--- /dev/null
+From 4f22ddc07d8c74575e4ee80eaf6aa1c04e55f731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 May 2025 15:45:27 +0200
+Subject: ALSA: seq: Fix delivery of UMP events to group ports
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit ff7b190aef6cccdb6f14d20c5753081fe6420e0b ]
+
+When an event with UMP message is sent to a UMP client, the EP port
+receives always no matter where the event is sent to, as it's a
+catch-all port. OTOH, if an event is sent to EP port, and if the
+event has a certain UMP Group, it should have been delivered to the
+associated UMP Group port, too, but this was ignored, so far.
+
+This patch addresses the behavior. Now a UMP event sent to the
+Endpoint port will be delivered to the subscribers of the UMP group
+port the event is associated with.
+
+The patch also does a bit of refactoring to simplify the code about
+__deliver_to_subscribers().
+
+Fixes: 177ccf811df4 ("ALSA: seq: Support MIDI 2.0 UMP Endpoint port")
+Link: https://patch.msgid.link/20250511134528.6314-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_clientmgr.c | 52 ++++++++++++++++++++------------
+ sound/core/seq/seq_ump_convert.c | 18 +++++++++++
+ sound/core/seq/seq_ump_convert.h | 1 +
+ 3 files changed, 52 insertions(+), 19 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index b30faf731da72..b74de9c0969fc 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -732,15 +732,21 @@ static int snd_seq_deliver_single_event(struct snd_seq_client *client,
+ */
+ static int __deliver_to_subscribers(struct snd_seq_client *client,
+ struct snd_seq_event *event,
+- struct snd_seq_client_port *src_port,
+- int atomic, int hop)
++ int port, int atomic, int hop)
+ {
++ struct snd_seq_client_port *src_port;
+ struct snd_seq_subscribers *subs;
+ int err, result = 0, num_ev = 0;
+ union __snd_seq_event event_saved;
+ size_t saved_size;
+ struct snd_seq_port_subs_info *grp;
+
++ if (port < 0)
++ return 0;
++ src_port = snd_seq_port_use_ptr(client, port);
++ if (!src_port)
++ return 0;
++
+ /* save original event record */
+ saved_size = snd_seq_event_packet_size(event);
+ memcpy(&event_saved, event, saved_size);
+@@ -775,6 +781,7 @@ static int __deliver_to_subscribers(struct snd_seq_client *client,
+ read_unlock(&grp->list_lock);
+ else
+ up_read(&grp->list_mutex);
++ snd_seq_port_unlock(src_port);
+ memcpy(event, &event_saved, saved_size);
+ return (result < 0) ? result : num_ev;
+ }
+@@ -783,25 +790,32 @@ static int deliver_to_subscribers(struct snd_seq_client *client,
+ struct snd_seq_event *event,
+ int atomic, int hop)
+ {
+- struct snd_seq_client_port *src_port;
+- int ret = 0, ret2;
+-
+- src_port = snd_seq_port_use_ptr(client, event->source.port);
+- if (src_port) {
+- ret = __deliver_to_subscribers(client, event, src_port, atomic, hop);
+- snd_seq_port_unlock(src_port);
+- }
+-
+- if (client->ump_endpoint_port < 0 ||
+- event->source.port == client->ump_endpoint_port)
+- return ret;
++ int ret;
++#if IS_ENABLED(CONFIG_SND_SEQ_UMP)
++ int ret2;
++#endif
+
+- src_port = snd_seq_port_use_ptr(client, client->ump_endpoint_port);
+- if (!src_port)
++ ret = __deliver_to_subscribers(client, event,
++ event->source.port, atomic, hop);
++#if IS_ENABLED(CONFIG_SND_SEQ_UMP)
++ if (!snd_seq_client_is_ump(client) || client->ump_endpoint_port < 0)
+ return ret;
+- ret2 = __deliver_to_subscribers(client, event, src_port, atomic, hop);
+- snd_seq_port_unlock(src_port);
+- return ret2 < 0 ? ret2 : ret;
++ /* If it's an event from EP port (and with a UMP group),
++ * deliver to subscribers of the corresponding UMP group port, too.
++ * Or, if it's from non-EP port, deliver to subscribers of EP port, too.
++ */
++ if (event->source.port == client->ump_endpoint_port)
++ ret2 = __deliver_to_subscribers(client, event,
++ snd_seq_ump_group_port(event),
++ atomic, hop);
++ else
++ ret2 = __deliver_to_subscribers(client, event,
++ client->ump_endpoint_port,
++ atomic, hop);
++ if (ret2 < 0)
++ return ret2;
++#endif
++ return ret;
+ }
+
+ /* deliver an event to the destination port(s).
+diff --git a/sound/core/seq/seq_ump_convert.c b/sound/core/seq/seq_ump_convert.c
+index ff7e558b4d51d..db2f169cae11e 100644
+--- a/sound/core/seq/seq_ump_convert.c
++++ b/sound/core/seq/seq_ump_convert.c
+@@ -1285,3 +1285,21 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source,
+ else
+ return cvt_to_ump_midi1(dest, dest_port, event, atomic, hop);
+ }
++
++/* return the UMP group-port number of the event;
++ * return -1 if groupless or non-UMP event
++ */
++int snd_seq_ump_group_port(const struct snd_seq_event *event)
++{
++ const struct snd_seq_ump_event *ump_ev =
++ (const struct snd_seq_ump_event *)event;
++ unsigned char type;
++
++ if (!snd_seq_ev_is_ump(event))
++ return -1;
++ type = ump_message_type(ump_ev->ump[0]);
++ if (ump_is_groupless_msg(type))
++ return -1;
++ /* group-port number starts from 1 */
++ return ump_message_group(ump_ev->ump[0]) + 1;
++}
+diff --git a/sound/core/seq/seq_ump_convert.h b/sound/core/seq/seq_ump_convert.h
+index 6c146d8032804..4abf0a7637d70 100644
+--- a/sound/core/seq/seq_ump_convert.h
++++ b/sound/core/seq/seq_ump_convert.h
+@@ -18,5 +18,6 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source,
+ struct snd_seq_client_port *dest_port,
+ struct snd_seq_event *event,
+ int atomic, int hop);
++int snd_seq_ump_group_port(const struct snd_seq_event *event);
+
+ #endif /* __SEQ_UMP_CONVERT_H */
+--
+2.39.5
+
--- /dev/null
+From a8a0c9dea84b0d211aede2ec926b9d141617aa75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 09:31:04 +0200
+Subject: ALSA: sh: SND_AICA should depend on SH_DMA_API
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 66e48ef6ef506c89ec1b3851c6f9f5f80b5835ff ]
+
+If CONFIG_SH_DMA_API=n:
+
+ WARNING: unmet direct dependencies detected for G2_DMA
+ Depends on [n]: SH_DREAMCAST [=y] && SH_DMA_API [=n]
+ Selected by [y]:
+ - SND_AICA [=y] && SOUND [=y] && SND [=y] && SND_SUPERH [=y] && SH_DREAMCAST [=y]
+
+SND_AICA selects G2_DMA. As the latter depends on SH_DMA_API, the
+former should depend on SH_DMA_API, too.
+
+Fixes: f477a538c14d07f8 ("sh: dma: fix kconfig dependency for G2_DMA")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202505131320.PzgTtl9H-lkp@intel.com/
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/b90625f8a9078d0d304bafe862cbe3a3fab40082.1747121335.git.geert+renesas@glider.be
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/sh/Kconfig b/sound/sh/Kconfig
+index b75fbb3236a7b..f5fa09d740b4c 100644
+--- a/sound/sh/Kconfig
++++ b/sound/sh/Kconfig
+@@ -14,7 +14,7 @@ if SND_SUPERH
+
+ config SND_AICA
+ tristate "Dreamcast Yamaha AICA sound"
+- depends on SH_DREAMCAST
++ depends on SH_DREAMCAST && SH_DMA_API
+ select SND_PCM
+ select G2_DMA
+ help
+--
+2.39.5
+
--- /dev/null
+From 9480e58082f5b4617e46799814380f6dbf25cd46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 May 2025 16:11:45 +0200
+Subject: ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit dd33993a9721ab1dae38bd37c9f665987d554239 ]
+
+s/devince/device/
+
+It's used only internally, so no any behavior changes.
+
+Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing")
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/20250511141147.10246-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_midi2.c | 2 +-
+ include/sound/ump_msg.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
+index 8c9d0074db588..0c45936f51b3d 100644
+--- a/drivers/usb/gadget/function/f_midi2.c
++++ b/drivers/usb/gadget/function/f_midi2.c
+@@ -475,7 +475,7 @@ static void reply_ump_stream_ep_info(struct f_midi2_ep *ep)
+ /* reply a UMP EP device info */
+ static void reply_ump_stream_ep_device(struct f_midi2_ep *ep)
+ {
+- struct snd_ump_stream_msg_devince_info rep = {
++ struct snd_ump_stream_msg_device_info rep = {
+ .type = UMP_MSG_TYPE_STREAM,
+ .status = UMP_STREAM_MSG_STATUS_DEVICE_INFO,
+ .manufacture_id = ep->info.manufacturer,
+diff --git a/include/sound/ump_msg.h b/include/sound/ump_msg.h
+index 72f60ddfea753..9556b4755a1ed 100644
+--- a/include/sound/ump_msg.h
++++ b/include/sound/ump_msg.h
+@@ -604,7 +604,7 @@ struct snd_ump_stream_msg_ep_info {
+ } __packed;
+
+ /* UMP Stream Message: Device Info Notification (128bit) */
+-struct snd_ump_stream_msg_devince_info {
++struct snd_ump_stream_msg_device_info {
+ #ifdef __BIG_ENDIAN_BITFIELD
+ /* 0 */
+ u32 type:4;
+@@ -754,7 +754,7 @@ struct snd_ump_stream_msg_fb_name {
+ union snd_ump_stream_msg {
+ struct snd_ump_stream_msg_ep_discovery ep_discovery;
+ struct snd_ump_stream_msg_ep_info ep_info;
+- struct snd_ump_stream_msg_devince_info device_info;
++ struct snd_ump_stream_msg_device_info device_info;
+ struct snd_ump_stream_msg_stream_cfg stream_cfg;
+ struct snd_ump_stream_msg_fb_discovery fb_discovery;
+ struct snd_ump_stream_msg_fb_info fb_info;
+--
+2.39.5
+
--- /dev/null
+From 6b7070119e649f812b88a325c40c08c7ecd01e7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 11:28:27 +0530
+Subject: arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout
+
+From: Himanshu Bhavani <himanshu.bhavani@siliconsignals.io>
+
+[ Upstream commit c6888983134e2ccc2db8ffd2720b0d4826d952e4 ]
+
+Fix SD card timeout issue caused by LDO5 regulator getting disabled
+after boot.
+
+The kernel log shows LDO5 being disabled, which leads to a timeout
+on USDHC2:
+[ 33.760561] LDO5: disabling
+[ 81.119861] mmc1: Timeout waiting for hardware interrupt.
+
+To prevent this, set regulator-boot-on and regulator-always-on for
+LDO5. Also add the vqmmc regulator to properly support 1.8V/3.3V
+signaling for USDHC2 using a GPIO-controlled regulator.
+
+Fixes: 6c2a1f4f71258 ("arm64: dts: imx8mp-var-som-symphony: Add Variscite Symphony board and VAR-SOM-MX8MP SoM")
+Signed-off-by: Himanshu Bhavani <himanshu.bhavani@siliconsignals.io>
+Acked-by: Tarang Raval <tarang.raval@siliconsignals.io>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi
+index b2ac2583a5929..b59da91fdd041 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-var-som.dtsi
+@@ -35,7 +35,6 @@
+ <0x1 0x00000000 0 0xc0000000>;
+ };
+
+-
+ reg_usdhc2_vmmc: regulator-usdhc2-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "VSD_3V3";
+@@ -46,6 +45,16 @@
+ startup-delay-us = <100>;
+ off-on-delay-us = <12000>;
+ };
++
++ reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc {
++ compatible = "regulator-gpio";
++ regulator-name = "VSD_VSEL";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <3300000>;
++ gpios = <&gpio2 12 GPIO_ACTIVE_HIGH>;
++ states = <3300000 0x0 1800000 0x1>;
++ vin-supply = <&ldo5>;
++ };
+ };
+
+ &A53_0 {
+@@ -205,6 +214,7 @@
+ pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
+ cd-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
+ vmmc-supply = <®_usdhc2_vmmc>;
++ vqmmc-supply = <®_usdhc2_vqmmc>;
+ bus-width = <4>;
+ status = "okay";
+ };
+--
+2.39.5
+
--- /dev/null
+From c76fff9ec72645bec613dce6bae59351674790e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 09:17:53 +0100
+Subject: arm64: dts: rockchip: Assign RT5616 MCLK rate on
+ rk3588-friendlyelec-cm3588
+
+From: Tom Vincent <linux@tlvince.com>
+
+[ Upstream commit 5e6a4ee9799b202fefa8c6264647971f892f0264 ]
+
+The Realtek RT5616 audio codec on the FriendlyElec CM3588 module fails
+to probe correctly due to the missing clock properties. This results
+in distorted analogue audio output.
+
+Assign MCLK to 12.288 MHz, which allows the codec to advertise most of
+the standard sample rates per other RK3588 devices.
+
+Fixes: e23819cf273c ("arm64: dts: rockchip: Add FriendlyElec CM3588 NAS board")
+Signed-off-by: Tom Vincent <linux@tlvince.com>
+Link: https://lore.kernel.org/r/20250417081753.644950-1-linux@tlvince.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi
+index e3a9598b99fca..cacffc851584f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-friendlyelec-cm3588.dtsi
+@@ -222,6 +222,10 @@
+ compatible = "realtek,rt5616";
+ reg = <0x1b>;
+ #sound-dai-cells = <0>;
++ assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
++ assigned-clock-rates = <12288000>;
++ clocks = <&cru I2S0_8CH_MCLKOUT>;
++ clock-names = "mclk";
+ };
+ };
+
+--
+2.39.5
+
--- /dev/null
+From ac5b1ae0f9eeb0115421d37aa8c901bca0f51064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 15:45:06 -0700
+Subject: binfmt_elf: Move brk for static PIE even if ASLR disabled
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 11854fe263eb1b9a8efa33b0c087add7719ea9b4 ]
+
+In commit bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing
+direct loader exec"), the brk was moved out of the mmap region when
+loading static PIE binaries (ET_DYN without INTERP). The common case
+for these binaries was testing new ELF loaders, so the brk needed to
+be away from mmap to avoid colliding with stack, future mmaps (of the
+loader-loaded binary), etc. But this was only done when ASLR was enabled,
+in an attempt to minimize changes to memory layouts.
+
+After adding support to respect alignment requirements for static PIE
+binaries in commit 3545deff0ec7 ("binfmt_elf: Honor PT_LOAD alignment
+for static PIE"), it became possible to have a large gap after the
+final PT_LOAD segment and the top of the mmap region. This means that
+future mmap allocations might go after the last PT_LOAD segment (where
+brk might be if ASLR was disabled) instead of before them (where they
+traditionally ended up).
+
+On arm64, running with ASLR disabled, Ubuntu 22.04's "ldconfig" binary,
+a static PIE, has alignment requirements that leaves a gap large enough
+after the last PT_LOAD segment to fit the vdso and vvar, but still leave
+enough space for the brk (which immediately follows the last PT_LOAD
+segment) to be allocated by the binary.
+
+fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real
+fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real
+fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0
+***[brk will go here at fffff7ffa000]***
+fffff7ffc000-fffff7ffe000 r--p 00000000 00:00 0 [vvar]
+fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso]
+fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack]
+
+After commit 0b3bc3354eb9 ("arm64: vdso: Switch to generic storage
+implementation"), the arm64 vvar grew slightly, and suddenly the brk
+collided with the allocation.
+
+fffff7f20000-fffff7fde000 r-xp 00000000 fe:02 8110426 /sbin/ldconfig.real
+fffff7fee000-fffff7ff5000 rw-p 000be000 fe:02 8110426 /sbin/ldconfig.real
+fffff7ff5000-fffff7ffa000 rw-p 00000000 00:00 0
+***[oops, no room any more, vvar is at fffff7ffa000!]***
+fffff7ffa000-fffff7ffe000 r--p 00000000 00:00 0 [vvar]
+fffff7ffe000-fffff8000000 r-xp 00000000 00:00 0 [vdso]
+fffffffdf000-1000000000000 rw-p 00000000 00:00 0 [stack]
+
+The solution is to unconditionally move the brk out of the mmap region
+for static PIE binaries. Whether ASLR is enabled or not does not change if
+there may be future mmap allocation collisions with a growing brk region.
+
+Update memory layout comments (with kernel-doc headings), consolidate
+the setting of mm->brk to later (it isn't needed early), move static PIE
+brk out of mmap unconditionally, and make sure brk(2) knows to base brk
+position off of mm->start_brk not mm->end_data no matter what the cause of
+moving it is (via current->brk_randomized).
+
+For the CONFIG_COMPAT_BRK case, though, leave the logic unchanged, as we
+can never safely move the brk. These systems, however, are not using
+specially aligned static PIE binaries.
+
+Reported-by: Ryan Roberts <ryan.roberts@arm.com>
+Closes: https://lore.kernel.org/lkml/f93db308-4a0e-4806-9faf-98f890f5a5e6@arm.com/
+Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec")
+Link: https://lore.kernel.org/r/20250425224502.work.520-kees@kernel.org
+Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
+Tested-by: Ryan Roberts <ryan.roberts@arm.com>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 71 ++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 47 insertions(+), 24 deletions(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 0a216a078c315..47335a0f4a618 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -825,6 +825,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
+ struct elf_phdr *elf_property_phdata = NULL;
+ unsigned long elf_brk;
++ bool brk_moved = false;
+ int retval, i;
+ unsigned long elf_entry;
+ unsigned long e_entry;
+@@ -1092,15 +1093,19 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ /* Calculate any requested alignment. */
+ alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
+
+- /*
+- * There are effectively two types of ET_DYN
+- * binaries: programs (i.e. PIE: ET_DYN with PT_INTERP)
+- * and loaders (ET_DYN without PT_INTERP, since they
+- * _are_ the ELF interpreter). The loaders must
+- * be loaded away from programs since the program
+- * may otherwise collide with the loader (especially
+- * for ET_EXEC which does not have a randomized
+- * position). For example to handle invocations of
++ /**
++ * DOC: PIE handling
++ *
++ * There are effectively two types of ET_DYN ELF
++ * binaries: programs (i.e. PIE: ET_DYN with
++ * PT_INTERP) and loaders (i.e. static PIE: ET_DYN
++ * without PT_INTERP, usually the ELF interpreter
++ * itself). Loaders must be loaded away from programs
++ * since the program may otherwise collide with the
++ * loader (especially for ET_EXEC which does not have
++ * a randomized position).
++ *
++ * For example, to handle invocations of
+ * "./ld.so someprog" to test out a new version of
+ * the loader, the subsequent program that the
+ * loader loads must avoid the loader itself, so
+@@ -1113,6 +1118,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ * ELF_ET_DYN_BASE and loaders are loaded into the
+ * independently randomized mmap region (0 load_bias
+ * without MAP_FIXED nor MAP_FIXED_NOREPLACE).
++ *
++ * See below for "brk" handling details, which is
++ * also affected by program vs loader and ASLR.
+ */
+ if (interpreter) {
+ /* On ET_DYN with PT_INTERP, we do the ASLR. */
+@@ -1229,8 +1237,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ start_data += load_bias;
+ end_data += load_bias;
+
+- current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk);
+-
+ if (interpreter) {
+ elf_entry = load_elf_interp(interp_elf_ex,
+ interpreter,
+@@ -1286,27 +1292,44 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ mm->end_data = end_data;
+ mm->start_stack = bprm->p;
+
+- if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
++ /**
++ * DOC: "brk" handling
++ *
++ * For architectures with ELF randomization, when executing a
++ * loader directly (i.e. static PIE: ET_DYN without PT_INTERP),
++ * move the brk area out of the mmap region and into the unused
++ * ELF_ET_DYN_BASE region. Since "brk" grows up it may collide
++ * early with the stack growing down or other regions being put
++ * into the mmap region by the kernel (e.g. vdso).
++ *
++ * In the CONFIG_COMPAT_BRK case, though, everything is turned
++ * off because we're not allowed to move the brk at all.
++ */
++ if (!IS_ENABLED(CONFIG_COMPAT_BRK) &&
++ IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
++ elf_ex->e_type == ET_DYN && !interpreter) {
++ elf_brk = ELF_ET_DYN_BASE;
++ /* This counts as moving the brk, so let brk(2) know. */
++ brk_moved = true;
++ }
++ mm->start_brk = mm->brk = ELF_PAGEALIGN(elf_brk);
++
++ if ((current->flags & PF_RANDOMIZE) && snapshot_randomize_va_space > 1) {
+ /*
+- * For architectures with ELF randomization, when executing
+- * a loader directly (i.e. no interpreter listed in ELF
+- * headers), move the brk area out of the mmap region
+- * (since it grows up, and may collide early with the stack
+- * growing down), and into the unused ELF_ET_DYN_BASE region.
++ * If we didn't move the brk to ELF_ET_DYN_BASE (above),
++ * leave a gap between .bss and brk.
+ */
+- if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
+- elf_ex->e_type == ET_DYN && !interpreter) {
+- mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
+- } else {
+- /* Otherwise leave a gap between .bss and brk. */
++ if (!brk_moved)
+ mm->brk = mm->start_brk = mm->brk + PAGE_SIZE;
+- }
+
+ mm->brk = mm->start_brk = arch_randomize_brk(mm);
++ brk_moved = true;
++ }
++
+ #ifdef compat_brk_randomized
++ if (brk_moved)
+ current->brk_randomized = 1;
+ #endif
+- }
+
+ if (current->personality & MMAP_PAGE_ZERO) {
+ /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
+--
+2.39.5
+
--- /dev/null
+From 41dda7d3eadc991a279378f492714c1c813c896b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 15:05:59 -0400
+Subject: Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775 ]
+
+Device flags could be updated in the meantime while MGMT_OP_ADD_DEVICE
+is pending on hci_update_passive_scan_sync so instead of setting the
+current_flags as cmd->user_data just do a lookup using
+hci_conn_params_lookup and use the latest stored flags.
+
+Fixes: a182d9c84f9c ("Bluetooth: MGMT: Fix Add Device to responding before completing")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index c019f69c59395..d4700f940e8a1 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -7612,11 +7612,16 @@ static void add_device_complete(struct hci_dev *hdev, void *data, int err)
+ struct mgmt_cp_add_device *cp = cmd->param;
+
+ if (!err) {
++ struct hci_conn_params *params;
++
++ params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
++ le_addr_type(cp->addr.type));
++
+ device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type,
+ cp->action);
+ device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
+ cp->addr.type, hdev->conn_flags,
+- PTR_UINT(cmd->user_data));
++ params ? params->flags : 0);
+ }
+
+ mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
+@@ -7719,8 +7724,6 @@ static int add_device(struct sock *sk, struct hci_dev *hdev,
+ goto unlock;
+ }
+
+- cmd->user_data = UINT_PTR(current_flags);
+-
+ err = hci_cmd_sync_queue(hdev, add_device_sync, cmd,
+ add_device_complete);
+ if (err < 0) {
+--
+2.39.5
+
--- /dev/null
+From 642a2050dbb7e73521defb0208b68d70d9e1f100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 15:24:13 -0400
+Subject: cgroup/cpuset: Extend kthread_is_per_cpu() check to all
+ PF_NO_SETAFFINITY tasks
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 39b5ef791d109dd54c7c2e6e87933edfcc0ad1ac ]
+
+Commit ec5fbdfb99d1 ("cgroup/cpuset: Enable update_tasks_cpumask()
+on top_cpuset") enabled us to pull CPUs dedicated to child partitions
+from tasks in top_cpuset by ignoring per cpu kthreads. However, there
+can be other kthreads that are not per cpu but have PF_NO_SETAFFINITY
+flag set to indicate that we shouldn't mess with their CPU affinity.
+For other kthreads, their affinity will be changed to skip CPUs dedicated
+to child partitions whether it is an isolating or a scheduling one.
+
+As all the per cpu kthreads have PF_NO_SETAFFINITY set, the
+PF_NO_SETAFFINITY tasks are essentially a superset of per cpu kthreads.
+Fix this issue by dropping the kthread_is_per_cpu() check and checking
+the PF_NO_SETAFFINITY flag instead.
+
+Fixes: ec5fbdfb99d1 ("cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index c709a05023cd9..d1fb4bfbbd4c3 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1100,9 +1100,11 @@ void cpuset_update_tasks_cpumask(struct cpuset *cs, struct cpumask *new_cpus)
+
+ if (top_cs) {
+ /*
+- * Percpu kthreads in top_cpuset are ignored
++ * PF_NO_SETAFFINITY tasks are ignored.
++ * All per cpu kthreads should have PF_NO_SETAFFINITY
++ * flag set, see kthread_set_per_cpu().
+ */
+- if (kthread_is_per_cpu(task))
++ if (task->flags & PF_NO_SETAFFINITY)
+ continue;
+ cpumask_andnot(new_cpus, possible_mask, subpartitions_cpus);
+ } else {
+--
+2.39.5
+
--- /dev/null
+From 6bced41d951e54ea3e0ac5ccac72a5485c9e41d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 08:18:44 -0500
+Subject: drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC
+ Policies
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 690d722e02819ef978f90cd7553973eba1007e6c ]
+
+If a policy is passed into amd_pmf_get_pb_data() that causes the engine
+to fail to start there is a memory leak. Free the memory in this failure
+path.
+
+Fixes: 10817f28e5337 ("platform/x86/amd/pmf: Add capability to sideload of policy binary")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250423132002.3984997-2-superm1@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/tee-if.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
+index cb5abab2210a7..804c4085b82fb 100644
+--- a/drivers/platform/x86/amd/pmf/tee-if.c
++++ b/drivers/platform/x86/amd/pmf/tee-if.c
+@@ -364,9 +364,14 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
+ amd_pmf_hex_dump_pb(dev);
+ ret = amd_pmf_start_policy_engine(dev);
+ if (ret < 0)
+- return ret;
++ goto cleanup;
+
+ return length;
++
++cleanup:
++ kfree(dev->policy_buf);
++ dev->policy_buf = NULL;
++ return ret;
+ }
+
+ static const struct file_operations pb_fops = {
+--
+2.39.5
+
--- /dev/null
+From acdd9b63ab9001eabfb138fce3d1ae8c21ed9845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 08:18:45 -0500
+Subject: drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 8e81b9cd6e95188d12c9cc25d40b61dd5ea05ace ]
+
+commit 376a8c2a14439 ("platform/x86/amd/pmf: Update PMF Driver for
+Compatibility with new PMF-TA") added support for platforms that support
+an updated TA, however it also exposed a number of platforms that although
+they have support for the updated TA don't actually populate a policy
+binary.
+
+Add an explicit check that the policy binary isn't empty before
+initializing the TA.
+
+Reported-by: Christian Heusel <christian@heusel.eu>
+Closes: https://lore.kernel.org/platform-driver-x86/ae644428-5bf2-4b30-81ba-0b259ed3449b@heusel.eu/
+Fixes: 376a8c2a14439 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Tested-by: Christian Heusel <christian@heusel.eu>
+Link: https://lore.kernel.org/r/20250423132002.3984997-3-superm1@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/tee-if.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
+index 804c4085b82fb..b6bcc1d57f968 100644
+--- a/drivers/platform/x86/amd/pmf/tee-if.c
++++ b/drivers/platform/x86/amd/pmf/tee-if.c
+@@ -334,6 +334,11 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev)
+ return 0;
+ }
+
++static inline bool amd_pmf_pb_valid(struct amd_pmf_dev *dev)
++{
++ return memchr_inv(dev->policy_buf, 0xff, dev->policy_sz);
++}
++
+ #ifdef CONFIG_AMD_PMF_DEBUG
+ static void amd_pmf_hex_dump_pb(struct amd_pmf_dev *dev)
+ {
+@@ -361,6 +366,11 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
+ dev->policy_buf = new_policy_buf;
+ dev->policy_sz = length;
+
++ if (!amd_pmf_pb_valid(dev)) {
++ ret = -EINVAL;
++ goto cleanup;
++ }
++
+ amd_pmf_hex_dump_pb(dev);
+ ret = amd_pmf_start_policy_engine(dev);
+ if (ret < 0)
+@@ -533,6 +543,12 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
+
+ memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz);
+
++ if (!amd_pmf_pb_valid(dev)) {
++ dev_info(dev->dev, "No Smart PC policy present\n");
++ ret = -EINVAL;
++ goto err_free_policy;
++ }
++
+ amd_pmf_hex_dump_pb(dev);
+
+ dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);
+--
+2.39.5
+
--- /dev/null
+From 1ed91bb2b778b83568076b49e5fbfda5e0a871ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 21:26:56 -0600
+Subject: drm/amd: Add Suspend/Hibernate notification callback support
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 2965e6355dcdf157b5fafa25a2715f00064da8bf ]
+
+As part of the suspend sequence VRAM needs to be evicted on dGPUs.
+In order to make suspend/resume more reliable we moved this into
+the pmops prepare() callback so that the suspend sequence would fail
+but the system could remain operational under high memory usage suspend.
+
+Another class of issues exist though where due to memory fragementation
+there isn't a large enough contiguous space and swap isn't accessible.
+
+Add support for a suspend/hibernate notification callback that could
+evict VRAM before tasks are frozen. This should allow paging out to swap
+if necessary.
+
+Link: https://github.com/ROCm/ROCK-Kernel-Driver/issues/174
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3476
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2362
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3781
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Link: https://lore.kernel.org/r/20241128032656.2090059-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: d0ce1aaa8531 ("Revert "drm/amd: Stop evicting resources on APUs in suspend"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 46 +++++++++++++++++++++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 -
+ 3 files changed, 46 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index b7aad43d9ad07..8050e0960f5e2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -853,6 +853,7 @@ struct amdgpu_device {
+ bool need_swiotlb;
+ bool accel_working;
+ struct notifier_block acpi_nb;
++ struct notifier_block pm_nb;
+ struct amdgpu_i2c_chan *i2c_bus[AMDGPU_MAX_I2C_BUS];
+ struct debugfs_blob_wrapper debugfs_vbios_blob;
+ struct debugfs_blob_wrapper debugfs_discovery_blob;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 24d007715a14a..e6c8426fa06ec 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -145,6 +145,8 @@ const char *amdgpu_asic_name[] = {
+ };
+
+ static inline void amdgpu_device_stop_pending_resets(struct amdgpu_device *adev);
++static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode,
++ void *data);
+
+ /**
+ * DOC: pcie_replay_count
+@@ -4519,6 +4521,11 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+
+ amdgpu_device_check_iommu_direct_map(adev);
+
++ adev->pm_nb.notifier_call = amdgpu_device_pm_notifier;
++ r = register_pm_notifier(&adev->pm_nb);
++ if (r)
++ goto failed;
++
+ return 0;
+
+ release_ras_con:
+@@ -4583,6 +4590,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
+ drain_workqueue(adev->mman.bdev.wq);
+ adev->shutdown = true;
+
++ unregister_pm_notifier(&adev->pm_nb);
++
+ /* make sure IB test finished before entering exclusive mode
+ * to avoid preemption on IB test
+ */
+@@ -4712,6 +4721,41 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
+ /*
+ * Suspend & resume.
