static void qcom_battmgr_notification(struct qcom_battmgr *battmgr,
+ 	}
+ 
+ 	notification = le32_to_cpu(msg->notification);
++	notification &= 0xff;
+ 	switch (notification) {
+ 	case NOTIF_BAT_INFO:
+ 		battmgr->info.valid = false;
+ 		fallthrough;
+ 	case NOTIF_BAT_STATUS:
+ 	case NOTIF_BAT_PROPERTY:
++	case NOTIF_BAT_CHARGING_STATE:
+ 		power_supply_changed(battmgr->bat_psy);
+ 		break;
+ 	case NOTIF_USB_PROPERTY:
+-- 
+2.51.0
+
diff --git a/queue-6.6/power-supply-sbs-charger-support-multiple-devices.patch b/queue-6.6/power-supply-sbs-charger-support-multiple-devices.patch
new file mode 100644
index 0000000000..3efc96bd9c
--- /dev/null
+++ b/queue-6.6/power-supply-sbs-charger-support-multiple-devices.patch
@@ -0,0 +1,114 @@
+From 6b58ddd3500a020cee6f7c1e9f21cb784cef209a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 17:55:08 +0200
+Subject: power: supply: sbs-charger: Support multiple devices
+
+From: Fabien Proriol <fabien.proriol@viavisolutions.com>
+
+[ Upstream commit 3ec600210849cf122606e24caab85f0b936cf63c ]
+
+If we have 2 instances of sbs-charger in the DTS, the driver probe for the second instance will fail:
+
+[    8.012874] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    8.039094] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    8.112911] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    8.134533] sysfs: cannot create duplicate filename '/class/power_supply/sbs-charger'
+[    8.143871] CPU: 3 PID: 295 Comm: systemd-udevd Tainted: G           O      5.10.147 #22
+[    8.151974] Hardware name: ALE AMB (DT)
+[    8.155828] Call trace:
+[    8.158292]  dump_backtrace+0x0/0x1d4
+[    8.161960]  show_stack+0x18/0x6c
+[    8.165280]  dump_stack+0xcc/0x128
+[    8.168687]  sysfs_warn_dup+0x60/0x7c
+[    8.172353]  sysfs_do_create_link_sd+0xf0/0x100
+[    8.176886]  sysfs_create_link+0x20/0x40
+[    8.180816]  device_add+0x270/0x7a4
+[    8.184311]  __power_supply_register+0x304/0x560
+[    8.188930]  devm_power_supply_register+0x54/0xa0
+[    8.193644]  sbs_probe+0xc0/0x214 [sbs_charger]
+[    8.198183]  i2c_device_probe+0x2dc/0x2f4
+[    8.202196]  really_probe+0xf0/0x510
+[    8.205774]  driver_probe_device+0xfc/0x160
+[    8.209960]  device_driver_attach+0xc0/0xcc
+[    8.214146]  __driver_attach+0xc0/0x170
+[    8.218002]  bus_for_each_dev+0x74/0xd4
+[    8.221862]  driver_attach+0x24/0x30
+[    8.225444]  bus_add_driver+0x148/0x250
+[    8.229283]  driver_register+0x78/0x130
+[    8.233140]  i2c_register_driver+0x4c/0xe0
+[    8.237250]  sbs_driver_init+0x20/0x1000 [sbs_charger]
+[    8.242424]  do_one_initcall+0x50/0x1b0
+[    8.242434]  do_init_module+0x44/0x230
+[    8.242438]  load_module+0x2200/0x27c0
+[    8.242442]  __do_sys_finit_module+0xa8/0x11c
+[    8.242447]  __arm64_sys_finit_module+0x20/0x30
+[    8.242457]  el0_svc_common.constprop.0+0x64/0x154
+[    8.242464]  do_el0_svc+0x24/0x8c
+[    8.242474]  el0_svc+0x10/0x20
+[    8.242481]  el0_sync_handler+0x108/0x114
+[    8.242485]  el0_sync+0x180/0x1c0
+[    8.243847] sbs-charger 20-0009: Failed to register power supply
+[    8.287934] sbs-charger: probe of 20-0009 failed with error -17
+
+This is mainly because the "name" field of power_supply_desc is a constant.
+This patch fixes the issue by reusing the same approach as sbs-battery.
