--- /dev/null
+From 0372cc5776e7fd5570884aed0c1e9a8a546cad66 Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Thu, 5 Mar 2026 13:06:16 -0500
+Subject: ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply property
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit 0372cc5776e7fd5570884aed0c1e9a8a546cad66 upstream.
+
+The dc-supply property is non-existent in Linux now, nor when this DTS file
+was created when importing it from Variscite own kernel.
+
+Therefore remove it to fix this warning:
+
+ imx6ul-var-som-concerto.dtb: cpu@0 (arm,cortex-a7): Unevaluated
+ properties are not allowed ('dc-supply' was unexpected)
+ from schema $id: http://devicetree.org/schemas/arm/cpus.yaml
+
+Fixes: 9d6a67d9c7a9 ("ARM: dts: imx6ul: Add Variscite VAR-SOM-MX6UL SoM support")
+Cc: stable@kernel.org
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6ul-var-som.dtsi | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/arch/arm/boot/dts/nxp/imx/imx6ul-var-som.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6ul-var-som.dtsi
+@@ -45,10 +45,6 @@
+ assigned-clock-rates = <786432000>;
+ };
+
+-&cpu0 {
+- dc-supply = <®_gpio_dvfs>;
+-};
+-
+ &fec1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet1>, <&pinctrl_enet1_gpio>, <&pinctrl_enet1_mdio>;
--- /dev/null
+From c84f22405085d91cd5f0c5b967318371c07904ba Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:17 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference
+
+From: David Jander <david@protonic.nl>
+
+commit c84f22405085d91cd5f0c5b967318371c07904ba upstream.
+
+Switch the ADC reference supply from the general 3.3V rail to the
+internal 2.5V VREFBUF regulator. The ADC circuits on this board are
+designed for the internal 2.5V reference. Without this change, all ADC
+measurement values are incorrect.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20260318105123.819807-2-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -95,7 +95,7 @@
+ pinctrl-names = "default";
+ vdd-supply = <&v3v3>;
+ vdda-supply = <&v3v3>;
+- vref-supply = <&v3v3>;
++ vref-supply = <&vrefbuf>;
+ status = "okay";
+ };
+
+@@ -362,6 +362,13 @@
+ phy-supply = <&v3v3>;
+ };
+
++&vrefbuf {
++ regulator-min-microvolt = <2500000>;
++ regulator-max-microvolt = <2500000>;
++ vdda-supply = <&v3v3>;
++ status = "okay";
++};
++
+ &pinctrl {
+ adc12_pins_mecsbc: adc12-ain-mecsbc-0 {
+ pins {
--- /dev/null
+From 8407e611faf80ce790a393addf7b44cc595742af Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:18 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times
+
+From: David Jander <david@protonic.nl>
+
+commit 8407e611faf80ce790a393addf7b44cc595742af upstream.
+
+Increase the minimum ADC sample times for all configured channels on
+ADC1 and ADC2 to ensure measurement accuracy meets specifications.
+
+The default 5us sample time is insufficient for the internal sampling
+capacitor to fully charge. Increase the default time to 20us to relax
+the input impedance requirements.
+
+Additionally, the phint0_ain and phint1_ain channels require a much
+longer sampling period due to their specific circuit design. Increase
+their sample times to 200us. Remove stale comments regarding clock
+cycles that no longer match the updated timings.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20260318105123.819807-3-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 32 +++++++++++--------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -104,80 +104,79 @@
+
+ channel@0 {
+ reg = <0>;
+- /* 16.5 ck_cycles sampling time */
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "p24v_stp";
+ };
+
+ channel@1 {
+ reg = <1>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "p24v_hpdcm";
+ };
+
+ channel@2 {
+ reg = <2>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "ain0";
+ };
+
+ channel@3 {
+ reg = <3>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpdcm1_i2";
+ };
+
+ channel@5 {
+ reg = <5>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpout1_i";
+ };
+
+ channel@6 {
+ reg = <6>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "ain1";
+ };
+
+ channel@9 {
+ reg = <9>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpout0_i";
+ };
+
+ channel@10 {
+ reg = <10>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <200000>;
+ label = "phint0_ain";
+ };
+
+ channel@13 {
+ reg = <13>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <200000>;
+ label = "phint1_ain";
+ };
+
+ channel@15 {
+ reg = <15>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpdcm0_i1";
+ };
+
+ channel@16 {
+ reg = <16>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "lsin";
+ };
+
+ channel@18 {
+ reg = <18>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpdcm0_i2";
+ };
+
+ channel@19 {
+ reg = <19>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "hpdcm1_i1";
+ };
+ };
+@@ -187,14 +186,13 @@
+
+ channel@2 {
+ reg = <2>;
+- /* 16.5 ck_cycles sampling time */
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "ain2";
+ };
+
+ channel@6 {
+ reg = <6>;
+- st,min-sample-time-ns = <5000>;
++ st,min-sample-time-ns = <20000>;
+ label = "ain3";
+ };
+ };
--- /dev/null
+From dfb93c4acce8ad9c4f573128b2cf7ddb936e0de7 Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:22 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo
+
+From: David Jander <david@protonic.nl>
+
+commit dfb93c4acce8ad9c4f573128b2cf7ddb936e0de7 upstream.
+
+Fix a copy-paste error in the GPIO line names for the TCA6416 expander
+(gpio@20).
+
+The common mecio1-io include file was originally defined using the
+mecio1r1 (Revision 1) hardware layout, but incorrectly labeled pin 13
+as "HSIN9_BIAS" instead of the actual "HSIN7_BIAS" present in the
+schematics.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20260318105123.819807-7-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -186,7 +186,7 @@
+ #gpio-cells = <2>;
+ gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS",
+ "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL",
+- "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN9_BIAS",
++ "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS",
+ "", "", "", "";
+ };
+
--- /dev/null
+From b04ccecb714de913e360f0866c66f38e1606e89b Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:20 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo
+
+From: David Jander <david@protonic.nl>
+
+commit b04ccecb714de913e360f0866c66f38e1606e89b upstream.
+
+The reset pins for the LPOUT lines were incorrectly prefixed with "GPOUT"
+instead of "LPOUT" in the gpio-line-names array. Fix these typos so the
+pin names consistently match the LPOUT0-4 signals they belong to.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20260318105123.819807-5-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -185,14 +185,14 @@
+ &gpioe {
+ gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "",
+ "", "", "HPOUT1_RESETN",
+- "LPOUT0", "LPOUT0_ALERTN", "GPOUT0_RESETN",
+- "LPOUT1", "LPOUT1_ALERTN", "GPOUT1_RESETN",
+- "LPOUT2", "LPOUT2_ALERTN", "GPOUT2_RESETN";
++ "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN",
++ "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN",
++ "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN";
+ };
+
+ &gpiof {
+- gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "GPOUT3_RESETN",
+- "LPOUT4", "LPOUT4_ALERTN", "GPOUT4_RESETN",
++ gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN",
++ "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN",
+ "", "",
+ "", "", "", "",
+ "", "", "", "";
--- /dev/null
+From 70f1d8fcbd121a40f51b6c846d41e8cbb38ba210 Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:19 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files
+
+From: David Jander <david@protonic.nl>
+
+commit 70f1d8fcbd121a40f51b6c846d41e8cbb38ba210 upstream.
+
+Move the divergent adc1 channel definitions out of the common
+mecio1-io.dtsi file and into the specific Revision 0 and Revision 1
+board files.
+
+The original common file contained incorrect schematic labels for the
+Revision 0 hardware (e.g., labeling ana0 as p24v_hpdcm instead of
+ain_aux0) and failed to account for physical signal routing changes
+between the board revisions.
+
+Retain only the strictly shared channels in the common include file. Map
+the correct channels and schematic labels directly within
+stm32mp151c-mecio1r0.dts and stm32mp153c-mecio1r1.dts.
+
+Crucially, ensure that the required 200us sample time follows the
+phint1_ain signal to its new physical location on channel 3 for the
+Revision 1 hardware.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20260318105123.819807-4-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 50 +++++++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 50 +++++++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 50 -------------------------
+ 3 files changed, 101 insertions(+), 49 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
+@@ -36,6 +36,56 @@
+ };
+ };
+
++&adc1 {
++ channel@0 {
++ reg = <0>;
++ st,min-sample-time-ns = <20000>;
++ label = "ain_aux0";
++ };
++
++ channel@1 {
++ reg = <1>;
++ st,min-sample-time-ns = <20000>;
++ label = "ain_aux1";
++ };
++
++ channel@3 {
++ reg = <3>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm1_i2";
++ };
++
++ channel@5 {
++ reg = <5>;
++ st,min-sample-time-ns = <20000>;
++ label = "pout1_i";
++ };
++
++ channel@9 {
++ reg = <9>;
++ st,min-sample-time-ns = <20000>;
++ label = "pout0_i";
++ };
++
++ channel@13 {
++ reg = <13>;
++ st,min-sample-time-ns = <200000>;
++ label = "phint1_ain";
++ };
++
++ channel@15 {
++ reg = <15>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm0_i1";
++ };
++
++ channel@18 {
++ reg = <18>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm0_i2";
++ };
++};
++
+ &clk_hse {
+ clock-frequency = <25000000>;
+ };
+--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
+@@ -36,6 +36,56 @@
+ };
+ };
+
++&adc1 {
++ channel@0 {
++ reg = <0>;
++ st,min-sample-time-ns = <20000>;
++ label = "p24v_hpdcm";
++ };
++
++ channel@1 {
++ reg = <1>;
++ st,min-sample-time-ns = <20000>;
++ label = "p24v_stp";
++ };
++
++ channel@3 {
++ reg = <3>;
++ st,min-sample-time-ns = <200000>;
++ label = "phint1_ain";
++ };
++
++ channel@5 {
++ reg = <5>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpout1_i";
++ };
++
++ channel@9 {
++ reg = <9>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpout0_i";
++ };
++
++ channel@13 {
++ reg = <13>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm0_i2";
++ };
++
++ channel@15 {
++ reg = <15>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm1_i2";
++ };
++
++ channel@18 {
++ reg = <18>;
++ st,min-sample-time-ns = <20000>;
++ label = "hpdcm0_i1";
++ };
++};
++
+ &clk_hse {
+ clock-frequency = <24000000>;
+ };
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -90,7 +90,7 @@
+ };
+
+ &adc {
+- /* ANA0, ANA1 are dedicated pins and don't need pinctrl: only in6. */
++ /* ANA0, ANA1 are dedicated pins and don't need pinctrl. */
+ pinctrl-0 = <&adc12_pins_mecsbc>;
+ pinctrl-names = "default";
+ vdd-supply = <&v3v3>;
+@@ -102,78 +102,30 @@
+ &adc1 {
+ status = "okay";
+
+- channel@0 {
+- reg = <0>;
+- st,min-sample-time-ns = <20000>;
+- label = "p24v_stp";
+- };
+-
+- channel@1 {
+- reg = <1>;
+- st,min-sample-time-ns = <20000>;
+- label = "p24v_hpdcm";
+- };
+-
+ channel@2 {
+ reg = <2>;
+ st,min-sample-time-ns = <20000>;
+ label = "ain0";
+ };
+
+- channel@3 {
+- reg = <3>;
+- st,min-sample-time-ns = <20000>;
+- label = "hpdcm1_i2";
+- };
+-
+- channel@5 {
+- reg = <5>;
+- st,min-sample-time-ns = <20000>;
+- label = "hpout1_i";
+- };
+-
+ channel@6 {
+ reg = <6>;
+ st,min-sample-time-ns = <20000>;
+ label = "ain1";
+ };
+
+- channel@9 {
+- reg = <9>;
+- st,min-sample-time-ns = <20000>;
+- label = "hpout0_i";
+- };
+-
+ channel@10 {
+ reg = <10>;
+ st,min-sample-time-ns = <200000>;
+ label = "phint0_ain";
+ };
+
+- channel@13 {
+- reg = <13>;
+- st,min-sample-time-ns = <200000>;
+- label = "phint1_ain";
+- };
+-
+- channel@15 {
+- reg = <15>;
+- st,min-sample-time-ns = <20000>;
+- label = "hpdcm0_i1";
+- };
+-
+ channel@16 {
+ reg = <16>;
+ st,min-sample-time-ns = <20000>;
+ label = "lsin";
+ };
+
+- channel@18 {
+- reg = <18>;
+- st,min-sample-time-ns = <20000>;
+- label = "hpdcm0_i2";
+- };
+-
+ channel@19 {
+ reg = <19>;
+ st,min-sample-time-ns = <20000>;
--- /dev/null
+From a0d6c2a06fffff47bcca4d5bfdab4cc428a315fc Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:23 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files
+
+From: David Jander <david@protonic.nl>
+
+commit a0d6c2a06fffff47bcca4d5bfdab4cc428a315fc upstream.
+
+Move the gpio-line-names properties for the I2C GPIO expanders (gpio0
+and gpio1) out of the common mecio1-io.dtsi file and into the specific
+board dts files.
+
+The layout originally defined in the common include file belonged to the
+mecio1r1 (Revision 1) hardware. This layout is moved 1:1 into the
+stm32mp153c-mecio1r1.dts file.