+ */
++/**
++ * amdgpu_device_pm_notifier - Notification block for Suspend/Hibernate events
++ * @nb: notifier block
++ * @mode: suspend mode
++ * @data: data
++ *
++ * This function is called when the system is about to suspend or hibernate.
++ * It is used to evict resources from the device before the system goes to
++ * sleep while there is still access to swap.
++ */
++static int amdgpu_device_pm_notifier(struct notifier_block *nb, unsigned long mode,
++ void *data)
++{
++ struct amdgpu_device *adev = container_of(nb, struct amdgpu_device, pm_nb);
++ int r;
++
++ switch (mode) {
++ case PM_HIBERNATION_PREPARE:
++ adev->in_s4 = true;
++ fallthrough;
++ case PM_SUSPEND_PREPARE:
++ r = amdgpu_device_evict_resources(adev);
++ /*
++ * This is considered non-fatal at this time because
++ * amdgpu_device_prepare() will also fatally evict resources.
++ * See https://gitlab.freedesktop.org/drm/amd/-/issues/3781
++ */
++ if (r)
++ drm_warn(adev_to_drm(adev), "Failed to evict resources, freeze active processes if problems occur: %d\n", r);
++ break;
++ }
++
++ return NOTIFY_DONE;
++}
++
+ /**
+ * amdgpu_device_prepare - prepare for device suspend
+ *
+@@ -4751,7 +4795,7 @@ int amdgpu_device_prepare(struct drm_device *dev)
+ return 0;
+
+ unprepare:
+- adev->in_s0ix = adev->in_s3 = false;
++ adev->in_s0ix = adev->in_s3 = adev->in_s4 = false;
+
+ return r;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index a9eb0927a7664..700be1ac3c64c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2635,7 +2635,6 @@ static int amdgpu_pmops_freeze(struct device *dev)
+ struct amdgpu_device *adev = drm_to_adev(drm_dev);
+ int r;
+
+- adev->in_s4 = true;
+ r = amdgpu_device_suspend(drm_dev, true);
+ if (r)
+ return r;
+--
+2.39.5
+
--- /dev/null
+From 09353ec17a2039378fc31db6f2ddbc0adc772d0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 09:12:01 -0700
+Subject: drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 66c8f7b435bddb7d8577ac8a57e175a6cb147227 ]
+
+For determining actual job execution time, save the current value of the
+CTX_TIMESTAMP register rather than the value saved in LRC since the
+current register value is the closest to the start time of the job.
+
+v2: Define MI_STORE_REGISTER_MEM to fix compile error
+v3: Place MI_STORE_REGISTER_MEM sorted by MI_INSTR (Lucas)
+
+Fixes: 65921374c48f ("drm/xe: Emit ctx timestamp copy in ring ops")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://lore.kernel.org/r/20250509161159.2173069-6-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 38b14233e5deff51db8faec287b4acd227152246)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/instructions/xe_mi_commands.h | 4 ++++
+ drivers/gpu/drm/xe/xe_lrc.c | 2 +-
+ drivers/gpu/drm/xe/xe_ring_ops.c | 7 ++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/instructions/xe_mi_commands.h b/drivers/gpu/drm/xe/instructions/xe_mi_commands.h
+index 10ec2920d31b3..d4033278be9fc 100644
+--- a/drivers/gpu/drm/xe/instructions/xe_mi_commands.h
++++ b/drivers/gpu/drm/xe/instructions/xe_mi_commands.h
+@@ -47,6 +47,10 @@
+ #define MI_LRI_FORCE_POSTED REG_BIT(12)
+ #define MI_LRI_LEN(x) (((x) & 0xff) + 1)
+
++#define MI_STORE_REGISTER_MEM (__MI_INSTR(0x24) | XE_INSTR_NUM_DW(4))
++#define MI_SRM_USE_GGTT REG_BIT(22)
++#define MI_SRM_ADD_CS_OFFSET REG_BIT(19)
++
+ #define MI_FLUSH_DW __MI_INSTR(0x26)
+ #define MI_FLUSH_DW_STORE_INDEX REG_BIT(21)
+ #define MI_INVALIDATE_TLB REG_BIT(18)
+diff --git a/drivers/gpu/drm/xe/xe_lrc.c b/drivers/gpu/drm/xe/xe_lrc.c
+index aec7db39c061e..2d4e38b3bab19 100644
+--- a/drivers/gpu/drm/xe/xe_lrc.c
++++ b/drivers/gpu/drm/xe/xe_lrc.c
+@@ -694,7 +694,7 @@ static inline u32 __xe_lrc_start_seqno_offset(struct xe_lrc *lrc)
+
+ static u32 __xe_lrc_ctx_job_timestamp_offset(struct xe_lrc *lrc)
+ {
+- /* The start seqno is stored in the driver-defined portion of PPHWSP */
++ /* This is stored in the driver-defined portion of PPHWSP */
+ return xe_lrc_pphwsp_offset(lrc) + LRC_CTX_JOB_TIMESTAMP_OFFSET;
+ }
+
+diff --git a/drivers/gpu/drm/xe/xe_ring_ops.c b/drivers/gpu/drm/xe/xe_ring_ops.c
+index 9f327f27c0726..fb31e09acb519 100644
+--- a/drivers/gpu/drm/xe/xe_ring_ops.c
++++ b/drivers/gpu/drm/xe/xe_ring_ops.c
+@@ -229,13 +229,10 @@ static u32 get_ppgtt_flag(struct xe_sched_job *job)
+
+ static int emit_copy_timestamp(struct xe_lrc *lrc, u32 *dw, int i)
+ {
+- dw[i++] = MI_COPY_MEM_MEM | MI_COPY_MEM_MEM_SRC_GGTT |
+- MI_COPY_MEM_MEM_DST_GGTT;
++ dw[i++] = MI_STORE_REGISTER_MEM | MI_SRM_USE_GGTT | MI_SRM_ADD_CS_OFFSET;
++ dw[i++] = RING_CTX_TIMESTAMP(0).addr;
+ dw[i++] = xe_lrc_ctx_job_timestamp_ggtt_addr(lrc);
+ dw[i++] = 0;
+- dw[i++] = xe_lrc_ctx_timestamp_ggtt_addr(lrc);
+- dw[i++] = 0;
+- dw[i++] = MI_NOOP;
+
+ return i;
+ }
+--
+2.39.5
+
--- /dev/null
+From cd8c4ce4a3cf5bf77e1e60a5851842dc06047282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 11:28:20 -0400
+Subject: fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
+
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+
+[ Upstream commit 8b0ba61df5a1c44e2b3cf683831a4fc5e24ea99d ]
+
+The vfs has long had a fallback to obtain the security.* xattrs from the
+LSM when the filesystem does not implement its own listxattr, but
+shmem/tmpfs and kernfs later gained their own xattr handlers to support
+other xattrs. Unfortunately, as a side effect, tmpfs and kernfs-based
+filesystems like sysfs no longer return the synthetic security.* xattr
+names via listxattr unless they are explicitly set by userspace or
+initially set upon inode creation after policy load. coreutils has
+recently switched from unconditionally invoking getxattr for security.*
+for ls -Z via libselinux to only doing so if listxattr returns the xattr
+name, breaking ls -Z of such inodes.
+
+Before:
+$ getfattr -m.* /run/initramfs
+<no output>
+$ getfattr -m.* /sys/kernel/fscaps
+<no output>
+$ setfattr -n user.foo /run/initramfs
+$ getfattr -m.* /run/initramfs
+user.foo
+
+After:
+$ getfattr -m.* /run/initramfs
+security.selinux
+$ getfattr -m.* /sys/kernel/fscaps
+security.selinux
+$ setfattr -n user.foo /run/initramfs
+$ getfattr -m.* /run/initramfs
+security.selinux
+user.foo
+
+Link: https://lore.kernel.org/selinux/CAFqZXNtF8wDyQajPCdGn=iOawX4y77ph0EcfcqcUUj+T87FKyA@mail.gmail.com/
+Link: https://lore.kernel.org/selinux/20250423175728.3185-2-stephen.smalley.work@gmail.com/
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Link: https://lore.kernel.org/20250424152822.2719-1-stephen.smalley.work@gmail.com
+Fixes: b09e0fa4b4ea66266058ee ("tmpfs: implement generic xattr support")
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xattr.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 05ec7e7d9e87e..4f5a45338a83a 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -1290,6 +1290,15 @@ static bool xattr_is_trusted(const char *name)
+ return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN);
+ }
+
++static bool xattr_is_maclabel(const char *name)
++{
++ const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
++
++ return !strncmp(name, XATTR_SECURITY_PREFIX,
++ XATTR_SECURITY_PREFIX_LEN) &&
++ security_ismaclabel(suffix);
++}
++
+ /**
+ * simple_xattr_list - list all xattr objects
+ * @inode: inode from which to get the xattrs
+@@ -1322,6 +1331,17 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
+ if (err)
+ return err;
+
++ err = security_inode_listsecurity(inode, buffer, remaining_size);
++ if (err < 0)
++ return err;
++
++ if (buffer) {
++ if (remaining_size < err)
++ return -ERANGE;
++ buffer += err;
++ }
++ remaining_size -= err;
++
+ read_lock(&xattrs->lock);
+ for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {
+ xattr = rb_entry(rbp, struct simple_xattr, rb_node);
+@@ -1330,6 +1350,10 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
+ if (!trusted && xattr_is_trusted(xattr->name))
+ continue;
+
++ /* skip MAC labels; these are provided by LSM above */
++ if (xattr_is_maclabel(xattr->name))
++ continue;
++
+ err = xattr_list_one(&buffer, &remaining_size, xattr->name);
+ if (err)
+ break;
+--
+2.39.5
+
--- /dev/null
+From 9152f055a0b8791ae2646ceda328023ddb47277e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 23:11:46 +0000
+Subject: HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+[ Upstream commit 09d546303b370113323bfff456c4e8cff8756005 ]
+
+In thrustmaster_interrupts(), the allocated send_buf is not
+freed if the usb_check_int_endpoints() check fails, leading
+to a memory leak.
+
+Fix this by ensuring send_buf is freed before returning in
+the error path.
+
+Fixes: 50420d7c79c3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check")
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-thrustmaster.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c
+index 3b81468a1df29..0bf70664c35ee 100644
+--- a/drivers/hid/hid-thrustmaster.c
++++ b/drivers/hid/hid-thrustmaster.c
+@@ -174,6 +174,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev)
+ u8 ep_addr[2] = {b_ep, 0};
+
+ if (!usb_check_int_endpoints(usbif, ep_addr)) {
++ kfree(send_buf);
+ hid_err(hdev, "Unexpected non-int endpoint\n");
+ return;
+ }
+--
+2.39.5
+
--- /dev/null
+From 28da7c9532cad5fe9db97715d75a641dadab41e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 17:48:53 +0800
+Subject: HID: uclogic: Add NULL check in uclogic_input_configured()
+
+From: Henry Martin <bsdhenrymartin@gmail.com>
+
+[ Upstream commit bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e ]
+
+devm_kasprintf() returns NULL when memory allocation fails. Currently,
+uclogic_input_configured() does not check for this case, which results
+in a NULL pointer dereference.
+
+Add NULL check after devm_kasprintf() to prevent this issue.
+
+Fixes: dd613a4e45f8 ("HID: uclogic: Correct devm device reference for hidinput input_dev name")
+Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-uclogic-core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index d8008933c052f..321c43fb06ae0 100644
+--- a/drivers/hid/hid-uclogic-core.c
++++ b/drivers/hid/hid-uclogic-core.c
+@@ -142,11 +142,12 @@ static int uclogic_input_configured(struct hid_device *hdev,
+ suffix = "System Control";
+ break;
+ }
+- }
+-
+- if (suffix)
++ } else {
+ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+ "%s %s", hdev->name, suffix);
++ if (!hi->input->name)
++ return -ENOMEM;
++ }
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From c46219ecbbeeb61c48152fb3a853d2ee18edbe22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 11:34:24 +0100
+Subject: iio: adc: ad7266: Fix potential timestamp alignment issue.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 52d349884738c346961e153f195f4c7fe186fcf4 ]
+
+On architectures where an s64 is only 32-bit aligned insufficient padding
+would be left between the earlier elements and the timestamp. Use
+aligned_s64 to enforce the correct placement and ensure the storage is
+large enough.
+
+Fixes: 54e018da3141 ("iio:ad7266: Mark transfer buffer as __be16") # aligned_s64 is much newer.
+Reported-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250413103443.2420727-2-jic23@kernel.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7266.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
+index 7949b076fb87e..d4c9b85135f58 100644
+--- a/drivers/iio/adc/ad7266.c
++++ b/drivers/iio/adc/ad7266.c
+@@ -45,7 +45,7 @@ struct ad7266_state {
+ */
+ struct {
+ __be16 sample[2];
+- s64 timestamp;
++ aligned_s64 timestamp;
+ } data __aligned(IIO_DMA_MINALIGN);
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 46c048a777d4ef91fc6c95023c6f935a0f30bd62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 11:34:25 +0100
+Subject: iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit ffbc26bc91c1f1eb3dcf5d8776e74cbae21ee13a ]
+
+On architectures where an s64 is not 64-bit aligned, this may result
+insufficient alignment of the timestamp and the structure being too small.
+Use aligned_s64 to force the alignment.
+
+Fixes: a1caeebab07e ("iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp()") # aligned_s64 newer
+Reported-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250413103443.2420727-3-jic23@kernel.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7768-1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
+index 157a0df97f971..a9248a85466ea 100644
+--- a/drivers/iio/adc/ad7768-1.c
++++ b/drivers/iio/adc/ad7768-1.c
+@@ -169,7 +169,7 @@ struct ad7768_state {
+ union {
+ struct {
+ __be32 chan;
+- s64 timestamp;
++ aligned_s64 timestamp;
+ } scan;
+ __be32 d32;
+ u8 d8[2];
+--
+2.39.5
+
--- /dev/null
+From 616d4e8cccd5f19f08b979fea920e4be0382e534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 11:52:36 -0500
+Subject: iio: chemical: pms7003: use aligned_s64 for timestamp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 6ffa698674053e82e811520642db2650d00d2c01 ]
+
+Follow the pattern of other drivers and use aligned_s64 for the
+timestamp. This will ensure that the timestamp is correctly aligned on
+all architectures.
+
+Also move the unaligned.h header while touching this since it was the
+only one not in alphabetical order.
+
+Fixes: 13e945631c2f ("iio:chemical:pms7003: Fix timestamp alignment and prevent data leak.")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-4-eafac1e22318@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/chemical/pms7003.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/chemical/pms7003.c b/drivers/iio/chemical/pms7003.c
+index d0bd94912e0a3..e05ce1f12065c 100644
+--- a/drivers/iio/chemical/pms7003.c
++++ b/drivers/iio/chemical/pms7003.c
+@@ -5,7 +5,6 @@
+ * Copyright (c) Tomasz Duszynski <tduszyns@gmail.com>
+ */
+
+-#include <linux/unaligned.h>
+ #include <linux/completion.h>
+ #include <linux/device.h>
+ #include <linux/errno.h>
+@@ -19,6 +18,8 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/serdev.h>
++#include <linux/types.h>
++#include <linux/unaligned.h>
+
+ #define PMS7003_DRIVER_NAME "pms7003"
+
+@@ -76,7 +77,7 @@ struct pms7003_state {
+ /* Used to construct scan to push to the IIO buffer */
+ struct {
+ u16 data[3]; /* PM1, PM2P5, PM10 */
+- s64 ts;
++ aligned_s64 ts;
+ } scan;
+ };
+
+--
+2.39.5
+
--- /dev/null
+From cdf1f358486f4f9093276f7690fc0bae7d0b61ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 11:52:37 -0500
+Subject: iio: chemical: sps30: use aligned_s64 for timestamp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit bb49d940344bcb8e2b19e69d7ac86f567887ea9a ]
+
+Follow the pattern of other drivers and use aligned_s64 for the
+timestamp. This will ensure that the timestamp is correctly aligned on
+all architectures.
+
+Fixes: a5bf6fdd19c3 ("iio:chemical:sps30: Fix timestamp alignment")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-5-eafac1e22318@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/chemical/sps30.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c
+index 814ce0aad1ccc..4085a36cd1db7 100644
+--- a/drivers/iio/chemical/sps30.c
++++ b/drivers/iio/chemical/sps30.c
+@@ -108,7 +108,7 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p)
+ int ret;
+ struct {
+ s32 data[4]; /* PM1, PM2P5, PM4, PM10 */
+- s64 ts;
++ aligned_s64 ts;
+ } scan;
+
+ mutex_lock(&state->lock);
+--
+2.39.5
+
--- /dev/null
+From 2d40f89fbeab2a2176387b35e9b8555429351455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 11:17:14 -0500
+Subject: iio: pressure: mprls0025pa: use aligned_s64 for timestamp
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit ffcd19e9f4cca0c8f9e23e88f968711acefbb37b ]
+
+Follow the pattern of other drivers and use aligned_s64 for the
+timestamp. This will ensure the struct itself it also 8-byte aligned.
+
+While touching this, convert struct mpr_chan to an anonymous struct
+to consolidate the code a bit to make it easier for future readers.
+
+Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250418-iio-more-timestamp-alignment-v2-2-d6a5d2b1c9fe@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/mprls0025pa.h | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iio/pressure/mprls0025pa.h b/drivers/iio/pressure/mprls0025pa.h
+index 9d5c30afa9d69..d62a018eaff32 100644
+--- a/drivers/iio/pressure/mprls0025pa.h
++++ b/drivers/iio/pressure/mprls0025pa.h
+@@ -34,16 +34,6 @@ struct iio_dev;
+ struct mpr_data;
+ struct mpr_ops;
+
+-/**
+- * struct mpr_chan
+- * @pres: pressure value
+- * @ts: timestamp
+- */
+-struct mpr_chan {
+- s32 pres;
+- s64 ts;
+-};
+-
+ enum mpr_func_id {
+ MPR_FUNCTION_A,
+ MPR_FUNCTION_B,
+@@ -69,6 +59,8 @@ enum mpr_func_id {
+ * reading in a loop until data is ready
+ * @completion: handshake from irq to read
+ * @chan: channel values for buffered mode
++ * @chan.pres: pressure value
++ * @chan.ts: timestamp
+ * @buffer: raw conversion data
+ */
+ struct mpr_data {
+@@ -87,7 +79,10 @@ struct mpr_data {
+ struct gpio_desc *gpiod_reset;
+ int irq;
+ struct completion completion;
+- struct mpr_chan chan;
++ struct {
++ s32 pres;
++ aligned_s64 ts;
++ } chan;
+ u8 buffer[MPR_MEASUREMENT_RD_SIZE] __aligned(IIO_DMA_MINALIGN);
+ };
+
+--
+2.39.5
+
--- /dev/null
+From ce729338122a8d97bc11de68eaa132dd76ef130d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 14:12:14 -0700
+Subject: KVM: Add member to struct kvm_gfn_range to indicate private/shared
+
+From: Isaku Yamahata <isaku.yamahata@intel.com>
+
+[ Upstream commit dca6c88532322830d5d92486467fcc91b67a9ad8 ]
+
+Add new members to strut kvm_gfn_range to indicate which mapping
+(private-vs-shared) to operate on: enum kvm_gfn_range_filter
+attr_filter. Update the core zapping operations to set them appropriately.
+
+TDX utilizes two GPA aliases for the same memslots, one for memory that is
+for private memory and one that is for shared. For private memory, KVM
+cannot always perform the same operations it does on memory for default
+VMs, such as zapping pages and having them be faulted back in, as this
+requires guest coordination. However, some operations such as guest driven
+conversion of memory between private and shared should zap private memory.
+
+Internally to the MMU, private and shared mappings are tracked on separate
+roots. Mapping and zapping operations will operate on the respective GFN
+alias for each root (private or shared). So zapping operations will by
+default zap both aliases. Add fields in struct kvm_gfn_range to allow
+callers to specify which aliases so they can only target the aliases
+appropriate for their specific operation.
+
+There was feedback that target aliases should be specified such that the
+default value (0) is to operate on both aliases. Several options were
+considered. Several variations of having separate bools defined such
+that the default behavior was to process both aliases. They either allowed
+nonsensical configurations, or were confusing for the caller. A simple
+enum was also explored and was close, but was hard to process in the
+caller. Instead, use an enum with the default value (0) reserved as a
+disallowed value. Catch ranges that didn't have the target aliases
+specified by looking for that specific value.
+
+Set target alias with enum appropriately for these MMU operations:
+ - For KVM's mmu notifier callbacks, zap shared pages only because private
+ pages won't have a userspace mapping
+ - For setting memory attributes, kvm_arch_pre_set_memory_attributes()
+ chooses the aliases based on the attribute.
+ - For guest_memfd invalidations, zap private only.
+
+Link: https://lore.kernel.org/kvm/ZivIF9vjKcuGie3s@google.com/
+Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Co-developed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
+Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
+Message-ID: <20240718211230.1492011-3-rick.p.edgecombe@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Stable-dep-of: 9129633d568e ("KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 6 ++++++
+ include/linux/kvm_host.h | 6 ++++++
+ virt/kvm/guest_memfd.c | 2 ++
+ virt/kvm/kvm_main.c | 14 ++++++++++++++
+ 4 files changed, 28 insertions(+)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 9242c0649adf1..4943732e07cd7 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -7633,6 +7633,12 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm,
+ if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm)))
+ return false;
+
++ /* Unmap the old attribute page. */
++ if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE)
++ range->attr_filter = KVM_FILTER_SHARED;
++ else
++ range->attr_filter = KVM_FILTER_PRIVATE;
++
+ return kvm_unmap_gfn_range(kvm, range);
+ }
+
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 15206450929d5..2e836d44f7386 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -260,11 +260,17 @@ union kvm_mmu_notifier_arg {
+ unsigned long attributes;
+ };
+
++enum kvm_gfn_range_filter {
++ KVM_FILTER_SHARED = BIT(0),
++ KVM_FILTER_PRIVATE = BIT(1),
++};
++
+ struct kvm_gfn_range {
+ struct kvm_memory_slot *slot;
+ gfn_t start;
+ gfn_t end;
+ union kvm_mmu_notifier_arg arg;
++ enum kvm_gfn_range_filter attr_filter;
+ bool may_block;
+ };
+ bool kvm_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range);
+diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
+index 8f079a61a56db..bb062d3d24572 100644
+--- a/virt/kvm/guest_memfd.c
++++ b/virt/kvm/guest_memfd.c
+@@ -118,6 +118,8 @@ static void kvm_gmem_invalidate_begin(struct kvm_gmem *gmem, pgoff_t start,
+ .end = slot->base_gfn + min(pgoff + slot->npages, end) - pgoff,
+ .slot = slot,
+ .may_block = true,
++ /* guest memfd is relevant to only private mappings. */
++ .attr_filter = KVM_FILTER_PRIVATE,
+ };
+
+ if (!found_memslot) {
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 279e03029ce14..b99de3b5ffbc0 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -632,6 +632,11 @@ static __always_inline kvm_mn_ret_t __kvm_handle_hva_range(struct kvm *kvm,
+ */
+ gfn_range.arg = range->arg;
+ gfn_range.may_block = range->may_block;
++ /*
++ * HVA-based notifications aren't relevant to private
++ * mappings as they don't have a userspace mapping.
++ */
++ gfn_range.attr_filter = KVM_FILTER_SHARED;
+
+ /*
+ * {gfn(page) | page intersects with [hva_start, hva_end)} =
+@@ -2454,6 +2459,14 @@ static __always_inline void kvm_handle_gfn_range(struct kvm *kvm,
+ gfn_range.arg = range->arg;
+ gfn_range.may_block = range->may_block;
+
++ /*
++ * If/when KVM supports more attributes beyond private .vs shared, this
++ * _could_ set KVM_FILTER_{SHARED,PRIVATE} appropriately if the entire target
++ * range already has the desired private vs. shared state (it's unclear
++ * if that is a net win). For now, KVM reaches this point if and only
++ * if the private flag is being toggled, i.e. all mappings are in play.
++ */
++
+ for (i = 0; i < kvm_arch_nr_memslot_as_ids(kvm); i++) {
+ slots = __kvm_memslots(kvm, i);
+
+@@ -2510,6 +2523,7 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
+ struct kvm_mmu_notifier_range pre_set_range = {
+ .start = start,
+ .end = end,
++ .arg.attributes = attributes,
+ .handler = kvm_pre_set_memory_attributes,
+ .on_lock = kvm_mmu_invalidate_begin,
+ .flush_on_ret = true,
+--
+2.39.5
+
--- /dev/null
+From 8b25c6c43bb6f0f345c5da479af1212224f8c24f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 15:09:54 -0700
+Subject: KVM: x86/mmu: Prevent installing hugepages when mem attributes are
+ changing
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 9129633d568edd36aa22bf703b12835153cec985 ]
+
+When changing memory attributes on a subset of a potential hugepage, add
+the hugepage to the invalidation range tracking to prevent installing a
+hugepage until the attributes are fully updated. Like the actual hugepage
+tracking updates in kvm_arch_post_set_memory_attributes(), process only
+the head and tail pages, as any potential hugepages that are entirely
+covered by the range will already be tracked.
+
+Note, only hugepage chunks whose current attributes are NOT mixed need to
+be added to the invalidation set, as mixed attributes already prevent
+installing a hugepage, and it's perfectly safe to install a smaller
+mapping for a gfn whose attributes aren't changing.
+
+Fixes: 8dd2eee9d526 ("KVM: x86/mmu: Handle page fault for private memory")
+Cc: stable@vger.kernel.org
+Reported-by: Michael Roth <michael.roth@amd.com>
+Tested-by: Michael Roth <michael.roth@amd.com>
+Link: https://lore.kernel.org/r/20250430220954.522672-1-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 69 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 4943732e07cd7..4607610ef0628 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -7616,9 +7616,30 @@ void kvm_mmu_pre_destroy_vm(struct kvm *kvm)
+ }
+
+ #ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES
++static bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
++ int level)
++{
++ return lpage_info_slot(gfn, slot, level)->disallow_lpage & KVM_LPAGE_MIXED_FLAG;
++}
++
++static void hugepage_clear_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
++ int level)
++{
++ lpage_info_slot(gfn, slot, level)->disallow_lpage &= ~KVM_LPAGE_MIXED_FLAG;
++}
++
++static void hugepage_set_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
++ int level)
++{
++ lpage_info_slot(gfn, slot, level)->disallow_lpage |= KVM_LPAGE_MIXED_FLAG;
++}
++
+ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm,
+ struct kvm_gfn_range *range)
+ {
++ struct kvm_memory_slot *slot = range->slot;
++ int level;
++
+ /*
+ * Zap SPTEs even if the slot can't be mapped PRIVATE. KVM x86 only
+ * supports KVM_MEMORY_ATTRIBUTE_PRIVATE, and so it *seems* like KVM
+@@ -7633,6 +7654,38 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm,
+ if (WARN_ON_ONCE(!kvm_arch_has_private_mem(kvm)))
+ return false;
+
++ if (WARN_ON_ONCE(range->end <= range->start))
++ return false;
++
++ /*
++ * If the head and tail pages of the range currently allow a hugepage,
++ * i.e. reside fully in the slot and don't have mixed attributes, then
++ * add each corresponding hugepage range to the ongoing invalidation,
++ * e.g. to prevent KVM from creating a hugepage in response to a fault
++ * for a gfn whose attributes aren't changing. Note, only the range
++ * of gfns whose attributes are being modified needs to be explicitly
++ * unmapped, as that will unmap any existing hugepages.
++ */
++ for (level = PG_LEVEL_2M; level <= KVM_MAX_HUGEPAGE_LEVEL; level++) {
++ gfn_t start = gfn_round_for_level(range->start, level);
++ gfn_t end = gfn_round_for_level(range->end - 1, level);
++ gfn_t nr_pages = KVM_PAGES_PER_HPAGE(level);
++
++ if ((start != range->start || start + nr_pages > range->end) &&
++ start >= slot->base_gfn &&
++ start + nr_pages <= slot->base_gfn + slot->npages &&
++ !hugepage_test_mixed(slot, start, level))
++ kvm_mmu_invalidate_range_add(kvm, start, start + nr_pages);
++
++ if (end == start)
++ continue;
++
++ if ((end + nr_pages) > range->end &&
++ (end + nr_pages) <= (slot->base_gfn + slot->npages) &&
++ !hugepage_test_mixed(slot, end, level))
++ kvm_mmu_invalidate_range_add(kvm, end, end + nr_pages);
++ }
++
+ /* Unmap the old attribute page. */
+ if (range->arg.attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE)
+ range->attr_filter = KVM_FILTER_SHARED;
+@@ -7642,23 +7695,7 @@ bool kvm_arch_pre_set_memory_attributes(struct kvm *kvm,
+ return kvm_unmap_gfn_range(kvm, range);
+ }
+
+-static bool hugepage_test_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
+- int level)
+-{
+- return lpage_info_slot(gfn, slot, level)->disallow_lpage & KVM_LPAGE_MIXED_FLAG;
+-}
+-
+-static void hugepage_clear_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
+- int level)
+-{
+- lpage_info_slot(gfn, slot, level)->disallow_lpage &= ~KVM_LPAGE_MIXED_FLAG;
+-}
+
+-static void hugepage_set_mixed(struct kvm_memory_slot *slot, gfn_t gfn,
+- int level)
+-{
+- lpage_info_slot(gfn, slot, level)->disallow_lpage |= KVM_LPAGE_MIXED_FLAG;
+-}
+
+ static bool hugepage_has_attrs(struct kvm *kvm, struct kvm_memory_slot *slot,
+ gfn_t gfn, int level, unsigned long attrs)
+--
+2.39.5
+
--- /dev/null
+From b74413986ae78eea24cd5bacd7903d7616b93d58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 22:38:11 +0000
+Subject: mctp: no longer rely on net->dev_index_head[]
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 2d20773aec14996b6cc4db92d885028319be683d ]
+
+mctp_dump_addrinfo() is one of the last users of
+net->dev_index_head[] in the control path.
