--- /dev/null
+From bfe3d755ef7cec71aac6ecda34a107624735aac7 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Wed, 29 Oct 2025 13:05:32 +0000
+Subject: btrfs: do not update last_log_commit when logging inode due to a new name
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit bfe3d755ef7cec71aac6ecda34a107624735aac7 upstream.
+
+When logging that a new name exists, we skip updating the inode's
+last_log_commit field to prevent a later explicit fsync against the inode
+from doing nothing (as updating last_log_commit makes btrfs_inode_in_log()
+return true). We are detecting, at btrfs_log_inode(), that logging a new
+name is happening by checking the logging mode is not LOG_INODE_EXISTS,
+but that is not enough because we may log parent directories when logging
+a new name of a file in LOG_INODE_ALL mode - we need to check that the
+logging_new_name field of the log context too.
+
+An example scenario where this results in an explicit fsync against a
+directory not persisting changes to the directory is the following:
+
+ $ mkfs.btrfs -f /dev/sdc
+ $ mount /dev/sdc /mnt
+
+ $ touch /mnt/foo
+
+ $ sync
+
+ $ mkdir /mnt/dir
+
+ # Write some data to our file and fsync it.
+ $ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo
+
+ # Add a new link to our file. Since the file was logged before, we
+ # update it in the log tree by calling btrfs_log_new_name().
+ $ ln /mnt/foo /mnt/dir/bar
+
+ # fsync the root directory - we expect it to persist the dentry for
+ # the new directory "dir".
+ $ xfs_io -c "fsync" /mnt
+
+ <power fail>
+
+After mounting the fs the entry for directory "dir" does not exists,
+despite the explicit fsync on the root directory.
+
+Here's why this happens:
+
+1) When we fsync the file we log the inode, so that it's present in the
+ log tree;
+
+2) When adding the new link we enter btrfs_log_new_name(), and since the
+ inode is in the log tree we proceed to updating the inode in the log
+ tree;
+
+3) We first set the inode's last_unlink_trans to the current transaction
+ (early in btrfs_log_new_name());
+
+4) We then eventually enter btrfs_log_inode_parent(), and after logging
+ the file's inode, we call btrfs_log_all_parents() because the inode's
+ last_unlink_trans matches the current transaction's ID (updated in the
+ previous step);
+
+5) So btrfs_log_all_parents() logs the root directory by calling
+ btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL
+ so that new dentries are logged;
+
+6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we
+ update root inode's last_log_commit to the last transaction that
+ changed the inode (->last_sub_trans field of the inode), which
+ corresponds to the current transaction's ID;
+
+7) Then later when user space explicitly calls fsync against the root
+ directory, we enter btrfs_sync_file(), which calls skip_inode_logging()
+ and that returns true, since its call to btrfs_inode_in_log() returns
+ true and there are no ordered extents (it's a directory, never has
+ ordered extents). This results in btrfs_sync_file() returning without
+ syncing the log or committing the current transaction, so all the
+ updates we did when logging the new name, including logging the root
+ directory, are not persisted.
+
+So fix this by but updating the inode's last_log_commit if we are sure
+we are not logging a new name (if ctx->logging_new_name is false).
+
+A test case for fstests will follow soon.
+
+Reported-by: Vyacheslav Kovalevsky <slava.kovalevskiy.2014@gmail.com>
+Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/
+Fixes: 130341be7ffa ("btrfs: always update the logged transaction when logging new names")
+CC: stable@vger.kernel.org # 6.1+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/tree-log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -6812,7 +6812,7 @@ log_extents:
+ * a power failure unless the log was synced as part of an fsync
+ * against any other unrelated inode.
+ */
+- if (inode_only != LOG_INODE_EXISTS)
++ if (!ctx->logging_new_name && inode_only != LOG_INODE_EXISTS)
+ inode->last_log_commit = inode->last_sub_trans;
+ spin_unlock(&inode->lock);
+
--- /dev/null
+From c367af440e03eba7beb0c9f3fe540f9bcb69134a Mon Sep 17 00:00:00 2001
+From: Zilin Guan <zilin@seu.edu.cn>
+Date: Wed, 5 Nov 2025 02:37:22 +0000
+Subject: btrfs: release root after error in data_reloc_print_warning_inode()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+commit c367af440e03eba7beb0c9f3fe540f9bcb69134a upstream.