+
+The mecio1r0 (Revision 0) hardware utilizes a completely different
+pinout for these expanders. A new, accurate mapping reflecting the
+Revision 0 schematics is added to stm32mp151c-mecio1r0.dts.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20260318105123.819807-8-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 14 ++++++++++++++
+ arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 14 ++++++++++++++
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 8 --------
+ 3 files changed, 28 insertions(+), 8 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
+@@ -97,6 +97,20 @@
+ st,eth-clk-sel;
+ };
+
++&gpio0 {
++ gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS",
++ "HSIN4_BIAS", "", "STP_VREF0_LVL", "HSIN_VREF0_LVL",
++ "STP0_FB_BIAS", "STP1_FB_BIAS", "STP2_FB_BIAS", "STP3_FB_BIAS",
++ "", "", "", "";
++};
++
++&gpio1 {
++ gpio-line-names = "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS", "HSIN8_BIAS",
++ "HSIN9_BIAS", "", "STP_VREF1_LVL", "HSIN_VREF1_LVL",
++ "STP4_FB_BIAS", "STP5_FB_BIAS", "STP6_FB_BIAS", "",
++ "", "", "LSIN8_BIAS", "LSIN9_BIAS";
++};
++
+ &gpiod {
+ gpio-line-names = "", "", "", "",
+ "", "", "", "",
+--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
+@@ -90,6 +90,20 @@
+ clock-frequency = <24000000>;
+ };
+
++&gpio0 {
++ gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS",
++ "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL",
++ "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS",
++ "", "", "", "";
++};
++
++&gpio1 {
++ gpio-line-names = "HSIN8_BIAS", "HSIN9_BIAS", "HSIN10_BIAS", "HSIN11_BIAS",
++ "", "", "HSIN_VREF2_LVL", "HSIN_VREF3_LVL",
++ "HSIN12_BIAS", "HSIN13_BIAS", "HSIN14_BIAS", "HSIN15_BIAS",
++ "", "", "LSIN8_BIAS", "LSIN9_BIAS";
++};
++
+ &gpioa {
+ gpio-line-names = "", "", "", "",
+ "", "", "", "",
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -184,10 +184,6 @@
+ reg = <0x20>;
+ gpio-controller;
+ #gpio-cells = <2>;
+- gpio-line-names = "HSIN0_BIAS", "HSIN1_BIAS", "HSIN2_BIAS", "HSIN3_BIAS",
+- "", "", "HSIN_VREF0_LVL", "HSIN_VREF1_LVL",
+- "HSIN4_BIAS", "HSIN5_BIAS", "HSIN6_BIAS", "HSIN7_BIAS",
+- "", "", "", "";
+ };
+
+ gpio1: gpio@21 {
+@@ -195,10 +191,6 @@
+ reg = <0x21>;
+ gpio-controller;
+ #gpio-cells = <2>;
+- gpio-line-names = "HSIN8_BIAS", "HSIN9_BIAS", "HSIN10_BIAS", "HSIN11_BIAS",
+- "", "", "HSIN_VREF2_LVL", "HSIN_VREF3_LVL",
+- "HSIN12_BIAS", "HSIN13_BIAS", "HSIN14_BIAS", "HSIN15_BIAS",
+- "", "", "LSIN8_BIAS", "LSIN9_BIAS";
+ };
+ };
+
--- /dev/null
+From 4f5069609ac99894c0632d8b8c4c016f85199de9 Mon Sep 17 00:00:00 2001
+From: David Jander <david@protonic.nl>
+Date: Wed, 18 Mar 2026 11:51:21 +0100
+Subject: ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files
+
+From: David Jander <david@protonic.nl>
+
+commit 4f5069609ac99894c0632d8b8c4c016f85199de9 upstream.
+
+Move the gpio-line-names properties out of the common mecio1-io.dtsi file
+and into the specific board dts files.
+
+The pinout originally defined in the common include file belonged to the
+mecio1r0 (Revision 0) hardware. This is moved 1:1 into the
+stm32mp151c-mecio1r0.dts file without any modifications.
+
+A large number of GPIO pins are swapped on the mecio1r1 (Revision 1)
+hardware, so a new, board-specific gpio-line-names mapping is added to
+stm32mp153c-mecio1r1.dts to reflect those hardware changes.
+
+Fixes: 8267753c891c ("ARM: dts: stm32: Add MECIO1 and MECT1S board variants")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20260318105123.819807-6-o.rempel@pengutronix.de
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts | 64 ++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts | 80 +++++++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi | 63 -------------------
+ 3 files changed, 144 insertions(+), 63 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
++++ b/arch/arm/boot/dts/st/stm32mp151c-mecio1r0.dts
+@@ -96,3 +96,67 @@
+ assigned-clock-rates = <125000000>; /* Clock PLL3 to 625Mhz in tf-a. */
+ st,eth-clk-sel;
+ };
++
++&gpiod {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "", "", "",
++ "STP_RESETN", "STP_ENABLEN", "HPOUT0", "HPOUT0_ALERTN";
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_hog_d_mecsbc>;
++};
++
++&gpioe {
++ gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "",
++ "", "", "HPOUT1_RESETN",
++ "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN",
++ "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN",
++ "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN";
++};
++
++&gpiof {
++ gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN",
++ "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN",
++ "", "",
++ "", "", "", "",
++ "", "", "", "";
++};
++
++&gpiog {
++ gpio-line-names = "LPOUT5", "LPOUT5_ALERTN", "", "LPOUT5_RESETN",
++ "", "", "", "",
++ "", "", "", "",
++ "", "", "", "";
++};
++
++&gpioh {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "GPIO0_RESETN", "", "", "",
++ "", "", "", "";
++};
++
++&gpioi {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "HPDCM0_SLEEPN", "HPDCM1_SLEEPN", "GPIO1_RESETN", "",
++ "", "", "", "";
++};
++
++&gpioj {
++ gpio-line-names = "HSIN10", "HSIN11", "HSIN12", "HSIN13",
++ "HSIN14", "HSIN15", "", "",
++ "", "", "", "",
++ "", "RTD_RESETN", "", "";
++};
++
++&gpiok {
++ gpio-line-names = "", "", "HSIN0", "HSIN1",
++ "HSIN2", "HSIN3", "HSIN4", "HSIN5";
++};
++
++&gpioz {
++ gpio-line-names = "", "", "", "HSIN6",
++ "HSIN7", "HSIN8", "HSIN9", "";
++};
++
+--- a/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
++++ b/arch/arm/boot/dts/st/stm32mp153c-mecio1r1.dts
+@@ -90,6 +90,86 @@
+ clock-frequency = <24000000>;
+ };
+
++&gpioa {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "", "GPIO1_RESETN", "",
++ "", "", "", "LPOUT5";
++};
++
++&gpiob {
++ gpio-line-names = "", "", "", "",
++ "LPOUT4_RESETN", "", "", "",
++ "", "LPOUT4_ALERTN", "", "",
++ "", "", "", "";
++};
++
++&gpioc {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "LPOUT4", "", "",
++ "", "", "", "";
++};
++
++&gpiod {
++ gpio-line-names = "LPOUT2", "", "LPOUT3_RESETN", "",
++ "LPOUT2_ALERTN", "", "MECIO_ADDR0", "",
++ "HPOUT1_ALERTN", "HPOUT1_RESETN", "", "",
++ "", "", "HPOUT0", "HPOUT1";
++};
++
++&gpioe {
++ gpio-line-names = "LPOUT0_RESETN", "", "", "",
++ "", "LPOUT3", "LPOUT5_ALERTN", "",
++ "", "", "", "",
++ "", "", "", "HSIN_RESETN";
++};
++
++&gpiof {
++ gpio-line-names = "LPOUT5_RESETN", "", "", "HPOUT0_ALERTN",
++ "", "LPOUT1", "", "",
++ "", "", "", "",
++ "", "", "", "";
++};
++
++&gpiog {
++ gpio-line-names = "", "", "", "HPOUT0_RESETN",
++ "", "", "LPOUT3_ALERTN", "",
++ "", "", "GPIO0_RESETN", "",
++ "", "", "", "LPOUT2_RESETN";
++};
++
++&gpioh {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "LPOUT0", "", "",
++ "", "LPOUT0_ALERTN", "STP_ENABLEN", "STP_RESETN";
++};
++
++&gpioi {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "", "SPE_RESETN", "",
++ "HPDCM0_SLEEPN", "", "", "";
++};
++
++&gpioj {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "MECIO_ADDR1",
++ "", "", "", "",
++ "", "", "", "LPOUT1_RESETN";
++};
++
++&gpiok {
++ gpio-line-names = "", "", "RTD_RESETN", "",
++ "", "LPOUT1_ALERTN", "", "";
++};
++
++&gpioz {
++ gpio-line-names = "", "", "", "",
++ "HPDCM1_SLEEPN", "", "", "";
++};
++
+ &m_can1 {
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&m_can1_pins_b>;
+--- a/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp15x-mecio1-io.dtsi
+@@ -173,69 +173,6 @@
+ };
+ };
+
+-&gpiod {
+- gpio-line-names = "", "", "", "",
+- "", "", "", "",
+- "", "", "", "",
+- "STP_RESETN", "STP_ENABLEN", "HPOUT0", "HPOUT0_ALERTN";
+- pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_hog_d_mecsbc>;
+-};
+-
+-&gpioe {
+- gpio-line-names = "HPOUT0_RESETN", "HPOUT1", "HPOUT1_ALERTN", "",
+- "", "", "HPOUT1_RESETN",
+- "LPOUT0", "LPOUT0_ALERTN", "LPOUT0_RESETN",
+- "LPOUT1", "LPOUT1_ALERTN", "LPOUT1_RESETN",
+- "LPOUT2", "LPOUT2_ALERTN", "LPOUT2_RESETN";
+-};
+-
+-&gpiof {
+- gpio-line-names = "LPOUT3", "LPOUT3_ALERTN", "LPOUT3_RESETN",
+- "LPOUT4", "LPOUT4_ALERTN", "LPOUT4_RESETN",
+- "", "",
+- "", "", "", "",
+- "", "", "", "";
+-};
+-
+-&gpiog {
+- gpio-line-names = "LPOUT5", "LPOUT5_ALERTN", "", "LPOUT5_RESETN",
+- "", "", "", "",
+- "", "", "", "",
+- "", "", "", "";
+-};
+-
+-&gpioh {
+- gpio-line-names = "", "", "", "",
+- "", "", "", "",
+- "GPIO0_RESETN", "", "", "",
+- "", "", "", "";
+-};
+-
+-&gpioi {
+- gpio-line-names = "", "", "", "",
+- "", "", "", "",
+- "HPDCM0_SLEEPN", "HPDCM1_SLEEPN", "GPIO1_RESETN", "",
+- "", "", "", "";
+-};
+-
+-&gpioj {
+- gpio-line-names = "HSIN10", "HSIN11", "HSIN12", "HSIN13",
+- "HSIN14", "HSIN15", "", "",
+- "", "", "", "",
+- "", "RTD_RESETN", "", "";
+-};
+-
+-&gpiok {
+- gpio-line-names = "", "", "HSIN0", "HSIN1",
+- "HSIN2", "HSIN3", "HSIN4", "HSIN5";
+-};
+-
+-&gpioz {
+- gpio-line-names = "", "", "", "HSIN6",
+- "HSIN7", "HSIN8", "HSIN9", "";
+-};
+-
+ &i2c2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2_pins_a>;
--- /dev/null
+From b4f5c46163b3fe3ec7ed8a76dff8b7e80a776a1f Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Date: Mon, 13 Apr 2026 11:07:24 +0200
+Subject: arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+
+commit b4f5c46163b3fe3ec7ed8a76dff8b7e80a776a1f upstream.
+
+IRQ_TYPE_xxx flags are not correct in the context of GPIO flags.
+These are simple defines so they could be used in DTS but they will not
+have the same meaning: IRQ_TYPE_EDGE_FALLING = 2 = GPIO_SINGLE_ENDED.
+
+Correct the Type-C int-gpios to use proper flags, assuming the author of
+the code wanted similar logical behavior:
+
+ IRQ_TYPE_EDGE_FALLING => GPIO_ACTIVE_LOW
+
+Fixes: c4b4593ecb0b ("arm64: dts: imx8ulp-evk: enable usb nodes and add ptn5150 nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8ulp-evk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts
++++ b/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts
+@@ -166,7 +166,7 @@
+ ptn5150_1: typec@1d {
+ compatible = "nxp,ptn5150";
+ reg = <0x1d>;
+- int-gpios = <&gpiof 3 IRQ_TYPE_EDGE_FALLING>;
++ int-gpios = <&gpiof 3 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_typec1>;
+ status = "disabled";
+@@ -182,7 +182,7 @@
+ ptn5150_2: typec@3d {
+ compatible = "nxp,ptn5150";
+ reg = <0x3d>;
+- int-gpios = <&gpiof 5 IRQ_TYPE_EDGE_FALLING>;
++ int-gpios = <&gpiof 5 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_typec2>;
+ status = "disabled";
--- /dev/null
+From ce414263e9ebe5080381a50cbdf9065c29816202 Mon Sep 17 00:00:00 2001
+From: Nickolay Goppen <setotau@mainlining.org>
+Date: Wed, 29 Apr 2026 12:30:11 +0300
+Subject: arm64: dts: qcom: sdm630: describe adsp_mem region properly
+
+From: Nickolay Goppen <setotau@mainlining.org>
+
+commit ce414263e9ebe5080381a50cbdf9065c29816202 upstream.
+
+Downstream [1] this region is marked as shared, reusable and dynamic so
+describe it that way.
+
+[1]: https://github.com/xiaomi-sdm660/android_kernel_xiaomi_sdm660/blob/11-EAS/arch/arm/boot/dts/qcom/sdm660.dtsi#L448
+
+Fixes: b190fb010664 ("arm64: dts: qcom: sdm630: Add sdm630 dts file")
+Cc: stable@vger.kernel.org
+Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Nickolay Goppen <setotau@mainlining.org>
+Link: https://lore.kernel.org/r/20260429-qcom-sdm660-cdsp-adsp-fastrpc-dts-fix-v5-4-16bc82e622ad@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
+@@ -494,9 +494,12 @@
+ no-map;
+ };
+
+- adsp_mem: adsp-region@f6000000 {
+- reg = <0x0 0xf6000000 0x0 0x800000>;
+- no-map;
++ adsp_mem: adsp-region {
++ compatible = "shared-dma-pool";
++ alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
++ alignment = <0x0 0x400000>;
++ size = <0x0 0x800000>;
++ reusable;
+ };
+
+ qseecom_mem: qseecom-region@f6800000 {
--- /dev/null
+From ae653cb854f36d1555681ce70ca3d80d0ec73516 Mon Sep 17 00:00:00 2001
+From: Quentin Schulz <quentin.schulz@cherry.de>
+Date: Tue, 21 Apr 2026 11:45:06 +0200
+Subject: arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
+
+From: Quentin Schulz <quentin.schulz@cherry.de>
+
+commit ae653cb854f36d1555681ce70ca3d80d0ec73516 upstream.
+
+When not passing the PHY ID with an ethernet-phy-idX.Y compatible
+property, the MDIO bus will attempt to auto-detect the PHY by reading
+its registers and then probing the appropriate driver. For this to work,
+the PHY needs to be in a working state.
+
+Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
+attempting to auto-detect the PHY. This means the PHY needs to be in a
+working state when entering the Linux kernel. This historically has been
+the case for this device, but only because the bootloader was taking
+care of initializing the Ethernet controller even when not using it.
+We're attempting to support the removal of the network stack in the
+bootloader, which means the Linux kernel will be entered with the PHY
+still in reset and now Ethernet doesn't work anymore.
+
+The devices in the field only ever had a TI DP83825, so let's simply
+bypass the auto-detection mechanism entirely by passing the appropriate
+PHY IDs via the compatible.
+
+Note that this is only an issue since commit e463625af7f9 ("arm64: dts:
+rockchip: move reset to dedicated eth-phy node on ringneck") as before
+that commit the reset was done by the MAC controller before starting the
+MDIO auto-detection mechanism, via the snps,reset-* properties.