+With this patch, the result is:
+[    7.819532] sbs-charger 18-0009: ltc4100: smart charger device registered
+[    7.825305] sbs-battery 18-000b: sbs-battery: battery gas gauge device registered
+[    7.887423] sbs-battery 20-000b: sbs-battery: battery gas gauge device registered
+[    7.893501] sbs-charger 20-0009: ltc4100: smart charger device registered
+
+Signed-off-by: Fabien Proriol <fabien.proriol@viavisolutions.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index f4adde4492707..d405c3657ce93 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -154,8 +154,7 @@ static const struct regmap_config sbs_regmap = {
+ 	.val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+ };
+ 
+-static const struct power_supply_desc sbs_desc = {
+-	.name = "sbs-charger",
++static const struct power_supply_desc sbs_default_desc = {
+ 	.type = POWER_SUPPLY_TYPE_MAINS,
+ 	.properties = sbs_properties,
+ 	.num_properties = ARRAY_SIZE(sbs_properties),
+@@ -165,9 +164,20 @@ static const struct power_supply_desc sbs_desc = {
+ static int sbs_probe(struct i2c_client *client)
+ {
+ 	struct power_supply_config psy_cfg = {};
++	struct power_supply_desc *sbs_desc;
+ 	struct sbs_info *chip;
+ 	int ret, val;
+ 
++	sbs_desc = devm_kmemdup(&client->dev, &sbs_default_desc,
++				sizeof(*sbs_desc), GFP_KERNEL);
++	if (!sbs_desc)
++		return -ENOMEM;
++
++	sbs_desc->name = devm_kasprintf(&client->dev, GFP_KERNEL, "sbs-%s",
++					dev_name(&client->dev));
++	if (!sbs_desc->name)
++		return -ENOMEM;
++
+ 	chip = devm_kzalloc(&client->dev, sizeof(struct sbs_info), GFP_KERNEL);
+ 	if (!chip)
+ 		return -ENOMEM;
+@@ -191,7 +201,7 @@ static int sbs_probe(struct i2c_client *client)
+ 		return dev_err_probe(&client->dev, ret, "Failed to get device status\n");
+ 	chip->last_state = val;
+ 
+-	chip->power_supply = devm_power_supply_register(&client->dev, &sbs_desc, &psy_cfg);
++	chip->power_supply = devm_power_supply_register(&client->dev, sbs_desc, &psy_cfg);
+ 	if (IS_ERR(chip->power_supply))
+ 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
+ 				     "Failed to register power supply\n");
+-- 
+2.51.0
+
diff --git a/queue-6.6/riscv-bpf-fix-uninitialized-symbol-retval_off.patch b/queue-6.6/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
new file mode 100644
index 0000000000..5da0eda330
--- /dev/null
+++ b/queue-6.6/riscv-bpf-fix-uninitialized-symbol-retval_off.patch
@@ -0,0 +1,48 @@
+From 71f7f36795f89226781eff1c792008ac8df88153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:22:44 +0800
+Subject: riscv: bpf: Fix uninitialized symbol 'retval_off'
+
+From: Chenghao Duan <duanchenghao@kylinos.cn>
+
+[ Upstream commit d0bf7cd5df18466d969bb60e8890b74cf96081ca ]
+
+In the __arch_prepare_bpf_trampoline() function, retval_off is only
+meaningful when save_ret is true, so the current logic is correct.
+However, in the original logic, retval_off is only initialized under
+certain conditions; for example, in the fmod_ret logic, the compiler is
+not aware that the flags of the fmod_ret program (prog) have set
+BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol
+compilation warning.
+
+So initialize retval_off unconditionally to fix it.
+
+Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 16eb4cd11cbd6..5426dc2697f94 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -855,10 +855,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ 	stack_size += 16;
+ 
+ 	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+-	if (save_ret) {
++	if (save_ret)
+ 		stack_size += 16; /* Save both A5 (BPF R0) and A0 */
+-		retval_off = stack_size;
+-	}
++	retval_off = stack_size;
+ 
+ 	stack_size += nregs * 8;
+ 	args_off = stack_size;
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch b/queue-6.6/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
new file mode 100644
index 0000000000..eb279ede6d
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
@@ -0,0 +1,40 @@
+From 3a9fef27cb635abdaa44140407a6ae833a6be073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:12:33 -0300
+Subject: selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
+
+Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
+APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
+the usage in test_lirc_mode2_user.c.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+index 4694422aa76c3..88e4aeab21b7b 100644
+--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
++++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+@@ -74,7 +74,7 @@ int main(int argc, char **argv)
+ 
+ 	/* Let's try detach it before it was ever attached */
+ 	ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
+-	if (ret != -1 || errno != ENOENT) {
++	if (ret != -ENOENT) {
+ 		printf("bpf_prog_detach2 not attached should fail: %m\n");
+ 		return 1;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch b/queue-6.6/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
new file mode 100644
index 0000000000..d5af8c8457
--- /dev/null
+++ b/queue-6.6/selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
@@ -0,0 +1,39 @@
+From e43fde5b90c36ecc84ee9c0e0a4f4adf3e345424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:48:30 -0300
+Subject: selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit 2a912258c90e895363c0ffc0be8a47f112ab67b7 ]
+
+Currently, even if some subtests fails, the end result will still yield
+"ok 1 selftests: bpf: test_xsk.sh". Fix it by exiting with 1 if there are
+any failures.