+
+data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain
+local_root, but fails to release its reference when paths_from_inode()
+returns an error. This causes a potential memory leak.
+
+Add a missing btrfs_put_root() call in the error path to properly
+decrease the reference count of local_root.
+
+Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails")
+CC: stable@vger.kernel.org # 6.6+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -174,8 +174,10 @@ static int data_reloc_print_warning_inod
+ return ret;
+ }
+ ret = paths_from_inode(inum, ipath);
+- if (ret < 0)
++ if (ret < 0) {
++ btrfs_put_root(local_root);
+ goto err;
++ }
+
+ /*
+ * We deliberately ignore the bit ipath might have been too small to
--- /dev/null
+From 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd Mon Sep 17 00:00:00 2001
+From: Zilin Guan <zilin@seu.edu.cn>
+Date: Wed, 5 Nov 2025 03:53:21 +0000
+Subject: btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+commit 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd upstream.
+
+scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but
+fails to release it on some error paths, leading to a potential
+memory leak.
+
+Add the missing bio_put() calls to properly drop the bio reference
+in those error cases.
+
+Fixes: 1009254bf22a3 ("btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub")
+CC: stable@vger.kernel.org # 6.6+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/scrub.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2185,6 +2185,7 @@ static int scrub_raid56_parity_stripe(st
+ ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, full_stripe_start,
+ &length, &bioc, NULL, NULL);
+ if (ret < 0) {
++ bio_put(bio);
+ btrfs_put_bioc(bioc);
+ btrfs_bio_counter_dec(fs_info);
+ goto out;
+@@ -2194,6 +2195,7 @@ static int scrub_raid56_parity_stripe(st
+ btrfs_put_bioc(bioc);
+ if (!rbio) {
+ ret = -ENOMEM;
++ bio_put(bio);
+ btrfs_bio_counter_dec(fs_info);
+ goto out;
+ }
--- /dev/null
+From 94f54924b96d3565c6b559294b3401b5496c21ac Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naohiro.aota@wdc.com>
+Date: Fri, 12 Sep 2025 15:43:21 +0900
+Subject: btrfs: zoned: fix conventional zone capacity calculation
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+commit 94f54924b96d3565c6b559294b3401b5496c21ac upstream.
+
+When a block group contains both conventional zone and sequential zone, the
+capacity of the block group is wrongly set to the block group's full
+length. The capacity should be calculated in btrfs_load_block_group_* using
+the last allocation offset.
+
+Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree")
+CC: stable@vger.kernel.org # v6.12+
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/zoned.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/zoned.c
++++ b/fs/btrfs/zoned.c
+@@ -1317,6 +1317,7 @@ static int btrfs_load_zone_info(struct b
+ if (!btrfs_dev_is_sequential(device, info->physical)) {
+ up_read(&dev_replace->rwsem);
+ info->alloc_offset = WP_CONVENTIONAL;
++ info->capacity = device->zone_info->zone_size;
+ return 0;
+ }
+
+@@ -1683,8 +1684,6 @@ int btrfs_load_block_group_zone_info(str
+ set_bit(BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, &cache->runtime_flags);
+
+ if (num_conventional > 0) {
+- /* Zone capacity is always zone size in emulation */
+- cache->zone_capacity = cache->length;
+ ret = calculate_alloc_pointer(cache, &last_alloc, new);
+ if (ret) {
+ btrfs_err(fs_info,
+@@ -1693,6 +1692,7 @@ int btrfs_load_block_group_zone_info(str
+ goto out;
+ } else if (map->num_stripes == num_conventional) {
+ cache->alloc_offset = last_alloc;
++ cache->zone_capacity = cache->length;
+ set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &cache->runtime_flags);
+ goto out;
+ }
--- /dev/null
+From 6a1ab50135ce829b834b448ce49867b5210a1641 Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naohiro.aota@wdc.com>
+Date: Tue, 16 Sep 2025 11:46:11 +0900
+Subject: btrfs: zoned: fix stripe width calculation
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+commit 6a1ab50135ce829b834b448ce49867b5210a1641 upstream.
+
+The stripe offset calculation in the zoned code for raid0 and raid10
+wrongly uses map->stripe_size to calculate it. In fact, map->stripe_size is
+the size of the device extent composing the block group, which always is
+the zone_size on the zoned setup.