+
+Cc: stable@vger.kernel.org
+Fixes: e463625af7f9 ("arm64: dts: rockchip: move reset to dedicated eth-phy node on ringneck")
+Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
+Link: https://patch.msgid.link/20260421-px30-eth-phy-v2-2-68c375b120fd@cherry.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+@@ -344,7 +344,7 @@
+
+ &mdio {
+ dp83825: ethernet-phy@0 {
+- compatible = "ethernet-phy-ieee802.3-c22";
++ compatible = "ethernet-phy-id2000.a140";
+ reg = <0x0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&phy_rst>;
--- /dev/null
+From 65210e81f7837a871a17237d15e4b1191d5e8771 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Date: Thu, 28 May 2026 14:03:24 +0200
+Subject: arm64: dts: s32g3: Fix SWT8 watchdog address
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+
+commit 65210e81f7837a871a17237d15e4b1191d5e8771 upstream.
+
+Add missing hex annotation to fix the SWT8 watchdog address in 'reg'
+property, as reported by dtc W=1:
+
+ s32g3.dtsi:863.27-869.5: Warning (simple_bus_reg): /soc@0/watchdog@40500000: simple-bus unit address format error, expected "269fb20"
+
+Lack of hex '0x' meant address would be interpreted as decimal thus
+completely different value used as this device MMIO. If device was
+enabled this could lead to corruption of other device address space and
+broken boot.
+
+Cc: stable@vger.kernel.org
+Fixes: 6db84f042745 ("arm64: dts: s32g3: Add the Software Timer Watchdog (SWT) nodes")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/s32g3.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/s32g3.dtsi
++++ b/arch/arm64/boot/dts/freescale/s32g3.dtsi
+@@ -806,7 +806,7 @@
+
+ swt8: watchdog@40500000 {
+ compatible = "nxp,s32g3-swt", "nxp,s32g2-swt";
+- reg = <40500000 0x1000>;
++ reg = <0x40500000 0x1000>;
+ clocks = <&clks 0x3a>, <&clks 0x3b>, <&clks 0x3b>;
+ clock-names = "counter", "module", "register";
+ status = "disabled";
--- /dev/null
+From d8fe8442366ffd8306575028bda92389d0dfb674 Mon Sep 17 00:00:00 2001
+From: Judith Mendez <jm@ti.com>
+Date: Tue, 24 Mar 2026 09:02:47 -0500
+Subject: arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
+
+From: Judith Mendez <jm@ti.com>
+
+commit d8fe8442366ffd8306575028bda92389d0dfb674 upstream.
+
+Add bootph-all property to vqmmc voltage regulator node and its
+corresponding pinmux node to make it available during all boot
+phases. This allows to run tuning early in SPL stages of boot.
+
+Fixes: 8f023012eb4a ("arm64: dts: ti: k3-am62a: Enable UHS mode support for SD cards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Judith Mendez <jm@ti.com>
+Link: https://patch.msgid.link/20260324140247.1200631-1-jm@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+@@ -154,6 +154,7 @@
+ gpios = <&main_gpio0 31 GPIO_ACTIVE_HIGH>;
+ states = <1800000 0x0>,
+ <3300000 0x1>;
++ bootph-all;
+ };
+
+ leds {
+@@ -396,6 +397,7 @@
+ pinctrl-single,pins = <
+ AM62AX_IOPAD(0x07c, PIN_OUTPUT, 7) /* (N22) GPMC0_CLK.GPIO0_31 */
+ >;
++ bootph-all;
+ };
+
+ main_ecap0_pins_default: main-ecap0-default-pins {
--- /dev/null
+From ae24f6b06e90681ec36b9c21c3f5c09618350f5a Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Wed, 3 Jun 2026 12:06:11 +0100
+Subject: arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit ae24f6b06e90681ec36b9c21c3f5c09618350f5a upstream.
+
+The sve_save_state() and sve_load_state() functions take a 32-bit int
+argument that describes whether to save/restore the FFR. Their assembly
+implementations consume the entire 64-bit register containing this
+32-bit value, and will attempt to save/restore the FFR if any bit of
+that 64-bit register is non-zero.
+
+Per the AAPCS64 parameter passing rules, the callee is responsible for
+any necessary widening, and the upper 32-bits are permitted to contain
+arbitrary values. If the upper 32 bits are non-zero, this could result
+in an unexpected attempt to save/restore the FFR, and consequently could
+lead to unexpected traps/undefs/faults.
+
+In practice compilers are very unlikely to generate code where the upper
+32-bits would be non-zero, but they are permitted to do so.
+
+Fix this by only consuming the low 32 bits of the register, and update
+comments accordingly.
+
+The hyp code __sve_save_state() and __sve_restore_state() functions
+don't have the same latent bug as they override the full 64-bit register
+containing the argument.
+
+Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Fuad Tabba <tabba@google.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Oliver Upton <oupton@kernel.org>
+Cc: Vladimir Murzin <vladimir.murzin@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/entry-fpsimd.S | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/kernel/entry-fpsimd.S
++++ b/arch/arm64/kernel/entry-fpsimd.S
+@@ -38,10 +38,10 @@ SYM_FUNC_END(fpsimd_load_state)
+ *
+ * x0 - pointer to buffer for state
+ * x1 - pointer to storage for FPSR
+- * x2 - Save FFR if non-zero
++ * w2 - Save FFR if non-zero
+ */
+ SYM_FUNC_START(sve_save_state)
+- sve_save 0, x1, x2, 3
++ sve_save 0, x1, w2, 3
+ ret
+ SYM_FUNC_END(sve_save_state)
+
+@@ -50,10 +50,10 @@ SYM_FUNC_END(sve_save_state)
+ *
+ * x0 - pointer to buffer for state
+ * x1 - pointer to storage for FPSR
+- * x2 - Restore FFR if non-zero
++ * w2 - Restore FFR if non-zero
+ */
+ SYM_FUNC_START(sve_load_state)
+- sve_load 0, x1, x2, 4
++ sve_load 0, x1, w2, 4
+ ret
+ SYM_FUNC_END(sve_load_state)
+
--- /dev/null
+From 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Tue, 9 Jun 2026 11:34:57 +0300
+Subject: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 1f97760417b5faa60e9642fd0ed61eb17d0b1b39 upstream.
+
+In sof_ipc3_bytes_put(), the size used for the memcpy is derived from
+the old data->size already in the buffer, not the incoming new data's
+size field. If the new data has a different size, the copy length is
+wrong: it may truncate valid data or copy stale bytes.
+
+Similarly, sof_ipc3_bytes_get() checks data->size against max_size
+without accounting for the sizeof(struct sof_ipc_ctrl_data) offset
+of the flex array within the allocation.
+
+Fix bytes_put to validate and use the incoming data's sof_abi_hdr.size
+from ucontrol before copying. Fix bytes_get to subtract sizeof(*cdata)
+from the bounds check to match the actual available space.
+
+Fixes: 544ac8858f24 ("ASoC: SOF: Add bytes_get/put control IPC ops for IPC3")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20260609083458.31193-6-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc3-control.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/sound/soc/sof/ipc3-control.c
++++ b/sound/soc/sof/ipc3-control.c
+@@ -315,10 +315,13 @@ static int sof_ipc3_bytes_get(struct snd
+ }
+
+ /* be->max has been verified to be >= sizeof(struct sof_abi_hdr) */
+- if (data->size > scontrol->max_size - sizeof(*data)) {
++ if (data->size > scontrol->max_size - sizeof(*cdata) -
++ sizeof(*data)) {
+ dev_err_ratelimited(scomp->dev,
+ "%u bytes of control data is invalid, max is %zu\n",
+- data->size, scontrol->max_size - sizeof(*data));
++ data->size,
++ scontrol->max_size - sizeof(*cdata) -
++ sizeof(*data));
+ return -EINVAL;
+ }
+
+@@ -336,6 +339,8 @@ static int sof_ipc3_bytes_put(struct snd
+ struct sof_ipc_ctrl_data *cdata = scontrol->ipc_control_data;
+ struct snd_soc_component *scomp = scontrol->scomp;
+ struct sof_abi_hdr *data = cdata->data;
++ const struct sof_abi_hdr *new_hdr =
++ (const struct sof_abi_hdr *)ucontrol->value.bytes.data;
+ size_t size;
+
+ if (scontrol->max_size > sizeof(ucontrol->value.bytes.data)) {
+@@ -344,14 +349,18 @@ static int sof_ipc3_bytes_put(struct snd
+ return -EINVAL;
+ }
+
+- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */
+- if (data->size > scontrol->max_size - sizeof(*data)) {
+- dev_err_ratelimited(scomp->dev, "data size too big %u bytes max is %zu\n",
+- data->size, scontrol->max_size - sizeof(*data));
++ /* Validate the new data's size, not the old one */
++ if (new_hdr->size > scontrol->max_size - sizeof(*cdata) -
++ sizeof(*new_hdr)) {
++ dev_err_ratelimited(scomp->dev,
++ "data size too big %u bytes max is %zu\n",
++ new_hdr->size,
++ scontrol->max_size - sizeof(*cdata) -
++ sizeof(*new_hdr));
+ return -EINVAL;
+ }
+
+- size = data->size + sizeof(*data);
++ size = new_hdr->size + sizeof(*new_hdr);
+
+ /* copy from kcontrol */
+ memcpy(data, ucontrol->value.bytes.data, size);
--- /dev/null
+From 8791977d7289f6e9d2b014f60a5455f053a7bc04 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Tue, 9 Jun 2026 11:34:55 +0300
+Subject: ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 8791977d7289f6e9d2b014f60a5455f053a7bc04 upstream.
+
+In sof_ipc3_control_update(), the expected_size calculation uses
+firmware-provided cdata->num_elems in arithmetic that could overflow
+on 32-bit platforms, wrapping to a small value. This would allow the
+cdata->rhdr.hdr.size comparison to pass with mismatched sizes,
+potentially leading to out-of-bounds access in snd_sof_update_control.
+
+Use check_mul_overflow() and check_add_overflow() to detect and reject
+overflowed size calculations.
+
+Fixes: 10f461d79c2d ("ASoC: SOF: Add IPC3 topology control ops")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20260609083458.31193-4-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc3-control.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/sof/ipc3-control.c
++++ b/sound/soc/sof/ipc3-control.c
+@@ -626,16 +626,28 @@ static void sof_ipc3_control_update(stru
+ return;
+ }
+
+- expected_size = sizeof(struct sof_ipc_ctrl_data);
+ switch (cdata->type) {
+ case SOF_CTRL_TYPE_VALUE_CHAN_GET:
+ case SOF_CTRL_TYPE_VALUE_CHAN_SET:
+- expected_size += cdata->num_elems *
+- sizeof(struct sof_ipc_ctrl_value_chan);
++ if (check_mul_overflow((size_t)cdata->num_elems,
++ sizeof(struct sof_ipc_ctrl_value_chan),
++ &expected_size))
++ return;
++ if (check_add_overflow(expected_size,
++ sizeof(struct sof_ipc_ctrl_data),
++ &expected_size))
++ return;
+ break;
+ case SOF_CTRL_TYPE_DATA_GET:
+ case SOF_CTRL_TYPE_DATA_SET:
+- expected_size += cdata->num_elems + sizeof(struct sof_abi_hdr);
++ if (check_add_overflow((size_t)cdata->num_elems,
++ sizeof(struct sof_abi_hdr),
++ &expected_size))
++ return;
++ if (check_add_overflow(expected_size,
++ sizeof(struct sof_ipc_ctrl_data),
++ &expected_size))
++ return;
+ break;
+ default:
+ return;
--- /dev/null
+From 3ad673e7139cf214afd24321a829aad6575f4163 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Tue, 9 Jun 2026 11:34:53 +0300
+Subject: ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 3ad673e7139cf214afd24321a829aad6575f4163 upstream.
+
+In sof_ipc4_bytes_put(), the copy size is derived from the old
+data->size in the buffer rather than the incoming new data's size
+field from ucontrol. If the new data has a different size, the copy
+uses the wrong length: it may truncate valid data or copy stale bytes.
+
+Fix by validating and using the incoming data's sof_abi_hdr.size from
+ucontrol before copying.
+
+Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20260609083458.31193-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc4-control.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/sof/ipc4-control.c
++++ b/sound/soc/sof/ipc4-control.c
+@@ -455,6 +455,8 @@ static int sof_ipc4_bytes_put(struct snd
+ struct snd_soc_component *scomp = scontrol->scomp;
+ struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp);
+ struct sof_abi_hdr *data = cdata->data;
++ const struct sof_abi_hdr *new_hdr =
++ (const struct sof_abi_hdr *)ucontrol->value.bytes.data;
+ size_t size;
+ int ret;
+
+@@ -465,15 +467,16 @@ static int sof_ipc4_bytes_put(struct snd
+ return -EINVAL;
+ }
+
+- /* scontrol->max_size has been verified to be >= sizeof(struct sof_abi_hdr) */
+- if (data->size > scontrol->max_size - sizeof(*data)) {
++ /* Validate the new data's size, not the old one */
++ if (new_hdr->size > scontrol->max_size - sizeof(*new_hdr)) {
+ dev_err_ratelimited(scomp->dev,
+ "data size too big %u bytes max is %zu\n",
+- data->size, scontrol->max_size - sizeof(*data));
++ new_hdr->size,
++ scontrol->max_size - sizeof(*new_hdr));
+ return -EINVAL;
+ }
+
+- size = data->size + sizeof(*data);
++ size = new_hdr->size + sizeof(*new_hdr);
+
+ /* copy from kcontrol */
+ memcpy(data, ucontrol->value.bytes.data, size);
--- /dev/null
+From 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Wed, 3 Jun 2026 14:57:54 -0300
+Subject: ASoC: SOF: topology: validate vendor array size before parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 8468dd79cfb2ffbdeaf7c353f63d64941cb8ba05 upstream.
+
+sof_parse_token_sets() reads array->size while iterating over topology
+private data. The loop condition only checks that some data remains, so a
+malformed topology with a truncated trailing vendor array can make the
+parser read the size field before a full vendor-array header is available.
+
+Validate that the remaining private data contains a complete
+snd_soc_tplg_vendor_array header before reading array->size.
+
+The declared array size check also needs to remain signed. asize is an int,
+but sizeof(*array) has type size_t, so comparing them directly promotes
+negative asize values to unsigned and lets them pass the check,
+as reported in the stable review thread reference below.
+
+Cast sizeof(*array) to int when validating the declared array size. This
+rejects negative, zero and otherwise too-small sizes before the parser
+dispatches to the tuple-specific code.