+
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-test_xsk_ret-v1-1-e6656c01f397@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xsk.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_xsk.sh b/tools/testing/selftests/bpf/test_xsk.sh
+index 2aa5a3445056a..f4205823175a9 100755
+--- a/tools/testing/selftests/bpf/test_xsk.sh
++++ b/tools/testing/selftests/bpf/test_xsk.sh
+@@ -203,4 +203,6 @@ done
+ 
+ if [ $failures -eq 0 ]; then
+         echo "All tests successful!"
++else
++	exit 1
+ fi
+-- 
+2.51.0
+
diff --git a/queue-6.6/series b/queue-6.6/series
index 7478b8bf68..6a674471e9 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -54,3 +54,60 @@ s390-disable-arch_want_optimize_hugetlb_vmemmap.patch
 drm-sched-fix-race-in-drm_sched_entity_select_rq.patch
 drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch
 s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch
+soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
+soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
+spi-loopback-test-don-t-use-pk-through-printk.patch
+bpf-don-t-use-pk-through-printk.patch
+pinctrl-single-fix-bias-pull-up-down-handling-in-pin.patch
+mmc-host-renesas_sdhi-fix-the-actual-clock.patch
+memstick-add-timeout-to-prevent-indefinite-waiting.patch
+irqchip-sifive-plic-respect-mask-state-when-setting-.patch
+selftests-bpf-fix-bpf_prog_detach2-usage-in-test_lir.patch
+cpufreq-longhaul-handle-null-policy-in-longhaul_exit.patch
+arc-fix-__fls-const-foldability-via-__builtin_clzl.patch
+selftests-bpf-upon-failures-exit-with-code-1-in-test.patch
+irqchip-gic-v2m-handle-multiple-msi-base-irq-alignme.patch
+acpi-prm-skip-handlers-with-null-handler_address-or-.patch
+acpi-scan-add-intel-cvs-acpi-hids-to-acpi_ignore_dep.patch
+power-supply-qcom_battmgr-add-ooi-chemistry.patch
+hwmon-k10temp-add-thermal-support-for-amd-family-1ah.patch
+hwmon-k10temp-add-device-id-for-strix-halo.patch
+hwmon-sbtsi_temp-amd-cpu-extended-temperature-range-.patch
+pinctrl-keembay-release-allocated-memory-in-detach-p.patch
+power-supply-sbs-charger-support-multiple-devices.patch
+hwmon-sy7636a-add-alias.patch
+irqchip-loongson-pch-lpc-use-legacy-domain-for-pch-l.patch
+arm64-zynqmp-revert-usb-node-drive-strength-and-slew.patch
+soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
+arm-tegra-transformer-20-add-missing-magnetometer-in.patch
+arm-tegra-transformer-20-fix-audio-codec-interrupt.patch
+mmc-sdhci-msm-enable-tuning-for-sdr50-mode-for-sd-ca.patch
+acpica-dispatcher-use-acpi_ds_clear_operands-in-acpi.patch
+tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
+nvmet-fc-avoid-scheduling-association-deletion-twice.patch
+nvme-fc-use-lock-accessing-port_state-and-rport-stat.patch
+bpf-do-not-limit-bpf_cgroup_from_id-to-current-s-nam.patch
+video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
+tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
+pmdomain-apple-add-apple-t8103-pmgr-pwrstate.patch
+power-supply-qcom_battmgr-handle-charging-state-chan.patch
+bpftool-fix-wuninitialized-const-pointer-warnings-wi.patch
+cpuidle-fail-cpuidle-device-registration-if-there-is.patch
+futex-don-t-leak-robust_list-pointer-on-exec-race.patch
+spi-rpc-if-add-resume-support-for-rz-g3e.patch
+clocksource-drivers-vf-pit-replace-raw_readl-writel-.patch
+blk-cgroup-fix-possible-deadlock-while-configuring-p.patch
+riscv-bpf-fix-uninitialized-symbol-retval_off.patch
+bpf-clear-pfmemalloc-flag-when-freeing-all-fragments.patch
+nvme-use-non-zero-kato-for-persistent-discovery-conn.patch
+uprobe-do-not-emulate-sstep-original-instruction-whe.patch
+hwmon-asus-ec-sensors-increase-timeout-for-locking-a.patch
+hwmon-dell-smm-add-support-for-dell-optiplex-7040.patch
+tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
+tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
+tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
+tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
+mfd-stmpe-remove-irq-domain-upon-removal.patch
+mfd-stmpe-i2c-add-missing-module_license.patch
+mfd-madera-work-around-false-positive-wininitialized.patch
+mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
diff --git a/queue-6.6/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch b/queue-6.6/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