+
+Switch to for_each_netdev_dump() for better scalability.
+
+Use C99 for mctp_device_rtnl_msg_handlers[] to prepare
+future RTNL removal from mctp_dump_addrinfo()
+
+(mdev->addrs is not yet RCU protected)
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Matt Johnston <matt@codeconstruct.com.au>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Acked-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Link: https://patch.msgid.link/20241206223811.1343076-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: f11cf946c0a9 ("net: mctp: Don't access ifa_index when missing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mctp/device.c | 50 ++++++++++++++++++-----------------------------
+ 1 file changed, 19 insertions(+), 31 deletions(-)
+
+diff --git a/net/mctp/device.c b/net/mctp/device.c
+index 85cc5f31f1e7c..cdb18da96c4bc 100644
+--- a/net/mctp/device.c
++++ b/net/mctp/device.c
+@@ -20,8 +20,7 @@
+ #include <net/sock.h>
+
+ struct mctp_dump_cb {
+- int h;
+- int idx;
++ unsigned long ifindex;
+ size_t a_idx;
+ };
+
+@@ -115,43 +114,29 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ struct mctp_dump_cb *mcb = (void *)cb->ctx;
+ struct net *net = sock_net(skb->sk);
+- struct hlist_head *head;
+ struct net_device *dev;
+ struct ifaddrmsg *hdr;
+ struct mctp_dev *mdev;
+- int ifindex;
+- int idx = 0, rc;
++ int ifindex, rc;
+
+ hdr = nlmsg_data(cb->nlh);
+ // filter by ifindex if requested
+ ifindex = hdr->ifa_index;
+
+ rcu_read_lock();
+- for (; mcb->h < NETDEV_HASHENTRIES; mcb->h++, mcb->idx = 0) {
+- idx = 0;
+- head = &net->dev_index_head[mcb->h];
+- hlist_for_each_entry_rcu(dev, head, index_hlist) {
+- if (idx >= mcb->idx &&
+- (ifindex == 0 || ifindex == dev->ifindex)) {
+- mdev = __mctp_dev_get(dev);
+- if (mdev) {
+- rc = mctp_dump_dev_addrinfo(mdev,
+- skb, cb);
+- mctp_dev_put(mdev);
+- // Error indicates full buffer, this
+- // callback will get retried.
+- if (rc < 0)
+- goto out;
+- }
+- }
+- idx++;
+- // reset for next iteration
+- mcb->a_idx = 0;
+- }
++ for_each_netdev_dump(net, dev, mcb->ifindex) {
++ if (ifindex && ifindex != dev->ifindex)
++ continue;
++ mdev = __mctp_dev_get(dev);
++ if (!mdev)
++ continue;
++ rc = mctp_dump_dev_addrinfo(mdev, skb, cb);
++ mctp_dev_put(mdev);
++ if (rc < 0)
++ break;
++ mcb->a_idx = 0;
+ }
+-out:
+ rcu_read_unlock();
+- mcb->idx = idx;
+
+ return skb->len;
+ }
+@@ -525,9 +510,12 @@ static struct notifier_block mctp_dev_nb = {
+ };
+
+ static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = {
+- {THIS_MODULE, PF_MCTP, RTM_NEWADDR, mctp_rtm_newaddr, NULL, 0},
+- {THIS_MODULE, PF_MCTP, RTM_DELADDR, mctp_rtm_deladdr, NULL, 0},
+- {THIS_MODULE, PF_MCTP, RTM_GETADDR, NULL, mctp_dump_addrinfo, 0},
++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_NEWADDR,
++ .doit = mctp_rtm_newaddr},
++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_DELADDR,
++ .doit = mctp_rtm_deladdr},
++ {.owner = THIS_MODULE, .protocol = PF_MCTP, .msgtype = RTM_GETADDR,
++ .dumpit = mctp_dump_addrinfo},
+ };
+
+ int __init mctp_device_init(void)
+--
+2.39.5
+
--- /dev/null
+From 81a9e9797929d70e151e93477d46b3193bff11d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 14:48:05 +0200
+Subject: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net
+ devices
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 92ec4855034b2c4d13f117558dc73d20581fa9ff ]
+
+The driver only offloads neighbors that are constructed on top of net
+devices registered by it or their uppers (which are all Ethernet). The
+device supports GRE encapsulation and decapsulation of forwarded
+traffic, but the driver will not offload dummy neighbors constructed on
+top of GRE net devices as they are not uppers of its net devices:
+
+ # ip link add name gre1 up type gre tos inherit local 192.0.2.1 remote 198.51.100.1
+ # ip neigh add 0.0.0.0 lladdr 0.0.0.0 nud noarp dev gre1
+ $ ip neigh show dev gre1 nud noarp
+ 0.0.0.0 lladdr 0.0.0.0 NOARP
+
+(Note that the neighbor is not marked with 'offload')
+
+When the driver is reloaded and the existing configuration is replayed,
+the driver does not perform the same check regarding existing neighbors
+and offloads the previously added one:
+
+ # devlink dev reload pci/0000:01:00.0
+ $ ip neigh show dev gre1 nud noarp
+ 0.0.0.0 lladdr 0.0.0.0 offload NOARP
+
+If the neighbor is later deleted, the driver will ignore the
+notification (given the GRE net device is not its upper) and will
+therefore keep referencing freed memory, resulting in a use-after-free
+[1] when the net device is deleted:
+
+ # ip neigh del 0.0.0.0 lladdr 0.0.0.0 dev gre1
+ # ip link del dev gre1
+
+Fix by skipping neighbor replay if the net device for which the replay
+is performed is not our upper.
+
+[1]
+BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x1ea/0x200
+Read of size 8 at addr ffff888155b0e420 by task ip/2282
+[...]
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x6f/0xa0
+ print_address_description.constprop.0+0x6f/0x350
+ print_report+0x108/0x205
+ kasan_report+0xdf/0x110
+ mlxsw_sp_neigh_entry_update+0x1ea/0x200
+ mlxsw_sp_router_rif_gone_sync+0x2a8/0x440
+ mlxsw_sp_rif_destroy+0x1e9/0x750
+ mlxsw_sp_netdevice_ipip_ol_event+0x3c9/0xdc0
+ mlxsw_sp_router_netdevice_event+0x3ac/0x15e0
+ notifier_call_chain+0xca/0x150
+ call_netdevice_notifiers_info+0x7f/0x100
+ unregister_netdevice_many_notify+0xc8c/0x1d90
+ rtnl_dellink+0x34e/0xa50
+ rtnetlink_rcv_msg+0x6fb/0xb70
+ netlink_rcv_skb+0x131/0x360
+ netlink_unicast+0x426/0x710
+ netlink_sendmsg+0x75a/0xc20
+ __sock_sendmsg+0xc1/0x150
+ ____sys_sendmsg+0x5aa/0x7b0
+ ___sys_sendmsg+0xfc/0x180
+ __sys_sendmsg+0x121/0x1b0
+ do_syscall_64+0xbb/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+
+Fixes: 8fdb09a7674c ("mlxsw: spectrum_router: Replay neighbours when RIF is made")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://patch.msgid.link/c53c02c904fde32dad484657be3b1477884e9ad6.1747225701.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 7d6d859cef3f9..511cd92e0e3e7 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -3014,6 +3014,9 @@ static int mlxsw_sp_neigh_rif_made_sync(struct mlxsw_sp *mlxsw_sp,
+ .rif = rif,
+ };
+
++ if (!mlxsw_sp_dev_lower_is_port(mlxsw_sp_rif_dev(rif)))
++ return 0;
++
+ neigh_for_each(&arp_tbl, mlxsw_sp_neigh_rif_made_sync_each, &rms);
+ if (rms.err)
+ goto err_arp;
+--
+2.39.5
+
--- /dev/null
+From 7fb8b1b650b62a644284939066d85dd3c25e76de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 14:19:35 +0200
+Subject: net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
+
+From: Mathieu Othacehe <othacehe@gnu.org>
+
+[ Upstream commit c92d6089d8ad7d4d815ebcedee3f3907b539ff1f ]
+
+There is a situation where after THALT is set high, TGO stays high as
+well. Because jiffies are never updated, as we are in a context with
+interrupts disabled, we never exit that loop and have a deadlock.
+
+That deadlock was noticed on a sama5d4 device that stayed locked for days.
+
+Use retries instead of jiffies so that the timeout really works and we do
+not have a deadlock anymore.
+
+Fixes: e86cd53afc590 ("net/macb: better manage tx errors")
+Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250509121935.16282-1-othacehe@gnu.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 60847cdb516ee..ae100ed8ed6b9 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1016,22 +1016,15 @@ static void macb_update_stats(struct macb *bp)
+
+ static int macb_halt_tx(struct macb *bp)
+ {
+- unsigned long halt_time, timeout;
+- u32 status;
++ u32 status;
+
+ macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(THALT));
+
+- timeout = jiffies + usecs_to_jiffies(MACB_HALT_TIMEOUT);
+- do {
+- halt_time = jiffies;
+- status = macb_readl(bp, TSR);
+- if (!(status & MACB_BIT(TGO)))
+- return 0;
+-
+- udelay(250);
+- } while (time_before(halt_time, timeout));
+-
+- return -ETIMEDOUT;
++ /* Poll TSR until TGO is cleared or timeout. */
++ return read_poll_timeout_atomic(macb_readl, status,
++ !(status & MACB_BIT(TGO)),
++ 250, MACB_HALT_TIMEOUT, false,
++ bp, TSR);
+ }
+
+ static void macb_tx_unmap(struct macb *bp, struct macb_tx_skb *tx_skb, int budget)
+--
+2.39.5
+
--- /dev/null
+From de99288e7b62e7fd425733a99835e605cbd7b431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 11:14:24 +0200
+Subject: net: dsa: b53: prevent standalone from trying to forward to other
+ ports
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 4227ea91e2657f7965e34313448e9d0a2b67712e ]
+
+When bridged ports and standalone ports share a VLAN, e.g. via VLAN
+uppers, or untagged traffic with a vlan unaware bridge, the ASIC will
+still try to forward traffic to known FDB entries on standalone ports.
+But since the port VLAN masks prevent forwarding to bridged ports, this
+traffic will be dropped.
+
+This e.g. can be observed in the bridge_vlan_unaware ping tests, where
+this breaks pinging with learning on.
+
+Work around this by enabling the simplified EAP mode on switches
+supporting it for standalone ports, which causes the ASIC to redirect
+traffic of unknown source MAC addresses to the CPU port.
+
+Since standalone ports do not learn, there are no known source MAC
+addresses, so effectively this redirects all incoming traffic to the CPU
+port.
+
+Fixes: ff39c2d68679 ("net: dsa: b53: Add bridge support")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250508091424.26870-1-jonas.gorski@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 33 ++++++++++++++++++++++++++++++++
+ drivers/net/dsa/b53/b53_regs.h | 14 ++++++++++++++
+ 2 files changed, 47 insertions(+)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index e072d2b50c987..0168ad495e6c9 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -326,6 +326,26 @@ static void b53_get_vlan_entry(struct b53_device *dev, u16 vid,
+ }
+ }
+
++static void b53_set_eap_mode(struct b53_device *dev, int port, int mode)
++{
++ u64 eap_conf;
++
++ if (is5325(dev) || is5365(dev) || dev->chip_id == BCM5389_DEVICE_ID)
++ return;
++
++ b53_read64(dev, B53_EAP_PAGE, B53_PORT_EAP_CONF(port), &eap_conf);
++
++ if (is63xx(dev)) {
++ eap_conf &= ~EAP_MODE_MASK_63XX;
++ eap_conf |= (u64)mode << EAP_MODE_SHIFT_63XX;
++ } else {
++ eap_conf &= ~EAP_MODE_MASK;
++ eap_conf |= (u64)mode << EAP_MODE_SHIFT;
++ }
++
++ b53_write64(dev, B53_EAP_PAGE, B53_PORT_EAP_CONF(port), eap_conf);
++}
++
+ static void b53_set_forwarding(struct b53_device *dev, int enable)
+ {
+ u8 mgmt;
+@@ -586,6 +606,13 @@ int b53_setup_port(struct dsa_switch *ds, int port)
+ b53_port_set_mcast_flood(dev, port, true);
+ b53_port_set_learning(dev, port, false);
+
++ /* Force all traffic to go to the CPU port to prevent the ASIC from
++ * trying to forward to bridged ports on matching FDB entries, then
++ * dropping frames because it isn't allowed to forward there.
++ */
++ if (dsa_is_user_port(ds, port))
++ b53_set_eap_mode(dev, port, EAP_MODE_SIMPLIFIED);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(b53_setup_port);
+@@ -2043,6 +2070,9 @@ int b53_br_join(struct dsa_switch *ds, int port, struct dsa_bridge bridge,
+ pvlan |= BIT(i);
+ }
+
++ /* Disable redirection of unknown SA to the CPU port */
++ b53_set_eap_mode(dev, port, EAP_MODE_BASIC);
++
+ /* Configure the local port VLAN control membership to include
+ * remote ports and update the local port bitmask
+ */
+@@ -2078,6 +2108,9 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct dsa_bridge bridge)
+ pvlan &= ~BIT(i);
+ }
+
++ /* Enable redirection of unknown SA to the CPU port */
++ b53_set_eap_mode(dev, port, EAP_MODE_SIMPLIFIED);
++
+ b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
+ dev->ports[port].vlan_ctl_mask = pvlan;
+
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index bfbcb66bef662..5f7a0e5c5709d 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -50,6 +50,9 @@
+ /* Jumbo Frame Registers */
+ #define B53_JUMBO_PAGE 0x40
+
++/* EAP Registers */
++#define B53_EAP_PAGE 0x42
++
+ /* EEE Control Registers Page */
+ #define B53_EEE_PAGE 0x92
+
+@@ -480,6 +483,17 @@
+ #define JMS_MIN_SIZE 1518
+ #define JMS_MAX_SIZE 9724
+
++/*************************************************************************
++ * EAP Page Registers
++ *************************************************************************/
++#define B53_PORT_EAP_CONF(i) (0x20 + 8 * (i))
++#define EAP_MODE_SHIFT 51
++#define EAP_MODE_SHIFT_63XX 50
++#define EAP_MODE_MASK (0x3ull << EAP_MODE_SHIFT)
++#define EAP_MODE_MASK_63XX (0x3ull << EAP_MODE_SHIFT_63XX)
++#define EAP_MODE_BASIC 0
++#define EAP_MODE_SIMPLIFIED 3
++
+ /*************************************************************************
+ * EEE Configuration Page Registers
+ *************************************************************************/
+--
+2.39.5
+
--- /dev/null
+From 3a2cd75958a0e9b9be6c76ac8269cbda56908c89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 14:38:16 +0300
+Subject: net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 498625a8ab2c8e1c9ab5105744310e8d6952cc01 ]
+
+It has been reported that when under a bridge with stp_state=1, the logs
+get spammed with this message:
+
+[ 251.734607] fsl_dpaa2_eth dpni.5 eth0: Couldn't decode source port
+
+Further debugging shows the following info associated with packets:
+source_port=-1, switch_id=-1, vid=-1, vbid=1
+
+In other words, they are data plane packets which are supposed to be
+decoded by dsa_tag_8021q_find_port_by_vbid(), but the latter (correctly)
+refuses to do so, because no switch port is currently in
+BR_STATE_LEARNING or BR_STATE_FORWARDING - so the packet is effectively
+unexpected.
+
+The error goes away after the port progresses to BR_STATE_LEARNING in 15
+seconds (the default forward_time of the bridge), because then,
+dsa_tag_8021q_find_port_by_vbid() can correctly associate the data plane
+packets with a plausible bridge port in a plausible STP state.
+
+Re-reading IEEE 802.1D-1990, I see the following:
+
+"4.4.2 Learning: (...) The Forwarding Process shall discard received
+frames."
+
+IEEE 802.1D-2004 further clarifies:
+
+"DISABLED, BLOCKING, LISTENING, and BROKEN all correspond to the
+DISCARDING port state. While those dot1dStpPortStates serve to
+distinguish reasons for discarding frames, the operation of the
+Forwarding and Learning processes is the same for all of them. (...)
+LISTENING represents a port that the spanning tree algorithm has
+selected to be part of the active topology (computing a Root Port or
+Designated Port role) but is temporarily discarding frames to guard
+against loops or incorrect learning."
+
+Well, this is not what the driver does - instead it sets
+mac[port].ingress = true.
+
+To get rid of the log spam, prevent unexpected data plane packets to
+be received by software by discarding them on ingress in the LISTENING
+state.
+
+In terms of blame attribution: the prints only date back to commit
+d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based
+on the VBID"). However, the settings would permit a LISTENING port to
+forward to a FORWARDING port, and the standard suggests that's not OK.
+
+Fixes: 640f763f98c2 ("net: dsa: sja1105: Add support for Spanning Tree Protocol")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250509113816.2221992-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index d0563ef59acf6..fbac2a647b20b 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -2083,6 +2083,7 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port,
+ switch (state) {
+ case BR_STATE_DISABLED:
+ case BR_STATE_BLOCKING:
++ case BR_STATE_LISTENING:
+ /* From UM10944 description of DRPDTAG (why put this there?):
+ * "Management traffic flows to the port regardless of the state
+ * of the INGRESS flag". So BPDUs are still be allowed to pass.
+@@ -2092,11 +2093,6 @@ static void sja1105_bridge_stp_state_set(struct dsa_switch *ds, int port,
+ mac[port].egress = false;
+ mac[port].dyn_learn = false;
+ break;
+- case BR_STATE_LISTENING:
+- mac[port].ingress = true;
+- mac[port].egress = false;
+- mac[port].dyn_learn = false;
+- break;
+ case BR_STATE_LEARNING:
+ mac[port].ingress = true;
+ mac[port].egress = false;
+--
+2.39.5
+
--- /dev/null
+From e6597b5f62eb9c521ff598022a5d7e8c6d99256a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 05:27:30 +0100
+Subject: net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW
+ capability
+
+From: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+
+[ Upstream commit 1bdea6fad6fb985ff13828373c48e337c4e939f9 ]
+
+Since MTK_ESW_BIT is a bit number rather than a bitmap, it causes
+MTK_HAS_CAPS to produce incorrect results. This leads to the ETH
+driver not declaring MAC capabilities correctly for the MT7988 ESW.
+
+Fixes: 445eb6448ed3 ("net: ethernet: mtk_eth_soc: add basic support for MT7988 SoC")
+Signed-off-by: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/b8b37f409d1280fad9c4d32521e6207f63cd3213.1747110258.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 0a13f7c4684e0..272f178906d61 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4685,7 +4685,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+ }
+
+ if (mtk_is_netsys_v3_or_greater(mac->hw) &&
+- MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW_BIT) &&
++ MTK_HAS_CAPS(mac->hw->soc->caps, MTK_ESW) &&
+ id == MTK_GMAC1_ID) {
+ mac->phylink_config.mac_capabilities = MAC_ASYM_PAUSE |
+ MAC_SYM_PAUSE |
+--
+2.39.5
+
--- /dev/null
+From f41830ee89f3e054f66a8fc8301b0f5d83378736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 13:18:32 +0800
+Subject: net: mctp: Don't access ifa_index when missing
+
+From: Matt Johnston <matt@codeconstruct.com.au>
+
+[ Upstream commit f11cf946c0a92c560a890d68e4775723353599e1 ]
+
+In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but
+only when the struct ifaddrmsg is provided. Otherwise it will be
+comparing to uninitialised memory - reproducible in the syzkaller case from
+dhcpd, or busybox "ip addr show".
+
+The kernel MCTP implementation has always filtered by ifa_index, so
+existing userspace programs expecting to dump MCTP addresses must
+already be passing a valid ifa_index value (either 0 or a real index).
+
+BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
+ mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
+ rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380
+ rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824
+ netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309
+
+Fixes: 583be982d934 ("mctp: Add device handling and netlink interface")
+Reported-by: syzbot+e76d52dadc089b9d197f@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68135815.050a0220.3a872c.000e.GAE@google.com/
+Reported-by: syzbot+1065a199625a388fce60@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/681357d6.050a0220.14dd7d.000d.GAE@google.com/
+Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
+Link: https://patch.msgid.link/20250508-mctp-addr-dump-v2-1-c8a53fd2dd66@codeconstruct.com.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mctp/device.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/net/mctp/device.c b/net/mctp/device.c
+index cdb18da96c4bc..8d1386601bbe0 100644
+--- a/net/mctp/device.c
++++ b/net/mctp/device.c
+@@ -117,11 +117,18 @@ static int mctp_dump_addrinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ struct net_device *dev;
+ struct ifaddrmsg *hdr;
+ struct mctp_dev *mdev;
+- int ifindex, rc;
+-
+- hdr = nlmsg_data(cb->nlh);
+- // filter by ifindex if requested
+- ifindex = hdr->ifa_index;
++ int ifindex = 0, rc;
++
++ /* Filter by ifindex if a header is provided */
++ if (cb->nlh->nlmsg_len >= nlmsg_msg_size(sizeof(*hdr))) {
++ hdr = nlmsg_data(cb->nlh);
++ ifindex = hdr->ifa_index;
++ } else {
++ if (cb->strict_check) {
++ NL_SET_ERR_MSG(cb->extack, "mctp: Invalid header for addr dump request");
++ return -EINVAL;
++ }
++ }
+
+ rcu_read_lock();
+ for_each_netdev_dump(net, dev, mcb->ifindex) {
+--
+2.39.5
+
--- /dev/null
+From f102db7ac60a3b068018734ac51b99023f0447bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 14:16:00 +0930
+Subject: net: mctp: Ensure keys maintain only one ref to corresponding dev
+
+From: Andrew Jeffery <andrew@codeconstruct.com.au>
+
+[ Upstream commit e4f349bd6e58051df698b82f94721f18a02a293d ]
+
+mctp_flow_prepare_output() is called in mctp_route_output(), which
+places outbound packets onto a given interface. The packet may represent
+a message fragment, in which case we provoke an unbalanced reference
+count to the underlying device. This causes trouble if we ever attempt
+to remove the interface:
+
+ [ 48.702195] usb 1-1: USB disconnect, device number 2
+ [ 58.883056] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
+ [ 69.022548] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
+ [ 79.172568] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
+ ...
+
+Predicate the invocation of mctp_dev_set_key() in
+mctp_flow_prepare_output() on not already having associated the device
+with the key. It's not yet realistic to uphold the property that the key
+maintains only one device reference earlier in the transmission sequence
+as the route (and therefore the device) may not be known at the time the
+key is associated with the socket.
+
+Fixes: 67737c457281 ("mctp: Pass flow data & flow release events to drivers")
+Acked-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Link: https://patch.msgid.link/20250508-mctp-dev-refcount-v1-1-d4f965c67bb5@codeconstruct.com.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mctp/route.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/mctp/route.c b/net/mctp/route.c
+index 4c460160914f0..d9c8e5a5f9ce9 100644
+--- a/net/mctp/route.c
++++ b/net/mctp/route.c
+@@ -313,8 +313,10 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev)
+
+ key = flow->key;
+
+- if (WARN_ON(key->dev && key->dev != dev))
++ if (key->dev) {
++ WARN_ON(key->dev != dev);
+ return;
++ }
+
+ mctp_dev_set_key(dev, key);
+ }
+--
+2.39.5
+
--- /dev/null
+From e46e92f558a8e2d42c833534fd216ca80fc7004b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 May 2025 13:15:52 +0300
+Subject: net/mlx5e: Disable MACsec offload for uplink representor profile
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 588431474eb7572e57a927fa8558c9ba2f8af143 ]
+
+MACsec offload is not supported in switchdev mode for uplink
+representors. When switching to the uplink representor profile, the
+MACsec offload feature must be cleared from the netdevice's features.
+
+If left enabled, attempts to add offloads result in a null pointer
+dereference, as the uplink representor does not support MACsec offload
+even though the feature bit remains set.
+
+Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features().
+
+Kernel log:
+
+Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN
+KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
+CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+RIP: 0010:__mutex_lock+0x128/0x1dd0
+Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff
+RSP: 0018:ffff888147a4f160 EFLAGS: 00010206
+RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001
+RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078
+RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000
+R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
+R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000
+FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ ? die_addr+0x3d/0xa0
+ ? exc_general_protection+0x144/0x220
+ ? asm_exc_general_protection+0x22/0x30
+ ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]
+ ? __mutex_lock+0x128/0x1dd0
+ ? lockdep_set_lock_cmp_fn+0x190/0x190
+ ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]
+ ? mutex_lock_io_nested+0x1ae0/0x1ae0
+ ? lock_acquire+0x1c2/0x530
+ ? macsec_upd_offload+0x145/0x380
+ ? lockdep_hardirqs_on_prepare+0x400/0x400
+ ? kasan_save_stack+0x30/0x40
+ ? kasan_save_stack+0x20/0x40
+ ? kasan_save_track+0x10/0x30
+ ? __kasan_kmalloc+0x77/0x90
+ ? __kmalloc_noprof+0x249/0x6b0
+ ? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240
+ ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]
+ mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core]
+ ? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core]
+ macsec_update_offload+0x26c/0x820
+ ? macsec_set_mac_address+0x4b0/0x4b0
+ ? lockdep_hardirqs_on_prepare+0x284/0x400
+ ? _raw_spin_unlock_irqrestore+0x47/0x50
+ macsec_upd_offload+0x2c8/0x380
+ ? macsec_update_offload+0x820/0x820
+ ? __nla_parse+0x22/0x30
+ ? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240
+ genl_family_rcv_msg_doit+0x1cc/0x2a0
+ ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
+ ? cap_capable+0xd4/0x330
+ genl_rcv_msg+0x3ea/0x670
+ ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0
+ ? lockdep_set_lock_cmp_fn+0x190/0x190
+ ? macsec_update_offload+0x820/0x820
+ netlink_rcv_skb+0x12b/0x390
+ ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0
+ ? netlink_ack+0xd80/0xd80
+ ? rwsem_down_read_slowpath+0xf90/0xf90
+ ? netlink_deliver_tap+0xcd/0xac0
+ ? netlink_deliver_tap+0x155/0xac0
+ ? _copy_from_iter+0x1bb/0x12c0
+ genl_rcv+0x24/0x40
+ netlink_unicast+0x440/0x700
+ ? netlink_attachskb+0x760/0x760
+ ? lock_acquire+0x1c2/0x530
+ ? __might_fault+0xbb/0x170
+ netlink_sendmsg+0x749/0xc10
+ ? netlink_unicast+0x700/0x700
+ ? __might_fault+0xbb/0x170
+ ? netlink_unicast+0x700/0x700
+ __sock_sendmsg+0xc5/0x190
+ ____sys_sendmsg+0x53f/0x760
+ ? import_iovec+0x7/0x10
+ ? kernel_sendmsg+0x30/0x30
+ ? __copy_msghdr+0x3c0/0x3c0
+ ? filter_irq_stacks+0x90/0x90
+ ? stack_depot_save_flags+0x28/0xa30
+ ___sys_sendmsg+0xeb/0x170
+ ? kasan_save_stack+0x30/0x40
+ ? copy_msghdr_from_user+0x110/0x110
+ ? do_syscall_64+0x6d/0x140
+ ? lock_acquire+0x1c2/0x530
+ ? __virt_addr_valid+0x116/0x3b0
+ ? __virt_addr_valid+0x1da/0x3b0
+ ? lock_downgrade+0x680/0x680
+ ? __delete_object+0x21/0x50
+ __sys_sendmsg+0xf7/0x180
+ ? __sys_sendmsg_sock+0x20/0x20
+ ? kmem_cache_free+0x14c/0x4e0
+ ? __x64_sys_close+0x78/0xd0
+ do_syscall_64+0x6d/0x140
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+RIP: 0033:0x7f855e113367
+Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+RSP: 002b:00007ffd15e90c88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f855e113367
+RDX: 0000000000000000 RSI: 00007ffd15e90cf0 RDI: 0000000000000004
+RBP: 00007ffd15e90dbc R08: 0000000000000028 R09: 000000000045d100
+R10: 00007f855e011dd8 R11: 0000000000000246 R12: 0000000000000019
+R13: 0000000067c6b785 R14: 00000000004a1e80 R15: 0000000000000000
+ </TASK>
+Modules linked in: 8021q garp mrp sch_ingress openvswitch nsh mlx5_ib mlx5_fwctl mlx5_dpll mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core]
+---[ end trace 0000000000000000 ]---
+
+Fixes: 8ff0ac5be144 ("net/mlx5: Add MACsec offload Tx command support")
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/1746958552-561295-1-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 1c087fa1ca269..3e9ad3cb8121d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4344,6 +4344,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev
+ if (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
+ netdev_warn(netdev, "Disabling HW_VLAN CTAG FILTERING, not supported in switchdev mode\n");
+
++ features &= ~NETIF_F_HW_MACSEC;
++ if (netdev->features & NETIF_F_HW_MACSEC)
++ netdev_warn(netdev, "Disabling HW MACsec offload, not supported in switchdev mode\n");
++
+ return features;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From c162e980d067ed0fc87494f90ac7426835e1c3e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:20:13 +0800
+Subject: net/tls: fix kernel panic when alloc_page failed
+
+From: Pengtao He <hept.hept.hept@gmail.com>
+
+[ Upstream commit 491deb9b8c4ad12fe51d554a69b8165b9ef9429f ]
+
+We cannot set frag_list to NULL pointer when alloc_page failed.
+It will be used in tls_strp_check_queue_ok when the next time
+tls_strp_read_sock is called.
+
+This is because we don't reset full_len in tls_strp_flush_anchor_copy()
+so the recv path will try to continue handling the partial record
+on the next call but we dettached the rcvq from the frag list.
+Alternative fix would be to reset full_len.
+
+Unable to handle kernel NULL pointer dereference
+at virtual address 0000000000000028
+ Call trace:
+ tls_strp_check_rcv+0x128/0x27c
+ tls_strp_data_ready+0x34/0x44
+ tls_data_ready+0x3c/0x1f0
+ tcp_data_ready+0x9c/0xe4
+ tcp_data_queue+0xf6c/0x12d0
+ tcp_rcv_established+0x52c/0x798
+
+Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
+Signed-off-by: Pengtao He <hept.hept.hept@gmail.com>
+Link: https://patch.msgid.link/20250514132013.17274-1-hept.hept.hept@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_strp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c
+index 77e33e1e340e3..65b0da6fdf6a7 100644
+--- a/net/tls/tls_strp.c
++++ b/net/tls/tls_strp.c
+@@ -396,7 +396,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
+ return 0;
+
+ shinfo = skb_shinfo(strp->anchor);
+- shinfo->frag_list = NULL;
+
+ /* If we don't know the length go max plus page for cipher overhead */
+ need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE;
+@@ -412,6 +411,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
+ page, 0, 0);
+ }
+
++ shinfo->frag_list = NULL;
++
+ strp->copy_mode = 1;
+ strp->stm.offset = 0;
+
+--
+2.39.5
+
--- /dev/null
+From 8869cacc7736077b3482000c11bcf0fcb588cb9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 21:35:58 -0700
+Subject: net_sched: Flush gso_skb list too during ->change()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8 ]
+
+Previously, when reducing a qdisc's limit via the ->change() operation, only
+the main skb queue was trimmed, potentially leaving packets in the gso_skb
+list. This could result in NULL pointer dereference when we only check
+sch->limit against sch->q.qlen.