+
+Link: https://lore.kernel.org/stable/CANiDSCsjR5NHqu_Ui5cOqWdJgFqmYsQ9WR8O7m0WOhngaYXFpw@mail.gmail.com/t/#m9b3be379221e79327cc13fd71009287368ef4f23
+Fixes: 215e5fe75881 ("ASoC: SOF: topology: reject invalid vendor array size in token parser")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260603-sof-topology-array-size-signed-v1-1-84f97879a4ef@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/topology.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -733,10 +733,13 @@ static int sof_parse_token_sets(struct s
+ int ret;
+
+ while (array_size > 0 && total < count * token_instance_num) {
++ if (array_size < (int)sizeof(*array))
++ return -EINVAL;
++
+ asize = le32_to_cpu(array->size);
+
+ /* validate asize */
+- if (asize < sizeof(*array)) {
++ if (asize < (int)sizeof(*array)) {
+ dev_err(scomp->dev, "error: invalid array size 0x%x\n",
+ asize);
+ return -EINVAL;
--- /dev/null
+From d1e8f9fd6b98307bc8d2863c7baa465d8a5a43be Mon Sep 17 00:00:00 2001
+From: Przemyslaw Korba <przemyslaw.korba@intel.com>
+Date: Mon, 25 May 2026 10:38:03 +0200
+Subject: idpf: add padding to PTP virtchnl structures
+
+From: Przemyslaw Korba <przemyslaw.korba@intel.com>
+
+commit d1e8f9fd6b98307bc8d2863c7baa465d8a5a43be upstream.
+
+Add padding to virtchnl2 PTP structures to match the Control Plane
+expected message sizes:
+* virtchnl2_ptp_get_dev_clk_time: 8 -> 16 bytes
+* virtchnl2_ptp_set_dev_clk_time: 8 -> 16 bytes
+* virtchnl2_ptp_get_cross_time: 16 -> 24 bytes
+
+The FW expects the above sizes and PTP negotiation fails due to the
+mismatch. Previously neither the FW nor the driver checked message/reply
+sizes strictly, so the problem appeared only after recent validation
+improvements.
+
+reproduction steps:
+ptp4l -i <pf> -m
+Observe: failed to open /dev/ptp0: Permission denied
+
+Fixes: bf27283ba594 ("virtchnl: add PTP virtchnl definitions")
+Cc: stable@vger.kernel.org
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: Przemyslaw Korba <przemyslaw.korba@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/idpf/virtchnl2.h | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/virtchnl2.h b/drivers/net/ethernet/intel/idpf/virtchnl2.h
+index 02ae447cc24a..39fea65c075c 100644
+--- a/drivers/net/ethernet/intel/idpf/virtchnl2.h
++++ b/drivers/net/ethernet/intel/idpf/virtchnl2.h
+@@ -1572,13 +1572,15 @@ VIRTCHNL2_CHECK_STRUCT_LEN(16, virtchnl2_ptp_get_vport_tx_tstamp_latches);
+ * struct virtchnl2_ptp_get_dev_clk_time - Associated with message
+ * VIRTCHNL2_OP_PTP_GET_DEV_CLK_TIME.
+ * @dev_time_ns: Device clock time value in nanoseconds
++ * @pad: Padding for future extensions
+ *
+ * PF/VF sends this message to receive the time from the main timer.
+ */
+ struct virtchnl2_ptp_get_dev_clk_time {
+ __le64 dev_time_ns;
++ u8 pad[8];
+ };
+-VIRTCHNL2_CHECK_STRUCT_LEN(8, virtchnl2_ptp_get_dev_clk_time);
++VIRTCHNL2_CHECK_STRUCT_LEN(16, virtchnl2_ptp_get_dev_clk_time);
+
+ /**
+ * struct virtchnl2_ptp_get_cross_time: Associated with message
+@@ -1586,26 +1588,30 @@ VIRTCHNL2_CHECK_STRUCT_LEN(8, virtchnl2_ptp_get_dev_clk_time);
+ * @sys_time_ns: System counter value expressed in nanoseconds, read
+ * synchronously with device time
+ * @dev_time_ns: Device clock time value expressed in nanoseconds
++ * @pad: Padding for future extensions
+ *
+ * PF/VF sends this message to receive the cross time.
+ */
+ struct virtchnl2_ptp_get_cross_time {
+ __le64 sys_time_ns;
+ __le64 dev_time_ns;
++ u8 pad[8];
+ };
+-VIRTCHNL2_CHECK_STRUCT_LEN(16, virtchnl2_ptp_get_cross_time);
++VIRTCHNL2_CHECK_STRUCT_LEN(24, virtchnl2_ptp_get_cross_time);
+
+ /**
+ * struct virtchnl2_ptp_set_dev_clk_time: Associated with message
+ * VIRTCHNL2_OP_PTP_SET_DEV_CLK_TIME.
+ * @dev_time_ns: Device time value expressed in nanoseconds to set
++ * @pad: Padding for future extensions
+ *
+ * PF/VF sends this message to set the time of the main timer.
+ */
+ struct virtchnl2_ptp_set_dev_clk_time {
+ __le64 dev_time_ns;
++ u8 pad[8];
+ };
+-VIRTCHNL2_CHECK_STRUCT_LEN(8, virtchnl2_ptp_set_dev_clk_time);
++VIRTCHNL2_CHECK_STRUCT_LEN(16, virtchnl2_ptp_set_dev_clk_time);
+
+ /**
+ * struct virtchnl2_ptp_adj_dev_clk_fine: Associated with message
+--
+2.55.0
+
--- /dev/null
+From 9f1667098c6ae7ec81a9a56859cfdacb822aa0d0 Mon Sep 17 00:00:00 2001
+From: Oliver Upton <oupton@kernel.org>
+Date: Sun, 14 Jun 2026 22:13:24 -0700
+Subject: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
+
+From: Oliver Upton <oupton@kernel.org>
+
+commit 9f1667098c6ae7ec81a9a56859cfdacb822aa0d0 upstream.
+
+It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias
+while in a nested context, as it is expected if FEAT_NV2 is advertised
+to the L1 hypervisor.
+
+Get rid of the bogus WARN which, since the hyp vectors were installed at
+this point, has the effect of a hyp_panic...
+
+Cc: stable@vger.kernel.org
+Fixes: 0cfc85b8f5cf ("KVM: arm64: nv: Load guest FP state for ZCR_EL2 trap")
+Signed-off-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260615051324.830045-1-oupton@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/include/hyp/switch.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
++++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
+@@ -568,8 +568,6 @@ static inline bool kvm_hyp_handle_fpsimd
+ return false;
+ break;
+ case ESR_ELx_EC_SYS64:
+- if (WARN_ON_ONCE(!is_hyp_ctxt(vcpu)))
+- return false;
+ fallthrough;
+ case ESR_ELx_EC_SVE:
+ if (!sve_guest)
--- /dev/null
+From ff1022c3de46753eb7eba2f6efd990569e66ff95 Mon Sep 17 00:00:00 2001
+From: Weiming Shi <bestswngs@gmail.com>
+Date: Wed, 17 Jun 2026 12:08:21 +0800
+Subject: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+commit ff1022c3de46753eb7eba2f6efd990569e66ff95 upstream.
+
+kvm_hyp_handle_mops() resets the single-step state machine as part of
+rewinding state for a MOPS exception by modifying vcpu_cpsr() and
+writing the result directly into hardware.
+
+In the case of nested virtualization, vcpu_cpsr() is a synthetic value
+such that the rest of KVM can deal with vEL2 cleanly. That means the
+value requires translation before being written into hardware, which is
+unfortunately missing from the MOPS handler.
+
+Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state
+altogether, which will be resynchronized on the next 'full' exit back
+to KVM.
+
+Fixes: 2de451a329cf ("KVM: arm64: Add handler for MOPS exceptions")
+Reported-by: Zhong Wang <wangzhong.c0ss4ck@bytedance.com>
+Reported-by: Xuanqing Shi <shixuanqing.11@bytedance.com>
+Link: https://lore.kernel.org/all/ajE4lHQevXNHpl1M@Air.local/
+Cc: stable@vger.kernel.org
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Link: https://patch.msgid.link/20260617040820.2194831-2-bestswngs@gmail.com
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/include/hyp/switch.h | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
++++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
+@@ -419,16 +419,19 @@ static inline bool __populate_fault_info
+
+ static inline bool kvm_hyp_handle_mops(struct kvm_vcpu *vcpu, u64 *exit_code)
+ {
++ u64 spsr;
++
+ *vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR);
+ arm64_mops_reset_regs(vcpu_gp_regs(vcpu), vcpu->arch.fault.esr_el2);
+ write_sysreg_el2(*vcpu_pc(vcpu), SYS_ELR);
+
+ /*
+ * Finish potential single step before executing the prologue
+- * instruction.
++ * instruction. Modify the hardware SPSR_EL2 directly, as vcpu_cpsr()
++ * may hold a synthetic (vEL2) value for a guest hypervisor.
+ */
+- *vcpu_cpsr(vcpu) &= ~DBG_SPSR_SS;
+- write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR);
++ spsr = read_sysreg_el2(SYS_SPSR);
++ write_sysreg_el2(spsr & ~DBG_SPSR_SS, SYS_SPSR);
+
+ return true;
+ }
--- /dev/null
+From 4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6 Mon Sep 17 00:00:00 2001
+From: Oliver Upton <oupton@kernel.org>
+Date: Thu, 18 Jun 2026 16:42:05 -0700
+Subject: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
+
+From: Oliver Upton <oupton@kernel.org>
+
+commit 4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6 upstream.
+
+When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable
+memory attributes, even if the underlying PFN isn't memory. This gets
+particularly hairy if the endpoint doesn't support cacheable memory
+attributes, potentially throwing an SError on writeback...
+
+While KVM does permit cacheable memory attributes on certain PFNMAP
+VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the
+simpler thing for now and just reject everything that isn't memory.
+
+Cc: stable@vger.kernel.org
+Fixes: 2a359e072596 ("KVM: arm64: nv: Handle mapping of VNCR_EL2 at EL2")
+Signed-off-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260618234207.1063941-5-oupton@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/nested.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/arm64/kvm/nested.c
++++ b/arch/arm64/kvm/nested.c
+@@ -1244,6 +1244,17 @@ static int kvm_translate_vncr(struct kvm
+ writable = !(memslot->flags & KVM_MEM_READONLY);
+ }
+
++ /*
++ * FIXME: This check is too restrictive as KVM allows cacheable memory
++ * attributes for PFNMAP VMAs that have cacheable attributes in host
++ * stage-1.
++ */
++ if (!pfn_is_map_memory(pfn)) {
++ kvm_release_faultin_page(vcpu->kvm, page, true, false);
++ fail_s1_walk(&vt->wr, ESR_ELx_FSC_EXTABT, false);
++ return -EINVAL;
++ }
++
+ scoped_guard(write_lock, &vcpu->kvm->mmu_lock) {
+ if (mmu_invalidate_retry(vcpu->kvm, mmu_seq)) {
+ kvm_release_faultin_page(vcpu->kvm, page, true, false);
--- /dev/null
+From 9f3e83345a56280efffe235c65593c7e544c0fcc Mon Sep 17 00:00:00 2001
+From: Oliver Upton <oupton@kernel.org>
+Date: Thu, 18 Jun 2026 16:42:03 -0700
+Subject: KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
+
+From: Oliver Upton <oupton@kernel.org>
+
+commit 9f3e83345a56280efffe235c65593c7e544c0fcc upstream.
+
+kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort
+when kvm_translate_vncr() returns -EFAULT. This is not always the case
+as it's possible to encounter 'late' failures on the output of S1
+translation, e.g. a GFN outside of the memslots.
+
+Fix it by preparing an external abort before returning from
+kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection
+path while at it.
+
+Cc: stable@vger.kernel.org
+Fixes: 2a359e072596 ("KVM: arm64: nv: Handle mapping of VNCR_EL2 at EL2")
+Signed-off-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260618234207.1063941-3-oupton@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/kvm_nested.h | 8 ++++++++
+ arch/arm64/kvm/at.c | 8 --------
+ arch/arm64/kvm/nested.c | 10 ++++++----
+ 3 files changed, 14 insertions(+), 12 deletions(-)
+
+--- a/arch/arm64/include/asm/kvm_nested.h
++++ b/arch/arm64/include/asm/kvm_nested.h
+@@ -353,6 +353,14 @@ struct s1_walk_result {
+ bool failed;
+ };
+
++static inline void fail_s1_walk(struct s1_walk_result *wr, u8 fst, bool s1ptw)
++{
++ wr->fst = fst;
++ wr->ptw = s1ptw;
++ wr->s2 = s1ptw;
++ wr->failed = true;
++}
++
+ int __kvm_translate_va(struct kvm_vcpu *vcpu, struct s1_walk_info *wi,
+ struct s1_walk_result *wr, u64 va);
+ int __kvm_find_s1_desc_level(struct kvm_vcpu *vcpu, u64 va, u64 ipa,
+--- a/arch/arm64/kvm/at.c
++++ b/arch/arm64/kvm/at.c
+@@ -10,14 +10,6 @@
+ #include <asm/kvm_hyp.h>
+ #include <asm/kvm_mmu.h>
+
+-static void fail_s1_walk(struct s1_walk_result *wr, u8 fst, bool s1ptw)
+-{
+- wr->fst = fst;
+- wr->ptw = s1ptw;
+- wr->s2 = s1ptw;
+- wr->failed = true;
+-}
+-
+ #define S1_MMU_DISABLED (-127)
+
+ static int get_ia_size(struct s1_walk_info *wi)
+--- a/arch/arm64/kvm/nested.c
++++ b/arch/arm64/kvm/nested.c
+@@ -1220,15 +1220,19 @@ static int kvm_translate_vncr(struct kvm
+
+ gfn = vt->wr.pa >> PAGE_SHIFT;
+ memslot = gfn_to_memslot(vcpu->kvm, gfn);
+- if (!memslot)
++ if (!memslot) {
++ fail_s1_walk(&vt->wr, ESR_ELx_FSC_EXTABT, false);
+ return -EFAULT;
++ }
+
+ *is_gmem = kvm_slot_has_gmem(memslot);
+ if (!*is_gmem) {
+ pfn = __kvm_faultin_pfn(memslot, gfn, write_fault ? FOLL_WRITE : 0,
+ &writable, &page);
+- if (is_error_noslot_pfn(pfn))
++ if (is_error_noslot_pfn(pfn)) {
++ fail_s1_walk(&vt->wr, ESR_ELx_FSC_EXTABT, false);
+ return -EFAULT;
++ }
+ } else {
+ ret = kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, &page, NULL);
+ if (ret) {
+@@ -1367,8 +1371,6 @@ int kvm_handle_vncr_abort(struct kvm_vcp
+ * Translation failed, inject the corresponding
+ * exception back to EL2.