new file mode 100644
index 0000000000..0b55be7bb8
--- /dev/null
+++ b/queue-6.6/soc-aspeed-socinfo-add-ast27xx-silicon-ids.patch
@@ -0,0 +1,37 @@
+From 7e69d400461faf0489244d09de0edc3d1d8eb541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 08:52:08 +0800
+Subject: soc: aspeed: socinfo: Add AST27xx silicon IDs
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit c30dcfd4b5a0f0e3fe7138bf287f6de6b1b00278 ]
+
+Extend the ASPEED SoC info driver to support AST27XX silicon IDs.
+
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://patch.msgid.link/20250807005208.3517283-1-ryan_chen@aspeedtech.com
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 3f759121dc00a..67e9ac3d08ecc 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -27,6 +27,10 @@ static struct {
+ 	{ "AST2620", 0x05010203 },
+ 	{ "AST2605", 0x05030103 },
+ 	{ "AST2625", 0x05030403 },
++	/* AST2700 */
++	{ "AST2750", 0x06000003 },
++	{ "AST2700", 0x06000103 },
++	{ "AST2720", 0x06000203 },
+ };
+ 
+ static const char *siliconid_to_name(u32 siliconid)
+-- 
+2.51.0
+
diff --git a/queue-6.6/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch b/queue-6.6/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
new file mode 100644
index 0000000000..910fe9e58a
--- /dev/null
+++ b/queue-6.6/soc-qcom-smem-fix-endian-unaware-access-of-num_entri.patch
@@ -0,0 +1,38 @@
+From dacc99c2321573fbdbec7badb9022b9246a81745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 01:56:46 +0200
+Subject: soc: qcom: smem: Fix endian-unaware access of num_entries
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
+
+Add a missing le32_to_cpu when accessing num_entries, which is always a
+little endian integer.
+
+Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
+index 2e8568d6cde94..aead7dd482ea3 100644
+--- a/drivers/soc/qcom/smem.c
++++ b/drivers/soc/qcom/smem.c
+@@ -870,7 +870,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
+ 	if (IS_ERR_OR_NULL(ptable))
+ 		return SMEM_ITEM_COUNT;
+ 
+-	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
++	info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
+ 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
+ 		return SMEM_ITEM_COUNT;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch b/queue-6.6/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
new file mode 100644
index 0000000000..3a691d5001
--- /dev/null
+++ b/queue-6.6/soc-tegra-fuse-add-tegra114-nvmem-cells-and-fuse-loo.patch
@@ -0,0 +1,163 @@
+From 5fc8d6482e58b90b2279694f1092a6e08330b758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 08:50:59 +0300
+Subject: soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
+
+Add missing Tegra114 nvmem cells and fuse lookups which were added for
+Tegra124+ but omitted for Tegra114.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
+ 1 file changed, 122 insertions(+)
+
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index 402cf939c0326..a6b3217c3ccef 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -116,6 +116,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
+ #endif
+ 
+ #ifdef CONFIG_ARCH_TEGRA_114_SOC
++static const struct nvmem_cell_info tegra114_fuse_cells[] = {
++	{
++		.name = "tsensor-cpu1",
++		.offset = 0x084,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu2",
++		.offset = 0x088,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-common",
++		.offset = 0x08c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu0",
++		.offset = 0x098,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "xusb-pad-calibration",
++		.offset = 0x0f0,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-cpu3",
++		.offset = 0x12c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-gpu",
++		.offset = 0x154,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem0",
++		.offset = 0x158,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-mem1",
++		.offset = 0x15c,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	}, {
++		.name = "tsensor-pllx",
++		.offset = 0x160,
++		.bytes = 4,
++		.bit_offset = 0,
++		.nbits = 32,
++	},
++};
++
++static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
++	{
++		.nvmem_name = "fuse",
++		.cell_name = "xusb-pad-calibration",
++		.dev_id = "7009f000.padctl",