+
+Fix it by using BTRFS_STRIPE_LEN and BTRFS_STRIPE_LEN_SHIFT. Also, optimize
+the calculation a bit by doing the common calculation only once.
+
+Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups")
+CC: stable@vger.kernel.org # 6.17+
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/zoned.c | 56 +++++++++++++++++++++++++------------------------------
+ 1 file changed, 26 insertions(+), 30 deletions(-)
+
+--- a/fs/btrfs/zoned.c
++++ b/fs/btrfs/zoned.c
+@@ -1523,6 +1523,8 @@ static int btrfs_load_block_group_raid0(
+ u64 last_alloc)
+ {
+ struct btrfs_fs_info *fs_info = bg->fs_info;
++ u64 stripe_nr = 0, stripe_offset = 0;
++ u32 stripe_index = 0;
+
+ if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) {
+ btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree",
+@@ -1530,28 +1532,26 @@ static int btrfs_load_block_group_raid0(
+ return -EINVAL;
+ }
+
++ if (last_alloc) {
++ u32 factor = map->num_stripes;
++
++ stripe_nr = last_alloc >> BTRFS_STRIPE_LEN_SHIFT;
++ stripe_offset = last_alloc & BTRFS_STRIPE_LEN_MASK;
++ stripe_nr = div_u64_rem(stripe_nr, factor, &stripe_index);
++ }
++
+ for (int i = 0; i < map->num_stripes; i++) {
+ if (zone_info[i].alloc_offset == WP_MISSING_DEV)
+ continue;
+
+ if (zone_info[i].alloc_offset == WP_CONVENTIONAL) {
+- u64 stripe_nr, full_stripe_nr;
+- u64 stripe_offset;
+- int stripe_index;
+-
+- stripe_nr = div64_u64(last_alloc, map->stripe_size);
+- stripe_offset = stripe_nr * map->stripe_size;
+- full_stripe_nr = div_u64(stripe_nr, map->num_stripes);
+- div_u64_rem(stripe_nr, map->num_stripes, &stripe_index);
+
+- zone_info[i].alloc_offset =
+- full_stripe_nr * map->stripe_size;
++ zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr);
+
+ if (stripe_index > i)
+- zone_info[i].alloc_offset += map->stripe_size;
++ zone_info[i].alloc_offset += BTRFS_STRIPE_LEN;
+ else if (stripe_index == i)
+- zone_info[i].alloc_offset +=
+- (last_alloc - stripe_offset);
++ zone_info[i].alloc_offset += stripe_offset;
+ }
+
+ if (test_bit(0, active) != test_bit(i, active)) {
+@@ -1575,6 +1575,8 @@ static int btrfs_load_block_group_raid10
+ u64 last_alloc)
+ {
+ struct btrfs_fs_info *fs_info = bg->fs_info;
++ u64 stripe_nr = 0, stripe_offset = 0;
++ u32 stripe_index = 0;
+
+ if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) {
+ btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree",
+@@ -1582,6 +1584,14 @@ static int btrfs_load_block_group_raid10
+ return -EINVAL;
+ }
+
++ if (last_alloc) {
++ u32 factor = map->num_stripes / map->sub_stripes;
++
++ stripe_nr = last_alloc >> BTRFS_STRIPE_LEN_SHIFT;
++ stripe_offset = last_alloc & BTRFS_STRIPE_LEN_MASK;
++ stripe_nr = div_u64_rem(stripe_nr, factor, &stripe_index);
++ }
++
+ for (int i = 0; i < map->num_stripes; i++) {
+ if (zone_info[i].alloc_offset == WP_MISSING_DEV)
+ continue;
+@@ -1595,26 +1605,12 @@ static int btrfs_load_block_group_raid10
+ }
+
+ if (zone_info[i].alloc_offset == WP_CONVENTIONAL) {
+- u64 stripe_nr, full_stripe_nr;
+- u64 stripe_offset;
+- int stripe_index;
+-
+- stripe_nr = div64_u64(last_alloc, map->stripe_size);
+- stripe_offset = stripe_nr * map->stripe_size;
+- full_stripe_nr = div_u64(stripe_nr,
+- map->num_stripes / map->sub_stripes);
+- div_u64_rem(stripe_nr,
+- (map->num_stripes / map->sub_stripes),
+- &stripe_index);
+-
+- zone_info[i].alloc_offset =
+- full_stripe_nr * map->stripe_size;
++ zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr);
+
+ if (stripe_index > (i / map->sub_stripes))
+- zone_info[i].alloc_offset += map->stripe_size;
++ zone_info[i].alloc_offset += BTRFS_STRIPE_LEN;
+ else if (stripe_index == (i / map->sub_stripes))
+- zone_info[i].alloc_offset +=
+- (last_alloc - stripe_offset);
++ zone_info[i].alloc_offset += stripe_offset;
+ }
+
+ if ((i % map->sub_stripes) == 0) {
--- /dev/null
+From 22a36e660d014925114feb09a2680bb3c2d1e279 Mon Sep 17 00:00:00 2001
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Date: Thu, 6 Nov 2025 12:35:53 -0500
+Subject: drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+commit 22a36e660d014925114feb09a2680bb3c2d1e279 upstream.