+ */
+- BUG_ON(!vt->wr.failed);
+-
+ esr &= ~ESR_ELx_FSC;
+ esr |= FIELD_PREP(ESR_ELx_FSC, vt->wr.fst);
+
--- /dev/null
+From 2684e02bac41c5220f6c1ab2bdcc957b71812977 Mon Sep 17 00:00:00 2001
+From: Oliver Upton <oupton@kernel.org>
+Date: Thu, 18 Jun 2026 16:42:02 -0700
+Subject: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
+
+From: Oliver Upton <oupton@kernel.org>
+
+commit 2684e02bac41c5220f6c1ab2bdcc957b71812977 upstream.
+
+KVM currently maps the L1 VNCR into the host stage-1 by relying entirely
+on the permissions of the guest stage-1. At the same time, it is
+entirely possible that the backing PFN is read-only (e.g. RO memslot),
+meaning that the L1 VNCR should use at most a read-only mapping.
+
+Cache the writability of the PFN in the VNCR TLB and use it to constrain
+the resulting fixmap permissions. Promote VNCR permission faults to an
+SEA in the case where the guest attempts to write to a read-only
+endpoint. Conveniently, this also plugs a page leak found by Sashiko [*]
+resulting from the early return for a read-only PFN.
+
+Cc: stable@vger.kernel.org
+Fixes: 2a359e072596 ("KVM: arm64: nv: Handle mapping of VNCR_EL2 at EL2")
+Link: https://lore.kernel.org/kvm/20260608082603.16AEC1F00893@smtp.kernel.org/
+Signed-off-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260618234207.1063941-2-oupton@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/nested.c | 36 ++++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+--- a/arch/arm64/kvm/nested.c
++++ b/arch/arm64/kvm/nested.c
+@@ -24,6 +24,7 @@ struct vncr_tlb {
+ struct s1_walk_result wr;
+
+ u64 hpa;
++ bool hpa_writable;
+
+ /* -1 when not mapped on a CPU */
+ int cpu;
+@@ -1226,7 +1227,7 @@ static int kvm_translate_vncr(struct kvm
+ if (!*is_gmem) {
+ pfn = __kvm_faultin_pfn(memslot, gfn, write_fault ? FOLL_WRITE : 0,
+ &writable, &page);
+- if (is_error_noslot_pfn(pfn) || (write_fault && !writable))
++ if (is_error_noslot_pfn(pfn))
+ return -EFAULT;
+ } else {
+ ret = kvm_gmem_get_pfn(vcpu->kvm, memslot, gfn, &pfn, &page, NULL);
+@@ -1235,6 +1236,8 @@ static int kvm_translate_vncr(struct kvm
+ write_fault, false, false);
+ return ret;
+ }
++
++ writable = !(memslot->flags & KVM_MEM_READONLY);
+ }
+
+ scoped_guard(write_lock, &vcpu->kvm->mmu_lock) {
+@@ -1245,28 +1248,41 @@ static int kvm_translate_vncr(struct kvm
+
+ vt->gva = va;
+ vt->hpa = pfn << PAGE_SHIFT;
++ vt->hpa_writable = writable;
+ vt->valid = true;
+ vt->cpu = -1;
+
+ kvm_make_request(KVM_REQ_MAP_L1_VNCR_EL2, vcpu);
+- kvm_release_faultin_page(vcpu->kvm, page, false, vt->wr.pw);
++ kvm_release_faultin_page(vcpu->kvm, page, false, vt->wr.pw && vt->hpa_writable);
+ }
+
+- if (vt->wr.pw)
++ if (vt->wr.pw && vt->hpa_writable)
+ mark_page_dirty(vcpu->kvm, gfn);
+
+ return 0;
+ }
+
+-static void inject_vncr_perm(struct kvm_vcpu *vcpu)
++static void handle_vncr_perm(struct kvm_vcpu *vcpu)
+ {
+ struct vncr_tlb *vt = vcpu->arch.vncr_tlb;
+ u64 esr = kvm_vcpu_get_esr(vcpu);
++ u64 fsc;
++
++ /*
++ * Promote to an external abort if the stage-1 permits writes but the
++ * HPA is read-only (e.g. RO memslot).
++ */
++ if (kvm_is_write_fault(vcpu) && vt->wr.pw && !vt->hpa_writable)
++ fsc = ESR_ELx_FSC_EXTABT;
++ /*
++ * Otherwise, inject a permission fault using the guest's translation
++ * level rather than the host's.
++ */
++ else
++ fsc = ESR_ELx_FSC_PERM_L(vt->wr.level);
+
+- /* Adjust the fault level to reflect that of the guest's */
+ esr &= ~ESR_ELx_FSC;
+- esr |= FIELD_PREP(ESR_ELx_FSC,
+- ESR_ELx_FSC_PERM_L(vt->wr.level));
++ esr |= FIELD_PREP(ESR_ELx_FSC, fsc);
+
+ kvm_inject_nested_sync(vcpu, esr);
+ }
+@@ -1312,7 +1328,7 @@ int kvm_handle_vncr_abort(struct kvm_vcp
+ return kvm_handle_guest_sea(vcpu);
+
+ if (esr_fsc_is_permission_fault(esr)) {
+- inject_vncr_perm(vcpu);
++ handle_vncr_perm(vcpu);
+ } else if (esr_fsc_is_translation_fault(esr)) {
+ bool valid, is_gmem = false;
+ int ret;
+@@ -1360,7 +1376,7 @@ int kvm_handle_vncr_abort(struct kvm_vcp
+ break;
+ case -EPERM:
+ /* Hack to deal with POE until we get kernel support */
+- inject_vncr_perm(vcpu);
++ handle_vncr_perm(vcpu);
+ break;
+ case 0:
+ break;
+@@ -1417,7 +1433,7 @@ static void kvm_map_l1_vncr(struct kvm_v
+
+ vt->cpu = smp_processor_id();
+
+- if (vt->wr.pw && vt->wr.pr)
++ if (vt->hpa_writable && vt->wr.pw && vt->wr.pr)
+ prot = PAGE_KERNEL;
+ else if (vt->wr.pr)
+ prot = PAGE_KERNEL_RO;
--- /dev/null
+From e2cb1f4578625e71f461d5c1ce70984193389cbb Mon Sep 17 00:00:00 2001
+From: Fuad Tabba <tabba@google.com>
+Date: Mon, 15 Jun 2026 14:11:16 +0100
+Subject: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
+
+From: Fuad Tabba <tabba@google.com>
+
+commit e2cb1f4578625e71f461d5c1ce70984193389cbb upstream.
+
+kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions
+but not for SError. enter_exception64() does not write ESR_ELx for any
+exception type, so the constructed syndrome is dropped. A guest L2
+hypervisor taking a nested SError observes stale ESR_EL2.
+
+This affects both kvm_inject_nested_serror() and the EASE path in
+kvm_inject_nested_sea().
+
+Write ESR_EL2 for except_type_serror, matching except_type_sync.
+
+Fixes: 77ee70a07357 ("KVM: arm64: nv: Honor SError exception routing / masking")
+Reported-by: sashiko <sashiko@sashiko.dev>
+Signed-off-by: Fuad Tabba <tabba@google.com>
+Link: https://patch.msgid.link/20260615131116.390977-1-tabba@google.com
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/emulate-nested.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/kvm/emulate-nested.c
++++ b/arch/arm64/kvm/emulate-nested.c
+@@ -2729,6 +2729,7 @@ static void kvm_inject_el2_exception(str
+ break;
+ case except_type_serror:
+ kvm_pend_exception(vcpu, EXCEPT_AA64_EL2_SERR);
++ vcpu_write_sys_reg(vcpu, esr_el2, ESR_EL2);
+ break;
+ default:
+ WARN_ONCE(1, "Unsupported EL2 exception injection %d\n", type);
--- /dev/null
+From 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe Mon Sep 17 00:00:00 2001
+From: Hyunwoo Kim <imv4bel@gmail.com>
+Date: Fri, 5 Jun 2026 05:59:15 +0900
+Subject: KVM: arm64: vgic: Check the interrupt is still ours before migrating it
+
+From: Hyunwoo Kim <imv4bel@gmail.com>
+
+commit 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe upstream.
+
+vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
+an interrupt to another vCPU. After reacquiring the locks it only checks
+that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
+before moving the interrupt, which assumes that an interrupt whose affinity
+is preserved is still queued on this vCPU's ap_list.
+
+That assumption no longer holds if the interrupt is taken off the ap_list
+while the locks are dropped. vgic_flush_pending_lpis() removes the
+interrupt from the list and sets irq->vcpu to NULL, but leaves
+enabled/pending/target_vcpu untouched. As the interrupt is still enabled
+and pending, vgic_target_oracle() returns the same target_vcpu, so the
+affinity check passes and list_del() is run a second time on an entry that
+has already been removed.
+
+Also check that the interrupt is still assigned to this vCPU
+(irq->vcpu == vcpu) before moving it.
+
+Fixes: 0919e84c0fc1 ("KVM: arm/arm64: vgic-new: Add IRQ sync/flush framework")
+Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
+Link: https://patch.msgid.link/aiHnI1mu6SGQrgnz@v4bel
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/kvm/vgic/vgic.c
++++ b/arch/arm64/kvm/vgic/vgic.c
+@@ -735,15 +735,16 @@ retry:
+ raw_spin_lock(&irq->irq_lock);
+
+ /*
+- * If the affinity has been preserved, move the
+- * interrupt around. Otherwise, it means things have
+- * changed while the interrupt was unlocked, and we
+- * need to replay this.
++ * If the interrupt is still ours and its affinity has
++ * been preserved, move it around. Otherwise, it means
++ * things have changed while the interrupt was unlocked
++ * (it may even have been taken off the list with its
++ * affinity left untouched), and we need to replay this.
+ *
+ * In all cases, we cannot trust the list not to have
+ * changed, so we restart from the beginning.
+ */
+- if (target_vcpu == vgic_target_oracle(irq)) {
++ if (irq->vcpu == vcpu && target_vcpu == vgic_target_oracle(irq)) {
+ struct vgic_cpu *new_cpu = &target_vcpu->arch.vgic_cpu;
+
+ list_del(&irq->ap_list);
--- /dev/null
+From 7258770e5814f15e8308ebda82ac9acf6964ba8e Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Mon, 15 Jun 2026 19:16:25 +0100
+Subject: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 7258770e5814f15e8308ebda82ac9acf6964ba8e upstream.
+
+Hyunwoo Kim reports some really bad races should the following
+situation occur:
+
+- LPI-I is pending in vcpu-B's AP list
+- vcpu-A writes to vcpu-B's RD to disable its LPIs
+- vcpu-C moves I from B to C
+
+If the last two race nicely enough, vgic_prune_ap_list() can drop
+the irq and AP list locks, reacquire them, and in the interval
+the irq has been freed. UAF follows.
+
+The fix is two-fold:
+
+- Before dropping the irq and ap_list locks, take a reference on
+ the irq
+
+- Do not try to handle migration of the pending bit: there is no
+ expectation that this state is retained, as per the architecture
+
+With that, we're sure that the interrupt is still around, and we
+safely remove it from the AP list as it has no target at this
+stage (unless another interrupt fires, but that's another story).
+
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
+Link: https://lore.kernel.org/r/ailsCnyoS82r_QRz@v4bel
+Link: https://patch.msgid.link/20260615181625.3029352-1-maz@kernel.org
+Fixes: 5dd4b924e390a ("KVM: arm/arm64: vgic: Add refcounting for IRQs")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kvm/vgic/vgic.c
++++ b/arch/arm64/kvm/vgic/vgic.c
+@@ -188,6 +188,7 @@ void vgic_flush_pending_lpis(struct kvm_
+ list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
+ if (irq->intid >= VGIC_MIN_LPI) {
+ raw_spin_lock(&irq->irq_lock);
++ irq->pending_latch = false;
+ list_del(&irq->ap_list);
+ irq->vcpu = NULL;
+ raw_spin_unlock(&irq->irq_lock);
+@@ -712,7 +713,11 @@ retry:
+ continue;
+ }
+
+- /* This interrupt looks like it has to be migrated. */
++ /*
++ * This interrupt looks like it has to be migrated,
++ * make sure it is kept alive while locks are dropped.
++ */
++ vgic_get_irq_ref(irq);
+
+ raw_spin_unlock(&irq->irq_lock);
+ raw_spin_unlock(&vgic_cpu->ap_list_lock);
+@@ -757,6 +762,8 @@ retry:
+ raw_spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
+ raw_spin_unlock(&vcpuA->arch.vgic_cpu.ap_list_lock);
+
++ deleted_lpis |= vgic_put_irq_norelease(vcpu->kvm, irq);
++
+ if (target_vcpu_needs_kick) {
+ kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu);
+ kvm_vcpu_kick(target_vcpu);
--- /dev/null
+From 3a07249981629ace483ebbef81ef6b34c2d2afec Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Sat, 27 Jun 2026 11:51:05 +0100
+Subject: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream.
+
+kvm_io_bus_get_dev() returns a device that is only matched by the
+address, and nothing else. This can cause a lifetime issue if
+the matched device is not the expected type, as by the time
+the caller can introspect the object, it might be gone (the srcu
+lock having been dropped).
+
+Given that there is only a single user of this helper, the simplest
+option is to move the locking responsibility to the caller, which
+can keep the srcu lock held for as long as it wants.
+
+Note that this aligns with other kvm_io_bus*() helpers, which
+already require the srcu lock to be held by the callers.
+
+Reported-by: Will Deacon <will@kernel.org>
+Fixes: 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call")
+Link: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org
+Cc: stable@vger.kernel.org
+Reviewed-by: Oliver Upton <oupton@kernel.org>
+Link: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/vgic/vgic-its.c | 2 ++
+ virt/kvm/kvm_main.c | 16 +++++-----------
+ 2 files changed, 7 insertions(+), 11 deletions(-)
+
+--- a/arch/arm64/kvm/vgic/vgic-its.c
++++ b/arch/arm64/kvm/vgic/vgic-its.c
+@@ -507,6 +507,8 @@ static struct vgic_its *__vgic_doorbell_
+ struct kvm_io_device *kvm_io_dev;
+ struct vgic_io_device *iodev;
+
++ guard(srcu)(&kvm->srcu);
++
+ kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, db);
+ if (!kvm_io_dev)
+ return ERR_PTR(-EINVAL);
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -6059,25 +6059,19 @@ struct kvm_io_device *kvm_io_bus_get_dev
+ gpa_t addr)
+ {
+ struct kvm_io_bus *bus;
+- int dev_idx, srcu_idx;
+- struct kvm_io_device *iodev = NULL;
++ int dev_idx;
+
+- srcu_idx = srcu_read_lock(&kvm->srcu);
++ lockdep_assert_held(&kvm->srcu);
+
+ bus = kvm_get_bus_srcu(kvm, bus_idx);
+ if (!bus)
+- goto out_unlock;
++ return NULL;
+
+ dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
+ if (dev_idx < 0)
+- goto out_unlock;
++ return NULL;
+
+- iodev = bus->range[dev_idx].dev;
+-
+-out_unlock:
+- srcu_read_unlock(&kvm->srcu, srcu_idx);
+-
+- return iodev;
++ return bus->range[dev_idx].dev;
+ }
+ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_io_bus_get_dev);
+
--- /dev/null
+From 2f2312c422fd2695da772cecb30c69994b795964 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Tue, 14 Jul 2026 09:03:06 -0700
+Subject: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 2f2312c422fd2695da772cecb30c69994b795964 upstream.