+
+This patch introduces a new helper, qdisc_dequeue_internal(), which ensures
+both the gso_skb list and the main queue are properly flushed when trimming
+excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie)
+are updated to use this helper in their ->change() routines.
+
+Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
+Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
+Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler")
+Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler")
+Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc")
+Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
+Reported-by: Will <willsroot@protonmail.com>
+Reported-by: Savy <savy@syst3mfailure.io>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sch_generic.h | 15 +++++++++++++++
+ net/sched/sch_codel.c | 2 +-
+ net/sched/sch_fq.c | 2 +-
+ net/sched/sch_fq_codel.c | 2 +-
+ net/sched/sch_fq_pie.c | 2 +-
+ net/sched/sch_hhf.c | 2 +-
+ net/sched/sch_pie.c | 2 +-
+ 7 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 24e48af7e8f74..a9d7e9ecee6b5 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -1031,6 +1031,21 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh)
+ return skb;
+ }
+
++static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool direct)
++{
++ struct sk_buff *skb;
++
++ skb = __skb_dequeue(&sch->gso_skb);
++ if (skb) {
++ sch->q.qlen--;
++ return skb;
++ }
++ if (direct)
++ return __qdisc_dequeue_head(&sch->q);
++ else
++ return sch->dequeue(sch);
++}
++
+ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
+ {
+ struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
+diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
+index e1f6e7618debd..afd9805cb68e2 100644
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -143,7 +143,7 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt,
+
+ qlen = sch->q.qlen;
+ while (sch->q.qlen > sch->limit) {
+- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, true);
+
+ dropped += qdisc_pkt_len(skb);
+ qdisc_qstats_backlog_dec(sch, skb);
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index afefe124d9039..1af9768cd8ff6 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -1113,7 +1113,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt,
+ sch_tree_lock(sch);
+ }
+ while (sch->q.qlen > sch->limit) {
+- struct sk_buff *skb = fq_dequeue(sch);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false);
+
+ if (!skb)
+ break;
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index 778f6e5966be8..551b7cbdae90c 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -440,7 +440,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+
+ while (sch->q.qlen > sch->limit ||
+ q->memory_usage > q->memory_limit) {
+- struct sk_buff *skb = fq_codel_dequeue(sch);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false);
+
+ q->cstats.drop_len += qdisc_pkt_len(skb);
+ rtnl_kfree_skbs(skb, skb);
+diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
+index c38f33ff80bde..6ed08b705f8a5 100644
+--- a/net/sched/sch_fq_pie.c
++++ b/net/sched/sch_fq_pie.c
+@@ -364,7 +364,7 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt,
+
+ /* Drop excess packets if new limit is lower */
+ while (sch->q.qlen > sch->limit) {
+- struct sk_buff *skb = fq_pie_qdisc_dequeue(sch);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false);
+
+ len_dropped += qdisc_pkt_len(skb);
+ num_dropped += 1;
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index 44d9efe1a96a8..5aa434b467073 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -564,7 +564,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt,
+ qlen = sch->q.qlen;
+ prev_backlog = sch->qstats.backlog;
+ while (sch->q.qlen > sch->limit) {
+- struct sk_buff *skb = hhf_dequeue(sch);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, false);
+
+ rtnl_kfree_skbs(skb, skb);
+ }
+diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
+index b3dcb845b3275..db61cbc21b138 100644
+--- a/net/sched/sch_pie.c
++++ b/net/sched/sch_pie.c
+@@ -192,7 +192,7 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt,
+ /* Drop excess packets if new limit is lower */
+ qlen = sch->q.qlen;
+ while (sch->q.qlen > sch->limit) {
+- struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
++ struct sk_buff *skb = qdisc_dequeue_internal(sch, true);
+
+ dropped += qdisc_pkt_len(skb);
+ qdisc_qstats_backlog_dec(sch, skb);
+--
+2.39.5
+
--- /dev/null
+From c705a6a344230246ec2d88b64cbc1f39fb77e95e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 15:16:38 -0700
+Subject: netlink: specs: tc: all actions are indexed arrays
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3dd5fb2fa494dcbdb10f8d27f2deac8ef61a2fc ]
+
+Some TC filters have actions listed as indexed arrays of nests
+and some as just nests. They are all indexed arrays, the handling
+is common across filters.
+
+Fixes: 2267672a6190 ("doc/netlink/specs: Update the tc spec")
+Link: https://patch.msgid.link/20250513221638.842532-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/tc.yaml | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/netlink/specs/tc.yaml b/Documentation/netlink/specs/tc.yaml
+index a5bde25c89e52..c5579a5412fc9 100644
+--- a/Documentation/netlink/specs/tc.yaml
++++ b/Documentation/netlink/specs/tc.yaml
+@@ -2017,7 +2017,8 @@ attribute-sets:
+ attributes:
+ -
+ name: act
+- type: nest
++ type: indexed-array
++ sub-type: nest
+ nested-attributes: tc-act-attrs
+ -
+ name: police
+@@ -2250,7 +2251,8 @@ attribute-sets:
+ attributes:
+ -
+ name: act
+- type: nest
++ type: indexed-array
++ sub-type: nest
+ nested-attributes: tc-act-attrs
+ -
+ name: police
+--
+2.39.5
+
--- /dev/null
+From 0fea5977e3e282bee5d981fab1deb83178aa0e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 15:13:16 -0700
+Subject: netlink: specs: tc: fix a couple of attribute names
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit a9fb87b8b86918e34ef6bf3316311f41bc1a5b1f ]
+
+Fix up spelling of two attribute names. These are clearly typoes
+and will prevent C codegen from working. Let's treat this as
+a fix to get the correction into users' hands ASAP, and prevent
+anyone depending on the wrong names.
+
+Fixes: a1bcfde83669 ("doc/netlink/specs: Add a spec for tc")
+Link: https://patch.msgid.link/20250513221316.841700-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/tc.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/netlink/specs/tc.yaml b/Documentation/netlink/specs/tc.yaml
+index b02d59a0349c4..a5bde25c89e52 100644
+--- a/Documentation/netlink/specs/tc.yaml
++++ b/Documentation/netlink/specs/tc.yaml
+@@ -2745,7 +2745,7 @@ attribute-sets:
+ type: u16
+ byte-order: big-endian
+ -
+- name: key-l2-tpv3-sid
++ name: key-l2tpv3-sid
+ type: u32
+ byte-order: big-endian
+ -
+@@ -3504,7 +3504,7 @@ attribute-sets:
+ name: rate64
+ type: u64
+ -
+- name: prate4
++ name: prate64
+ type: u64
+ -
+ name: burst
+--
+2.39.5
+
--- /dev/null
+From 18e55b737e2578833972c27790a81ade44f9d0b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 15:25:08 +0800
+Subject: nfs: handle failure of nfs_get_lock_context in unlock path
+
+From: Li Lingfeng <lilingfeng3@huawei.com>
+
+[ Upstream commit c457dc1ec770a22636b473ce5d35614adfe97636 ]
+
+When memory is insufficient, the allocation of nfs_lock_context in
+nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat
+an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM)
+as valid and proceed to execute rpc_run_task(), this will trigger a NULL
+pointer dereference in nfs4_locku_prepare. For example:
+
+BUG: kernel NULL pointer dereference, address: 000000000000000c
+PGD 0 P4D 0
+Oops: Oops: 0000 [#1] SMP PTI
+CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40
+Workqueue: rpciod rpc_async_schedule
+RIP: 0010:nfs4_locku_prepare+0x35/0xc2
+Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3
+RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246
+RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40
+RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38
+R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030
+R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30
+FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0
+Call Trace:
+ <TASK>
+ __rpc_execute+0xbc/0x480
+ rpc_async_schedule+0x2f/0x40
+ process_one_work+0x232/0x5d0
+ worker_thread+0x1da/0x3d0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0x10d/0x240
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x34/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+Modules linked in:
+CR2: 000000000000000c
+---[ end trace 0000000000000000 ]---
+
+Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and
+return NULL to terminate subsequent rpc_run_task, preventing NULL pointer
+dereference.
+
+Fixes: f30cb757f680 ("NFS: Always wait for I/O completion before unlock")
+Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/r/20250417072508.3850532-1-lilingfeng3@huawei.com
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e7bc99c69743c..ca01f79c82e4a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7040,10 +7040,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+ struct nfs4_unlockdata *p;
+ struct nfs4_state *state = lsp->ls_state;
+ struct inode *inode = state->inode;
++ struct nfs_lock_context *l_ctx;
+
+ p = kzalloc(sizeof(*p), GFP_KERNEL);
+ if (p == NULL)
+ return NULL;
++ l_ctx = nfs_get_lock_context(ctx);
++ if (!IS_ERR(l_ctx)) {
++ p->l_ctx = l_ctx;
++ } else {
++ kfree(p);
++ return NULL;
++ }
+ p->arg.fh = NFS_FH(inode);
+ p->arg.fl = &p->fl;
+ p->arg.seqid = seqid;
+@@ -7051,7 +7059,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
+ p->lsp = lsp;
+ /* Ensure we don't close file until we're done freeing locks! */
+ p->ctx = get_nfs_open_context(ctx);
+- p->l_ctx = nfs_get_lock_context(ctx);
+ locks_init_lock(&p->fl);
+ locks_copy_lock(&p->fl, fl);
+ p->server = NFS_SERVER(inode);
+--
+2.39.5
+
--- /dev/null
+From 9f453a1e4b268270ee76ac247c97d56df570cce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 10:50:13 -0400
+Subject: NFSv4/pnfs: Reset the layout state after a layoutreturn
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 6d6d7f91cc8c111d40416ac9240a3bb9396c5235 ]
+
+If there are still layout segments in the layout plh_return_lsegs list
+after a layout return, we should be resetting the state to ensure they
+eventually get returned as well.
+
+Fixes: 68f744797edd ("pNFS: Do not free layout segments that are marked for return")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 5f582713bf05e..683e09be25adf 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -745,6 +745,14 @@ pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo,
+ return remaining;
+ }
+
++static void pnfs_reset_return_info(struct pnfs_layout_hdr *lo)
++{
++ struct pnfs_layout_segment *lseg;
++
++ list_for_each_entry(lseg, &lo->plh_return_segs, pls_list)
++ pnfs_set_plh_return_info(lo, lseg->pls_range.iomode, 0);
++}
++
+ static void
+ pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo,
+ struct list_head *free_me,
+@@ -1292,6 +1300,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo,
+ pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq);
+ pnfs_free_returned_lsegs(lo, &freeme, range, seq);
+ pnfs_set_layout_stateid(lo, stateid, NULL, true);
++ pnfs_reset_return_info(lo);
+ } else
+ pnfs_mark_layout_stateid_invalid(lo, &freeme);
+ out_unlock:
+--
+2.39.5
+
--- /dev/null
+From 05e919da3b4d95147480c84fdf651c4a8abc33cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 16:57:06 +0200
+Subject: nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 3d8932133dcecbd9bef1559533c1089601006f45 ]
+
+We need to lock this queue for that condition because the timeout work
+executes per-namespace and can poll the poll CQ.
+
+Reported-by: Hannes Reinecke <hare@kernel.org>
+Closes: https://lore.kernel.org/all/20240902130728.1999-1-hare@kernel.org/
+Fixes: a0fa9647a54e ("NVMe: add blk polling support")
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 504dc05380350..265b3608ae26e 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1202,7 +1202,9 @@ static void nvme_poll_irqdisable(struct nvme_queue *nvmeq)
+ WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags));
+
+ disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector));
++ spin_lock(&nvmeq->cq_poll_lock);
+ nvme_poll_cq(nvmeq, NULL);
++ spin_unlock(&nvmeq->cq_poll_lock);
+ enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector));
+ }
+
+--
+2.39.5
+
--- /dev/null
+From fe7b700a2be39d5d49481c1380141ad64adc3375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 20:35:40 -0700
+Subject: nvme-pci: make nvme_pci_npages_prp() __always_inline
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 40696426b8c8c4f13cf6ac52f0470eed144be4b2 ]
+
+The only reason nvme_pci_npages_prp() could be used as a compile-time
+known result in BUILD_BUG_ON() is because the compiler was always choosing
+to inline the function. Under special circumstances (sanitizer coverage
+functions disabled for __init functions on ARCH=um), the compiler decided
+to stop inlining it:
+
+ drivers/nvme/host/pci.c: In function 'nvme_init':
+ include/linux/compiler_types.h:557:45: error: call to '__compiletime_assert_678' declared with attribute error: BUILD_BUG_ON failed: nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS
+ 557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+ | ^
+ include/linux/compiler_types.h:538:25: note: in definition of macro '__compiletime_assert'
+ 538 | prefix ## suffix(); \
+ | ^~~~~~
+ include/linux/compiler_types.h:557:9: note: in expansion of macro '_compiletime_assert'
+ 557 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+ | ^~~~~~~~~~~~~~~~~~~
+ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
+ 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
+ | ^~~~~~~~~~~~~~~~~~
+ include/linux/build_bug.h:50:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
+ 50 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
+ | ^~~~~~~~~~~~~~~~
+ drivers/nvme/host/pci.c:3804:9: note: in expansion of macro 'BUILD_BUG_ON'
+ 3804 | BUILD_BUG_ON(nvme_pci_npages_prp() > NVME_MAX_NR_ALLOCATIONS);
+ | ^~~~~~~~~~~~
+
+Force it to be __always_inline to make sure it is always available for
+use with BUILD_BUG_ON().
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202505061846.12FMyRjj-lkp@intel.com/
+Fixes: c372cdd1efdf ("nvme-pci: iod npages fits in s8")
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 83ee433b69415..504dc05380350 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -390,7 +390,7 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, __le32 *dbbuf_db,
+ * as it only leads to a small amount of wasted memory for the lifetime of
+ * the I/O.
+ */
+-static int nvme_pci_npages_prp(void)
++static __always_inline int nvme_pci_npages_prp(void)
+ {
+ unsigned max_bytes = (NVME_MAX_KB_SZ * 1024) + NVME_CTRL_PAGE_SIZE;
+ unsigned nprps = DIV_ROUND_UP(max_bytes, NVME_CTRL_PAGE_SIZE);
+--
+2.39.5
+
--- /dev/null
+From cb126f4a1336cec586d6ed31748ad6e8c84bffcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:33 +0000
+Subject: nvmem: core: calculate bin_attribute size through bin_size()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 00ab6e97de0071b21a548e0a823348b3309970ba ]
+
+Stop abusing the is_bin_visible() callback to calculate the attribute
+size. Instead use the new, dedicated bin_size() one.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-4-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index d00a3b015635c..e4775938b9d40 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -303,11 +303,19 @@ static umode_t nvmem_bin_attr_is_visible(struct kobject *kobj,
+ struct device *dev = kobj_to_dev(kobj);
+ struct nvmem_device *nvmem = to_nvmem_device(dev);
+
+- attr->size = nvmem->size;
+-
+ return nvmem_bin_attr_get_umode(nvmem);
+ }
+
++static size_t nvmem_bin_attr_size(struct kobject *kobj,
++ const struct bin_attribute *attr,
++ int i)
++{
++ struct device *dev = kobj_to_dev(kobj);
++ struct nvmem_device *nvmem = to_nvmem_device(dev);
++
++ return nvmem->size;
++}
++
+ static umode_t nvmem_attr_is_visible(struct kobject *kobj,
+ struct attribute *attr, int i)
+ {
+@@ -383,6 +391,7 @@ static const struct attribute_group nvmem_bin_group = {
+ .bin_attrs = nvmem_bin_attributes,
+ .attrs = nvmem_attrs,
+ .is_bin_visible = nvmem_bin_attr_is_visible,
++ .bin_size = nvmem_bin_attr_size,
+ .is_visible = nvmem_attr_is_visible,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 76d6b995ff13bc4d2ee14dac6b823d8d6fb96287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 12:45:54 +0530
+Subject: octeontx2-af: Fix CGX Receive counters
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit bf449f35e77fd44017abf991fac1f9ab7705bbe0 ]
+
+Each CGX block supports 4 logical MACs (LMACS). Receive
+counters CGX_CMR_RX_STAT0-8 are per LMAC and CGX_CMR_RX_STAT9-12
+are per CGX.
+
+Due a bug in previous patch, stale Per CGX counters values observed.
+
+Fixes: 66208910e57a ("octeontx2-af: Support to retrieve CGX LMAC stats")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Link: https://patch.msgid.link/20250513071554.728922-1-hkelam@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 8216f843a7cd5..e43c4608d3ba3 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -707,6 +707,11 @@ int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat)
+
+ if (!is_lmac_valid(cgx, lmac_id))
+ return -ENODEV;
++
++ /* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */
++ if (idx >= CGX_RX_STAT_GLOBAL_INDEX)
++ lmac_id = 0;
++
+ *rx_stat = cgx_read(cgx, lmac_id, CGXX_CMRX_RX_STAT0 + (idx * 8));
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 9b94855bdf3ec5c785dcc14ebe626b4a78187035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 18:22:37 +0530
+Subject: octeontx2-pf: Do not reallocate all ntuple filters
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit dcb479fde00be9a151c047d0a7c0626b64eb0019 ]
+
+If ntuple filters count is modified followed by
+unicast filters count using devlink then the ntuple count
+set by user is ignored and all the ntuple filters are
+being reallocated. Fix this by storing the ntuple count
+set by user. Without this patch, say if user tries
+to modify ntuple count as 8 followed by ucast filter count as 4
+using devlink commands then ntuple count is being reverted to
+default value 16 i.e, not retaining user set value 8.
+
+Fixes: 39c469188b6d ("octeontx2-pf: Add ucast filter count configurability via devlink.")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/1747054357-5850-1-git-send-email-sbhatta@marvell.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 1 +
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c | 1 +
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 3 ++-
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index f27a3456ae64f..5b45fd78d2825 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -364,6 +364,7 @@ struct otx2_flow_config {
+ struct list_head flow_list_tc;
+ u8 ucast_flt_cnt;
+ bool ntuple;
++ u16 ntuple_cnt;
+ };
+
+ struct dev_hw_ops {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c
+index 53f14aa944bdb..aaea19345750e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_devlink.c
+@@ -41,6 +41,7 @@ static int otx2_dl_mcam_count_set(struct devlink *devlink, u32 id,
+ if (!pfvf->flow_cfg)
+ return 0;
+
++ pfvf->flow_cfg->ntuple_cnt = ctx->val.vu16;
+ otx2_alloc_mcam_entries(pfvf, ctx->val.vu16);
+
+ return 0;
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+index 58720a161ee24..2750326bfcf8b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+@@ -252,7 +252,7 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf)
+ mutex_unlock(&pfvf->mbox.lock);
+
+ /* Allocate entries for Ntuple filters */
+- count = otx2_alloc_mcam_entries(pfvf, OTX2_DEFAULT_FLOWCOUNT);
++ count = otx2_alloc_mcam_entries(pfvf, flow_cfg->ntuple_cnt);
+ if (count <= 0) {
+ otx2_clear_ntuple_flow_info(pfvf, flow_cfg);
+ return 0;
+@@ -312,6 +312,7 @@ int otx2_mcam_flow_init(struct otx2_nic *pf)
+ INIT_LIST_HEAD(&pf->flow_cfg->flow_list_tc);
+
+ pf->flow_cfg->ucast_flt_cnt = OTX2_DEFAULT_UNICAST_FLOWS;
++ pf->flow_cfg->ntuple_cnt = OTX2_DEFAULT_FLOWCOUNT;
+
+ /* Allocate bare minimum number of MCAM entries needed for
+ * unicast and ntuple filters.
+--
+2.39.5
+
--- /dev/null
+From 6317786cae64c1f620dbf4c35d1b31d120404227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 18:12:36 +0530
+Subject: octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 865ab2461375e3a5a2526f91f9a9f17b8931bc9e ]
+
+MASCEC hardware block has a field called maximum transmit size for
+TX secy. Max packet size going out of MCS block has be programmed
+taking into account full packet size which has L2 header,SecTag
+and ICV. MACSEC offload driver is configuring max transmit size as
+macsec interface MTU which is incorrect. Say with 1500 MTU of real
+device, macsec interface created on top of real device will have MTU of
+1468(1500 - (SecTag + ICV)). This is causing packets from macsec
+interface of size greater than or equal to 1468 are not getting
+transmitted out because driver programmed max transmit size as 1468
+instead of 1514(1500 + ETH_HDR_LEN).
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/1747053756-4529-1-git-send-email-sbhatta@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+index 6cc7a78968fc1..74953f67a2bf9 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+@@ -533,7 +533,8 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf,
+ if (sw_tx_sc->encrypt)
+ sectag_tci |= (MCS_TCI_E | MCS_TCI_C);
+
+- policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU, secy->netdev->mtu);
++ policy = FIELD_PREP(MCS_TX_SECY_PLCY_MTU,
++ pfvf->netdev->mtu + OTX2_ETH_HLEN);
+ /* Write SecTag excluding AN bits(1..0) */
+ policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_TCI, sectag_tci >> 2);
+ policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_OFFSET, tag_offset);
+--
+2.39.5
+
--- /dev/null
+From 393313393982448da3f49f75d27c513a876737bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:32 +0000
+Subject: PCI/sysfs: Calculate bin_attribute size through bin_size()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit a1ab720ee50686d9e9dcb6935995a75696ed2493 ]
+
+Stop abusing the is_bin_visible() callback to calculate the attribute
+size. Instead use the new, dedicated bin_size() one.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-3-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-sysfs.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 5af4a804a4f89..f62402bafc19b 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -844,21 +844,20 @@ static struct bin_attribute *pci_dev_config_attrs[] = {
+ NULL,
+ };
+
+-static umode_t pci_dev_config_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *a, int n)
++static size_t pci_dev_config_attr_bin_size(struct kobject *kobj,
++ const struct bin_attribute *a,
++ int n)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+
+- a->size = PCI_CFG_SPACE_SIZE;
+ if (pdev->cfg_size > PCI_CFG_SPACE_SIZE)
+- a->size = PCI_CFG_SPACE_EXP_SIZE;
+-
+- return a->attr.mode;
++ return PCI_CFG_SPACE_EXP_SIZE;
++ return PCI_CFG_SPACE_SIZE;
+ }
+
+ static const struct attribute_group pci_dev_config_attr_group = {
+ .bin_attrs = pci_dev_config_attrs,
+- .is_bin_visible = pci_dev_config_attr_is_visible,
++ .bin_size = pci_dev_config_attr_bin_size,
+ };
+
+ /*
+@@ -1356,21 +1355,26 @@ static umode_t pci_dev_rom_attr_is_visible(struct kobject *kobj,
+ struct bin_attribute *a, int n)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+- size_t rom_size;
+
+ /* If the device has a ROM, try to expose it in sysfs. */
+- rom_size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
+- if (!rom_size)
++ if (!pci_resource_end(pdev, PCI_ROM_RESOURCE))
+ return 0;
+
+- a->size = rom_size;
+-
+ return a->attr.mode;
+ }
+
++static size_t pci_dev_rom_attr_bin_size(struct kobject *kobj,
++ const struct bin_attribute *a, int n)
++{
++ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
++
++ return pci_resource_len(pdev, PCI_ROM_RESOURCE);
++}
++
+ static const struct attribute_group pci_dev_rom_attr_group = {
+ .bin_attrs = pci_dev_rom_attrs,
+ .is_bin_visible = pci_dev_rom_attr_is_visible,
++ .bin_size = pci_dev_rom_attr_bin_size,
+ };
+
+ static ssize_t reset_store(struct device *dev, struct device_attribute *attr,
+--
+2.39.5
+
--- /dev/null
+From 0cbb7e1c8bcbd1fe797f111689286e14acff3a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 18:01:03 +0800
+Subject: platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie
+ 14XA (GX4HRXL)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Runhua He <hua@aosc.io>
+
+[ Upstream commit 0887817e4953885fbd6a5c1bec2fdd339261eb19 ]
+
+MECHREVO Wujie 14XA (GX4HRXL) wakes up immediately after s2idle entry.
+This happens regardless of whether the laptop is plugged into AC power,
+or whether any peripheral is plugged into the laptop.
+
+Similar to commit a55bdad5dfd1 ("platform/x86/amd/pmc: Disable keyboard
+wakeup on AMD Framework 13"), the MECHREVO Wujie 14XA wakes up almost
+instantly after s2idle suspend entry (IRQ1 is the keyboard):
+
+2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 9
+2025-04-18 17:23:57,588 DEBUG: PM: Triggering wakeup from IRQ 1
+
+Add this model to the spurious_8042 quirk to workaround this.
+
+This patch does not affect the wake-up function of the built-in keyboard.
+Because the firmware of this machine adds an insurance for keyboard
+wake-up events, as it always triggers an additional IRQ 9 to wake up the
+system.
+
+Suggested-by: Mingcong Bai <jeffbai@aosc.io>
+Suggested-by: Xinhui Yang <cyan@cyano.uk>
+Suggested-by: Rong Zhang <i@rong.moe>
+Fixes: a55bdad5dfd1 ("platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4166
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://zhuanldan.zhihu.com/p/730538041
+Tested-by: Yemu Lu <prcups@krgm.moe>
+Signed-off-by: Runhua He <hua@aosc.io>
+Link: https://lore.kernel.org/r/20250507100103.995395-1-hua@aosc.io
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index b4f49720c87f6..2e3f6fc67c568 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -217,6 +217,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BIOS_VERSION, "03.05"),
+ }
+ },
++ {
++ .ident = "MECHREVO Wujie 14X (GX4HRXL)",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),
++ }
++ },
+ {}
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 32775d856133f5b401814999e69971fd2b55303e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 15:17:02 +0200
+Subject: platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit bfcfe6d335a967f8ea0c1980960e6f0205b5de6e ]
+
+The wlan_ctrl_by_user detection was introduced by commit a50bd128f28c
+("asus-wmi: record wlan status while controlled by userapp").
+
+Quoting from that commit's commit message:
+
+"""
+When you call WMIMethod(DSTS, 0x00010011) to get WLAN status, it may return
+
+(1) 0x00050001 (On)
+(2) 0x00050000 (Off)
+(3) 0x00030001 (On)
+(4) 0x00030000 (Off)
+(5) 0x00000002 (Unknown)
+
+(1), (2) means that the model has hardware GPIO for WLAN, you can call
+WMIMethod(DEVS, 0x00010011, 1 or 0) to turn WLAN on/off.
+(3), (4) means that the model doesn’t have hardware GPIO, you need to use
+API or driver library to turn WLAN on/off, and call
+WMIMethod(DEVS, 0x00010012, 1 or 0) to set WLAN LED status.
+After you set WLAN LED status, you can see the WLAN status is changed with
+WMIMethod(DSTS, 0x00010011). Because the status is recorded lastly
+(ex: Windows), you can use it for synchronization.
+(5) means that the model doesn’t have WLAN device.
+
+WLAN is the ONLY special case with upper rule.
+"""
+
+The wlan_ctrl_by_user flag should be set on 0x0003000? ((3), (4) above)
+return values, but the flag mistakenly also gets set on laptops with
+0x0005000? ((1), (2)) return values. This is causing rfkill problems on
+laptops where 0x0005000? is returned.
+
+Fix the check to only set the wlan_ctrl_by_user flag for 0x0003000?
+return values.
+
+Fixes: a50bd128f28c ("asus-wmi: record wlan status while controlled by userapp")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219786
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250501131702.103360-2-hdegoede@redhat.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 1101e5b2488e5..a1cff9ff35a92 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -4795,7 +4795,8 @@ static int asus_wmi_add(struct platform_device *pdev)
+ goto fail_leds;
+
+ asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
+- if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
++ if ((result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT)) ==
++ (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
+ asus->driver->wlan_ctrl_by_user = 1;
+
+ if (!(asus->driver->wlan_ctrl_by_user && ashs_present())) {
+--
+2.39.5
+
--- /dev/null
+From 0ea42adb6af799c83638883c005e2c8f441c1482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 10:18:27 +0530
+Subject: qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 9d8a99c5a7c7f4f7eca2c168a4ec254409670035 ]
+
+In one of the error paths in qlcnic_sriov_channel_cfg_cmd(), the memory
+allocated in qlcnic_sriov_alloc_bc_mbx_args() for mailbox arguments is
+not freed. Fix that by jumping to the error path that frees them, by
+calling qlcnic_free_mbx_args(). This was found using static analysis.
+
+Fixes: f197a7aa6288 ("qlcnic: VF-PF communication channel implementation")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250512044829.36400-1-abdun.nihaal@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index 28d24d59efb84..d57b976b90409 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -1484,8 +1484,11 @@ static int qlcnic_sriov_channel_cfg_cmd(struct qlcnic_adapter *adapter, u8 cmd_o
+ }
+
+ cmd_op = (cmd.rsp.arg[0] & 0xff);
+- if (cmd.rsp.arg[0] >> 25 == 2)
+- return 2;
++ if (cmd.rsp.arg[0] >> 25 == 2) {
++ ret = 2;
++ goto out;
++ }
++
+ if (cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT)
+ set_bit(QLC_BC_VF_STATE, &vf->state);
+ else
+--
+2.39.5
+
--- /dev/null
+From 18b6ab1f1262d08b13330bc8febad701bd440c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 17:10:08 +0200
+Subject: RDMA/core: Fix "KASAN: slab-use-after-free Read in
+ ib_register_device" problem
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit d0706bfd3ee40923c001c6827b786a309e2a8713 ]
+
+Call Trace:
+
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:408 [inline]
+ print_report+0xc3/0x670 mm/kasan/report.c:521
+ kasan_report+0xe0/0x110 mm/kasan/report.c:634
+ strlen+0x93/0xa0 lib/string.c:420
+ __fortify_strlen include/linux/fortify-string.h:268 [inline]
+ get_kobj_path_length lib/kobject.c:118 [inline]
+ kobject_get_path+0x3f/0x2a0 lib/kobject.c:158
+ kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
+ ib_register_device drivers/infiniband/core/device.c:1472 [inline]
+ ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393
+ rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
+ rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550
+ rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225
+ nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796
+ rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195
+ rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450
+ netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
+ netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339
+ netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883
+ sock_sendmsg_nosec net/socket.c:712 [inline]
+ __sock_sendmsg net/socket.c:727 [inline]
+ ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566
+ ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
+ __sys_sendmsg+0x16d/0x220 net/socket.c:2652
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+This problem is similar to the problem that the
+commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name")
+fixes.