+
+Certain multi-GPU configurations (especially GFX12) may hit
+data corruption when a DCC-compressed VRAM surface is shared across GPUs
+using peer-to-peer (P2P) DMA transfers.
+
+Such surfaces rely on device-local metadata and cannot be safely accessed
+through a remote GPU’s page tables. Attempting to import a DCC-enabled
+surface through P2P leads to incorrect rendering or GPU faults.
+
+This change disables P2P for DCC-enabled VRAM buffers that are contiguous
+and allocated on GFX12+ hardware. In these cases, the importer falls back
+to the standard system-memory path, avoiding invalid access to compressed
+surfaces.
+
+Future work could consider optional migration (VRAM→System→VRAM) if a
+performance regression is observed when `attach->peer2peer = false`.
+
+Tested on:
+ - Dual RX 9700 XT (Navi4x) setup
+ - GNOME and Wayland compositor scenarios
+ - Confirmed no corruption after disabling P2P under these conditions
+v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS.
+v3: simplify for upsteam and fix ip version check (Alex)
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+@@ -82,6 +82,18 @@ static int amdgpu_dma_buf_attach(struct
+ struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj);
+ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev);
+
++ /*
++ * Disable peer-to-peer access for DCC-enabled VRAM surfaces on GFX12+.
++ * Such buffers cannot be safely accessed over P2P due to device-local
++ * compression metadata. Fallback to system-memory path instead.
++ * Device supports GFX12 (GC 12.x or newer)
++ * BO was created with the AMDGPU_GEM_CREATE_GFX12_DCC flag
++ *
++ */
++ if (amdgpu_ip_version(adev, GC_HWIP, 0) >= IP_VERSION(12, 0, 0) &&
++ bo->flags & AMDGPU_GEM_CREATE_GFX12_DCC)
++ attach->peer2peer = false;
++
+ if (!amdgpu_dmabuf_is_xgmi_accessible(attach_adev, bo) &&
+ pci_p2pdma_distance(adev->pdev, attach->dev, false) < 0)
+ attach->peer2peer = false;
--- /dev/null
+From 6623c5f9fd877868fba133b4ae4dab0052e82dad Mon Sep 17 00:00:00 2001
+From: "Jesse.Zhang" <Jesse.Zhang@amd.com>
+Date: Fri, 24 Oct 2025 16:09:25 +0800
+Subject: drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+commit 6623c5f9fd877868fba133b4ae4dab0052e82dad upstream.
+
+Fix a potential deadlock caused by inconsistent spinlock usage
+between interrupt and process contexts in the userq fence driver.
+
+The issue occurs when amdgpu_userq_fence_driver_process() is called
+from both:
+- Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process()
+- Process context: amdgpu_eviction_fence_suspend_worker() ->
+ amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process()
+
+In interrupt context, the spinlock was acquired without disabling
+interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock
+is acquired in process context, the kernel detects inconsistent
+locking since the process context acquisition would enable interrupts
+while holding a lock previously acquired in interrupt context.