+
+Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid
+guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path
+doesn't use nested_vmx_vmexit() as that API is intended to be used if and
+only if L2 is active, and the open coded equivalent neglects to put the
+vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages
+(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.
+
+Note, the !from_vmenter scenario doesn't suffer the same problem, as
+vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is
+active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry
+getting vmcs12 pages.
+
+Fixes: 96c66e87deee ("KVM/nVMX: Use kvm_vcpu_map when mapping the virtual APIC page")
+Fixes: 3278e0492554 ("KVM/nVMX: Use kvm_vcpu_map when mapping the posted interrupt descriptor table")
+Fixes: fe1911aa443e ("KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page")
+Reported-by: Minh Nguyen <minhnguyen.080505@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx/nested.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -3799,6 +3799,8 @@ vmentry_fail_vmexit:
+ if (!from_vmentry)
+ return NVMX_VMENTRY_VMEXIT;
+
++ nested_put_vmcs12_pages(vcpu);
++
+ load_vmcs12_host_state(vcpu, vmcs12);
+ vmcs12->vm_exit_reason = exit_reason.full;
+ if (enable_shadow_vmcs || nested_vmx_is_evmptr12_valid(vmx))
--- /dev/null
+From 7b69729046a4c58f4cb457184e5ac4aaa179bff4 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Wed, 24 Jun 2026 14:19:10 +0800
+Subject: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 7b69729046a4c58f4cb457184e5ac4aaa179bff4 upstream.
+
+kvm_s390_gisc_register() registers the guest ISC before pinning
+the guest interrupt forwarding pages and allocating the AISB bit.
+If any of the later setup steps fails, the function unwinds the
+pinned pages and other local state, but does not unregister the
+GISC reference. Add the missing kvm_s390_gisc_unregister() to the
+error unwind path.
+
+Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Message-ID: <20260624061910.2794734-1-haoxiang_li2024@163.com>
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kvm/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/s390/kvm/pci.c
++++ b/arch/s390/kvm/pci.c
+@@ -329,6 +329,7 @@ unpin2:
+ unpin1:
+ unpin_user_page(aibv_page);
+ out:
++ kvm_s390_gisc_unregister(kvm, fib->fmt0.isc);
+ return rc;
+ }
+
--- /dev/null
+From 3e3aa6da87d30a0064a17b836685cd43c90a3572 Mon Sep 17 00:00:00 2001
+From: Matthew Rosato <mjrosato@linux.ibm.com>
+Date: Thu, 9 Jul 2026 09:54:04 -0400
+Subject: KVM: s390: pci: Fix handling of AIF enable without AISB
+
+From: Matthew Rosato <mjrosato@linux.ibm.com>
+
+commit 3e3aa6da87d30a0064a17b836685cd43c90a3572 upstream.
+
+When a guest seeks to register IRQs without a summary bit specified,
+ensure that the associated GAITE then stores 0 for the guest AISB
+location instead of virt_to_phys(page_address(NULL)).
+
+Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding")
+Cc: stable@vger.kernel.org
+Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
+Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kvm/pci.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/arch/s390/kvm/pci.c
++++ b/arch/s390/kvm/pci.c
+@@ -301,9 +301,14 @@ static int kvm_s390_pci_aif_enable(struc
+
+ gaite->gisc = fib->fmt0.isc;
+ gaite->count++;
+- gaite->aisbo = fib->fmt0.aisbo;
+- gaite->aisb = virt_to_phys(page_address(aisb_page) + (fib->fmt0.aisb &
+- ~PAGE_MASK));
++ if (fib->fmt0.sum == 1) {
++ gaite->aisbo = fib->fmt0.aisbo;
++ gaite->aisb = virt_to_phys(page_address(aisb_page) +
++ (fib->fmt0.aisb & ~PAGE_MASK));
++ } else {
++ gaite->aisbo = 0;
++ gaite->aisb = 0;
++ }
+ aift->kzdev[zdev->aisb] = zdev->kzdev;
+ spin_unlock_irq(&aift->gait_lock);
+
--- /dev/null
+From 6ee4140788234a6fabf59e6a50e38cdb936008cd Mon Sep 17 00:00:00 2001
+From: Atish Patra <atishp@meta.com>
+Date: Tue, 2 Jun 2026 15:36:32 -0700
+Subject: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
+
+From: Atish Patra <atishp@meta.com>
+
+commit 6ee4140788234a6fabf59e6a50e38cdb936008cd upstream.
+
+The intra-host migration/mirroring feature is not fully implemented for
+SEV-SNP VMs. The proper migration requires additional SNP-specific
+state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be
+transferred or initialized on the destination.
+
+The SNP VM mirroring requires vmsa features to be copied as well otherwise
+ASID would be bound to SNP range while VM is detected as a SEV VM.
+
+Reject SNP source VMs in migration/mirroring until proper SNP state
+transfer is implemented.
+
+Fixes: 1dfe571c12cf ("KVM: SEV: Add initial SEV-SNP support")
+
+Reported-by: Chris Mason <clm@meta.com>
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Assisted-by: Claude:claude-opus-4-6
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Atish Patra <atishp@meta.com>
+Link: https://patch.msgid.link/20260602-sev_snp_fixes-v3-1-24bfd3ae047c@meta.com
+Cc: stable@vger.kernel.org
+[sean: let lines poke past 80 chars, tag for stable]
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm/sev.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/svm/sev.c
++++ b/arch/x86/kvm/svm/sev.c
+@@ -2086,8 +2086,9 @@ int sev_vm_move_enc_context_from(struct
+ if (ret)
+ return ret;
+
++ /* Do not allow SNP VM migration until additional state transfer is implemented */
+ if (kvm->arch.vm_type != source_kvm->arch.vm_type ||
+- sev_guest(kvm) || !sev_guest(source_kvm)) {
++ sev_guest(kvm) || !sev_guest(source_kvm) || sev_snp_guest(source_kvm)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
+@@ -2831,8 +2832,9 @@ int sev_vm_copy_enc_context_from(struct
+ * disallow out-of-band SEV/SEV-ES init if the target is already an
+ * SEV guest, or if vCPUs have been created. KVM relies on vCPUs being
+ * created after SEV/SEV-ES initialization, e.g. to init intercepts.
++ * Also do not allow SNP VM mirroring until additional state transfer is implemented.
+ */
+- if (sev_guest(kvm) || !sev_guest(source_kvm) ||
++ if (sev_guest(kvm) || !sev_guest(source_kvm) || sev_snp_guest(source_kvm) ||
+ is_mirroring_enc_context(source_kvm) || kvm->created_vcpus) {
+ ret = -EINVAL;
+ goto e_unlock;
--- /dev/null
+From 9285e4070df2c40585c3d7ec9571faa7a2b97e17 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Wed, 24 Jun 2026 15:05:16 -0700
+Subject: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 9285e4070df2c40585c3d7ec9571faa7a2b97e17 upstream.
+
+Ignore KVM's internal "service pending PV EOI" request if the vCPU has
+disabled PV EOIs since the request was made. Asserting that PV EOIs are
+enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.
+if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables
+PV EOIs.
+
+ kernel BUG at arch/x86/kvm/lapic.c:3338!
+ Oops: invalid opcode: 0000 [#1] SMP
+ CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+ RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]
+ Call Trace:
+ <TASK>
+ kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]
+ kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
+ __x64_sys_ioctl+0x8a/0xd0
+ do_syscall_64+0xb5/0xb40
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ </TASK>
+ Modules linked in: kvm_intel kvm irqbypass
+ ---[ end trace 0000000000000000 ]---
+
+Fixes: ae7a2a3fb6f8 ("KVM: host side for eoi optimization")
+Cc: stable@vger.kernel.org
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Link: https://patch.msgid.link/20260624220516.3033391-1-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/lapic.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -3379,6 +3379,12 @@ static void apic_sync_pv_eoi_from_guest(
+ struct kvm_lapic *apic)
+ {
+ int vector;
++
++ if (unlikely(!pv_eoi_enabled(vcpu))) {
++ __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
++ return;
++ }
++
+ /*
+ * PV EOI state is derived from KVM_APIC_PV_EOI_PENDING in host
+ * and KVM_PV_EOI_ENABLED in guest memory as follows:
+@@ -3390,8 +3396,6 @@ static void apic_sync_pv_eoi_from_guest(
+ * KVM_APIC_PV_EOI_PENDING is set, KVM_PV_EOI_ENABLED is unset:
+ * -> host enabled PV EOI, guest executed EOI.
+ */
+- BUG_ON(!pv_eoi_enabled(vcpu));
+-
+ if (pv_eoi_test_and_clr_pending(vcpu))
+ return;
+ vector = apic_set_eoi(apic);
--- /dev/null
+From ed446e8aa894883c08892cfee69782fdf8f6c3ca Mon Sep 17 00:00:00 2001
+From: leixiang <leixiang@kylinos.cn>
+Date: Mon, 22 Jun 2026 15:51:01 +0800
+Subject: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
+
+From: leixiang <leixiang@kylinos.cn>
+
+commit ed446e8aa894883c08892cfee69782fdf8f6c3ca upstream.
+
+Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a
+dangling pointer will result in a use-after-free if the irqfd is reachable
+through KVM's routing, but the producer is freed separately. E.g. for VFIO
+PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when
+the vector is disabled, which can happen independent of routing updates.
+
+Fixes: 77e1b8332d1d ("KVM: x86: Decouple device assignment from IRQ bypass")
+Cc: stable@vger.kernel.org
+Signed-off-by: leixiang <leixiang@kylinos.cn>
+Link: https://patch.msgid.link/1782119051448443.14545.seg@mailgw.kylinos.cn
+[sean: drop PPC change, massage changelog]
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/irq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/irq.c
++++ b/arch/x86/kvm/irq.c
+@@ -488,8 +488,10 @@ int kvm_arch_irq_bypass_add_producer(str
+
+ if (irqfd->irq_entry.type == KVM_IRQ_ROUTING_MSI) {
+ ret = kvm_pi_update_irte(irqfd, &irqfd->irq_entry);
+- if (ret)
++ if (ret) {
+ kvm->arch.nr_possible_bypass_irqs--;
++ irqfd->producer = NULL;
++ }
+ }
+ spin_unlock_irq(&kvm->irqfds.lock);
+
--- /dev/null
+From 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 Mon Sep 17 00:00:00 2001
+From: Bibo Mao <maobibo@loongson.cn>
+Date: Thu, 11 Jun 2026 20:46:40 +0800
+Subject: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+commit 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 upstream.
+
+Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here
+add irq validility cheking in kvm_vcpu_ioctl_interrupt().
+
+Cc: stable@vger.kernel.org
+Fixes: f45ad5b8aa93 ("LoongArch: KVM: Implement vcpu interrupt operations")
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/vcpu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/loongarch/kvm/vcpu.c
++++ b/arch/loongarch/kvm/vcpu.c
+@@ -1461,6 +1461,10 @@ void kvm_lose_fpu(struct kvm_vcpu *vcpu)
+ int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, struct kvm_interrupt *irq)
+ {
+ int intr = (int)irq->irq;
++ unsigned int vector = abs(intr);
++
++ if (vector >= EXCCODE_INT_NUM)
++ return -EINVAL;
+
+ if (intr > 0)
+ kvm_queue_irq(vcpu, intr);
--- /dev/null
+From fb89e0fe2dc4246c86ad0eb0fa2b7cb2f8ba9728 Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Thu, 11 Jun 2026 20:46:43 +0800
+Subject: LoongArch: KVM: Check the return values for put_user()
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit fb89e0fe2dc4246c86ad0eb0fa2b7cb2f8ba9728 upstream.
+
+put_user() may return -EFAULT, so, when the user space address is
+invalid, the caller should return -EFAULT.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/vcpu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/loongarch/kvm/vcpu.c
++++ b/arch/loongarch/kvm/vcpu.c
+@@ -1061,7 +1061,8 @@ static int kvm_loongarch_cpucfg_get_attr
+ return -ENXIO;
+ }
+
+- put_user(val, uaddr);
++ if (put_user(val, uaddr))
++ return -EFAULT;
+
+ return ret;
+ }
--- /dev/null
+From f4caaac76379daf4a617d9134b6087fb2636fb31 Mon Sep 17 00:00:00 2001
+From: Bibo Mao <maobibo@loongson.cn>
+Date: Thu, 11 Jun 2026 20:46:40 +0800
+Subject: LoongArch: KVM: Fix FPU register width with user access API
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+commit f4caaac76379daf4a617d9134b6087fb2636fb31 upstream.
+
+At the beginning, only 64 bit FPU is supported. With FPU register get
+interface, 64 bit FPU data is copied to user space, the same with FPU
+register set API. However with LSX and LASX supported in later, there
+should be FPU data copied with bigger width. So here fixes this issue,
+copy the whole 256 bit FPU data from/to user space.
+
+Cc: stable@vger.kernel.org
+Fixes: db1ecca22edf ("LoongArch: KVM: Add LSX (128bit SIMD) support")
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/vcpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/kvm/vcpu.c
++++ b/arch/loongarch/kvm/vcpu.c
+@@ -1266,7 +1266,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct k
+ fpu->fcc = vcpu->arch.fpu.fcc;
+ fpu->fcsr = vcpu->arch.fpu.fcsr;
+ for (i = 0; i < NUM_FPU_REGS; i++)
+- memcpy(&fpu->fpr[i], &vcpu->arch.fpu.fpr[i], FPU_REG_WIDTH / 64);
++ memcpy(&fpu->fpr[i], &vcpu->arch.fpu.fpr[i], sizeof(union fpureg));
+
+ return 0;
+ }
+@@ -1278,7 +1278,7 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct k
+ vcpu->arch.fpu.fcc = fpu->fcc;
+ vcpu->arch.fpu.fcsr = fpu->fcsr;
+ for (i = 0; i < NUM_FPU_REGS; i++)
+- memcpy(&vcpu->arch.fpu.fpr[i], &fpu->fpr[i], FPU_REG_WIDTH / 64);
++ memcpy(&vcpu->arch.fpu.fpr[i], &fpu->fpr[i], sizeof(union fpureg));
+
+ return 0;
+ }
--- /dev/null
+From ebd50de14f1a06b7e0206083904bcc62b9ba65be Mon Sep 17 00:00:00 2001
+From: Qiang Ma <maqianga@uniontech.com>
+Date: Thu, 11 Jun 2026 20:46:43 +0800
+Subject: LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
+
+From: Qiang Ma <maqianga@uniontech.com>
+
+commit ebd50de14f1a06b7e0206083904bcc62b9ba65be upstream.