++		.con_id = "calibration",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-common",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "common",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu2",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu2",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-cpu3",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "cpu3",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem0",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem0",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-mem1",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "mem1",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-gpu",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "gpu",
++	}, {
++		.nvmem_name = "fuse",
++		.cell_name = "tsensor-pllx",
++		.dev_id = "700e2000.thermal-sensor",
++		.con_id = "pllx",
++	},
++};
++
+ static const struct tegra_fuse_info tegra114_fuse_info = {
+ 	.read = tegra30_fuse_read,
+ 	.size = 0x2a0,
+@@ -126,6 +244,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
+ 	.init = tegra30_fuse_init,
+ 	.speedo_init = tegra114_init_speedo_data,
+ 	.info = &tegra114_fuse_info,
++	.lookups = tegra114_fuse_lookups,
++	.num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
++	.cells = tegra114_fuse_cells,
++	.num_cells = ARRAY_SIZE(tegra114_fuse_cells),
+ 	.soc_attr_group = &tegra_soc_attr_group,
+ 	.clk_suspend_on = false,
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.6/spi-loopback-test-don-t-use-pk-through-printk.patch b/queue-6.6/spi-loopback-test-don-t-use-pk-through-printk.patch
new file mode 100644
index 0000000000..03d0aac312
--- /dev/null
+++ b/queue-6.6/spi-loopback-test-don-t-use-pk-through-printk.patch
@@ -0,0 +1,86 @@
+From 3b1dea3e0c6b752f1ef096ee2671211ea9f0087a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:10:21 +0200
+Subject: spi: loopback-test: Don't use %pK through printk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 69b6c87c5525e..41e1fb27a9f34 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -447,7 +447,7 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 	int i;
+ 	u8 b;
+ 
+-	dev_info(&spi->dev, "  spi_msg@%pK\n", msg);
++	dev_info(&spi->dev, "  spi_msg@%p\n", msg);
+ 	if (msg->status)
+ 		dev_info(&spi->dev, "    status:        %i\n",
+ 			 msg->status);
+@@ -457,15 +457,15 @@ static void spi_test_dump_message(struct spi_device *spi,
+ 		 msg->actual_length);
+ 
+ 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+-		dev_info(&spi->dev, "    spi_transfer@%pK\n", xfer);
++		dev_info(&spi->dev, "    spi_transfer@%p\n", xfer);
+ 		dev_info(&spi->dev, "      len:    %i\n", xfer->len);
+-		dev_info(&spi->dev, "      tx_buf: %pK\n", xfer->tx_buf);
++		dev_info(&spi->dev, "      tx_buf: %p\n", xfer->tx_buf);
+ 		if (dump_data && xfer->tx_buf)
+ 			spi_test_print_hex_dump("          TX: ",
+ 						xfer->tx_buf,
+ 						xfer->len);
+ 
+-		dev_info(&spi->dev, "      rx_buf: %pK\n", xfer->rx_buf);
++		dev_info(&spi->dev, "      rx_buf: %p\n", xfer->rx_buf);
+ 		if (dump_data && xfer->rx_buf)
+ 			spi_test_print_hex_dump("          RX: ",
+ 						xfer->rx_buf,
+@@ -559,7 +559,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
+ 		/* if still not found then something has modified too much */
+ 		/* we could list the "closest" transfer here... */
+ 		dev_err(&spi->dev,
+-			"loopback strangeness - rx changed outside of allowed range at: %pK\n",
++			"loopback strangeness - rx changed outside of allowed range at: %p\n",
+ 			addr);
+ 		/* do not return, only set ret,
+ 		 * so that we list all addresses
+@@ -697,7 +697,7 @@ static int spi_test_translate(struct spi_device *spi,
+ 	}
+ 
+ 	dev_err(&spi->dev,
+-		"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
++		"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
+ 		*ptr, *ptr + len,
+ 		RX(0), RX(SPI_TEST_MAX_SIZE),
+ 		TX(0), TX(SPI_TEST_MAX_SIZE));
+-- 
+2.51.0
+
diff --git a/queue-6.6/spi-rpc-if-add-resume-support-for-rz-g3e.patch b/queue-6.6/spi-rpc-if-add-resume-support-for-rz-g3e.patch
new file mode 100644
index 0000000000..29871afe91
--- /dev/null
+++ b/queue-6.6/spi-rpc-if-add-resume-support-for-rz-g3e.patch
@@ -0,0 +1,36 @@
+From a67c68176ad323fe5cd9c94ca88252bcefe03525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 12:26:46 +0100
+Subject: spi: rpc-if: Add resume support for RZ/G3E