+
+The root cause is: the function ib_device_rename() renames the name with
+lock. But in the function kobject_uevent(), this name is accessed without
+lock protection at the same time.
+
+The solution is to add the lock protection when this name is accessed in
+the function kobject_uevent().
+
+Fixes: 779e0bf47632 ("RDMA/core: Do not indicate device ready when device enablement fails")
+Link: https://patch.msgid.link/r/20250506151008.75701-1-yanjun.zhu@linux.dev
+Reported-by: syzbot+e2ce9e275ecc70a30b72@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=e2ce9e275ecc70a30b72
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 46102f179955b..df2aa15a5bc9b 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1368,6 +1368,9 @@ static void ib_device_notify_register(struct ib_device *device)
+
+ down_read(&devices_rwsem);
+
++ /* Mark for userspace that device is ready */
++ kobject_uevent(&device->dev.kobj, KOBJ_ADD);
++
+ ret = rdma_nl_notify_event(device, 0, RDMA_REGISTER_EVENT);
+ if (ret)
+ goto out;
+@@ -1484,10 +1487,9 @@ int ib_register_device(struct ib_device *device, const char *name,
+ return ret;
+ }
+ dev_set_uevent_suppress(&device->dev, false);
+- /* Mark for userspace that device is ready */
+- kobject_uevent(&device->dev.kobj, KOBJ_ADD);
+
+ ib_device_notify_register(device);
++
+ ib_device_put(device);
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 881c56e91bd5cb2c05abab8cef86e20bc741ec2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 09:57:14 +0200
+Subject: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit f81b33582f9339d2dc17c69b92040d3650bb4bae ]
+
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0xcf/0x610 mm/kasan/report.c:489
+ kasan_report+0xb5/0xe0 mm/kasan/report.c:602
+ rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195
+ rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132
+ __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232
+ rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109
+ create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052
+ ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095
+ ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679
+ vfs_write fs/read_write.c:677 [inline]
+ vfs_write+0x26a/0xcc0 fs/read_write.c:659
+ ksys_write+0x1b8/0x200 fs/read_write.c:731
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+In the function rxe_create_cq, when rxe_cq_from_init fails, the function
+rxe_cleanup will be called to handle the allocated resources. In fact,
+some memory resources have already been freed in the function
+rxe_cq_from_init. Thus, this problem will occur.
+
+The solution is to let rxe_cleanup do all the work.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://paste.ubuntu.com/p/tJgC42wDf6/
+Tested-by: liuyi <liuy22@mails.tsinghua.edu.cn>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://patch.msgid.link/20250412075714.3257358-1-yanjun.zhu@linux.dev
+Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_cq.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index fec87c9030abd..fffd144d509eb 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -56,11 +56,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+
+ err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, udata,
+ cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
+- if (err) {
+- vfree(cq->queue->buf);
+- kfree(cq->queue);
++ if (err)
+ return err;
+- }
+
+ cq->is_user = uresp;
+
+--
+2.39.5
+
--- /dev/null
+From 58c6fe2321685a57548cbfe3fc086dd8a26ccbb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 09:49:43 +0300
+Subject: regulator: max20086: fix invalid memory access
+
+From: Cosmin Tanislav <demonsingur@gmail.com>
+
+[ Upstream commit 6b0cd72757c69bc2d45da42b41023e288d02e772 ]
+
+max20086_parse_regulators_dt() calls of_regulator_match() using an
+array of struct of_regulator_match allocated on the stack for the
+matches argument.
+
+of_regulator_match() calls devm_of_regulator_put_matches(), which calls
+devres_alloc() to allocate a struct devm_of_regulator_matches which will
+be de-allocated using devm_of_regulator_put_matches().
+
+struct devm_of_regulator_matches is populated with the stack allocated
+matches array.
+
+If the device fails to probe, devm_of_regulator_put_matches() will be
+called and will try to call of_node_put() on that stack pointer,
+generating the following dmesg entries:
+
+max20086 6-0028: Failed to read DEVICE_ID reg: -121
+kobject: '\xc0$\xa5\x03' (000000002cebcb7a): is not initialized, yet
+kobject_put() is being called.
+
+Followed by a stack trace matching the call flow described above.
+
+Switch to allocating the matches array using devm_kcalloc() to
+avoid accessing the stack pointer long after it's out of scope.
+
+This also has the advantage of allowing multiple max20086 to probe
+without overriding the data stored inside the global of_regulator_match.
+
+Fixes: bfff546aae50 ("regulator: Add MAX20086-MAX20089 driver")
+Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com>
+Link: https://patch.msgid.link/20250508064947.2567255-1-demonsingur@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/max20086-regulator.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/max20086-regulator.c b/drivers/regulator/max20086-regulator.c
+index 59eb23d467ec0..198d45f8e8849 100644
+--- a/drivers/regulator/max20086-regulator.c
++++ b/drivers/regulator/max20086-regulator.c
+@@ -132,7 +132,7 @@ static int max20086_regulators_register(struct max20086 *chip)
+
+ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on)
+ {
+- struct of_regulator_match matches[MAX20086_MAX_REGULATORS] = { };
++ struct of_regulator_match *matches;
+ struct device_node *node;
+ unsigned int i;
+ int ret;
+@@ -143,6 +143,11 @@ static int max20086_parse_regulators_dt(struct max20086 *chip, bool *boot_on)
+ return -ENODEV;
+ }
+
++ matches = devm_kcalloc(chip->dev, chip->info->num_outputs,
++ sizeof(*matches), GFP_KERNEL);
++ if (!matches)
++ return -ENOMEM;
++
+ for (i = 0; i < chip->info->num_outputs; ++i)
+ matches[i].name = max20086_output_names[i];
+
+--
+2.39.5
+
--- /dev/null
+From fcd87bd66823bf3c7a511f4c8b1f9f630c9c03c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 13:00:16 -0400
+Subject: Revert "drm/amd: Stop evicting resources on APUs in suspend"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit d0ce1aaa8531a4a4707711cab5721374751c51b0 ]
+
+This reverts commit 3a9626c816db901def438dc2513622e281186d39.
+
+This breaks S4 because we end up setting the s3/s0ix flags
+even when we are entering s4 since prepare is used by both
+flows. The causes both the S3/s0ix and s4 flags to be set
+which breaks several checks in the driver which assume they
+are mutually exclusive.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3634
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ce8f7d95899c2869b47ea6ce0b3e5bf304b2fff4)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 --
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 18 ------------------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 ++---------
+ 3 files changed, 2 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 8050e0960f5e2..7edf8d67a0fa5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1571,11 +1571,9 @@ static inline void amdgpu_acpi_get_backlight_caps(struct amdgpu_dm_backlight_cap
+ #if defined(CONFIG_ACPI) && defined(CONFIG_SUSPEND)
+ bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev);
+ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev);
+-void amdgpu_choose_low_power_state(struct amdgpu_device *adev);
+ #else
+ static inline bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev) { return false; }
+ static inline bool amdgpu_acpi_is_s3_active(struct amdgpu_device *adev) { return false; }
+-static inline void amdgpu_choose_low_power_state(struct amdgpu_device *adev) { }
+ #endif
+
+ void amdgpu_register_gpu_instance(struct amdgpu_device *adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+index b8d4e07d2043e..bebfbc1497d8e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -1533,22 +1533,4 @@ bool amdgpu_acpi_is_s0ix_active(struct amdgpu_device *adev)
+ #endif /* CONFIG_AMD_PMC */
+ }
+
+-/**
+- * amdgpu_choose_low_power_state
+- *
+- * @adev: amdgpu_device_pointer
+- *
+- * Choose the target low power state for the GPU
+- */
+-void amdgpu_choose_low_power_state(struct amdgpu_device *adev)
+-{
+- if (adev->in_runpm)
+- return;
+-
+- if (amdgpu_acpi_is_s0ix_active(adev))
+- adev->in_s0ix = true;
+- else if (amdgpu_acpi_is_s3_active(adev))
+- adev->in_s3 = true;
+-}
+-
+ #endif /* CONFIG_SUSPEND */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index e6c8426fa06ec..1ed84648733ee 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4770,15 +4770,13 @@ int amdgpu_device_prepare(struct drm_device *dev)
+ struct amdgpu_device *adev = drm_to_adev(dev);
+ int i, r;
+
+- amdgpu_choose_low_power_state(adev);
+-
+ if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ return 0;
+
+ /* Evict the majority of BOs before starting suspend sequence */
+ r = amdgpu_device_evict_resources(adev);
+ if (r)
+- goto unprepare;
++ return r;
+
+ flush_delayed_work(&adev->gfx.gfx_off_delay_work);
+
+@@ -4789,15 +4787,10 @@ int amdgpu_device_prepare(struct drm_device *dev)
+ continue;
+ r = adev->ip_blocks[i].version->funcs->prepare_suspend((void *)adev);
+ if (r)
+- goto unprepare;
++ return r;
+ }
+
+ return 0;
+-
+-unprepare:
+- adev->in_s0ix = adev->in_s3 = adev->in_s4 = false;
+-
+- return r;
+ }
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From 574b84ad3675d194c391b9c0b5c3ed70f41feac3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 17:24:36 +0800
+Subject: riscv: dts: sophgo: fix DMA data-width configuration for CV18xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ze Huang <huangze@whut.edu.cn>
+
+[ Upstream commit 3e6244429ba38f8dee3336b8b805948276b281ab ]
+
+The "snps,data-width" property[1] defines the AXI data width of the DMA
+controller as:
+
+ width = 8 × (2^n) bits
+
+(0 = 8 bits, 1 = 16 bits, 2 = 32 bits, ..., 6 = 512 bits)
+where "n" is the value of "snps,data-width".
+
+For the CV18xx DMA controller, the correct AXI data width is 32 bits,
+corresponding to "snps,data-width = 2".
+
+Test results on Milkv Duo S can be found here [2].
+
+Link: https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/dma/snps%2Cdw-axi-dmac.yaml#L74 [1]
+Link: https://gist.github.com/Sutter099/4fa99bb2d89e5af975983124704b3861 [2]
+
+Fixes: 514951a81a5e ("riscv: dts: sophgo: cv18xx: add DMA controller")
+Co-developed-by: Yu Yuan <yu.yuan@sjtu.edu.cn>
+Signed-off-by: Yu Yuan <yu.yuan@sjtu.edu.cn>
+Signed-off-by: Ze Huang <huangze@whut.edu.cn>
+Link: https://lore.kernel.org/r/20250428-duo-dma-config-v1-1-eb6ad836ca42@whut.edu.cn
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+Signed-off-by: Chen Wang <wangchen20@iscas.ac.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sophgo/cv18xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
+index b724fb6d9689e..b8063ba6d6d7f 100644
+--- a/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
++++ b/arch/riscv/boot/dts/sophgo/cv18xx.dtsi
+@@ -309,7 +309,7 @@
+ 1024 1024 1024 1024>;
+ snps,priority = <0 1 2 3 4 5 6 7>;
+ snps,dma-masters = <2>;
+- snps,data-width = <4>;
++ snps,data-width = <2>;
+ status = "disabled";
+ };
+
+--
+2.39.5
+
--- /dev/null
+From b19ccb5dc4d3d35b83b94fe2514456dc0b3a9ba5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 10:26:33 +0200
+Subject: sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set()
+
+From: Andrea Righi <arighi@nvidia.com>
+
+[ Upstream commit a11d6784d7316a6c77ca9f14fb1a698ebbb3c1fb ]
+
+scx_bpf_cpuperf_set() can be used to set a performance target level on
+any CPU. However, it doesn't correctly acquire the corresponding rq
+lock, which may lead to unsafe behavior and trigger the following
+warning, due to the lockdep_assert_rq_held() check:
+
+[ 51.713737] WARNING: CPU: 3 PID: 3899 at kernel/sched/sched.h:1512 scx_bpf_cpuperf_set+0x1a0/0x1e0
+...
+[ 51.713836] Call trace:
+[ 51.713837] scx_bpf_cpuperf_set+0x1a0/0x1e0 (P)
+[ 51.713839] bpf_prog_62d35beb9301601f_bpfland_init+0x168/0x440
+[ 51.713841] bpf__sched_ext_ops_init+0x54/0x8c
+[ 51.713843] scx_ops_enable.constprop.0+0x2c0/0x10f0
+[ 51.713845] bpf_scx_reg+0x18/0x30
+[ 51.713847] bpf_struct_ops_link_create+0x154/0x1b0
+[ 51.713849] __sys_bpf+0x1934/0x22a0
+
+Fix by properly acquiring the rq lock when possible or raising an error
+if we try to operate on a CPU that is not the one currently locked.
+
+Fixes: d86adb4fc0655 ("sched_ext: Add cpuperf support")
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Acked-by: Changwoo Min <changwoo@igalia.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/ext.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
+index 7ed25654820fd..0147c4452f4df 100644
+--- a/kernel/sched/ext.c
++++ b/kernel/sched/ext.c
+@@ -7018,13 +7018,32 @@ __bpf_kfunc void scx_bpf_cpuperf_set(s32 cpu, u32 perf)
+ }
+
+ if (ops_cpu_valid(cpu, NULL)) {
+- struct rq *rq = cpu_rq(cpu);
++ struct rq *rq = cpu_rq(cpu), *locked_rq = scx_locked_rq();
++ struct rq_flags rf;
++
++ /*
++ * When called with an rq lock held, restrict the operation
++ * to the corresponding CPU to prevent ABBA deadlocks.
++ */
++ if (locked_rq && rq != locked_rq) {
++ scx_ops_error("Invalid target CPU %d", cpu);
++ return;
++ }
++
++ /*
++ * If no rq lock is held, allow to operate on any CPU by
++ * acquiring the corresponding rq lock.
++ */
++ if (!locked_rq) {
++ rq_lock_irqsave(rq, &rf);
++ update_rq_clock(rq);
++ }
+
+ rq->scx.cpuperf_target = perf;
++ cpufreq_update_util(rq, 0);
+
+- rcu_read_lock_sched_notrace();
+- cpufreq_update_util(cpu_rq(cpu), 0);
+- rcu_read_unlock_sched_notrace();
++ if (!locked_rq)
++ rq_unlock_irqrestore(rq, &rf);
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 0da407a691c585dc214f57224fcd4180929f94b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:12:03 -0800
+Subject: selftests: ncdevmem: Make client_ip optional
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 0ebd75f5f2392c2ada04c6e11447415911fe1506 ]
+
+Support 3-tuple filtering by making client_ip optional. When -c is
+not passed, don't specify src-ip/src-port in the filter.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241107181211.3934153-5-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index 4733d1a0aab5d..faa9dce121c72 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -62,7 +62,7 @@
+ */
+
+ static char *server_ip = "192.168.1.4";
+-static char *client_ip = "192.168.1.2";
++static char *client_ip;
+ static char *port = "5201";
+ static size_t do_validation;
+ static int start_queue = 8;
+@@ -236,8 +236,14 @@ static int configure_channels(unsigned int rx, unsigned int tx)
+
+ static int configure_flow_steering(void)
+ {
+- return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d >&2",
+- ifname, client_ip, server_ip, port, port, start_queue);
++ return run_command("sudo ethtool -N %s flow-type tcp4 %s %s dst-ip %s %s %s dst-port %s queue %d >&2",
++ ifname,
++ client_ip ? "src-ip" : "",
++ client_ip ?: "",
++ server_ip,
++ client_ip ? "src-port" : "",
++ client_ip ? port : "",
++ port, start_queue);
+ }
+
+ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd,
+--
+2.39.5
+
--- /dev/null
+From fb439d1b06f5d666e04f9776445ac738bddc8199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:12:00 -0800
+Subject: selftests: ncdevmem: Redirect all non-payload output to stderr
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 6891f0b523e1ef452523ba43d67ca2a654760e78 ]
+
+That should make it possible to do expected payload validation on
+the caller side.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241107181211.3934153-2-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 61 +++++++++++++-------------
+ 1 file changed, 30 insertions(+), 31 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index 64d6805381c50..9245d3f158dd3 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -88,7 +88,6 @@ void print_nonzero_bytes(void *ptr, size_t size)
+
+ for (i = 0; i < size; i++)
+ putchar(p[i]);
+- printf("\n");
+ }
+
+ void validate_buffer(void *line, size_t size)
+@@ -120,7 +119,7 @@ void validate_buffer(void *line, size_t size)
+ char command[256]; \
+ memset(command, 0, sizeof(command)); \
+ snprintf(command, sizeof(command), cmd, ##__VA_ARGS__); \
+- printf("Running: %s\n", command); \
++ fprintf(stderr, "Running: %s\n", command); \
+ system(command); \
+ })
+
+@@ -128,22 +127,22 @@ static int reset_flow_steering(void)
+ {
+ int ret = 0;
+
+- ret = run_command("sudo ethtool -K %s ntuple off", ifname);
++ ret = run_command("sudo ethtool -K %s ntuple off >&2", ifname);
+ if (ret)
+ return ret;
+
+- return run_command("sudo ethtool -K %s ntuple on", ifname);
++ return run_command("sudo ethtool -K %s ntuple on >&2", ifname);
+ }
+
+ static int configure_headersplit(bool on)
+ {
+- return run_command("sudo ethtool -G %s tcp-data-split %s", ifname,
++ return run_command("sudo ethtool -G %s tcp-data-split %s >&2", ifname,
+ on ? "on" : "off");
+ }
+
+ static int configure_rss(void)
+ {
+- return run_command("sudo ethtool -X %s equal %d", ifname, start_queue);
++ return run_command("sudo ethtool -X %s equal %d >&2", ifname, start_queue);
+ }
+
+ static int configure_channels(unsigned int rx, unsigned int tx)
+@@ -153,7 +152,7 @@ static int configure_channels(unsigned int rx, unsigned int tx)
+
+ static int configure_flow_steering(void)
+ {
+- return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d",
++ return run_command("sudo ethtool -N %s flow-type tcp4 src-ip %s dst-ip %s src-port %s dst-port %s queue %d >&2",
+ ifname, client_ip, server_ip, port, port, start_queue);
+ }
+
+@@ -187,7 +186,7 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd,
+ goto err_close;
+ }
+
+- printf("got dmabuf id=%d\n", rsp->id);
++ fprintf(stderr, "got dmabuf id=%d\n", rsp->id);
+ dmabuf_id = rsp->id;
+
+ netdev_bind_rx_req_free(req);
+@@ -314,8 +313,8 @@ int do_server(void)
+ if (ret)
+ error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
+
+- printf("binding to address %s:%d\n", server_ip,
+- ntohs(server_sin.sin_port));
++ fprintf(stderr, "binding to address %s:%d\n", server_ip,
++ ntohs(server_sin.sin_port));
+
+ ret = bind(socket_fd, &server_sin, sizeof(server_sin));
+ if (ret)
+@@ -329,14 +328,14 @@ int do_server(void)
+
+ inet_ntop(server_sin.sin_family, &server_sin.sin_addr, buffer,
+ sizeof(buffer));
+- printf("Waiting or connection on %s:%d\n", buffer,
+- ntohs(server_sin.sin_port));
++ fprintf(stderr, "Waiting or connection on %s:%d\n", buffer,
++ ntohs(server_sin.sin_port));
+ client_fd = accept(socket_fd, &client_addr, &client_addr_len);
+
+ inet_ntop(client_addr.sin_family, &client_addr.sin_addr, buffer,
+ sizeof(buffer));
+- printf("Got connection from %s:%d\n", buffer,
+- ntohs(client_addr.sin_port));
++ fprintf(stderr, "Got connection from %s:%d\n", buffer,
++ ntohs(client_addr.sin_port));
+
+ while (1) {
+ struct iovec iov = { .iov_base = iobuf,
+@@ -349,14 +348,13 @@ int do_server(void)
+ ssize_t ret;
+
+ is_devmem = false;
+- printf("\n\n");
+
+ msg.msg_iov = &iov;
+ msg.msg_iovlen = 1;
+ msg.msg_control = ctrl_data;
+ msg.msg_controllen = sizeof(ctrl_data);
+ ret = recvmsg(client_fd, &msg, MSG_SOCK_DEVMEM);
+- printf("recvmsg ret=%ld\n", ret);
++ fprintf(stderr, "recvmsg ret=%ld\n", ret);
+ if (ret < 0 && (errno == EAGAIN || errno == EWOULDBLOCK))
+ continue;
+ if (ret < 0) {
+@@ -364,7 +362,7 @@ int do_server(void)
+ continue;
+ }
+ if (ret == 0) {
+- printf("client exited\n");
++ fprintf(stderr, "client exited\n");
+ goto cleanup;
+ }
+
+@@ -373,7 +371,7 @@ int do_server(void)
+ if (cm->cmsg_level != SOL_SOCKET ||
+ (cm->cmsg_type != SCM_DEVMEM_DMABUF &&
+ cm->cmsg_type != SCM_DEVMEM_LINEAR)) {
+- fprintf(stdout, "skipping non-devmem cmsg\n");
++ fprintf(stderr, "skipping non-devmem cmsg\n");
+ continue;
+ }
+
+@@ -384,7 +382,7 @@ int do_server(void)
+ /* TODO: process data copied from skb's linear
+ * buffer.