+
+The LoongArch CSRXCHG instruction returns the full old CSR value in rd
+after applying the masked update. kvm_emu_xchg_csr() currently masks
+the saved value before returning it to the guest, so rd receives only
+the bits selected by the write mask.
+
+That breaks the architectural behavior and makes a zero mask return 0
+instead of the previous CSR value. So, keep the masked CSR update, but
+return the unmodified old CSR value.
+
+Cc: stable@vger.kernel.org
+Fixes: da50f5a693ff ("LoongArch: KVM: Implement handle csr exception")
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Qiang Ma <maqianga@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/exit.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/loongarch/kvm/exit.c
++++ b/arch/loongarch/kvm/exit.c
+@@ -103,7 +103,6 @@ static unsigned long kvm_emu_xchg_csr(st
+ old = kvm_read_sw_gcsr(csr, csrid);
+ val = (old & ~csr_mask) | (val & csr_mask);
+ kvm_write_sw_gcsr(csr, csrid, val);
+- old = old & csr_mask;
+ } else
+ pr_warn_once("Unsupported csrxchg 0x%x with pc %lx\n", csrid, vcpu->arch.pc);
+
--- /dev/null
+From 3474037904c20ff915e3ebab0ab5c1e41bbe549e Mon Sep 17 00:00:00 2001
+From: Yanfei Xu <yanfei.xu@bytedance.com>
+Date: Thu, 11 Jun 2026 20:46:43 +0800
+Subject: LoongArch: KVM: Validate irqchip index in irqfd routing
+
+From: Yanfei Xu <yanfei.xu@bytedance.com>
+
+commit 3474037904c20ff915e3ebab0ab5c1e41bbe549e upstream.
+
+Sashiko reported that the irqchip index is not validated for LoongArch.
+Add validation and reject out-of-range irqchip indexes to avoid indexing
+past the routing table's chip array.
+
+Cc: stable@vger.kernel.org
+Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
+Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kvm/irqfd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/loongarch/kvm/irqfd.c
++++ b/arch/loongarch/kvm/irqfd.c
+@@ -53,7 +53,8 @@ int kvm_set_routing_entry(struct kvm *kv
+ e->irqchip.irqchip = ue->u.irqchip.irqchip;
+ e->irqchip.pin = ue->u.irqchip.pin;
+
+- if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
++ if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS ||
++ e->irqchip.irqchip >= KVM_NR_IRQCHIPS)
+ return -EINVAL;
+
+ return 0;
--- /dev/null
+From 41c8c1d65b32beacd8d916a22457b4f6e47f45af Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Tue, 9 Jun 2026 08:37:09 +0000
+Subject: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af upstream.
+
+When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join()
+returns an error without releasing the lag reference obtained by
+the earlier mlxsw_sp_lag_get(). All other error paths in the
+function jump to the cleanup label that ends with
+mlxsw_sp_lag_put(), so this is a single missed release.
+
+Fix the leak by replacing the bare 'return err' with a goto to the
+existing error cleanup label, which will drop the reference safely.
+
+Cc: stable@vger.kernel.org
+Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20260609083709.209743-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -4363,7 +4363,7 @@ static int mlxsw_sp_port_lag_join(struct
+ lag_id = lag->lag_id;
+ err = mlxsw_sp_port_lag_index_get(mlxsw_sp, lag_id, &port_index);
+ if (err)
+- return err;
++ goto err_lag_uppers_bridge_join;
+
+ err = mlxsw_sp_lag_uppers_bridge_join(mlxsw_sp_port, lag_dev,
+ extack);
--- /dev/null
+From 21cf8dc478a49e8de039c2739b1646a774cb1944 Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Tue, 9 Jun 2026 08:47:30 +0000
+Subject: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit 21cf8dc478a49e8de039c2739b1646a774cb1944 upstream.
+
+When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,
+the error rollback loop does not correctly revert the preceding
+replacements. The loop decrements the index but fails to update the
+vr pointer, which still points to the VR that caused the failure. As
+a result, the condition and the rollback call always operate on the
+same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple
+times on it while never rolling back the earlier VRs. Those VRs
+continue to hold a reference to new_tree acquired via
+mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.
+
+Fix by reinitializing vr inside the error loop with the updated index:
+
+ vr = &mlxsw_sp->router->vrs[i];
+
+so that the loop correctly iterates over all VRs that were actually
+replaced.
+
+Cc: stable@vger.kernel.org
+Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20260609084730.215732-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -1019,6 +1019,7 @@ static int mlxsw_sp_vrs_lpm_tree_replace
+
+ err_tree_replace:
+ for (i--; i >= 0; i--) {
++ vr = &mlxsw_sp->router->vrs[i];
+ if (!mlxsw_sp_vr_lpm_tree_should_replace(vr, proto, new_id))
+ continue;
+ mlxsw_sp_vr_lpm_tree_replace(mlxsw_sp,
--- /dev/null
+From cdf19f380e46192e7084be559638aab1f6ed86a2 Mon Sep 17 00:00:00 2001
+From: Zhengchuan Liang <zcliangcn@gmail.com>
+Date: Tue, 9 Jun 2026 16:34:37 +0800
+Subject: net: atm: reject out-of-range traffic classes in QoS validation
+
+From: Zhengchuan Liang <zcliangcn@gmail.com>
+
+commit cdf19f380e46192e7084be559638aab1f6ed86a2 upstream.
+
+Reject ATM traffic classes above ATM_ANYCLASS in check_tp().
+SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so
+accepting larger values leaves invalid traffic_class values in
+vcc->qos.
+
+That bad state later reaches pvc_info(), which indexes class_name[]
+with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause
+an out-of-bounds read when /proc/net/atm/pvc is read.
+
+Tighten the existing QoS validation so invalid traffic_class values
+are rejected at the point where user supplied QoS is accepted.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/58f02c6f73d9818fd5d2022e1116759fdde6116b.1780965530.git.zcliangcn@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/atm/common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -720,6 +720,8 @@ static int atm_change_qos(struct atm_vcc
+ static int check_tp(const struct atm_trafprm *tp)
+ {
+ /* @@@ Should be merged with adjust_tp */
++ if (tp->traffic_class > ATM_ANYCLASS)
++ return -EINVAL;
+ if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS)
+ return 0;
+ if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr &&
--- /dev/null
+From 9406f6012b7343661efb516a11c62d4db2b62f75 Mon Sep 17 00:00:00 2001
+From: Yong Wang <edragain@163.com>
+Date: Thu, 11 Jun 2026 02:37:43 +0800
+Subject: net: ife: require ETH_HLEN to be pullable in ife_decode()
+
+From: Yong Wang <edragain@163.com>
+
+commit 9406f6012b7343661efb516a11c62d4db2b62f75 upstream.
+
+ife decode may return after making only the outer IFE header and
+metadata pullable. The caller then passes the decapsulated packet to
+eth_type_trans(), which expects the inner Ethernet header to be
+accessible from the linear data area.
+
+With a malformed IFE frame, the inner Ethernet header may still be
+shorter than ETH_HLEN in the linear area, which can lead to a crash in
+the original code.
+
+Fix this by extending the pull check in ife_decode() so that the inner
+Ethernet header is also guaranteed to be pullable before returning.
+
+Fixes: ef6980b6becb ("introduce IFE action")
+Cc: stable@vger.kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Yong Wang <edragain@163.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Link: https://patch.msgid.link/20260610183814.1648888-2-n05ec@lzu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ife/ife.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ife/ife.c
++++ b/net/ife/ife.c
+@@ -79,7 +79,7 @@ void *ife_decode(struct sk_buff *skb, u1
+ if (unlikely(ifehdrln < 2))
+ return NULL;
+
+- if (unlikely(!pskb_may_pull(skb, total_pull)))
++ if (unlikely(!pskb_may_pull(skb, total_pull + ETH_HLEN)))
+ return NULL;
+
+ ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len);
--- /dev/null
+From 20054869770c7df060c5ecee3e8bbf9029c47191 Mon Sep 17 00:00:00 2001
+From: Michael Bommarito <michael.bommarito@gmail.com>
+Date: Thu, 11 Jun 2026 08:54:55 -0400
+Subject: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
+
+From: Michael Bommarito <michael.bommarito@gmail.com>
+
+commit 20054869770c7df060c5ecee3e8bbf9029c47191 upstream.
+
+qrtr_endpoint_post() validates an incoming packet with
+
+ if (!size || len != ALIGN(size, 4) + hdrlen)
+ goto err;
+
+where size comes from the wire. On 32-bit, size_t is 32 bits and
+ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
+passes and skb_put_data(skb, data + hdrlen, size) writes past the
+hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.
+
+This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
+Read in qrtr_endpoint_post"), which fixed only the 64-bit case.
+
+Reject any size that cannot fit the buffer before the ALIGN.
+
+Fixes: ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260611125455.2352279-1-michael.bommarito@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/af_qrtr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/qrtr/af_qrtr.c
++++ b/net/qrtr/af_qrtr.c
+@@ -496,7 +496,7 @@ int qrtr_endpoint_post(struct qrtr_endpo
+ if (cb->dst_port == QRTR_PORT_CTRL_LEGACY)
+ cb->dst_port = QRTR_PORT_CTRL;
+
+- if (!size || len != ALIGN(size, 4) + hdrlen)
++ if (!size || size > len || len != ALIGN(size, 4) + hdrlen)
+ goto err;
+
+ if ((cb->type == QRTR_TYPE_NEW_SERVER ||
--- /dev/null
+From f918554fb7246e89b98ef90abe80801f038258b3 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 12 Jun 2026 00:00:13 +0800
+Subject: octeontx2-pf: clear stale mailbox IRQ state before request_irq()
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit f918554fb7246e89b98ef90abe80801f038258b3 upstream.
+
+otx2_register_mbox_intr() currently installs the PF mailbox IRQ handler
+before clearing stale mailbox interrupt state. The function itself then
+comments that the local interrupt bits must be cleared first to avoid
+spurious interrupts, but that clear happens only after request_irq() has
+already exposed the handler to irq delivery.
+
+A running system can reach this during PF mailbox interrupt registration
+while stale or latched RVU_PF_INT state is still present. If delivery
+happens in the request_irq()-to-clear window,
+otx2_pfaf_mbox_intr_handler() can run before local quiesce and touch
+the same pf->mbox and pf->mbox_wq carrier that probe and teardown later
+reuse or destroy.
+
+Move the stale mailbox interrupt clear ahead of request_irq(), but keep
+interrupt enabling after the handler is installed. This closes the
+pre-clear early-IRQ window without creating a new enable-before-handler
+window.
+
+Fixes: 5a6d7c9daef3 ("octeontx2-pf: Mailbox communication with AF")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Link: https://patch.msgid.link/20260611160014.3202224-2-runyu.xiao@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 20 ++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -1119,9 +1119,16 @@ int otx2_register_mbox_intr(struct otx2_
+ {
+ struct otx2_hw *hw = &pf->hw;
+ struct msg_req *req;
++ u64 mbox_int_mask;
+ char *irq_name;
+ int err;
+
++ mbox_int_mask = !is_cn20k(pf->pdev) ? BIT_ULL(0) :
++ BIT_ULL(0) | BIT_ULL(1);
++
++ /* Clear stale mailbox interrupt state before installing the handler. */
++ otx2_write64(pf, RVU_PF_INT, mbox_int_mask);
++
+ /* Register mailbox interrupt handler */
+ if (!is_cn20k(pf->pdev)) {
+ irq_name = &hw->irq_name[RVU_PF_INT_VEC_AFPF_MBOX * NAME_SIZE];
+@@ -1147,17 +1154,8 @@ int otx2_register_mbox_intr(struct otx2_
+ return err;
+ }
+
+- /* Enable mailbox interrupt for msgs coming from AF.
+- * First clear to avoid spurious interrupts, if any.
+- */
+- if (!is_cn20k(pf->pdev)) {
+- otx2_write64(pf, RVU_PF_INT, BIT_ULL(0));
+- otx2_write64(pf, RVU_PF_INT_ENA_W1S, BIT_ULL(0));
+- } else {
+- otx2_write64(pf, RVU_PF_INT, BIT_ULL(0) | BIT_ULL(1));
+- otx2_write64(pf, RVU_PF_INT_ENA_W1S, BIT_ULL(0) |
+- BIT_ULL(1));
+- }
++ /* Enable mailbox interrupt for msgs coming from AF. */
++ otx2_write64(pf, RVU_PF_INT_ENA_W1S, mbox_int_mask);
+
+ if (!probe_af)
+ return 0;
--- /dev/null
+From 0b352f04b9be2c83c0240aa6dae7257fefa90464 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 12 Jun 2026 00:00:14 +0800
+Subject: octeontx2-vf: clear stale mailbox IRQ state before request_irq()
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit 0b352f04b9be2c83c0240aa6dae7257fefa90464 upstream.
+
+otx2vf_register_mbox_intr() currently installs the VF mailbox IRQ
+handler before clearing stale mailbox interrupt state. The code then says
+that local interrupt bits should be cleared first to avoid spurious
+interrupts, but that clear still happens only after request_irq() has
+already made the handler reachable.
+
+A running system can reach this during VF mailbox interrupt registration
+while stale or latched RVU_VF_INT state is still present. If delivery
+happens in the request_irq()-to-clear window,
+otx2vf_vfaf_mbox_intr_handler() can run before local quiesce and touch
+the same vf->mbox and vf->mbox_wq carrier that probe and teardown later
+reuse or destroy.
+
+Move the stale mailbox interrupt clear ahead of request_irq(), but keep
+interrupt enabling after the handler is installed. This closes the
+pre-clear early-IRQ window without creating a new enable-before-handler
+window.