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ad4728740bd68d74365a43acc25a65339a9b2173 ]
+
+On RZ/G3E using PSCI, s2ram powers down the SoC. After resume,
+reinitialize the hardware for SPI operations.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250921112649.104516-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rpc-if.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
+index 7cce2d2ab9ca6..a1696672d12fe 100644
+--- a/drivers/spi/spi-rpc-if.c
++++ b/drivers/spi/spi-rpc-if.c
+@@ -193,6 +193,8 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev)
+ {
+ 	struct spi_controller *ctlr = dev_get_drvdata(dev);
+ 
++	rpcif_hw_init(dev, false);
++
+ 	return spi_controller_resume(ctlr);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch b/queue-6.6/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
new file mode 100644
index 0000000000..a28183a248
--- /dev/null
+++ b/queue-6.6/tee-allow-a-driver-to-allocate-a-tee_device-without-.patch
@@ -0,0 +1,38 @@
+From 8d7b72153ff04b195ff3f59b82fc677b6c26de49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 21:07:42 -0700
+Subject: tee: allow a driver to allocate a tee_device without a pool
+
+From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+
+[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
+
+A TEE driver doesn't always need to provide a pool if it doesn't
+support memory sharing ioctls and can allocate memory for TEE
+messages in another way. Although this is mentioned in the
+documentation for tee_device_alloc(), it is not handled correctly.
+
+Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
+Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index d7ad16f262b2e..976912f3bb5b4 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -889,7 +889,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ 
+ 	if (!teedesc || !teedesc->name || !teedesc->ops ||
+ 	    !teedesc->ops->get_version || !teedesc->ops->open ||
+-	    !teedesc->ops->release || !pool)
++	    !teedesc->ops->release)
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+-- 
+2.51.0
+
diff --git a/queue-6.6/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch b/queue-6.6/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
new file mode 100644
index 0000000000..f2b978b0d1
--- /dev/null
+++ b/queue-6.6/tools-cpupower-fix-error-return-value-in-cpupower_wr.patch
@@ -0,0 +1,44 @@
+From 5afd1aa584bc50c0a597f33c0730da47db6fa05d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:00:00 +0530
+Subject: tools/cpupower: fix error return value in cpupower_write_sysfs()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 57b100d4cf14276e0340eecb561005c07c129eb8 ]
+
+The cpupower_write_sysfs() function currently returns -1 on
+write failure, but the function signature indicates it should
+return an unsigned int. Returning -1 from an unsigned function
+results in a large positive value rather than indicating
+an error condition.
+
+Fix this by returning 0 on failure, which is more appropriate
+for an unsigned return type and maintains consistency with typical
+success/failure semantics where 0 indicates failure and non-zero
+indicates success (bytes written).
+
+Link: https://lore.kernel.org/r/20250828063000.803229-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpupower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 7a2ef691b20e1..c2a7af89a67bb 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -55,7 +55,7 @@ unsigned int cpupower_write_sysfs(const char *path, char *buf, size_t buflen)
+ 	if (numwritten < 1) {
+ 		perror(path);
+ 		close(fd);
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	close(fd);
+-- 
+2.51.0
+
diff --git a/queue-6.6/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch b/queue-6.6/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
new file mode 100644
index 0000000000..e1ef0302e4
--- /dev/null
+++ b/queue-6.6/tools-cpupower-fix-incorrect-size-in-cpuidle_state_d.patch
@@ -0,0 +1,60 @@
+From b30c7d7671f8e47310e86aabdb2e3df4342b1443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:38:20 +0530
+Subject: tools/cpupower: Fix incorrect size in cpuidle_state_disable()
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
+
+Fix incorrect size parameter passed to cpuidle_state_write_file() in
+cpuidle_state_disable().