+
+Kernel log shows:
+[ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+[ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes:
+[ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3},
+[ 4039.310993] {IN-HARDIRQ-W} state was registered at:
+[ 4039.311004] lock_acquire+0xc6/0x300
+[ 4039.311018] _raw_spin_lock+0x39/0x80
+[ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu]
+[ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu]
+[ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu]
+
+Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly
+manage interrupt state regardless of calling context.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+@@ -143,15 +143,16 @@ void amdgpu_userq_fence_driver_process(s
+ {
+ struct amdgpu_userq_fence *userq_fence, *tmp;
+ struct dma_fence *fence;
++ unsigned long flags;
+ u64 rptr;
+ int i;
+
+ if (!fence_drv)
+ return;
+
++ spin_lock_irqsave(&fence_drv->fence_list_lock, flags);
+ rptr = amdgpu_userq_fence_read(fence_drv);
+
+- spin_lock(&fence_drv->fence_list_lock);
+ list_for_each_entry_safe(userq_fence, tmp, &fence_drv->fences, link) {
+ fence = &userq_fence->base;
+
+@@ -166,7 +167,7 @@ void amdgpu_userq_fence_driver_process(s
+ list_del(&userq_fence->link);
+ dma_fence_put(fence);
+ }
+- spin_unlock(&fence_drv->fence_list_lock);
++ spin_unlock_irqrestore(&fence_drv->fence_list_lock, flags);
+ }
+
+ void amdgpu_userq_fence_driver_destroy(struct kref *ref)
--- /dev/null
+From d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 Mon Sep 17 00:00:00 2001
+From: Jonathan Kim <jonathan.kim@amd.com>
+Date: Thu, 6 Nov 2025 10:17:06 -0500
+Subject: drm/amdkfd: relax checks for over allocation of save area
+
+From: Jonathan Kim <jonathan.kim@amd.com>
+
+commit d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 upstream.
+
+Over allocation of save area is not fatal, only under allocation is.
+ROCm has various components that independently claim authority over save
+area size.
+
+Unless KFD decides to claim single authority, relax size checks.
+
+Signed-off-by: Jonathan Kim <jonathan.kim@amd.com>
+Reviewed-by: Philip Yang <philip.yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 15bd4958fe38e763bc17b607ba55155254a01f55)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -297,16 +297,16 @@ int kfd_queue_acquire_buffers(struct kfd
+ goto out_err_unreserve;
+ }
+
+- if (properties->ctx_save_restore_area_size != topo_dev->node_props.cwsr_size) {
+- pr_debug("queue cwsr size 0x%x not equal to node cwsr size 0x%x\n",
++ if (properties->ctx_save_restore_area_size < topo_dev->node_props.cwsr_size) {
++ pr_debug("queue cwsr size 0x%x not sufficient for node cwsr size 0x%x\n",
+ properties->ctx_save_restore_area_size,
+ topo_dev->node_props.cwsr_size);
+ err = -EINVAL;
+ goto out_err_unreserve;
+ }
+
+- total_cwsr_size = (topo_dev->node_props.cwsr_size + topo_dev->node_props.debug_memory_size)
+- * NUM_XCC(pdd->dev->xcc_mask);
++ total_cwsr_size = (properties->ctx_save_restore_area_size +
++ topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
+ total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
+
+ err = kfd_queue_buffer_get(vm, (void *)properties->ctx_save_restore_area_address,
+@@ -352,8 +352,8 @@ int kfd_queue_release_buffers(struct kfd
+ topo_dev = kfd_topology_device_by_id(pdd->dev->id);
+ if (!topo_dev)
+ return -EINVAL;
+- total_cwsr_size = (topo_dev->node_props.cwsr_size + topo_dev->node_props.debug_memory_size)
+- * NUM_XCC(pdd->dev->xcc_mask);
++ total_cwsr_size = (properties->ctx_save_restore_area_size +
++ topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
+ total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
+
+ kfd_queue_buffer_svm_put(pdd, properties->ctx_save_restore_area_address, total_cwsr_size);
--- /dev/null
+From 994dec10991b53beac3e16109d876ae363e8a329 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 6 Nov 2025 22:00:00 +0200
+Subject: drm/i915/psr: fix pipe to vblank conversion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 994dec10991b53beac3e16109d876ae363e8a329 upstream.
+
+First, we can't assume pipe == crtc index. If a pipe is fused off in
+between, it no longer holds. intel_crtc_for_pipe() is the only proper
+way to get from a pipe to the corresponding crtc.