+
+Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Link: https://patch.msgid.link/20260611160014.3202224-3-runyu.xiao@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 22 ++++++++-----------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+@@ -251,9 +251,17 @@ static int otx2vf_register_mbox_intr(str
+ {
+ struct otx2_hw *hw = &vf->hw;
+ struct msg_req *req;
++ u64 mbox_int_mask;
+ char *irq_name;
+ int err;
+
++ mbox_int_mask = !is_cn20k(vf->pdev) ? BIT_ULL(0) :
++ BIT_ULL(0) | BIT_ULL(1) |
++ BIT_ULL(2) | BIT_ULL(3);
++
++ /* Clear stale mailbox interrupt state before installing the handler. */
++ otx2_write64(vf, RVU_VF_INT, mbox_int_mask);
++
+ /* Register mailbox interrupt handler */
+ irq_name = &hw->irq_name[RVU_VF_INT_VEC_MBOX * NAME_SIZE];
+ snprintf(irq_name, NAME_SIZE, "RVUVF%d AFVF Mbox", ((vf->pcifunc &
+@@ -274,18 +282,8 @@ static int otx2vf_register_mbox_intr(str
+ return err;
+ }
+
+- /* Enable mailbox interrupt for msgs coming from PF.
+- * First clear to avoid spurious interrupts, if any.
+- */
+- if (!is_cn20k(vf->pdev)) {
+- otx2_write64(vf, RVU_VF_INT, BIT_ULL(0));
+- otx2_write64(vf, RVU_VF_INT_ENA_W1S, BIT_ULL(0));
+- } else {
+- otx2_write64(vf, RVU_VF_INT, BIT_ULL(0) | BIT_ULL(1) |
+- BIT_ULL(2) | BIT_ULL(3));
+- otx2_write64(vf, RVU_VF_INT_ENA_W1S, BIT_ULL(0) |
+- BIT_ULL(1) | BIT_ULL(2) | BIT_ULL(3));
+- }
++ /* Enable mailbox interrupt for msgs coming from PF. */
++ otx2_write64(vf, RVU_VF_INT_ENA_W1S, mbox_int_mask);
+
+ if (!probe_pf)
+ return 0;
--- /dev/null
+From fe179677b6dcb4b658586038a811f87265e97777 Mon Sep 17 00:00:00 2001
+From: Gautam Menghani <gautam@linux.ibm.com>
+Date: Mon, 15 Jun 2026 14:41:19 +0530
+Subject: powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
+
+From: Gautam Menghani <gautam@linux.ibm.com>
+
+commit fe179677b6dcb4b658586038a811f87265e97777 upstream.
+
+Currently, CONFIG_VPA_PMU is not enabled by default, and consequently
+cannot be used for KVM guests at all, unless explicitly enabled on
+host kernel.
+
+Mark CONFIG_VPA_PMU as "default m" to ensure it is available when KVM is
+being used.
+
+Cc: stable@vger.kernel.org # v6.13+
+Suggested-by: Sean Christopherson <seanjc@google.com>
+Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
+Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
+[Maddy: Changed tag order]
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20260615091120.84169-1-gautam@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/platforms/pseries/Kconfig
++++ b/arch/powerpc/platforms/pseries/Kconfig
+@@ -154,6 +154,7 @@ config HV_PERF_CTRS
+ config VPA_PMU
+ tristate "VPA PMU events"
+ depends on KVM_BOOK3S_64_HV && HV_PERF_CTRS
++ default m
+ help
+ Enable access to the VPA PMU counters via perf. This enables
+ code that support measurement for KVM on PowerVM(KoP) feature.
octeontx2-af-fix-vf-bringup-affecting-pf-promiscuous.patch
drm-xe-remove-duplicate-kunit-test-bug.h-include.patch
smb-client-fix-overflow-in-passthrough-ioctl-bounds-.patch
+idpf-add-padding-to-ptp-virtchnl-structures.patch
+mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch
+mlxsw-fix-refcount-leak-in-mlxsw_sp_vrs_lpm_tree_replace.patch
+vduse-fix-race-in-vduse_dev_msg_sync-and-vduse_dev_read_iter.patch
+asoc-sof-ipc4-control-fix-toctou-in-sof_ipc4_bytes_put.patch
+asoc-sof-ipc3-control-use-overflow-checks-in-control_update-size-calc.patch
+asoc-sof-ipc3-control-fix-toctou-in-bytes_put-and-bytes_get.patch
+asoc-sof-topology-validate-vendor-array-size-before-parsing.patch
+tipc-restrict-socket-queue-dumps-in-enqueue-tracepoints.patch
+net-qrtr-fix-32-bit-integer-overflow-in-qrtr_endpoint_post.patch
+net-atm-reject-out-of-range-traffic-classes-in-qos-validation.patch
+octeontx2-pf-clear-stale-mailbox-irq-state-before-request_irq.patch
+octeontx2-vf-clear-stale-mailbox-irq-state-before-request_irq.patch
+net-ife-require-eth_hlen-to-be-pullable-in-ife_decode.patch
+arm64-fpsimd-fix-type-mismatch-in-sve_-save-load-_state.patch
+arm64-dts-s32g3-fix-swt8-watchdog-address.patch
+arm-dts-imx6ul-var-som-fix-warning-for-non-existent-dc-supply-property.patch
+arm64-dts-qcom-sdm630-describe-adsp_mem-region-properly.patch
+arm64-dts-rockchip-fix-ethernet-phy-not-found-on-px30-ringneck.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-fix-adc-sampling-times.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-move-divergent-mecio1-adc-channels-to-board-files.patch
+arm64-dts-ti-k3-am62a7-sk-add-bootph-all-tag-to-vqmmc.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-enable-internal-adc-reference.patch
+arm64-dts-imx8ulp-evk-correct-type-c-int-gpio-flags.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-fix-gpio-names-typo.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-move-gpio-line-names-to-board-files.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-fix-expander-gpio-line-typo.patch
+arm-dts-stm32-stm32mp15x-mecio1-io-move-expander-gpio-line-names-to-board-files.patch
+loongarch-kvm-validate-irqchip-index-in-irqfd-routing.patch
+loongarch-kvm-check-irq-validity-in-kvm_vcpu_ioctl_interrupt.patch
+loongarch-kvm-check-the-return-values-for-put_user.patch
+loongarch-kvm-fix-fpu-register-width-with-user-access-api.patch
+loongarch-kvm-return-full-old-csr-value-from-kvm_emu_xchg_csr.patch
+powerpc-pseries-kconfig-enable-config_vpa_pmu-to-be-used-with-kvm.patch
+kvm-s390-pci-fix-gisc-refcount-leak-on-aif-enable-failure.patch
+kvm-arm64-vgic-check-the-interrupt-is-still-ours-before-migrating-it.patch
+kvm-arm64-vgic-handle-race-between-interrupt-affinity-change-and-lpi-disabling.patch
+kvm-s390-pci-fix-handling-of-aif-enable-without-aisb.patch
+kvm-sev-do-not-allow-intra-host-migration-mirroring-of-snp-vms.patch
+kvm-x86-ignore-pending-pv-eoi-if-the-vcpu-has-since-disabled-pv-eois.patch
+kvm-x86-nullify-irqfd-producer-if-updating-irte-for-bypass-fails.patch
+kvm-nvmx-put-vmcs12-pages-if-nested-vm-enter-fails-due-to-invalid-guest-state.patch
+kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch
+kvm-arm64-nv-drop-bogus-warn-for-write-to-zcr_el2.patch
+kvm-arm64-nv-write-esr_el2-for-injected-nested-serror-exceptions.patch
+kvm-arm64-nv-fix-spsr_el2-restore-in-kvm_hyp_handle_mops.patch
+kvm-arm64-nv-respect-read-only-pfn-when-mapping-l1-vncr.patch
+kvm-arm64-nv-inject-sea-if-kvm_translate_vncr-can-t-resolve-pfn.patch
+kvm-arm64-nv-inject-sea-if-guest-vncr-isn-t-normal-memory.patch
--- /dev/null
+From acd7df8d955480a6f6e5bb809da67b1500cc3cf4 Mon Sep 17 00:00:00 2001
+From: Li Xiasong <lixiasong1@huawei.com>
+Date: Thu, 11 Jun 2026 21:56:47 +0800
+Subject: tipc: restrict socket queue dumps in enqueue tracepoints
+
+From: Li Xiasong <lixiasong1@huawei.com>
+
+commit acd7df8d955480a6f6e5bb809da67b1500cc3cf4 upstream.
+
+tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is
+owned by user context. The spinlock protects the backlog queue in this
+path, but it does not serialize against the socket owner consuming or
+purging sk_receive_queue.
+
+KASAN reported:
+
+ CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
+ print_report+0xce/0x5b0 mm/kasan/report.c:482
+ kasan_report+0xc6/0x100 mm/kasan/report.c:597
+ __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
+ tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
+ tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
+ tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
+ trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
+ tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
+ tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
+ __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
+ tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
+ sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
+ splice_to_socket+0x7f9/0x1010 fs/splice.c:884
+ do_splice+0xe21/0x2330 fs/splice.c:936
+ __do_splice+0x153/0x260 fs/splice.c:1431
+ __x64_sys_splice+0x150/0x230 fs/splice.c:1616
+ x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
+ do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
+ RIP: 0033:0x71624e8aafe2
+ Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
+ RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
+ RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
+ RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
+ RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
+ R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
+ R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
+ </TASK>
+
+The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump
+sk_receive_queue and can therefore dereference skbs that the socket
+owner has already dequeued or freed. Restrict these dumps to
+TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held
+spinlock.
+
+Keep the change limited to the enqueue path, where the unsafe queue dump
+is reachable while the socket is owned by user context.
+
+Fixes: 01e661ebfbad ("tipc: add trace_events for tipc socket")
+Cc: stable@vger.kernel.org
+Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
+Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
+Link: https://patch.msgid.link/20260611135647.3666727-1-lixiasong1@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/socket.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2455,17 +2455,17 @@ static void tipc_sk_enqueue(struct sk_bu
+ atomic_set(dcnt, 0);
+ lim = rcvbuf_limit(sk, skb) + atomic_read(dcnt);
+ if (likely(!sk_add_backlog(sk, skb, lim))) {
+- trace_tipc_sk_overlimit1(sk, skb, TIPC_DUMP_ALL,
++ trace_tipc_sk_overlimit1(sk, skb, TIPC_DUMP_SK_BKLGQ,
+ "bklg & rcvq >90% allocated!");
+ continue;
+ }
+
+- trace_tipc_sk_dump(sk, skb, TIPC_DUMP_ALL, "err_overload!");
++ trace_tipc_sk_dump(sk, skb, TIPC_DUMP_SK_BKLGQ, "err_overload!");
+ /* Overload => reject message back to sender */
+ onode = tipc_own_addr(sock_net(sk));
+ sk_drops_inc(sk);
+ if (tipc_msg_reverse(onode, &skb, TIPC_ERR_OVERLOAD)) {
+- trace_tipc_sk_rej_msg(sk, skb, TIPC_DUMP_ALL,
++ trace_tipc_sk_rej_msg(sk, skb, TIPC_DUMP_SK_BKLGQ,
+ "@sk_enqueue!");
+ __skb_queue_tail(xmitq, skb);
+ }
--- /dev/null
+From ae9c13b6fd79087cc5a216ee1649b6f012c2a238 Mon Sep 17 00:00:00 2001
+From: Zhang Tianci <zhangtianci.1997@bytedance.com>
+Date: Thu, 26 Feb 2026 19:55:50 +0800
+Subject: vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhang Tianci <zhangtianci.1997@bytedance.com>
+
+commit ae9c13b6fd79087cc5a216ee1649b6f012c2a238 upstream.
+
+There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:
+
+vduse_dev_read_iter():
+ lock(msg_lock);
+ dequeue_msg(send_list);
+ unlock(msg_lock);
+vduse_dev_msg_sync():
+ wait_timeout() finish
+ lock(msg_lock);
+ check msg->complete is false
+ list_del(msg); <- double list_del() crash!
+
+To fix this case, we shall ensure vduse_msg is on send_list or recv_list
+outside the msg_lock critical section.
+
+Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com>
+Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20260226115550.1814-3-zhangtianci.1997@bytedance.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vdpa/vdpa_user/vduse_dev.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+--- a/drivers/vdpa/vdpa_user/vduse_dev.c
++++ b/drivers/vdpa/vdpa_user/vduse_dev.c
+@@ -331,6 +331,7 @@ static ssize_t vduse_dev_read_iter(struc
+ struct file *file = iocb->ki_filp;
+ struct vduse_dev *dev = file->private_data;
+ struct vduse_dev_msg *msg;
++ struct vduse_dev_request req;
+ int size = sizeof(struct vduse_dev_request);
+ ssize_t ret;
+
+@@ -342,12 +343,11 @@ static ssize_t vduse_dev_read_iter(struc
+ msg = vduse_dequeue_msg(&dev->send_list);
+ if (msg)
+ break;
++ spin_unlock(&dev->msg_lock);
+
+- ret = -EAGAIN;
+ if (file->f_flags & O_NONBLOCK)
+- goto unlock;
++ return -EAGAIN;
+
+- spin_unlock(&dev->msg_lock);
+ ret = wait_event_interruptible_exclusive(dev->waitq,
+ !list_empty(&dev->send_list));
+ if (ret)
+@@ -355,17 +355,34 @@ static ssize_t vduse_dev_read_iter(struc
+
+ spin_lock(&dev->msg_lock);
+ }
++
++ memcpy(&req, &msg->req, sizeof(req));
++ /*
++ * We must ensure vduse_msg is on send_list or recv_list before unlock
++ * dev->msg_lock. Because vduse_dev_msg_sync() may be timeout when we
++ * copy data to userspace, and will call list_del() for this msg.
++ */
++ vduse_enqueue_msg(&dev->recv_list, msg);
+ spin_unlock(&dev->msg_lock);
+- ret = copy_to_iter(&msg->req, size, to);
+- spin_lock(&dev->msg_lock);
++
++ ret = copy_to_iter(&req, size, to);
+ if (ret != size) {
++ /*
++ * Roll back: move msg back to send_list if still pending.
++ *
++ * NOTE:
++ * vduse_find_msg() must use req.request_id instead of `msg`.
++ * A malicious userspace may reply to this request, and wake up
++ * the caller, after which `msg` will have already been freed.
++ * And here vduse_find_msg() will return NULL then do nothing.
++ */
++ spin_lock(&dev->msg_lock);
++ msg = vduse_find_msg(&dev->recv_list, req.request_id);
++ if (msg)
++ vduse_enqueue_msg_head(&dev->send_list, msg);
++ spin_unlock(&dev->msg_lock);
+ ret = -EFAULT;
+- vduse_enqueue_msg_head(&dev->send_list, msg);
+- goto unlock;
+ }
+- vduse_enqueue_msg(&dev->recv_list, msg);
+-unlock:
+- spin_unlock(&dev->msg_lock);
+
+ return ret;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