+ */
+- fprintf(stdout,
++ fprintf(stderr,
+ "SCM_DEVMEM_LINEAR. dmabuf_cmsg->frag_size=%u\n",
+ dmabuf_cmsg->frag_size);
+
+@@ -395,12 +393,13 @@ int do_server(void)
+ token.token_count = 1;
+
+ total_received += dmabuf_cmsg->frag_size;
+- printf("received frag_page=%llu, in_page_offset=%llu, frag_offset=%llu, frag_size=%u, token=%u, total_received=%lu, dmabuf_id=%u\n",
+- dmabuf_cmsg->frag_offset >> PAGE_SHIFT,
+- dmabuf_cmsg->frag_offset % getpagesize(),
+- dmabuf_cmsg->frag_offset, dmabuf_cmsg->frag_size,
+- dmabuf_cmsg->frag_token, total_received,
+- dmabuf_cmsg->dmabuf_id);
++ fprintf(stderr,
++ "received frag_page=%llu, in_page_offset=%llu, frag_offset=%llu, frag_size=%u, token=%u, total_received=%lu, dmabuf_id=%u\n",
++ dmabuf_cmsg->frag_offset >> PAGE_SHIFT,
++ dmabuf_cmsg->frag_offset % getpagesize(),
++ dmabuf_cmsg->frag_offset,
++ dmabuf_cmsg->frag_size, dmabuf_cmsg->frag_token,
++ total_received, dmabuf_cmsg->dmabuf_id);
+
+ if (dmabuf_cmsg->dmabuf_id != dmabuf_id)
+ error(1, 0,
+@@ -438,15 +437,15 @@ int do_server(void)
+ if (!is_devmem)
+ error(1, 0, "flow steering error\n");
+
+- printf("total_received=%lu\n", total_received);
++ fprintf(stderr, "total_received=%lu\n", total_received);
+ }
+
+- fprintf(stdout, "%s: ok\n", TEST_PREFIX);
++ fprintf(stderr, "%s: ok\n", TEST_PREFIX);
+
+- fprintf(stdout, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n",
++ fprintf(stderr, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n",
+ page_aligned_frags, non_page_aligned_frags);
+
+- fprintf(stdout, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n",
++ fprintf(stderr, "page_aligned_frags=%lu, non_page_aligned_frags=%lu\n",
+ page_aligned_frags, non_page_aligned_frags);
+
+ cleanup:
+@@ -551,7 +550,7 @@ int main(int argc, char *argv[])
+ ifname = optarg;
+ break;
+ case '?':
+- printf("unknown option: %c\n", optopt);
++ fprintf(stderr, "unknown option: %c\n", optopt);
+ break;
+ }
+ }
+@@ -559,7 +558,7 @@ int main(int argc, char *argv[])
+ ifindex = if_nametoindex(ifname);
+
+ for (; optind < argc; optind++)
+- printf("extra arguments: %s\n", argv[optind]);
++ fprintf(stderr, "extra arguments: %s\n", argv[optind]);
+
+ run_devmem_tests();
+
+--
+2.39.5
+
--- /dev/null
+From 21cc6cabde4349a8d2a4b2e3d33216dd268a0956 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:12:01 -0800
+Subject: selftests: ncdevmem: Separate out dmabuf provider
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 8b9049af8066b4705d83bb7847ee3c960fc58d09 ]
+
+So we can plug the other ones in the future if needed.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241107181211.3934153-3-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 203 +++++++++++++++----------
+ 1 file changed, 119 insertions(+), 84 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index 9245d3f158dd3..3e7ef2eedd60b 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -71,17 +71,101 @@ static char *ifname = "eth1";
+ static unsigned int ifindex;
+ static unsigned int dmabuf_id;
+
+-void print_bytes(void *ptr, size_t size)
++struct memory_buffer {
++ int fd;
++ size_t size;
++
++ int devfd;
++ int memfd;
++ char *buf_mem;
++};
++
++struct memory_provider {
++ struct memory_buffer *(*alloc)(size_t size);
++ void (*free)(struct memory_buffer *ctx);
++ void (*memcpy_from_device)(void *dst, struct memory_buffer *src,
++ size_t off, int n);
++};
++
++static struct memory_buffer *udmabuf_alloc(size_t size)
+ {
+- unsigned char *p = ptr;
+- int i;
++ struct udmabuf_create create;
++ struct memory_buffer *ctx;
++ int ret;
+
+- for (i = 0; i < size; i++)
+- printf("%02hhX ", p[i]);
+- printf("\n");
++ ctx = malloc(sizeof(*ctx));
++ if (!ctx)
++ error(1, ENOMEM, "malloc failed");
++
++ ctx->size = size;
++
++ ctx->devfd = open("/dev/udmabuf", O_RDWR);
++ if (ctx->devfd < 0)
++ error(1, errno,
++ "%s: [skip,no-udmabuf: Unable to access DMA buffer device file]\n",
++ TEST_PREFIX);
++
++ ctx->memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
++ if (ctx->memfd < 0)
++ error(1, errno, "%s: [skip,no-memfd]\n", TEST_PREFIX);
++
++ ret = fcntl(ctx->memfd, F_ADD_SEALS, F_SEAL_SHRINK);
++ if (ret < 0)
++ error(1, errno, "%s: [skip,fcntl-add-seals]\n", TEST_PREFIX);
++
++ ret = ftruncate(ctx->memfd, size);
++ if (ret == -1)
++ error(1, errno, "%s: [FAIL,memfd-truncate]\n", TEST_PREFIX);
++
++ memset(&create, 0, sizeof(create));
++
++ create.memfd = ctx->memfd;
++ create.offset = 0;
++ create.size = size;
++ ctx->fd = ioctl(ctx->devfd, UDMABUF_CREATE, &create);
++ if (ctx->fd < 0)
++ error(1, errno, "%s: [FAIL, create udmabuf]\n", TEST_PREFIX);
++
++ ctx->buf_mem = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED,
++ ctx->fd, 0);
++ if (ctx->buf_mem == MAP_FAILED)
++ error(1, errno, "%s: [FAIL, map udmabuf]\n", TEST_PREFIX);
++
++ return ctx;
++}
++
++static void udmabuf_free(struct memory_buffer *ctx)
++{
++ munmap(ctx->buf_mem, ctx->size);
++ close(ctx->fd);
++ close(ctx->memfd);
++ close(ctx->devfd);
++ free(ctx);
+ }
+
+-void print_nonzero_bytes(void *ptr, size_t size)
++static void udmabuf_memcpy_from_device(void *dst, struct memory_buffer *src,
++ size_t off, int n)
++{
++ struct dma_buf_sync sync = {};
++
++ sync.flags = DMA_BUF_SYNC_START;
++ ioctl(src->fd, DMA_BUF_IOCTL_SYNC, &sync);
++
++ memcpy(dst, src->buf_mem + off, n);
++
++ sync.flags = DMA_BUF_SYNC_END;
++ ioctl(src->fd, DMA_BUF_IOCTL_SYNC, &sync);
++}
++
++static struct memory_provider udmabuf_memory_provider = {
++ .alloc = udmabuf_alloc,
++ .free = udmabuf_free,
++ .memcpy_from_device = udmabuf_memcpy_from_device,
++};
++
++static struct memory_provider *provider = &udmabuf_memory_provider;
++
++static void print_nonzero_bytes(void *ptr, size_t size)
+ {
+ unsigned char *p = ptr;
+ unsigned int i;
+@@ -201,42 +285,7 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd,
+ return -1;
+ }
+
+-static void create_udmabuf(int *devfd, int *memfd, int *buf, size_t dmabuf_size)
+-{
+- struct udmabuf_create create;
+- int ret;
+-
+- *devfd = open("/dev/udmabuf", O_RDWR);
+- if (*devfd < 0) {
+- error(70, 0,
+- "%s: [skip,no-udmabuf: Unable to access DMA buffer device file]\n",
+- TEST_PREFIX);
+- }
+-
+- *memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
+- if (*memfd < 0)
+- error(70, 0, "%s: [skip,no-memfd]\n", TEST_PREFIX);
+-
+- /* Required for udmabuf */
+- ret = fcntl(*memfd, F_ADD_SEALS, F_SEAL_SHRINK);
+- if (ret < 0)
+- error(73, 0, "%s: [skip,fcntl-add-seals]\n", TEST_PREFIX);
+-
+- ret = ftruncate(*memfd, dmabuf_size);
+- if (ret == -1)
+- error(74, 0, "%s: [FAIL,memfd-truncate]\n", TEST_PREFIX);
+-
+- memset(&create, 0, sizeof(create));
+-
+- create.memfd = *memfd;
+- create.offset = 0;
+- create.size = dmabuf_size;
+- *buf = ioctl(*devfd, UDMABUF_CREATE, &create);
+- if (*buf < 0)
+- error(75, 0, "%s: [FAIL, create udmabuf]\n", TEST_PREFIX);
+-}
+-
+-int do_server(void)
++int do_server(struct memory_buffer *mem)
+ {
+ char ctrl_data[sizeof(int) * 20000];
+ struct netdev_queue_id *queues;
+@@ -244,23 +293,18 @@ int do_server(void)
+ struct sockaddr_in client_addr;
+ struct sockaddr_in server_sin;
+ size_t page_aligned_frags = 0;
+- int devfd, memfd, buf, ret;
+ size_t total_received = 0;
+ socklen_t client_addr_len;
+ bool is_devmem = false;
+- char *buf_mem = NULL;
++ char *tmp_mem = NULL;
+ struct ynl_sock *ys;
+- size_t dmabuf_size;
+ char iobuf[819200];
+ char buffer[256];
+ int socket_fd;
+ int client_fd;
+ size_t i = 0;
+ int opt = 1;
+-
+- dmabuf_size = getpagesize() * NUM_PAGES;
+-
+- create_udmabuf(&devfd, &memfd, &buf, dmabuf_size);
++ int ret;
+
+ if (reset_flow_steering())
+ error(1, 0, "Failed to reset flow steering\n");
+@@ -284,13 +328,12 @@ int do_server(void)
+ queues[i].id = start_queue + i;
+ }
+
+- if (bind_rx_queue(ifindex, buf, queues, num_queues, &ys))
++ if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
+ error(1, 0, "Failed to bind\n");
+
+- buf_mem = mmap(NULL, dmabuf_size, PROT_READ | PROT_WRITE, MAP_SHARED,
+- buf, 0);
+- if (buf_mem == MAP_FAILED)
+- error(1, 0, "mmap()");
++ tmp_mem = malloc(mem->size);
++ if (!tmp_mem)
++ error(1, ENOMEM, "malloc failed");
+
+ server_sin.sin_family = AF_INET;
+ server_sin.sin_port = htons(atoi(port));
+@@ -341,7 +384,6 @@ int do_server(void)
+ struct iovec iov = { .iov_base = iobuf,
+ .iov_len = sizeof(iobuf) };
+ struct dmabuf_cmsg *dmabuf_cmsg = NULL;
+- struct dma_buf_sync sync = { 0 };
+ struct cmsghdr *cm = NULL;
+ struct msghdr msg = { 0 };
+ struct dmabuf_token token;
+@@ -410,22 +452,16 @@ int do_server(void)
+ else
+ page_aligned_frags++;
+
+- sync.flags = DMA_BUF_SYNC_READ | DMA_BUF_SYNC_START;
+- ioctl(buf, DMA_BUF_IOCTL_SYNC, &sync);
++ provider->memcpy_from_device(tmp_mem, mem,
++ dmabuf_cmsg->frag_offset,
++ dmabuf_cmsg->frag_size);
+
+ if (do_validation)
+- validate_buffer(
+- ((unsigned char *)buf_mem) +
+- dmabuf_cmsg->frag_offset,
+- dmabuf_cmsg->frag_size);
++ validate_buffer(tmp_mem,
++ dmabuf_cmsg->frag_size);
+ else
+- print_nonzero_bytes(
+- ((unsigned char *)buf_mem) +
+- dmabuf_cmsg->frag_offset,
+- dmabuf_cmsg->frag_size);
+-
+- sync.flags = DMA_BUF_SYNC_READ | DMA_BUF_SYNC_END;
+- ioctl(buf, DMA_BUF_IOCTL_SYNC, &sync);
++ print_nonzero_bytes(tmp_mem,
++ dmabuf_cmsg->frag_size);
+
+ ret = setsockopt(client_fd, SOL_SOCKET,
+ SO_DEVMEM_DONTNEED, &token,
+@@ -450,12 +486,9 @@ int do_server(void)
+
+ cleanup:
+
+- munmap(buf_mem, dmabuf_size);
++ free(tmp_mem);
+ close(client_fd);
+ close(socket_fd);
+- close(buf);
+- close(memfd);
+- close(devfd);
+ ynl_sock_destroy(ys);
+
+ return 0;
+@@ -464,14 +497,11 @@ int do_server(void)
+ void run_devmem_tests(void)
+ {
+ struct netdev_queue_id *queues;
+- int devfd, memfd, buf;
++ struct memory_buffer *mem;
+ struct ynl_sock *ys;
+- size_t dmabuf_size;
+ size_t i = 0;
+
+- dmabuf_size = getpagesize() * NUM_PAGES;
+-
+- create_udmabuf(&devfd, &memfd, &buf, dmabuf_size);
++ mem = provider->alloc(getpagesize() * NUM_PAGES);
+
+ /* Configure RSS to divert all traffic from our devmem queues */
+ if (configure_rss())
+@@ -482,7 +512,7 @@ void run_devmem_tests(void)
+ if (configure_headersplit(1))
+ error(1, 0, "Failed to configure header split\n");
+
+- if (!bind_rx_queue(ifindex, buf, queues, num_queues, &ys))
++ if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
+ error(1, 0, "Binding empty queues array should have failed\n");
+
+ for (i = 0; i < num_queues; i++) {
+@@ -495,7 +525,7 @@ void run_devmem_tests(void)
+ if (configure_headersplit(0))
+ error(1, 0, "Failed to configure header split\n");
+
+- if (!bind_rx_queue(ifindex, buf, queues, num_queues, &ys))
++ if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
+ error(1, 0, "Configure dmabuf with header split off should have failed\n");
+
+ if (configure_headersplit(1))
+@@ -508,7 +538,7 @@ void run_devmem_tests(void)
+ queues[i].id = start_queue + i;
+ }
+
+- if (bind_rx_queue(ifindex, buf, queues, num_queues, &ys))
++ if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
+ error(1, 0, "Failed to bind\n");
+
+ /* Deactivating a bound queue should not be legal */
+@@ -517,11 +547,15 @@ void run_devmem_tests(void)
+
+ /* Closing the netlink socket does an implicit unbind */
+ ynl_sock_destroy(ys);
++
++ provider->free(mem);
+ }
+
+ int main(int argc, char *argv[])
+ {
++ struct memory_buffer *mem;
+ int is_server = 0, opt;
++ int ret;
+
+ while ((opt = getopt(argc, argv, "ls:c:p:v:q:t:f:")) != -1) {
+ switch (opt) {
+@@ -562,8 +596,9 @@ int main(int argc, char *argv[])
+
+ run_devmem_tests();
+
+- if (is_server)
+- return do_server();
++ mem = provider->alloc(getpagesize() * NUM_PAGES);
++ ret = is_server ? do_server(mem) : 1;
++ provider->free(mem);
+
+- return 0;
++ return ret;
+ }
+--
+2.39.5
+
--- /dev/null
+From 64d0a5fa81ef68462d0bc4138d50b0f070db8dea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:12:05 -0800
+Subject: selftests: ncdevmem: Switch to AF_INET6
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 933056357a8cf0c9b3fb2ecc4d2d8d142614f0a3 ]
+
+Use dualstack socket to support both v4 and v6. v4-mapped-v6 address
+can be used to do v4.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241107181211.3934153-7-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 97 ++++++++++++++++++--------
+ 1 file changed, 68 insertions(+), 29 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index faa9dce121c72..7c671b246d80f 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -234,13 +234,26 @@ static int configure_channels(unsigned int rx, unsigned int tx)
+ return run_command("sudo ethtool -L %s rx %u tx %u", ifname, rx, tx);
+ }
+
+-static int configure_flow_steering(void)
++static int configure_flow_steering(struct sockaddr_in6 *server_sin)
+ {
+- return run_command("sudo ethtool -N %s flow-type tcp4 %s %s dst-ip %s %s %s dst-port %s queue %d >&2",
++ const char *type = "tcp6";
++ const char *server_addr;
++ char buf[40];
++
++ inet_ntop(AF_INET6, &server_sin->sin6_addr, buf, sizeof(buf));
++ server_addr = buf;
++
++ if (IN6_IS_ADDR_V4MAPPED(&server_sin->sin6_addr)) {
++ type = "tcp4";
++ server_addr = strrchr(server_addr, ':') + 1;
++ }
++
++ return run_command("sudo ethtool -N %s flow-type %s %s %s dst-ip %s %s %s dst-port %s queue %d >&2",
+ ifname,
++ type,
+ client_ip ? "src-ip" : "",
+ client_ip ?: "",
+- server_ip,
++ server_addr,
+ client_ip ? "src-port" : "",
+ client_ip ? port : "",
+ port, start_queue);
+@@ -291,13 +304,51 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd,
+ return -1;
+ }
+
++static void enable_reuseaddr(int fd)
++{
++ int opt = 1;
++ int ret;
++
++ ret = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt));
++ if (ret)
++ error(1, errno, "%s: [FAIL, SO_REUSEPORT]\n", TEST_PREFIX);
++
++ ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
++ if (ret)
++ error(1, errno, "%s: [FAIL, SO_REUSEADDR]\n", TEST_PREFIX);
++}
++
++static int parse_address(const char *str, int port, struct sockaddr_in6 *sin6)
++{
++ int ret;
++
++ sin6->sin6_family = AF_INET6;
++ sin6->sin6_port = htons(port);
++
++ ret = inet_pton(sin6->sin6_family, str, &sin6->sin6_addr);
++ if (ret != 1) {
++ /* fallback to plain IPv4 */
++ ret = inet_pton(AF_INET, str, &sin6->sin6_addr.s6_addr32[3]);
++ if (ret != 1)
++ return -1;
++
++ /* add ::ffff prefix */
++ sin6->sin6_addr.s6_addr32[0] = 0;
++ sin6->sin6_addr.s6_addr32[1] = 0;
++ sin6->sin6_addr.s6_addr16[4] = 0;
++ sin6->sin6_addr.s6_addr16[5] = 0xffff;
++ }
++
++ return 0;
++}
++
+ int do_server(struct memory_buffer *mem)
+ {
+ char ctrl_data[sizeof(int) * 20000];
+ struct netdev_queue_id *queues;
+ size_t non_page_aligned_frags = 0;
+- struct sockaddr_in client_addr;
+- struct sockaddr_in server_sin;
++ struct sockaddr_in6 client_addr;
++ struct sockaddr_in6 server_sin;
+ size_t page_aligned_frags = 0;
+ size_t total_received = 0;
+ socklen_t client_addr_len;
+@@ -309,9 +360,12 @@ int do_server(struct memory_buffer *mem)
+ int socket_fd;
+ int client_fd;
+ size_t i = 0;
+- int opt = 1;
+ int ret;
+
++ ret = parse_address(server_ip, atoi(port), &server_sin);
++ if (ret < 0)
++ error(1, 0, "parse server address");
++
+ if (reset_flow_steering())
+ error(1, 0, "Failed to reset flow steering\n");
+
+@@ -320,7 +374,7 @@ int do_server(struct memory_buffer *mem)
+ error(1, 0, "Failed to configure rss\n");
+
+ /* Flow steer our devmem flows to start_queue */
+- if (configure_flow_steering())
++ if (configure_flow_steering(&server_sin))
+ error(1, 0, "Failed to configure flow steering\n");
+
+ sleep(1);
+@@ -341,29 +395,14 @@ int do_server(struct memory_buffer *mem)
+ if (!tmp_mem)
+ error(1, ENOMEM, "malloc failed");
+
+- server_sin.sin_family = AF_INET;
+- server_sin.sin_port = htons(atoi(port));
+-
+- ret = inet_pton(server_sin.sin_family, server_ip, &server_sin.sin_addr);
+- if (ret < 0)
+- error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX);
+-
+- socket_fd = socket(server_sin.sin_family, SOCK_STREAM, 0);
++ socket_fd = socket(AF_INET6, SOCK_STREAM, 0);
+ if (socket_fd < 0)
+ error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX);
+
+- ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEPORT, &opt,
+- sizeof(opt));
+- if (ret)
+- error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
+-
+- ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEADDR, &opt,
+- sizeof(opt));
+- if (ret)
+- error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
++ enable_reuseaddr(socket_fd);
+
+ fprintf(stderr, "binding to address %s:%d\n", server_ip,
+- ntohs(server_sin.sin_port));
++ ntohs(server_sin.sin6_port));
+
+ ret = bind(socket_fd, &server_sin, sizeof(server_sin));
+ if (ret)
+@@ -375,16 +414,16 @@ int do_server(struct memory_buffer *mem)
+
+ client_addr_len = sizeof(client_addr);
+
+- inet_ntop(server_sin.sin_family, &server_sin.sin_addr, buffer,
++ inet_ntop(AF_INET6, &server_sin.sin6_addr, buffer,
+ sizeof(buffer));
+ fprintf(stderr, "Waiting or connection on %s:%d\n", buffer,
+- ntohs(server_sin.sin_port));
++ ntohs(server_sin.sin6_port));
+ client_fd = accept(socket_fd, &client_addr, &client_addr_len);
+
+- inet_ntop(client_addr.sin_family, &client_addr.sin_addr, buffer,
++ inet_ntop(AF_INET6, &client_addr.sin6_addr, buffer,
+ sizeof(buffer));
+ fprintf(stderr, "Got connection from %s:%d\n", buffer,
+- ntohs(client_addr.sin_port));
++ ntohs(client_addr.sin6_port));
+
+ while (1) {
+ struct iovec iov = { .iov_base = iobuf,
+--
+2.39.5
+
--- /dev/null
+From ebc7c38fb20bc37caa9dbf07a0ffe6bd6f20033d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:12:02 -0800
+Subject: selftests: ncdevmem: Unify error handling
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit bfccbaac1b45f9af7d76589d7e31ad921b50c0d7 ]
+
+There is a bunch of places where error() calls look out of place.
+Use the same error(1, errno, ...) pattern everywhere.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20241107181211.3934153-4-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 97c4e094a4b2 ("tests/ncdevmem: Fix double-free of queue array")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index 3e7ef2eedd60b..4733d1a0aab5d 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -339,33 +339,33 @@ int do_server(struct memory_buffer *mem)
+ server_sin.sin_port = htons(atoi(port));
+
+ ret = inet_pton(server_sin.sin_family, server_ip, &server_sin.sin_addr);
+- if (socket < 0)
+- error(79, 0, "%s: [FAIL, create socket]\n", TEST_PREFIX);
++ if (ret < 0)
++ error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX);
+
+ socket_fd = socket(server_sin.sin_family, SOCK_STREAM, 0);
+- if (socket < 0)
+- error(errno, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX);
++ if (socket_fd < 0)
++ error(1, errno, "%s: [FAIL, create socket]\n", TEST_PREFIX);
+
+ ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEPORT, &opt,
+ sizeof(opt));
+ if (ret)
+- error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
++ error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
+
+ ret = setsockopt(socket_fd, SOL_SOCKET, SO_REUSEADDR, &opt,
+ sizeof(opt));
+ if (ret)
+- error(errno, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
++ error(1, errno, "%s: [FAIL, set sock opt]\n", TEST_PREFIX);
+
+ fprintf(stderr, "binding to address %s:%d\n", server_ip,
+ ntohs(server_sin.sin_port));
+
+ ret = bind(socket_fd, &server_sin, sizeof(server_sin));
+ if (ret)
+- error(errno, errno, "%s: [FAIL, bind]\n", TEST_PREFIX);
++ error(1, errno, "%s: [FAIL, bind]\n", TEST_PREFIX);
+
+ ret = listen(socket_fd, 1);
+ if (ret)
+- error(errno, errno, "%s: [FAIL, listen]\n", TEST_PREFIX);
++ error(1, errno, "%s: [FAIL, listen]\n", TEST_PREFIX);
+
+ client_addr_len = sizeof(client_addr);
+
+--
+2.39.5
+
--- /dev/null
+sched_ext-fix-missing-rq-lock-in-scx_bpf_cpuperf_set.patch
+arm64-dts-rockchip-assign-rt5616-mclk-rate-on-rk3588.patch
+fs-xattr.c-fix-simple_xattr_list-to-always-include-s.patch
+drivers-platform-x86-amd-pmf-check-for-invalid-sidel.patch
+drivers-platform-x86-amd-pmf-check-for-invalid-smart.patch
+riscv-dts-sophgo-fix-dma-data-width-configuration-fo.patch
+binfmt_elf-move-brk-for-static-pie-even-if-aslr-disa.patch
+platform-x86-amd-pmc-declare-quirk_spurious_8042-for.patch
+platform-x86-asus-wmi-fix-wlan_ctrl_by_user-detectio.patch
+arm64-dts-imx8mp-var-som-fix-ldo5-shutdown-causing-s.patch
+cgroup-cpuset-extend-kthread_is_per_cpu-check-to-all.patch
+tracing-probes-fix-a-possible-race-in-trace_probe_lo.patch
+tpm-tis-double-the-timeout-b-to-4s.patch
+sysfs-explicitly-pass-size-to-sysfs_add_bin_file_mod.patch
+sysfs-introduce-callback-attribute_group-bin_size.patch
+pci-sysfs-calculate-bin_attribute-size-through-bin_s.patch
+nvmem-core-calculate-bin_attribute-size-through-bin_.patch
+sysfs-treewide-constify-attribute-callback-of-bin_is.patch
+sysfs-treewide-constify-attribute-callback-of-bin_at.patch
+uio_hv_generic-fix-sysfs-creation-path-for-ring-buff.patch
+kvm-add-member-to-struct-kvm_gfn_range-to-indicate-p.patch
+kvm-x86-mmu-prevent-installing-hugepages-when-mem-at.patch
+iio-adc-ad7266-fix-potential-timestamp-alignment-iss.patch
+iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch
+iio-pressure-mprls0025pa-use-aligned_s64-for-timesta.patch
+drm-amd-add-suspend-hibernate-notification-callback-.patch
+revert-drm-amd-stop-evicting-resources-on-apus-in-su.patch
+xhci-dbc-improve-performance-by-removing-delay-in-tr.patch
+xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-.patch
+iio-adc-ad7768-1-fix-insufficient-alignment-of-times.patch
+iio-chemical-sps30-use-aligned_s64-for-timestamp.patch
+virtio_ring-add-a-func-argument-recycle_done-to-virt.patch
+virtio_net-ensure-netdev_tx_reset_queue-is-called-on.patch
+rdma-rxe-fix-slab-use-after-free-read-in-rxe_queue_c.patch
+hid-thrustmaster-fix-memory-leak-in-thrustmaster_int.patch
+hid-uclogic-add-null-check-in-uclogic_input_configur.patch
+nfs-handle-failure-of-nfs_get_lock_context-in-unlock.patch
+spi-loopback-test-do-not-split-1024-byte-hexdumps.patch
+rdma-core-fix-kasan-slab-use-after-free-read-in-ib_r.patch
+bluetooth-mgmt-fix-mgmt_op_add_device-invalid-device.patch
+net_sched-flush-gso_skb-list-too-during-change.patch
+tools-net-ynl-ethtool-fix-crash-when-hardware-clock-.patch
+mctp-no-longer-rely-on-net-dev_index_head.patch
+net-mctp-don-t-access-ifa_index-when-missing.patch
+selftests-ncdevmem-redirect-all-non-payload-output-t.patch
+selftests-ncdevmem-separate-out-dmabuf-provider.patch
+selftests-ncdevmem-unify-error-handling.patch
+selftests-ncdevmem-make-client_ip-optional.patch
+selftests-ncdevmem-switch-to-af_inet6.patch
+tests-ncdevmem-fix-double-free-of-queue-array.patch
+net-mctp-ensure-keys-maintain-only-one-ref-to-corres.patch
+alsa-seq-fix-delivery-of-ump-events-to-group-ports.patch
+alsa-ump-fix-a-typo-of-snd_ump_stream_msg_device_inf.patch
+net-cadence-macb-fix-a-possible-deadlock-in-macb_hal.patch
+net-dsa-sja1105-discard-incoming-frames-in-br_state_.patch
+nvme-pci-make-nvme_pci_npages_prp-__always_inline.patch
+nvme-pci-acquire-cq_poll_lock-in-nvme_poll_irqdisabl.patch
+alsa-sh-snd_aica-should-depend-on-sh_dma_api.patch
+net-dsa-b53-prevent-standalone-from-trying-to-forwar.patch
+vsock-test-fix-occasional-failure-in-siocoutq-tests.patch
+net-mlx5e-disable-macsec-offload-for-uplink-represen.patch
+qlcnic-fix-memory-leak-in-qlcnic_sriov_channel_cfg_c.patch
+regulator-max20086-fix-invalid-memory-access.patch
+drm-xe-save-ctx_timestamp-mmio-value-instead-of-lrc-.patch
+netlink-specs-tc-fix-a-couple-of-attribute-names.patch
+netlink-specs-tc-all-actions-are-indexed-arrays.patch
+octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch
+net-ethernet-mtk_eth_soc-fix-typo-for-declaration-mt.patch
+octeontx2-af-fix-cgx-receive-counters.patch
+octeontx2-pf-do-not-reallocate-all-ntuple-filters.patch
+wifi-mac80211-set-n_channels-after-allocating-struct.patch
+mlxsw-spectrum_router-fix-use-after-free-when-deleti.patch
+net-tls-fix-kernel-panic-when-alloc_page-failed.patch
+tsnep-fix-timestamping-with-a-stacked-dsa-driver.patch
+nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch
--- /dev/null
+From 4fcddc27f32e13e37f36406874f00180db6e682e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 May 2025 13:10:35 +0200
+Subject: spi: loopback-test: Do not split 1024-byte hexdumps
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a73fa3690a1f3014d6677e368dce4e70767a6ba2 ]
+
+spi_test_print_hex_dump() prints buffers holding less than 1024 bytes in
+full. Larger buffers are truncated: only the first 512 and the last 512
+bytes are printed, separated by a truncation message. The latter is
+confusing in case the buffer holds exactly 1024 bytes, as all data is
+printed anyway.
+
+Fix this by printing buffers holding up to and including 1024 bytes in
+full.
+
+Fixes: 84e0c4e5e2c4ef42 ("spi: add loopback test driver to allow for spi_master regression tests")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/37ee1bc90c6554c9347040adabf04188c8f704aa.1746184171.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-loopback-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index 31a878d9458d9..7740f94847a88 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -420,7 +420,7 @@ MODULE_LICENSE("GPL");
+ static void spi_test_print_hex_dump(char *pre, const void *ptr, size_t len)
+ {
+ /* limit the hex_dump */
+- if (len < 1024) {
++ if (len <= 1024) {
+ print_hex_dump(KERN_INFO, pre,
+ DUMP_PREFIX_OFFSET, 16, 1,
+ ptr, len, 0);
+--
+2.39.5
+
--- /dev/null
+From a306c38bd23f3a59dbc618fc44a3a8ccb430185b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:30 +0000
+Subject: sysfs: explicitly pass size to sysfs_add_bin_file_mode_ns()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 0afcee132bbc9d7ef9c5bb4da9b6fe014a9afaa9 ]
+
+Upcoming changes to the sysfs core require the size of the created file
+to be overridable by the caller.
+Add a parameter to enable this.
+For now keep using attr->size in all cases.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-1-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/sysfs/file.c | 8 ++++----
+ fs/sysfs/group.c | 3 ++-
+ fs/sysfs/sysfs.h | 2 +-
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index d1995e2d6c943..6d39696b43069 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -315,7 +315,7 @@ int sysfs_add_file_mode_ns(struct kernfs_node *parent,
+ }
+
+ int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent,
+- const struct bin_attribute *battr, umode_t mode,
++ const struct bin_attribute *battr, umode_t mode, size_t size,
+ kuid_t uid, kgid_t gid, const void *ns)
+ {
+ const struct attribute *attr = &battr->attr;
+@@ -340,7 +340,7 @@ int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent,
+ #endif
+
+ kn = __kernfs_create_file(parent, attr->name, mode & 0777, uid, gid,
+- battr->size, ops, (void *)attr, ns, key);
++ size, ops, (void *)attr, ns, key);
+ if (IS_ERR(kn)) {
+ if (PTR_ERR(kn) == -EEXIST)
+ sysfs_warn_dup(parent, attr->name);
+@@ -580,8 +580,8 @@ int sysfs_create_bin_file(struct kobject *kobj,
+ return -EINVAL;
+
+ kobject_get_ownership(kobj, &uid, &gid);
+- return sysfs_add_bin_file_mode_ns(kobj->sd, attr, attr->attr.mode, uid,
+- gid, NULL);
++ return sysfs_add_bin_file_mode_ns(kobj->sd, attr, attr->attr.mode,
++ attr->size, uid, gid, NULL);
+ }
+ EXPORT_SYMBOL_GPL(sysfs_create_bin_file);
+
+diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
+index d22ad67a0f329..45b2e92941da1 100644
+--- a/fs/sysfs/group.c
++++ b/fs/sysfs/group.c
+@@ -87,6 +87,7 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj,
+ if (grp->bin_attrs) {
+ for (i = 0, bin_attr = grp->bin_attrs; *bin_attr; i++, bin_attr++) {
+ umode_t mode = (*bin_attr)->attr.mode;
++ size_t size = (*bin_attr)->size;
+
+ if (update)
+ kernfs_remove_by_name(parent,
+@@ -104,7 +105,7 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj,
+
+ mode &= SYSFS_PREALLOC | 0664;
+ error = sysfs_add_bin_file_mode_ns(parent, *bin_attr,
+- mode, uid, gid,
++ mode, size, uid, gid,
+ NULL);
+ if (error)
+ break;
+diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
+index 3f28c9af57562..8e012f25e1c06 100644
+--- a/fs/sysfs/sysfs.h
++++ b/fs/sysfs/sysfs.h
+@@ -31,7 +31,7 @@ int sysfs_add_file_mode_ns(struct kernfs_node *parent,
+ const struct attribute *attr, umode_t amode, kuid_t uid,
+ kgid_t gid, const void *ns);
+ int sysfs_add_bin_file_mode_ns(struct kernfs_node *parent,
+- const struct bin_attribute *battr, umode_t mode,
++ const struct bin_attribute *battr, umode_t mode, size_t size,
+ kuid_t uid, kgid_t gid, const void *ns);
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From f0551860dbe3ab315f1bfcff207a7359c8d905ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:31 +0000
+Subject: sysfs: introduce callback attribute_group::bin_size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit bebf29b18f34620e25f7e2bd9e4e4d8e34a8977d ]
+
+Several drivers need to dynamically calculate the size of an binary
+attribute. Currently this is done by assigning attr->size from the
+is_bin_visible() callback.
+
+This has drawbacks:
+* It is not documented.
+* A single attribute can be instantiated multiple times, overwriting the
+ shared size field.
+* It prevents the structure to be moved to read-only memory.
+
+Introduce a new dedicated callback to calculate the size of the
+attribute.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-2-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/sysfs/group.c | 2 ++
+ include/linux/sysfs.h | 8 ++++++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
+index 45b2e92941da1..8b01a7eda5fb3 100644
+--- a/fs/sysfs/group.c
++++ b/fs/sysfs/group.c
+@@ -98,6 +98,8 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj,
+ if (!mode)
+ continue;
+ }
++ if (grp->bin_size)
++ size = grp->bin_size(kobj, *bin_attr, i);
+
+ WARN(mode & ~(SYSFS_PREALLOC | 0664),
+ "Attribute %s: Invalid permissions 0%o\n",
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index c4e64dc112063..4746cccb95898 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -87,6 +87,11 @@ do { \
+ * SYSFS_GROUP_VISIBLE() when assigning this callback to
+ * specify separate _group_visible() and _attr_visible()
+ * handlers.
++ * @bin_size:
++ * Optional: Function to return the size of a binary attribute
++ * of the group. Will be called repeatedly for each binary
++ * attribute in the group. Overwrites the size field embedded
++ * inside the attribute itself.
+ * @attrs: Pointer to NULL terminated list of attributes.
+ * @bin_attrs: Pointer to NULL terminated list of binary attributes.
+ * Either attrs or bin_attrs or both must be provided.
+@@ -97,6 +102,9 @@ struct attribute_group {
+ struct attribute *, int);
+ umode_t (*is_bin_visible)(struct kobject *,
+ struct bin_attribute *, int);
++ size_t (*bin_size)(struct kobject *,
++ const struct bin_attribute *,
++ int);
+ struct attribute **attrs;
+ struct bin_attribute **bin_attrs;
+ };
+--
+2.39.5
+
--- /dev/null
+From b5282192aedfc2ea9b70a72626474c5d9fb8a422 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:35 +0000
+Subject: sysfs: treewide: constify attribute callback of bin_attribute::mmap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 94a20fb9af16417ab5fd17bcde3d906926f15ef6 ]
+
+The mmap() callbacks should not modify the struct
+bin_attribute passed as argument.
+Enforce this by marking the argument as const.
+
+As there are not many callback implementers perform this change
+throughout the tree at once.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Andrew Donnellan <ajd@linux.ibm.com> # ocxl
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-6-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/kernel/pci-sysfs.c | 6 +++---
+ drivers/cdx/cdx.c | 2 +-
+ drivers/misc/ocxl/sysfs.c | 2 +-
+ drivers/pci/p2pdma.c | 2 +-
+ drivers/pci/pci-sysfs.c | 10 +++++-----
+ drivers/platform/x86/intel/pmt/class.c | 2 +-
+ drivers/uio/uio_hv_generic.c | 2 +-
+ include/linux/sysfs.h | 2 +-
+ 8 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
+index 5808a66e2a81f..3048758304b57 100644
+--- a/arch/alpha/kernel/pci-sysfs.c
++++ b/arch/alpha/kernel/pci-sysfs.c
+@@ -64,7 +64,7 @@ static int __pci_mmap_fits(struct pci_dev *pdev, int num,
+ * Return: %0 on success, negative error code otherwise
+ */
+ static int pci_mmap_resource(struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma, int sparse)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+@@ -93,14 +93,14 @@ static int pci_mmap_resource(struct kobject *kobj,
+ }
+
+ static int pci_mmap_resource_sparse(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ return pci_mmap_resource(kobj, attr, vma, 1);
+ }
+
+ static int pci_mmap_resource_dense(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ return pci_mmap_resource(kobj, attr, vma, 0);
+diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
+index 4af1901c9d524..8228b0d91629a 100644
+--- a/drivers/cdx/cdx.c
++++ b/drivers/cdx/cdx.c
+@@ -711,7 +711,7 @@ static const struct vm_operations_struct cdx_phys_vm_ops = {
+ * Return: true on success, false otherwise.
+ */
+ static int cdx_mmap_resource(struct file *fp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ struct cdx_device *cdx_dev = to_cdx_device(kobj_to_dev(kobj));
+diff --git a/drivers/misc/ocxl/sysfs.c b/drivers/misc/ocxl/sysfs.c
+index 405180d47d9bf..07520d6e6dc55 100644
+--- a/drivers/misc/ocxl/sysfs.c
++++ b/drivers/misc/ocxl/sysfs.c
+@@ -125,7 +125,7 @@ static const struct vm_operations_struct global_mmio_vmops = {
+ };
+
+ static int global_mmio_mmap(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *bin_attr,
++ const struct bin_attribute *bin_attr,
+ struct vm_area_struct *vma)
+ {
+ struct ocxl_afu *afu = to_afu(kobj_to_dev(kobj));
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 4f47a13cb500f..7abd4f546d3c0 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -90,7 +90,7 @@ static ssize_t published_show(struct device *dev, struct device_attribute *attr,
+ static DEVICE_ATTR_RO(published);
+
+ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr, struct vm_area_struct *vma)
++ const struct bin_attribute *attr, struct vm_area_struct *vma)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+ size_t len = vma->vm_end - vma->vm_start;
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index c5725f5185620..f31eb80c1c38b 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -936,7 +936,7 @@ static ssize_t pci_write_legacy_io(struct file *filp, struct kobject *kobj,
+ * memory space.