+
+The function was incorrectly using sizeof(disable) which returns the
+size of the unsigned int variable (4 bytes) instead of the actual
+length of the string stored in the 'value' buffer.
+
+Since 'value' is populated with snprintf() to contain the string
+representation of the disable value, we should use the length
+returned by snprintf() to get the correct string length for
+writing to the sysfs file.
+
+This ensures the correct number of bytes is written to the cpuidle
+state disable file in sysfs.
+
+Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/lib/cpuidle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 479c5971aa6da..c15d0de12357f 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
+ {
+ 	char value[SYSFS_PATH_MAX];
+ 	int bytes_written;
++	int len;
+ 
+ 	if (cpuidle_state_count(cpu) <= idlestate)
+ 		return -1;
+@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
+ 				 idlestate_value_files[IDLESTATE_DISABLE]))
+ 		return -2;
+ 
+-	snprintf(value, SYSFS_PATH_MAX, "%u", disable);
++	len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ 
+ 	bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
+-						   value, sizeof(disable));
++						   value, len);
+ 	if (bytes_written)
+ 		return 0;
+ 	return -3;
+-- 
+2.51.0
+
diff --git a/queue-6.6/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch b/queue-6.6/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
new file mode 100644
index 0000000000..ae685419e1
--- /dev/null
+++ b/queue-6.6/tools-power-x86_energy_perf_policy-enhance-hwp-enabl.patch
@@ -0,0 +1,49 @@
+From 5ba2c438960ea6f9e520b44660ef69b99cfe3961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:07:02 -0400
+Subject: tools/power x86_energy_perf_policy: Enhance HWP enable
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
+
+On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
+
+Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index c883f211dbcc9..0bda8e3ae7f77 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -1166,13 +1166,18 @@ int update_hwp_request_pkg(int pkg)
+ 
+ int enable_hwp_on_cpu(int cpu)
+ {
+-	unsigned long long msr;
++	unsigned long long old_msr, new_msr;
++
++	get_msr(cpu, MSR_PM_ENABLE, &old_msr);
++
++	if (old_msr & 1)
++		return 0;	/* already enabled */
+ 
+-	get_msr(cpu, MSR_PM_ENABLE, &msr);
+-	put_msr(cpu, MSR_PM_ENABLE, 1);
++	new_msr = old_msr | 1;
++	put_msr(cpu, MSR_PM_ENABLE, new_msr);
+ 
+ 	if (verbose)
+-		printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
++		printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch b/queue-6.6/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
new file mode 100644
index 0000000000..08f1d2685b
--- /dev/null
+++ b/queue-6.6/tools-power-x86_energy_perf_policy-fix-incorrect-fop.patch
@@ -0,0 +1,52 @@
+From c8129906610a5dff32c7f6722eec35a016fd2634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:32:08 +0530
+Subject: tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
+
+The fopen_or_die() function was previously hardcoded
+to open files in read-only mode ("r"), ignoring the
+mode parameter passed to it. This patch corrects
+fopen_or_die() to use the provided mode argument,
+allowing for flexible file access as intended.
+
+Additionally, the call to fopen_or_die() in
+err_on_hypervisor() incorrectly used the mode
+"ro", which is not a valid fopen mode. This is
+fixed to use the correct "r" mode.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index ebda9c366b2ba..c883f211dbcc9 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -630,7 +630,7 @@ void cmdline(int argc, char **argv)
+  */
+ FILE *fopen_or_die(const char *path, const char *mode)
+ {
+-	FILE *filep = fopen(path, "r");
++	FILE *filep = fopen(path, mode);
+ 
+ 	if (!filep)
+ 		err(1, "%s: open failed", path);
+@@ -644,7 +644,7 @@ void err_on_hypervisor(void)
+ 	char *buffer;
+ 
+ 	/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
+-	cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
++	cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
+ 
+ 	buffer = malloc(4096);
+ 	if (!buffer) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch b/queue-6.6/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
new file mode 100644
index 0000000000..dd91cd6e79
--- /dev/null
+++ b/queue-6.6/tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
@@ -0,0 +1,75 @@
+From df10487021c4d0db9d12252231a2e6c98fa3ef57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:56:46 -0400
+Subject: tools/power x86_energy_perf_policy: Prefer driver HWP limits
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
+
+When we are successful in using cpufreq min/max limits,
+skip setting the raw MSR limits entirely.