+ */
+ static int pci_mmap_legacy_mem(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj));
+@@ -956,7 +956,7 @@ static int pci_mmap_legacy_mem(struct file *filp, struct kobject *kobj,
+ * memory space. Returns -ENOSYS if the operation isn't supported
+ */
+ static int pci_mmap_legacy_io(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ struct pci_bus *bus = to_pci_bus(kobj_to_dev(kobj));
+@@ -1060,7 +1060,7 @@ void pci_remove_legacy_files(struct pci_bus *b)
+ *
+ * Use the regular PCI mapping routines to map a PCI resource into userspace.
+ */
+-static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
++static int pci_mmap_resource(struct kobject *kobj, const struct bin_attribute *attr,
+ struct vm_area_struct *vma, int write_combine)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+@@ -1085,14 +1085,14 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
+ }
+
+ static int pci_mmap_resource_uc(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ return pci_mmap_resource(kobj, attr, vma, 0);
+ }
+
+ static int pci_mmap_resource_wc(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ return pci_mmap_resource(kobj, attr, vma, 1);
+diff --git a/drivers/platform/x86/intel/pmt/class.c b/drivers/platform/x86/intel/pmt/class.c
+index c3ca2ac91b056..4cd46323001e0 100644
+--- a/drivers/platform/x86/intel/pmt/class.c
++++ b/drivers/platform/x86/intel/pmt/class.c
+@@ -105,7 +105,7 @@ intel_pmt_read(struct file *filp, struct kobject *kobj,
+
+ static int
+ intel_pmt_mmap(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr, struct vm_area_struct *vma)
++ const struct bin_attribute *attr, struct vm_area_struct *vma)
+ {
+ struct intel_pmt_entry *entry = container_of(attr,
+ struct intel_pmt_entry,
+diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
+index 8704095994118..3976360d0096d 100644
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -135,7 +135,7 @@ static void hv_uio_rescind(struct vmbus_channel *channel)
+ * The ring buffer is allocated as contiguous memory by vmbus_open
+ */
+ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ struct vm_area_struct *vma)
+ {
+ struct vmbus_channel *channel
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index d1b22d56198b5..9fcdc8cd3118f 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -309,7 +309,7 @@ struct bin_attribute {
+ char *, loff_t, size_t);
+ loff_t (*llseek)(struct file *, struct kobject *, struct bin_attribute *,
+ loff_t, int);
+- int (*mmap)(struct file *, struct kobject *, struct bin_attribute *attr,
++ int (*mmap)(struct file *, struct kobject *, const struct bin_attribute *attr,
+ struct vm_area_struct *vma);
+ };
+
+--
+2.39.5
+
--- /dev/null
+From b1f4c72ffbd27e7d32208270d27af0e8a43de265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 17:03:34 +0000
+Subject: sysfs: treewide: constify attribute callback of bin_is_visible()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit b626816fdd7f9beb841856ba049396cff46e99aa ]
+
+The is_bin_visible() callbacks should not modify the struct
+bin_attribute passed as argument.
+Enforce this by marking the argument as const.
+
+As there are not many callback implementers perform this change
+throughout the tree at once.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Jason Gunthorpe <jgg@nvidia.com>
+Acked-by: Ira Weiny <ira.weiny@intel.com>
+Acked-by: Krzysztof Wilczyński <kw@linux.com>
+Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-5-71110628844c@weissschuh.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f31fe8165d36 ("uio_hv_generic: Fix sysfs creation path for ring buffer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/port.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ drivers/infiniband/hw/qib/qib_sysfs.c | 2 +-
+ drivers/mtd/spi-nor/sysfs.c | 2 +-
+ drivers/nvmem/core.c | 3 ++-
+ drivers/pci/pci-sysfs.c | 2 +-
+ drivers/pci/vpd.c | 2 +-
+ drivers/platform/x86/amd/hsmp.c | 2 +-
+ drivers/platform/x86/intel/sdsi.c | 2 +-
+ drivers/scsi/scsi_sysfs.c | 2 +-
+ drivers/usb/core/sysfs.c | 2 +-
+ include/linux/sysfs.h | 30 ++++++++++++-------------
+ 12 files changed, 27 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/cxl/port.c b/drivers/cxl/port.c
+index 9dc394295e1fc..24041cf85cfbe 100644
+--- a/drivers/cxl/port.c
++++ b/drivers/cxl/port.c
+@@ -173,7 +173,7 @@ static ssize_t CDAT_read(struct file *filp, struct kobject *kobj,
+ static BIN_ATTR_ADMIN_RO(CDAT, 0);
+
+ static umode_t cxl_port_bin_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *attr, int i)
++ const struct bin_attribute *attr, int i)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+ struct cxl_port *port = to_cxl_port(dev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index d70855d7c61c1..3c8ef0cb5e567 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -4000,7 +4000,7 @@ static umode_t amdgpu_flash_attr_is_visible(struct kobject *kobj, struct attribu
+ }
+
+ static umode_t amdgpu_bin_flash_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *attr,
++ const struct bin_attribute *attr,
+ int idx)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index 53ec7510e4ebf..ba2cd68b53e6c 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -283,7 +283,7 @@ static struct bin_attribute *port_ccmgta_attributes[] = {
+ };
+
+ static umode_t qib_ccmgta_is_bin_visible(struct kobject *kobj,
+- struct bin_attribute *attr, int n)
++ const struct bin_attribute *attr, int n)
+ {
+ struct qib_pportdata *ppd = qib_get_pportdata_kobj(kobj);
+
+diff --git a/drivers/mtd/spi-nor/sysfs.c b/drivers/mtd/spi-nor/sysfs.c
+index 96064e4babf01..5e9eb268073d1 100644
+--- a/drivers/mtd/spi-nor/sysfs.c
++++ b/drivers/mtd/spi-nor/sysfs.c
+@@ -87,7 +87,7 @@ static umode_t spi_nor_sysfs_is_visible(struct kobject *kobj,
+ }
+
+ static umode_t spi_nor_sysfs_is_bin_visible(struct kobject *kobj,
+- struct bin_attribute *attr, int n)
++ const struct bin_attribute *attr, int n)
+ {
+ struct spi_device *spi = to_spi_device(kobj_to_dev(kobj));
+ struct spi_mem *spimem = spi_get_drvdata(spi);
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index e4775938b9d40..026c0bfdad268 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -298,7 +298,8 @@ static umode_t nvmem_bin_attr_get_umode(struct nvmem_device *nvmem)
+ }
+
+ static umode_t nvmem_bin_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *attr, int i)
++ const struct bin_attribute *attr,
++ int i)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+ struct nvmem_device *nvmem = to_nvmem_device(dev);
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index f62402bafc19b..c5725f5185620 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -1352,7 +1352,7 @@ static struct bin_attribute *pci_dev_rom_attrs[] = {
+ };
+
+ static umode_t pci_dev_rom_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *a, int n)
++ const struct bin_attribute *a, int n)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+
+diff --git a/drivers/pci/vpd.c b/drivers/pci/vpd.c
+index e4300f5f304f3..a469bcbc0da7f 100644
+--- a/drivers/pci/vpd.c
++++ b/drivers/pci/vpd.c
+@@ -325,7 +325,7 @@ static struct bin_attribute *vpd_attrs[] = {
+ };
+
+ static umode_t vpd_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *a, int n)
++ const struct bin_attribute *a, int n)
+ {
+ struct pci_dev *pdev = to_pci_dev(kobj_to_dev(kobj));
+
+diff --git a/drivers/platform/x86/amd/hsmp.c b/drivers/platform/x86/amd/hsmp.c
+index 8fcf38eed7f00..8f00850c139fa 100644
+--- a/drivers/platform/x86/amd/hsmp.c
++++ b/drivers/platform/x86/amd/hsmp.c
+@@ -620,7 +620,7 @@ static int hsmp_get_tbl_dram_base(u16 sock_ind)
+ }
+
+ static umode_t hsmp_is_sock_attr_visible(struct kobject *kobj,
+- struct bin_attribute *battr, int id)
++ const struct bin_attribute *battr, int id)
+ {
+ if (plat_dev.proto_ver == HSMP_PROTO_VER6)
+ return battr->attr.mode;
+diff --git a/drivers/platform/x86/intel/sdsi.c b/drivers/platform/x86/intel/sdsi.c
+index 9d137621f0e6e..33f33b1070fdc 100644
+--- a/drivers/platform/x86/intel/sdsi.c
++++ b/drivers/platform/x86/intel/sdsi.c
+@@ -541,7 +541,7 @@ static struct bin_attribute *sdsi_bin_attrs[] = {
+ };
+
+ static umode_t
+-sdsi_battr_is_visible(struct kobject *kobj, struct bin_attribute *attr, int n)
++sdsi_battr_is_visible(struct kobject *kobj, const struct bin_attribute *attr, int n)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+ struct sdsi_priv *priv = dev_get_drvdata(dev);
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 32f94db6d6bf5..f3a1ecb42128a 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -1274,7 +1274,7 @@ static umode_t scsi_sdev_attr_is_visible(struct kobject *kobj,
+ }
+
+ static umode_t scsi_sdev_bin_attr_is_visible(struct kobject *kobj,
+- struct bin_attribute *attr, int i)
++ const struct bin_attribute *attr, int i)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+ struct scsi_device *sdev = to_scsi_device(dev);
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index 61b6d978892c7..b4cba23831acd 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -925,7 +925,7 @@ static struct bin_attribute *dev_bin_attrs[] = {
+ };
+
+ static umode_t dev_bin_attrs_are_visible(struct kobject *kobj,
+- struct bin_attribute *a, int n)
++ const struct bin_attribute *a, int n)
+ {
+ struct device *dev = kobj_to_dev(kobj);
+ struct usb_device *udev = to_usb_device(dev);
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index 4746cccb95898..d1b22d56198b5 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -101,7 +101,7 @@ struct attribute_group {
+ umode_t (*is_visible)(struct kobject *,
+ struct attribute *, int);
+ umode_t (*is_bin_visible)(struct kobject *,
+- struct bin_attribute *, int);
++ const struct bin_attribute *, int);
+ size_t (*bin_size)(struct kobject *,
+ const struct bin_attribute *,
+ int);
+@@ -199,22 +199,22 @@ struct attribute_group {
+ * attributes, the group visibility is determined by the function
+ * specified to is_visible() not is_bin_visible()
+ */
+-#define DEFINE_SYSFS_BIN_GROUP_VISIBLE(name) \
+- static inline umode_t sysfs_group_visible_##name( \
+- struct kobject *kobj, struct bin_attribute *attr, int n) \
+- { \
+- if (n == 0 && !name##_group_visible(kobj)) \
+- return SYSFS_GROUP_INVISIBLE; \
+- return name##_attr_visible(kobj, attr, n); \
++#define DEFINE_SYSFS_BIN_GROUP_VISIBLE(name) \
++ static inline umode_t sysfs_group_visible_##name( \
++ struct kobject *kobj, const struct bin_attribute *attr, int n) \
++ { \
++ if (n == 0 && !name##_group_visible(kobj)) \
++ return SYSFS_GROUP_INVISIBLE; \
++ return name##_attr_visible(kobj, attr, n); \
+ }
+
+-#define DEFINE_SIMPLE_SYSFS_BIN_GROUP_VISIBLE(name) \
+- static inline umode_t sysfs_group_visible_##name( \
+- struct kobject *kobj, struct bin_attribute *a, int n) \
+- { \
+- if (n == 0 && !name##_group_visible(kobj)) \
+- return SYSFS_GROUP_INVISIBLE; \
+- return a->mode; \
++#define DEFINE_SIMPLE_SYSFS_BIN_GROUP_VISIBLE(name) \
++ static inline umode_t sysfs_group_visible_##name( \
++ struct kobject *kobj, const struct bin_attribute *a, int n) \
++ { \
++ if (n == 0 && !name##_group_visible(kobj)) \
++ return SYSFS_GROUP_INVISIBLE; \
++ return a->mode; \
+ }
+
+ #define SYSFS_GROUP_VISIBLE(fn) sysfs_group_visible_##fn
+--
+2.39.5
+
--- /dev/null
+From 39227e98346a6c7448ee223c9f5cc83fd041ab02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 11:44:34 +0300
+Subject: tests/ncdevmem: Fix double-free of queue array
+
+From: Cosmin Ratiu <cratiu@nvidia.com>
+
+[ Upstream commit 97c4e094a4b2edbb4fffeda718f8e806f825a18f ]
+
+netdev_bind_rx takes ownership of the queue array passed as parameter
+and frees it, so a queue array buffer cannot be reused across multiple
+netdev_bind_rx calls.
+
+This commit fixes that by always passing in a newly created queue array
+to all netdev_bind_rx calls in ncdevmem.
+
+Fixes: 85585b4bc8d8 ("selftests: add ncdevmem, netcat for devmem TCP")
+Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250508084434.1933069-1-cratiu@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ncdevmem.c | 55 +++++++++++---------------
+ 1 file changed, 22 insertions(+), 33 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ncdevmem.c b/tools/testing/selftests/net/ncdevmem.c
+index 7c671b246d80f..8617e6d7698de 100644
+--- a/tools/testing/selftests/net/ncdevmem.c
++++ b/tools/testing/selftests/net/ncdevmem.c
+@@ -342,6 +342,22 @@ static int parse_address(const char *str, int port, struct sockaddr_in6 *sin6)
+ return 0;
+ }
+
++static struct netdev_queue_id *create_queues(void)
++{
++ struct netdev_queue_id *queues;
++ size_t i = 0;
++
++ queues = calloc(num_queues, sizeof(*queues));
++ for (i = 0; i < num_queues; i++) {
++ queues[i]._present.type = 1;
++ queues[i]._present.id = 1;
++ queues[i].type = NETDEV_QUEUE_TYPE_RX;
++ queues[i].id = start_queue + i;
++ }
++
++ return queues;
++}
++
+ int do_server(struct memory_buffer *mem)
+ {
+ char ctrl_data[sizeof(int) * 20000];
+@@ -359,7 +375,6 @@ int do_server(struct memory_buffer *mem)
+ char buffer[256];
+ int socket_fd;
+ int client_fd;
+- size_t i = 0;
+ int ret;
+
+ ret = parse_address(server_ip, atoi(port), &server_sin);
+@@ -379,16 +394,7 @@ int do_server(struct memory_buffer *mem)
+
+ sleep(1);
+
+- queues = malloc(sizeof(*queues) * num_queues);
+-
+- for (i = 0; i < num_queues; i++) {
+- queues[i]._present.type = 1;
+- queues[i]._present.id = 1;
+- queues[i].type = NETDEV_QUEUE_TYPE_RX;
+- queues[i].id = start_queue + i;
+- }
+-
+- if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
++ if (bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys))
+ error(1, 0, "Failed to bind\n");
+
+ tmp_mem = malloc(mem->size);
+@@ -453,7 +459,6 @@ int do_server(struct memory_buffer *mem)
+ goto cleanup;
+ }
+
+- i++;
+ for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm)) {
+ if (cm->cmsg_level != SOL_SOCKET ||
+ (cm->cmsg_type != SCM_DEVMEM_DMABUF &&
+@@ -541,10 +546,8 @@ int do_server(struct memory_buffer *mem)
+
+ void run_devmem_tests(void)
+ {
+- struct netdev_queue_id *queues;
+ struct memory_buffer *mem;
+ struct ynl_sock *ys;
+- size_t i = 0;
+
+ mem = provider->alloc(getpagesize() * NUM_PAGES);
+
+@@ -552,38 +555,24 @@ void run_devmem_tests(void)
+ if (configure_rss())
+ error(1, 0, "rss error\n");
+
+- queues = calloc(num_queues, sizeof(*queues));
+-
+ if (configure_headersplit(1))
+ error(1, 0, "Failed to configure header split\n");
+
+- if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
++ if (!bind_rx_queue(ifindex, mem->fd,
++ calloc(num_queues, sizeof(struct netdev_queue_id)),
++ num_queues, &ys))
+ error(1, 0, "Binding empty queues array should have failed\n");
+
+- for (i = 0; i < num_queues; i++) {
+- queues[i]._present.type = 1;
+- queues[i]._present.id = 1;
+- queues[i].type = NETDEV_QUEUE_TYPE_RX;
+- queues[i].id = start_queue + i;
+- }
+-
+ if (configure_headersplit(0))
+ error(1, 0, "Failed to configure header split\n");
+
+- if (!bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
++ if (!bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys))
+ error(1, 0, "Configure dmabuf with header split off should have failed\n");
+
+ if (configure_headersplit(1))
+ error(1, 0, "Failed to configure header split\n");
+
+- for (i = 0; i < num_queues; i++) {
+- queues[i]._present.type = 1;
+- queues[i]._present.id = 1;
+- queues[i].type = NETDEV_QUEUE_TYPE_RX;
+- queues[i].id = start_queue + i;
+- }
+-
+- if (bind_rx_queue(ifindex, mem->fd, queues, num_queues, &ys))
++ if (bind_rx_queue(ifindex, mem->fd, create_queues(), num_queues, &ys))
+ error(1, 0, "Failed to bind\n");
+
+ /* Deactivating a bound queue should not be legal */
+--
+2.39.5
+
--- /dev/null
+From 2e2dd0088f18c340aec73c341c5b493a5868c0a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 03:54:14 +0000
+Subject: tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 45375814eb3f4245956c0c85092a4eee4441d167 ]
+
+Fix a crash in the ethtool YNL implementation when Hardware Clock information
+is not present in the response. This ensures graceful handling of devices or
+drivers that do not provide this optional field. e.g.
+
+ Traceback (most recent call last):
+ File "/net/tools/net/ynl/pyynl/./ethtool.py", line 438, in <module>
+ main()
+ ~~~~^^
+ File "/net/tools/net/ynl/pyynl/./ethtool.py", line 341, in main
+ print(f'PTP Hardware Clock: {tsinfo["phc-index"]}')
+ ~~~~~~^^^^^^^^^^^^^
+ KeyError: 'phc-index'
+
+Fixes: f3d07b02b2b8 ("tools: ynl: ethtool testing tool")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250508035414.82974-1-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/ethtool.py | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/tools/net/ynl/ethtool.py b/tools/net/ynl/ethtool.py
+index 63c471f075abf..7e8342f914816 100755
+--- a/tools/net/ynl/ethtool.py
++++ b/tools/net/ynl/ethtool.py
+@@ -337,16 +337,24 @@ def main():
+ print('Capabilities:')
+ [print(f'\t{v}') for v in bits_to_dict(tsinfo['timestamping'])]
+
+- print(f'PTP Hardware Clock: {tsinfo["phc-index"]}')
++ print(f'PTP Hardware Clock: {tsinfo.get("phc-index", "none")}')
+
+- print('Hardware Transmit Timestamp Modes:')
+- [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])]
++ if 'tx-types' in tsinfo:
++ print('Hardware Transmit Timestamp Modes:')
++ [print(f'\t{v}') for v in bits_to_dict(tsinfo['tx-types'])]
++ else:
++ print('Hardware Transmit Timestamp Modes: none')
++
++ if 'rx-filters' in tsinfo:
++ print('Hardware Receive Filter Modes:')
++ [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])]
++ else:
++ print('Hardware Receive Filter Modes: none')
+
+- print('Hardware Receive Filter Modes:')
+- [print(f'\t{v}') for v in bits_to_dict(tsinfo['rx-filters'])]
++ if 'stats' in tsinfo and tsinfo['stats']:
++ print('Statistics:')
++ [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()]
+
+- print('Statistics:')
+- [print(f'\t{k}: {v}') for k, v in tsinfo['stats'].items()]
+ return
+
+ print(f'Settings for {args.device}:')
+--
+2.39.5
+
--- /dev/null
+From db830ff52d040de645acd16bdec040af01735068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Apr 2025 10:23:14 +0200
+Subject: tpm: tis: Double the timeout B to 4s
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit 2f661f71fda1fc0c42b7746ca5b7da529eb6b5be ]
+
+With some Infineon chips the timeouts in tpm_tis_send_data (both B and
+C) can reach up to about 2250 ms.
+
+Timeout C is retried since
+commit de9e33df7762 ("tpm, tpm_tis: Workaround failed command reception on Infineon devices")
+
+Timeout B still needs to be extended.
+
+The problem is most commonly encountered with context related operation
+such as load context/save context. These are issued directly by the
+kernel, and there is no retry logic for them.
+
+When a filesystem is set up to use the TPM for unlocking the boot fails,
+and restarting the userspace service is ineffective. This is likely
+because ignoring a load context/save context result puts the real TPM
+state and the TPM state expected by the kernel out of sync.
+
+Chips known to be affected:
+tpm_tis IFX1522:00: 2.0 TPM (device-id 0x1D, rev-id 54)
+Description: SLB9672
+Firmware Revision: 15.22
+
+tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1B, rev-id 22)
+Firmware Revision: 7.83
+
+tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16)
+Firmware Revision: 5.63
+
+Link: https://lore.kernel.org/linux-integrity/Z5pI07m0Muapyu9w@kitsune.suse.cz/
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.h | 2 +-
+ include/linux/tpm.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
+index 970d02c337c7f..6c3aa480396b6 100644
+--- a/drivers/char/tpm/tpm_tis_core.h
++++ b/drivers/char/tpm/tpm_tis_core.h
+@@ -54,7 +54,7 @@ enum tis_int_flags {
+ enum tis_defaults {
+ TIS_MEM_LEN = 0x5000,
+ TIS_SHORT_TIMEOUT = 750, /* ms */
+- TIS_LONG_TIMEOUT = 2000, /* 2 sec */
++ TIS_LONG_TIMEOUT = 4000, /* 4 secs */
+ TIS_TIMEOUT_MIN_ATML = 14700, /* usecs */
+ TIS_TIMEOUT_MAX_ATML = 15000, /* usecs */
+ };
+diff --git a/include/linux/tpm.h b/include/linux/tpm.h
+index 6c3125300c009..3db0b6a87d454 100644
+--- a/include/linux/tpm.h
++++ b/include/linux/tpm.h
+@@ -224,7 +224,7 @@ enum tpm2_const {
+
+ enum tpm2_timeouts {
+ TPM2_TIMEOUT_A = 750,
+- TPM2_TIMEOUT_B = 2000,
++ TPM2_TIMEOUT_B = 4000,
+ TPM2_TIMEOUT_C = 200,
+ TPM2_TIMEOUT_D = 30,
+ TPM2_DURATION_SHORT = 20,
+--
+2.39.5
+
--- /dev/null
+From def059ab3d6700cfa401a631139cc446662bb5bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 12:44:41 +0900
+Subject: tracing: probes: Fix a possible race in trace_probe_log APIs
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 ]
+
+Since the shared trace_probe_log variable can be accessed and
+modified via probe event create operation of kprobe_events,
+uprobe_events, and dynamic_events, it should be protected.
+In the dynamic_events, all operations are serialized by
+`dyn_event_ops_mutex`. But kprobe_events and uprobe_events
+interfaces are not serialized.
+
+To solve this issue, introduces dyn_event_create(), which runs
+create() operation under the mutex, for kprobe_events and
+uprobe_events. This also uses lockdep to check the mutex is
+held when using trace_probe_log* APIs.
+
+Link: https://lore.kernel.org/all/174684868120.551552.3068655787654268804.stgit@devnote2/
+
+Reported-by: Paul Cacheux <paulcacheux@gmail.com>
+Closes: https://lore.kernel.org/all/20250510074456.805a16872b591e2971a4d221@kernel.org/
+Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_dynevent.c | 16 +++++++++++++++-
+ kernel/trace/trace_dynevent.h | 1 +
+ kernel/trace/trace_kprobe.c | 2 +-
+ kernel/trace/trace_probe.c | 9 +++++++++
+ kernel/trace/trace_uprobe.c | 2 +-
+ 5 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c
+index 4376887e0d8aa..c9b0533407ede 100644
+--- a/kernel/trace/trace_dynevent.c
++++ b/kernel/trace/trace_dynevent.c
+@@ -16,7 +16,7 @@
+ #include "trace_output.h" /* for trace_event_sem */
+ #include "trace_dynevent.h"
+
+-static DEFINE_MUTEX(dyn_event_ops_mutex);
++DEFINE_MUTEX(dyn_event_ops_mutex);
+ static LIST_HEAD(dyn_event_ops_list);
+
+ bool trace_event_dyn_try_get_ref(struct trace_event_call *dyn_call)
+@@ -125,6 +125,20 @@ int dyn_event_release(const char *raw_command, struct dyn_event_operations *type
+ return ret;
+ }
+
++/*
++ * Locked version of event creation. The event creation must be protected by
++ * dyn_event_ops_mutex because of protecting trace_probe_log.
++ */
++int dyn_event_create(const char *raw_command, struct dyn_event_operations *type)
++{
++ int ret;
++
++ mutex_lock(&dyn_event_ops_mutex);
++ ret = type->create(raw_command);
++ mutex_unlock(&dyn_event_ops_mutex);
++ return ret;
++}
++
+ static int create_dyn_event(const char *raw_command)
+ {
+ struct dyn_event_operations *ops;
+diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h
+index 936477a111d3e..beee3f8d75444 100644
+--- a/kernel/trace/trace_dynevent.h
++++ b/kernel/trace/trace_dynevent.h
+@@ -100,6 +100,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos);
+ void dyn_event_seq_stop(struct seq_file *m, void *v);
+ int dyn_events_release_all(struct dyn_event_operations *type);
+ int dyn_event_release(const char *raw_command, struct dyn_event_operations *type);
++int dyn_event_create(const char *raw_command, struct dyn_event_operations *type);
+
+ /*
+ * for_each_dyn_event - iterate over the dyn_event list
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 935a886af40c9..6b9c3f3f870f4 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -1090,7 +1090,7 @@ static int create_or_delete_trace_kprobe(const char *raw_command)
+ if (raw_command[0] == '-')
+ return dyn_event_release(raw_command, &trace_kprobe_ops);
+
+- ret = trace_kprobe_create(raw_command);
++ ret = dyn_event_create(raw_command, &trace_kprobe_ops);
+ return ret == -ECANCELED ? -EINVAL : ret;
+ }
+
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index 578919962e5df..ae20ad7f74616 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -154,9 +154,12 @@ static const struct fetch_type *find_fetch_type(const char *type, unsigned long
+ }
+
+ static struct trace_probe_log trace_probe_log;
++extern struct mutex dyn_event_ops_mutex;
+
+ void trace_probe_log_init(const char *subsystem, int argc, const char **argv)
+ {
++ lockdep_assert_held(&dyn_event_ops_mutex);
++
+ trace_probe_log.subsystem = subsystem;
+ trace_probe_log.argc = argc;
+ trace_probe_log.argv = argv;
+@@ -165,11 +168,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv)
+
+ void trace_probe_log_clear(void)
+ {
++ lockdep_assert_held(&dyn_event_ops_mutex);
++
+ memset(&trace_probe_log, 0, sizeof(trace_probe_log));
+ }
+
+ void trace_probe_log_set_index(int index)
+ {
++ lockdep_assert_held(&dyn_event_ops_mutex);
++
+ trace_probe_log.index = index;
+ }
+
+@@ -178,6 +185,8 @@ void __trace_probe_log_err(int offset, int err_type)
+ char *command, *p;
+ int i, len = 0, pos = 0;
+
++ lockdep_assert_held(&dyn_event_ops_mutex);
++
+ if (!trace_probe_log.argv)
+ return;
+
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index b085a8a164ea0..9916677acf24e 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -739,7 +739,7 @@ static int create_or_delete_trace_uprobe(const char *raw_command)
+ if (raw_command[0] == '-')
+ return dyn_event_release(raw_command, &trace_uprobe_ops);
+
+- ret = trace_uprobe_create(raw_command);
++ ret = dyn_event_create(raw_command, &trace_uprobe_ops);
+ return ret == -ECANCELED ? -EINVAL : ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 8fabb2e9d159833a2799d64715993382585dcc1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:56:57 +0200
+Subject: tsnep: fix timestamping with a stacked DSA driver
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit b3ca9eef6646576ad506a96d941d87a69f66732a ]
+
+This driver is susceptible to a form of the bug explained in commit
+c26a2c2ddc01 ("gianfar: Fix TX timestamping with a stacked DSA driver")
+and in Documentation/networking/timestamping.rst section "Other caveats
+for MAC drivers", specifically it timestamps any skb which has
+SKBTX_HW_TSTAMP, and does not consider if timestamping has been enabled
+in adapter->hwtstamp_config.tx_type.
+
+Evaluate the proper TX timestamping condition only once on the TX
+path (in tsnep_xmit_frame_ring()) and store the result in an additional
+TX entry flag. Evaluate the new TX entry flag in the TX confirmation path
+(in tsnep_tx_poll()).
+
+This way SKBTX_IN_PROGRESS is set by the driver as required, but never
+evaluated. SKBTX_IN_PROGRESS shall not be evaluated as it can be set
+by a stacked DSA driver and evaluating it would lead to unwanted
+timestamps.
+
+Fixes: 403f69bbdbad ("tsnep: Add TSN endpoint Ethernet MAC driver")
+Suggested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250514195657.25874-1-gerhard@engleder-embedded.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_main.c | 30 ++++++++++++++--------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
+index 44da335d66bda..6a6efe2b2bc51 100644
+--- a/drivers/net/ethernet/engleder/tsnep_main.c
++++ b/drivers/net/ethernet/engleder/tsnep_main.c
+@@ -67,6 +67,8 @@
+ #define TSNEP_TX_TYPE_XDP_NDO_MAP_PAGE (TSNEP_TX_TYPE_XDP_NDO | TSNEP_TX_TYPE_MAP_PAGE)
+ #define TSNEP_TX_TYPE_XDP (TSNEP_TX_TYPE_XDP_TX | TSNEP_TX_TYPE_XDP_NDO)
+ #define TSNEP_TX_TYPE_XSK BIT(12)
++#define TSNEP_TX_TYPE_TSTAMP BIT(13)
++#define TSNEP_TX_TYPE_SKB_TSTAMP (TSNEP_TX_TYPE_SKB | TSNEP_TX_TYPE_TSTAMP)
+
+ #define TSNEP_XDP_TX BIT(0)
+ #define TSNEP_XDP_REDIRECT BIT(1)
+@@ -387,8 +389,7 @@ static void tsnep_tx_activate(struct tsnep_tx *tx, int index, int length,
+ if (entry->skb) {
+ entry->properties = length & TSNEP_DESC_LENGTH_MASK;
+ entry->properties |= TSNEP_DESC_INTERRUPT_FLAG;
+- if ((entry->type & TSNEP_TX_TYPE_SKB) &&
+- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS))
++ if ((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP)
+ entry->properties |= TSNEP_DESC_EXTENDED_WRITEBACK_FLAG;
+
+ /* toggle user flag to prevent false acknowledge
+@@ -480,7 +481,8 @@ static int tsnep_tx_map_frag(skb_frag_t *frag, struct tsnep_tx_entry *entry,
+ return mapped;
+ }
+
+-static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count)
++static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count,
++ bool do_tstamp)
+ {
+ struct device *dmadev = tx->adapter->dmadev;
+ struct tsnep_tx_entry *entry;
+@@ -506,6 +508,9 @@ static int tsnep_tx_map(struct sk_buff *skb, struct tsnep_tx *tx, int count)
+ entry->type = TSNEP_TX_TYPE_SKB_INLINE;
+ mapped = 0;
+ }
++
++ if (do_tstamp)
++ entry->type |= TSNEP_TX_TYPE_TSTAMP;
+ } else {
+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i - 1];
+
+@@ -559,11 +564,12 @@ static int tsnep_tx_unmap(struct tsnep_tx *tx, int index, int count)
+ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb,
+ struct tsnep_tx *tx)
+ {
+- int count = 1;
+ struct tsnep_tx_entry *entry;
++ bool do_tstamp = false;
++ int count = 1;
+ int length;
+- int i;
+ int retval;
++ int i;
+
+ if (skb_shinfo(skb)->nr_frags > 0)
+ count += skb_shinfo(skb)->nr_frags;
+@@ -580,7 +586,13 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb,
+ entry = &tx->entry[tx->write];
+ entry->skb = skb;
+
+- retval = tsnep_tx_map(skb, tx, count);
++ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ tx->adapter->hwtstamp_config.tx_type == HWTSTAMP_TX_ON) {
++ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
++ do_tstamp = true;
++ }
++
++ retval = tsnep_tx_map(skb, tx, count, do_tstamp);
+ if (retval < 0) {
+ tsnep_tx_unmap(tx, tx->write, count);
+ dev_kfree_skb_any(entry->skb);
+@@ -592,9 +604,6 @@ static netdev_tx_t tsnep_xmit_frame_ring(struct sk_buff *skb,
+ }
+ length = retval;
+
+- if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)
+- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+-
+ for (i = 0; i < count; i++)
+ tsnep_tx_activate(tx, (tx->write + i) & TSNEP_RING_MASK, length,
+ i == count - 1);
+@@ -845,8 +854,7 @@ static bool tsnep_tx_poll(struct tsnep_tx *tx, int napi_budget)
+
+ length = tsnep_tx_unmap(tx, tx->read, count);
+
+- if ((entry->type & TSNEP_TX_TYPE_SKB) &&
+- (skb_shinfo(entry->skb)->tx_flags & SKBTX_IN_PROGRESS) &&
++ if (((entry->type & TSNEP_TX_TYPE_SKB_TSTAMP) == TSNEP_TX_TYPE_SKB_TSTAMP) &&
+ (__le32_to_cpu(entry->desc_wb->properties) &
+ TSNEP_DESC_EXTENDED_WRITEBACK_FLAG)) {
+ struct skb_shared_hwtstamps hwtstamps;
+--
+2.39.5
+
--- /dev/null
+From e3abc1558c667ce40d14d2a2e54748640a1fee1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 May 2025 13:18:10 +0530
+Subject: uio_hv_generic: Fix sysfs creation path for ring buffer
+
+From: Naman Jain <namjain@linux.microsoft.com>
+
+[ Upstream commit f31fe8165d365379d858c53bef43254c7d6d1cfd ]
+
+On regular bootup, devices get registered to VMBus first, so when
+uio_hv_generic driver for a particular device type is probed,
+the device is already initialized and added, so sysfs creation in
+hv_uio_probe() works fine. However, when the device is removed
+and brought back, the channel gets rescinded and the device again gets
+registered to VMBus. However this time, the uio_hv_generic driver is
+already registered to probe for that device and in this case sysfs
+creation is tried before the device's kobject gets initialized
+completely.
+
+Fix this by moving the core logic of sysfs creation of ring buffer,
+from uio_hv_generic to HyperV's VMBus driver, where the rest of the
+sysfs attributes for the channels are defined. While doing that, make
+use of attribute groups and macros, instead of creating sysfs
+directly, to ensure better error handling and code flow.
+
+Problematic path:
+vmbus_process_offer (A new offer comes for the VMBus device)
+ vmbus_add_channel_work
+ vmbus_device_register
+ |-> device_register
+ | |...
+ | |-> hv_uio_probe
+ | |...
+ | |-> sysfs_create_bin_file (leads to a warning as
+ | the primary channel's kobject, which is used to
+ | create the sysfs file, is not yet initialized)
+ |-> kset_create_and_add
+ |-> vmbus_add_channel_kobj (initialization of the primary
+ channel's kobject happens later)
+
+Above code flow is sequential and the warning is always reproducible in
+this path.
+
+Fixes: 9ab877a6ccf8 ("uio_hv_generic: make ring buffer attribute for primary channel")
+Cc: stable@kernel.org
+Suggested-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Suggested-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Tested-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
+Link: https://lore.kernel.org/r/20250502074811.2022-2-namjain@linux.microsoft.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hyperv_vmbus.h | 6 +++
+ drivers/hv/vmbus_drv.c | 100 ++++++++++++++++++++++++++++++++++-
+ drivers/uio/uio_hv_generic.c | 39 ++++++--------
+ include/linux/hyperv.h | 6 +++
+ 4 files changed, 128 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index 52cb744b4d7fd..e4136cbaa4d40 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -485,4 +485,10 @@ static inline int hv_debug_add_dev_dir(struct hv_device *dev)
+
+ #endif /* CONFIG_HYPERV_TESTING */
+
++/* Create and remove sysfs entry for memory mapped ring buffers for a channel */
++int hv_create_ring_sysfs(struct vmbus_channel *channel,
++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ struct vm_area_struct *vma));
++int hv_remove_ring_sysfs(struct vmbus_channel *channel);
++
+ #endif /* _HYPERV_VMBUS_H */
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 2b6749c9712ef..410df07ef983a 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1792,6 +1792,27 @@ static ssize_t subchannel_id_show(struct vmbus_channel *channel,
+ }
+ static VMBUS_CHAN_ATTR_RO(subchannel_id);
+
++static int hv_mmap_ring_buffer_wrapper(struct file *filp, struct kobject *kobj,
++ const struct bin_attribute *attr,
++ struct vm_area_struct *vma)
++{
++ struct vmbus_channel *channel = container_of(kobj, struct vmbus_channel, kobj);
++
++ /*
++ * hv_(create|remove)_ring_sysfs implementation ensures that mmap_ring_buffer
++ * is not NULL.
++ */
++ return channel->mmap_ring_buffer(channel, vma);
++}
++
++static struct bin_attribute chan_attr_ring_buffer = {
++ .attr = {
++ .name = "ring",
++ .mode = 0600,
++ },
++ .size = 2 * SZ_2M,
++ .mmap = hv_mmap_ring_buffer_wrapper,
++};
+ static struct attribute *vmbus_chan_attrs[] = {
+ &chan_attr_out_mask.attr,
+ &chan_attr_in_mask.attr,
+@@ -1811,6 +1832,11 @@ static struct attribute *vmbus_chan_attrs[] = {
+ NULL
+ };
+
++static struct bin_attribute *vmbus_chan_bin_attrs[] = {
++ &chan_attr_ring_buffer,
++ NULL
++};
++
+ /*
+ * Channel-level attribute_group callback function. Returns the permission for
+ * each attribute, and returns 0 if an attribute is not visible.
+@@ -1831,9 +1857,24 @@ static umode_t vmbus_chan_attr_is_visible(struct kobject *kobj,
+ return attr->mode;
+ }
+
++static umode_t vmbus_chan_bin_attr_is_visible(struct kobject *kobj,
++ const struct bin_attribute *attr, int idx)
++{
++ const struct vmbus_channel *channel =
++ container_of(kobj, struct vmbus_channel, kobj);
++
++ /* Hide ring attribute if channel's ring_sysfs_visible is set to false */
++ if (attr == &chan_attr_ring_buffer && !channel->ring_sysfs_visible)
++ return 0;
++
++ return attr->attr.mode;
++}
++
+ static const struct attribute_group vmbus_chan_group = {
+ .attrs = vmbus_chan_attrs,
+- .is_visible = vmbus_chan_attr_is_visible
++ .bin_attrs = vmbus_chan_bin_attrs,
++ .is_visible = vmbus_chan_attr_is_visible,
++ .is_bin_visible = vmbus_chan_bin_attr_is_visible,
+ };
+
+ static const struct kobj_type vmbus_chan_ktype = {
+@@ -1841,6 +1882,63 @@ static const struct kobj_type vmbus_chan_ktype = {
+ .release = vmbus_chan_release,
+ };
+
++/**
++ * hv_create_ring_sysfs() - create "ring" sysfs entry corresponding to ring buffers for a channel.
++ * @channel: Pointer to vmbus_channel structure
++ * @hv_mmap_ring_buffer: function pointer for initializing the function to be called on mmap of
++ * channel's "ring" sysfs node, which is for the ring buffer of that channel.
++ * Function pointer is of below type:
++ * int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ * struct vm_area_struct *vma))
++ * This has a pointer to the channel and a pointer to vm_area_struct,
++ * used for mmap, as arguments.
++ *
++ * Sysfs node for ring buffer of a channel is created along with other fields, however its
++ * visibility is disabled by default. Sysfs creation needs to be controlled when the use-case
++ * is running.
++ * For example, HV_NIC device is used either by uio_hv_generic or hv_netvsc at any given point of
++ * time, and "ring" sysfs is needed only when uio_hv_generic is bound to that device. To avoid
++ * exposing the ring buffer by default, this function is reponsible to enable visibility of
++ * ring for userspace to use.
++ * Note: Race conditions can happen with userspace and it is not encouraged to create new
++ * use-cases for this. This was added to maintain backward compatibility, while solving
++ * one of the race conditions in uio_hv_generic while creating sysfs.
++ *
++ * Returns 0 on success or error code on failure.
++ */
++int hv_create_ring_sysfs(struct vmbus_channel *channel,
++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ struct vm_area_struct *vma))
++{
++ struct kobject *kobj = &channel->kobj;
++
++ channel->mmap_ring_buffer = hv_mmap_ring_buffer;
++ channel->ring_sysfs_visible = true;
++
++ return sysfs_update_group(kobj, &vmbus_chan_group);
++}
++EXPORT_SYMBOL_GPL(hv_create_ring_sysfs);
++
++/**
++ * hv_remove_ring_sysfs() - remove ring sysfs entry corresponding to ring buffers for a channel.
++ * @channel: Pointer to vmbus_channel structure
++ *
++ * Hide "ring" sysfs for a channel by changing its is_visible attribute and updating sysfs group.
++ *
++ * Returns 0 on success or error code on failure.
++ */
++int hv_remove_ring_sysfs(struct vmbus_channel *channel)
++{
++ struct kobject *kobj = &channel->kobj;
++ int ret;
++
++ channel->ring_sysfs_visible = false;
++ ret = sysfs_update_group(kobj, &vmbus_chan_group);
++ channel->mmap_ring_buffer = NULL;
++ return ret;
++}
++EXPORT_SYMBOL_GPL(hv_remove_ring_sysfs);
++
+ /*
+ * vmbus_add_channel_kobj - setup a sub-directory under device/channels
+ */
+diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
+index 3976360d0096d..c2759bbeed849 100644
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -131,15 +131,12 @@ static void hv_uio_rescind(struct vmbus_channel *channel)
+ vmbus_device_unregister(channel->device_obj);
+ }
+
+-/* Sysfs API to allow mmap of the ring buffers
++/* Function used for mmap of ring buffer sysfs interface.
+ * The ring buffer is allocated as contiguous memory by vmbus_open
+ */
+-static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+- const struct bin_attribute *attr,
+- struct vm_area_struct *vma)
++static int
++hv_uio_ring_mmap(struct vmbus_channel *channel, struct vm_area_struct *vma)
+ {
+- struct vmbus_channel *channel
+- = container_of(kobj, struct vmbus_channel, kobj);
+ void *ring_buffer = page_address(channel->ringbuffer_page);
+
+ if (channel->state != CHANNEL_OPENED_STATE)
+@@ -149,15 +146,6 @@ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+ channel->ringbuffer_pagecount << PAGE_SHIFT);
+ }
+
+-static const struct bin_attribute ring_buffer_bin_attr = {
+- .attr = {
+- .name = "ring",
+- .mode = 0600,
+- },
+- .size = 2 * SZ_2M,
+- .mmap = hv_uio_ring_mmap,
+-};
+-
+ /* Callback from VMBUS subsystem when new channel created. */
+ static void
+ hv_uio_new_channel(struct vmbus_channel *new_sc)
+@@ -178,8 +166,7 @@ hv_uio_new_channel(struct vmbus_channel *new_sc)
+ /* Disable interrupts on sub channel */
+ new_sc->inbound.ring_buffer->interrupt_mask = 1;
+ set_channel_read_mode(new_sc, HV_CALL_ISR);
+-
+- ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr);
++ ret = hv_create_ring_sysfs(new_sc, hv_uio_ring_mmap);
+ if (ret) {
+ dev_err(device, "sysfs create ring bin file failed; %d\n", ret);
+ vmbus_close(new_sc);
+@@ -350,10 +337,18 @@ hv_uio_probe(struct hv_device *dev,
+ goto fail_close;
+ }
+
+- ret = sysfs_create_bin_file(&channel->kobj, &ring_buffer_bin_attr);
+- if (ret)
+- dev_notice(&dev->device,
+- "sysfs create ring bin file failed; %d\n", ret);
++ /*
++ * This internally calls sysfs_update_group, which returns a non-zero value if it executes
++ * before sysfs_create_group. This is expected as the 'ring' will be created later in
++ * vmbus_device_register() -> vmbus_add_channel_kobj(). Thus, no need to check the return
++ * value and print warning.
++ *
++ * Creating/exposing sysfs in driver probe is not encouraged as it can lead to race
++ * conditions with userspace. For backward compatibility, "ring" sysfs could not be removed
++ * or decoupled from uio_hv_generic probe. Userspace programs can make use of inotify
++ * APIs to make sure that ring is created.
++ */
++ hv_create_ring_sysfs(channel, hv_uio_ring_mmap);
+
+ hv_set_drvdata(dev, pdata);
+
+@@ -375,7 +370,7 @@ hv_uio_remove(struct hv_device *dev)
+ if (!pdata)
+ return;
+
+- sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr);
++ hv_remove_ring_sysfs(dev->channel);
+ uio_unregister_device(&pdata->info);
+ hv_uio_cleanup(dev, pdata);
+
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index 02a226bcf0edc..6e331b7adfcd8 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -1067,6 +1067,12 @@ struct vmbus_channel {
+
+ /* The max size of a packet on this channel */
+ u32 max_pkt_size;
++
++ /* function to mmap ring buffer memory to the channel's sysfs ring attribute */
++ int (*mmap_ring_buffer)(struct vmbus_channel *channel, struct vm_area_struct *vma);
++
++ /* boolean to control visibility of sysfs for ring buffer */
++ bool ring_sysfs_visible;
+ };
+
+ #define lock_requestor(channel, flags) \
+--
+2.39.5
+
--- /dev/null
+From 9e77233212419591f427adaaf64dc1aa1057bc30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 10:10:47 +0900
+Subject: virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx
+
+From: Koichiro Den <koichiro.den@canonical.com>
+
+[ Upstream commit 76a771ec4c9adfd75fe53c8505cf656a075d7101 ]
+
+virtnet_sq_bind_xsk_pool() flushes tx skbs and then resets tx queue, so
+DQL counters need to be reset when flushing has actually occurred, Add
+virtnet_sq_free_unused_buf_done() as a callback for virtqueue_resize()
+to handle this.
+
+Fixes: 21a4e3ce6dc7 ("virtio_net: xsk: bind/unbind xsk for tx")
+Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index bb444972693a0..6d36cb204f9bc 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -5576,7 +5576,8 @@ static int virtnet_sq_bind_xsk_pool(struct virtnet_info *vi,
+
+ virtnet_tx_pause(vi, sq);
+
+- err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf, NULL);
++ err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf,
++ virtnet_sq_free_unused_buf_done);
+ if (err) {
+ netdev_err(vi->dev, "reset tx fail: tx queue index: %d err: %d\n", qindex, err);
+ pool = NULL;
+--
+2.39.5
+
--- /dev/null
+From fc3420e50e645a7796d8d2e16ffeaec9f911826f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 10:10:46 +0900
+Subject: virtio_ring: add a func argument 'recycle_done' to virtqueue_reset()
+
+From: Koichiro Den <koichiro.den@canonical.com>
+
+[ Upstream commit 8d2da07c813ad333c20eb803e15f8c4541f25350 ]
+
+When virtqueue_reset() has actually recycled all unused buffers,
+additional work may be required in some cases. Relying solely on its
+return status is fragile, so introduce a new function argument
+'recycle_done', which is invoked when it really occurs.
+
+Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 76a771ec4c9a ("virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 4 ++--
+ drivers/virtio/virtio_ring.c | 6 +++++-
+ include/linux/virtio.h | 3 ++-
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index fbd1150c33cce..bb444972693a0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -5547,7 +5547,7 @@ static int virtnet_rq_bind_xsk_pool(struct virtnet_info *vi, struct receive_queu
+
+ virtnet_rx_pause(vi, rq);
+
+- err = virtqueue_reset(rq->vq, virtnet_rq_unmap_free_buf);
++ err = virtqueue_reset(rq->vq, virtnet_rq_unmap_free_buf, NULL);
+ if (err) {
+ netdev_err(vi->dev, "reset rx fail: rx queue index: %d err: %d\n", qindex, err);
+
+@@ -5576,7 +5576,7 @@ static int virtnet_sq_bind_xsk_pool(struct virtnet_info *vi,
+
+ virtnet_tx_pause(vi, sq);
+
+- err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf);
++ err = virtqueue_reset(sq->vq, virtnet_sq_free_unused_buf, NULL);
+ if (err) {
+ netdev_err(vi->dev, "reset tx fail: tx queue index: %d err: %d\n", qindex, err);
+ pool = NULL;
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 0112742e4504b..1f8a322eb00be 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -2815,6 +2815,7 @@ EXPORT_SYMBOL_GPL(virtqueue_set_dma_premapped);
+ * virtqueue_reset - detach and recycle all unused buffers
+ * @_vq: the struct virtqueue we're talking about.
+ * @recycle: callback to recycle unused buffers
++ * @recycle_done: callback to be invoked when recycle for all unused buffers done
+ *
+ * Caller must ensure we don't call this with other virtqueue operations
+ * at the same time (except where noted).
+@@ -2826,7 +2827,8 @@ EXPORT_SYMBOL_GPL(virtqueue_set_dma_premapped);
+ * -EPERM: Operation not permitted
+ */
+ int virtqueue_reset(struct virtqueue *_vq,
+- void (*recycle)(struct virtqueue *vq, void *buf))
++ void (*recycle)(struct virtqueue *vq, void *buf),
++ void (*recycle_done)(struct virtqueue *vq))
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+ int err;
+@@ -2834,6 +2836,8 @@ int virtqueue_reset(struct virtqueue *_vq,
+ err = virtqueue_disable_and_recycle(_vq, recycle);
+ if (err)
+ return err;
++ if (recycle_done)
++ recycle_done(_vq);
+
+ if (vq->packed_ring)
+ virtqueue_reinit_packed(vq);
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 73c8922e69e09..d791d47eb00ed 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -103,7 +103,8 @@ int virtqueue_resize(struct virtqueue *vq, u32 num,
+ void (*recycle)(struct virtqueue *vq, void *buf),
+ void (*recycle_done)(struct virtqueue *vq));
+ int virtqueue_reset(struct virtqueue *vq,
+- void (*recycle)(struct virtqueue *vq, void *buf));
++ void (*recycle)(struct virtqueue *vq, void *buf),
++ void (*recycle_done)(struct virtqueue *vq));
+
+ struct virtio_admin_cmd {
+ __le16 opcode;
+--
+2.39.5
+
--- /dev/null
+From f581625e26e4dd9287c4a3aeadf2b07b36a5a626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 10:14:56 -0500
+Subject: vsock/test: Fix occasional failure in SIOCOUTQ tests
+
+From: Konstantin Shkolnyy <kshk@linux.ibm.com>
+
+[ Upstream commit 7fd7ad6f36af36f30a06d165eff3780cb139fa79 ]
+
+These tests:
+ "SOCK_STREAM ioctl(SIOCOUTQ) 0 unsent bytes"
+ "SOCK_SEQPACKET ioctl(SIOCOUTQ) 0 unsent bytes"
+output: "Unexpected 'SIOCOUTQ' value, expected 0, got 64 (CLIENT)".
+
+They test that the SIOCOUTQ ioctl reports 0 unsent bytes after the data
+have been received by the other side. However, sometimes there is a delay
+in updating this "unsent bytes" counter, and the test fails even though
+the counter properly goes to 0 several milliseconds later.
+
+The delay occurs in the kernel because the used buffer notification
+callback virtio_vsock_tx_done(), called upon receipt of the data by the
+other side, doesn't update the counter itself. It delegates that to
+a kernel thread (via vsock->tx_work). Sometimes that thread is delayed
+more than the test expects.
+
+Change the test to poll SIOCOUTQ until it returns 0 or a timeout occurs.
+
+Signed-off-by: Konstantin Shkolnyy <kshk@linux.ibm.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Fixes: 18ee44ce97c1 ("test/vsock: add ioctl unsent bytes test")
+Link: https://patch.msgid.link/20250507151456.2577061-1-kshk@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/vsock/vsock_test.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
+index 0b7f5bf546da5..0c22ff7a8de2a 100644
+--- a/tools/testing/vsock/vsock_test.c
++++ b/tools/testing/vsock/vsock_test.c
+@@ -1283,21 +1283,25 @@ static void test_unsent_bytes_client(const struct test_opts *opts, int type)
+ send_buf(fd, buf, sizeof(buf), 0, sizeof(buf));
+ control_expectln("RECEIVED");
+
+- ret = ioctl(fd, SIOCOUTQ, &sock_bytes_unsent);
+- if (ret < 0) {
+- if (errno == EOPNOTSUPP) {
+- fprintf(stderr, "Test skipped, SIOCOUTQ not supported.\n");
+- } else {
++ /* SIOCOUTQ isn't guaranteed to instantly track sent data. Even though
++ * the "RECEIVED" message means that the other side has received the
++ * data, there can be a delay in our kernel before updating the "unsent
++ * bytes" counter. Repeat SIOCOUTQ until it returns 0.
++ */
++ timeout_begin(TIMEOUT);
++ do {
++ ret = ioctl(fd, SIOCOUTQ, &sock_bytes_unsent);
++ if (ret < 0) {
++ if (errno == EOPNOTSUPP) {
++ fprintf(stderr, "Test skipped, SIOCOUTQ not supported.\n");
++ break;
++ }
+ perror("ioctl");
+ exit(EXIT_FAILURE);
+ }
+- } else if (ret == 0 && sock_bytes_unsent != 0) {
+- fprintf(stderr,
+- "Unexpected 'SIOCOUTQ' value, expected 0, got %i\n",
+- sock_bytes_unsent);
+- exit(EXIT_FAILURE);
+- }
+-
++ timeout_check("SIOCOUTQ");
++ } while (sock_bytes_unsent != 0);
++ timeout_end();
+ close(fd);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 845ec86128cd2593f17bf7afb8a575a9af2f6b32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 11:46:45 -0700
+Subject: wifi: mac80211: Set n_channels after allocating struct
+ cfg80211_scan_request
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 82bbe02b2500ef0a62053fe2eb84773fe31c5a0a ]
+
+Make sure that n_channels is set after allocating the
+struct cfg80211_registered_device::int_scan_req member. Seen with
+syzkaller:
+
+UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
+index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')
+
+This was missed in the initial conversions because I failed to locate
+the allocation likely due to the "sizeof(void *)" not matching the
+"channels" array type.
+
+Reported-by: syzbot+4bcdddd48bb6f0be0da1@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/lkml/680fd171.050a0220.2b69d1.045e.GAE@google.com/
+Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
+Signed-off-by: Kees Cook <kees@kernel.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://patch.msgid.link/20250509184641.work.542-kees@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index ee1211a213d70..caedc939eea19 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1344,10 +1344,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);
+
+
+- local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
+- sizeof(void *) * channels, GFP_KERNEL);
++ local->int_scan_req = kzalloc(struct_size(local->int_scan_req,
++ channels, channels),
++ GFP_KERNEL);
+ if (!local->int_scan_req)
+ return -ENOMEM;
++ local->int_scan_req->n_channels = channels;
+
+ eth_broadcast_addr(local->int_scan_req->bssid);
+
+--
+2.39.5
+
--- /dev/null
+From d5739aa7de3eb34b07c51ff012574ca46a581206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 15:56:30 +0300
+Subject: xhci: dbc: Avoid event polling busyloop if pending rx transfers are
+ inactive.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit cab63934c33b12c0d1e9f4da7450928057f2c142 ]
+
+Event polling delay is set to 0 if there are any pending requests in
+either rx or tx requests lists. Checking for pending requests does
+not work well for "IN" transfers as the tty driver always queues
+requests to the list and TRBs to the ring, preparing to receive data
+from the host.
+
+This causes unnecessary busylooping and cpu hogging.
+
+Only set the event polling delay to 0 if there are pending tx "write"
+transfers, or if it was less than 10ms since last active data transfer
+in any direction.
+
+Cc: Łukasz Bartosik <ukaszb@chromium.org>
+Fixes: fb18e5bb9660 ("xhci: dbc: poll at different rate depending on data transfer activity")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250505125630.561699-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++---
+ drivers/usb/host/xhci-dbgcap.h | 3 +++
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
+index 6b239b3770d15..d35f3a18dd13b 100644
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -822,6 +822,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
+ {
+ dma_addr_t deq;
+ union xhci_trb *evt;
++ enum evtreturn ret = EVT_DONE;
+ u32 ctrl, portsc;
+ bool update_erdp = false;
+
+@@ -906,6 +907,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
+ break;
+ case TRB_TYPE(TRB_TRANSFER):
+ dbc_handle_xfer_event(dbc, evt);
++ ret = EVT_XFER_DONE;
+ break;
+ default:
+ break;
+@@ -924,7 +926,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
+ lo_hi_writeq(deq, &dbc->regs->erdp);
+ }
+
+- return EVT_DONE;
++ return ret;
+ }
+
+ static void xhci_dbc_handle_events(struct work_struct *work)
+@@ -933,6 +935,7 @@ static void xhci_dbc_handle_events(struct work_struct *work)
+ struct xhci_dbc *dbc;
+ unsigned long flags;
+ unsigned int poll_interval;
++ unsigned long busypoll_timelimit;
+
+ dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
+ poll_interval = dbc->poll_interval;
+@@ -951,11 +954,21 @@ static void xhci_dbc_handle_events(struct work_struct *work)
+ dbc->driver->disconnect(dbc);
+ break;
+ case EVT_DONE:
+- /* set fast poll rate if there are pending data transfers */
++ /*
++ * Set fast poll rate if there are pending out transfers, or
++ * a transfer was recently processed
++ */
++ busypoll_timelimit = dbc->xfer_timestamp +
++ msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT);
++
+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
+- !list_empty(&dbc->eps[BULK_IN].list_pending))
++ time_is_after_jiffies(busypoll_timelimit))
+ poll_interval = 0;
+ break;
++ case EVT_XFER_DONE:
++ dbc->xfer_timestamp = jiffies;
++ poll_interval = 0;
++ break;
+ default:
+ dev_info(dbc->dev, "stop handling dbc events\n");
+ return;
+diff --git a/drivers/usb/host/xhci-dbgcap.h b/drivers/usb/host/xhci-dbgcap.h
+index 9dc8f4d8077cc..47ac72c2286d9 100644
+--- a/drivers/usb/host/xhci-dbgcap.h
++++ b/drivers/usb/host/xhci-dbgcap.h
+@@ -96,6 +96,7 @@ struct dbc_ep {
+ #define DBC_WRITE_BUF_SIZE 8192
+ #define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
+ #define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */
++#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */
+ /*
+ * Private structure for DbC hardware state:
+ */
+@@ -142,6 +143,7 @@ struct xhci_dbc {
+ enum dbc_state state;
+ struct delayed_work event_work;
+ unsigned int poll_interval; /* ms */
++ unsigned long xfer_timestamp;
+ unsigned resume_required:1;
+ struct dbc_ep eps[2];
+
+@@ -187,6 +189,7 @@ struct dbc_request {
+ enum evtreturn {
+ EVT_ERR = -1,
+ EVT_DONE,
++ EVT_XFER_DONE,
+ EVT_GSER,
+ EVT_DISC,
+ };
+--
+2.39.5
+
--- /dev/null
+From e502738982aac42e10d05e673529d16c5cfab3c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2024 14:01:38 +0200
+Subject: xhci: dbc: Improve performance by removing delay in transfer event
+ polling.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 03e3d9c2bd85cda941b3cf78e895c1498ac05c5f ]
+
+Queue event polling work with 0 delay in case there are pending transfers
+queued up. This is part 2 of a 3 part series that roughly triples dbc
+performace when using adb push and pull over dbc.
+
+Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s,
+tested with large files (300MB-9GB) by Łukasz Bartosik
+
+First performance improvement patch was commit 31128e7492dc
+("xhci: dbc: add dbgtty request to end of list once it completes")
+
+Cc: Łukasz Bartosik <ukaszb@chromium.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20241227120142.1035206-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cab63934c33b ("xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
+index 241d7aa1fbc20..6b239b3770d15 100644
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -954,7 +954,7 @@ static void xhci_dbc_handle_events(struct work_struct *work)
+ /* set fast poll rate if there are pending data transfers */
+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
+ !list_empty(&dbc->eps[BULK_IN].list_pending))
+- poll_interval = 1;
++ poll_interval = 0;
+ break;
+ default:
+ dev_info(dbc->dev, "stop handling dbc events\n");
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