+
+This is necessary to avoid undoing any modification that
+the cpufreq driver makes to our sysfs request.
+
+eg. intel_pstate may take our request for a limit
+that is valid according to HWP.CAP.MIN/MAX and clip
+it to be within the range available in PLATFORM_INFO.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 0bda8e3ae7f77..891738116c8b2 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
+ unsigned char update_hwp_epp;
+ unsigned char update_hwp_min;
+ unsigned char update_hwp_max;
++unsigned char hwp_limits_done_via_sysfs;
+ unsigned char update_hwp_desired;
+ unsigned char update_hwp_window;
+ unsigned char update_hwp_use_pkg;
+@@ -951,8 +952,10 @@ int ratio_2_sysfs_khz(int ratio)
+ }
+ /*
+  * If HWP is enabled and cpufreq sysfs attribtes are present,
+- * then update sysfs, so that it will not become
+- * stale when we write to MSRs.
++ * then update via sysfs. The intel_pstate driver may modify (clip)
++ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
++ * and the driver-chosen value takes precidence.
++ *
+  * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
+  *  so we don't have to touch that.)
+  */
+@@ -1007,6 +1010,8 @@ int update_sysfs(int cpu)
+ 	if (update_hwp_max)
+ 		update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ 
++	hwp_limits_done_via_sysfs = 1;
++
+ 	return 0;
+ }
+ 
+@@ -1085,10 +1090,10 @@ int update_hwp_request(int cpu)
+ 	if (debug)
+ 		print_hwp_request(cpu, &req, "old: ");
+ 
+-	if (update_hwp_min)
++	if (update_hwp_min && !hwp_limits_done_via_sysfs)
+ 		req.hwp_min = req_update.hwp_min;
+ 
+-	if (update_hwp_max)
++	if (update_hwp_max && !hwp_limits_done_via_sysfs)
+ 		req.hwp_max = req_update.hwp_max;
+ 
+ 	if (update_hwp_desired)
+-- 
+2.51.0
+
diff --git a/queue-6.6/uprobe-do-not-emulate-sstep-original-instruction-whe.patch b/queue-6.6/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
new file mode 100644
index 0000000000..97a7c27666
--- /dev/null
+++ b/queue-6.6/uprobe-do-not-emulate-sstep-original-instruction-whe.patch
@@ -0,0 +1,50 @@
+From 533206dcf6eed76e7f63ffe01e78de52c64f6d01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:52:57 +0200
+Subject: uprobe: Do not emulate/sstep original instruction when ip is changed
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
+
+If uprobe handler changes instruction pointer we still execute single
+step) or emulate the original instruction and increment the (new) ip
+with its length.
+
+This makes the new instruction pointer bogus and application will
+likely crash on illegal instruction execution.
+
+If user decided to take execution elsewhere, it makes little sense
+to execute the original instruction, so let's skip it.
+
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index a554f43d3ceb9..6304238293ae1 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -2255,6 +2255,13 @@ static void handle_swbp(struct pt_regs *regs)
+ 
+ 	handler_chain(uprobe, regs);
+ 
++	/*
++	 * If user decided to take execution elsewhere, it makes little sense
++	 * to execute the original instruction, so let's skip it.
++	 */
++	if (instruction_pointer(regs) != bp_vaddr)
++		goto out;
++
+ 	if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+ 		goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch b/queue-6.6/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
new file mode 100644
index 0000000000..678e0b68f2
--- /dev/null
+++ b/queue-6.6/video-backlight-lp855x_bl-set-correct-eprom-start-fo.patch
@@ -0,0 +1,37 @@
+From 039a28857dafbdb0aa132e573d8e55eca3e2ba70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:43:04 +0300
+Subject: video: backlight: lp855x_bl: Set correct EPROM start for LP8556
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
+
+According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
+in the driver accordingly.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
+Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp855x_bl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 7075bfab59c4d..d191560ce285f 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -22,7 +22,7 @@
+ #define LP855X_DEVICE_CTRL		0x01
+ #define LP855X_EEPROM_START		0xA0
+ #define LP855X_EEPROM_END		0xA7
+-#define LP8556_EPROM_START		0xA0
++#define LP8556_EPROM_START		0x98
+ #define LP8556_EPROM_END		0xAF
+ 
+ /* LP8555/7 Registers */
+-- 
+2.51.0
+
-- 
2.47.3