+
+Second, drivers aren't supposed to access or index drm->vblank[]
+directly. There's drm_crtc_vblank_crtc() for this.
+
+Use both functions to fix the pipe to vblank conversion.
+
+Fixes: f02658c46cf7 ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable")
+Cc: Jouni Högander <jouni.hogander@intel.com>
+Cc: stable@vger.kernel.org # v6.16+
+Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
+Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -896,7 +896,8 @@ static bool is_dc5_dc6_blocked(struct in
+ {
+ struct intel_display *display = to_intel_display(intel_dp);
+ u32 current_dc_state = intel_display_power_get_current_dc_state(display);
+- struct drm_vblank_crtc *vblank = &display->drm->vblank[intel_dp->psr.pipe];
++ struct intel_crtc *crtc = intel_crtc_for_pipe(display, intel_dp->psr.pipe);
++ struct drm_vblank_crtc *vblank = drm_crtc_vblank_crtc(&crtc->base);
+
+ return (current_dc_state != DC_STATE_EN_UPTO_DC5 &&
+ current_dc_state != DC_STATE_EN_UPTO_DC6) ||
--- /dev/null
+From 0b2f7be548006b0651e1e8320790f49723265cbc Mon Sep 17 00:00:00 2001
+From: Nitin Gote <nitin.r.gote@intel.com>
+Date: Mon, 27 Oct 2025 14:56:43 +0530
+Subject: drm/xe/xe3: Add WA_14024681466 for Xe3_LPG
+
+From: Nitin Gote <nitin.r.gote@intel.com>
+
+commit 0b2f7be548006b0651e1e8320790f49723265cbc upstream.
+
+Apply WA_14024681466 to Xe3_LPG graphics IP versions from 30.00 to 30.05.
+
+v2: (Matthew Roper)
+ - Remove stepping filter as workaround applies to all steppings.
+ - Add an engine class filter so it only applies to the RENDER engine.
+
+Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
+Link: https://patch.msgid.link/20251027092643.335904-1-nitin.r.gote@intel.com
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+(cherry picked from commit 071089a69e199bd810ff31c4c933bd528e502743)
+Cc: stable@vger.kernel.org # v6.16+
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 +
+ drivers/gpu/drm/xe/xe_wa.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/xe/regs/xe_gt_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+@@ -168,6 +168,7 @@
+
+ #define XEHP_SLICE_COMMON_ECO_CHICKEN1 XE_REG_MCR(0x731c, XE_REG_OPTION_MASKED)
+ #define MSC_MSAA_REODER_BUF_BYPASS_DISABLE REG_BIT(14)
++#define FAST_CLEAR_VALIGN_FIX REG_BIT(13)
+
+ #define XE2LPM_CCCHKNREG1 XE_REG(0x82a8)
+
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -890,6 +890,10 @@ static const struct xe_rtp_entry_sr lrc_
+ ENGINE_CLASS(RENDER)),
+ XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX))
+ },
++ { XE_RTP_NAME("14024681466"),
++ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005), ENGINE_CLASS(RENDER)),
++ XE_RTP_ACTIONS(SET(XEHP_SLICE_COMMON_ECO_CHICKEN1, FAST_CLEAR_VALIGN_FIX))
++ },
+ };
+
+ static __maybe_unused const struct xe_rtp_entry oob_was[] = {
--- /dev/null
+From fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc Mon Sep 17 00:00:00 2001
+From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+Date: Thu, 30 Oct 2025 21:16:26 +0530
+Subject: drm/xe/xe3: Extend wa_14023061436
+
+From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+
+commit fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc upstream.
+
+Extend wa_14023061436 to Graphics Versions 30.03, 30.04
+and 30.05.
+
+Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patch.msgid.link/20251030154626.3124565-1-tilak.tirumalesh.tangudu@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+(cherry picked from commit 0dd656d06f50ae4cedf160634cf13fd9e0944cf7)
+Cc: stable@vger.kernel.org # v6.17+
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_wa.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -653,6 +653,8 @@ static const struct xe_rtp_entry_sr engi
+ },
+ { XE_RTP_NAME("14023061436"),
+ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3001),
++ FUNC(xe_rtp_match_first_render_or_compute), OR,
++ GRAPHICS_VERSION_RANGE(3003, 3005),
+ FUNC(xe_rtp_match_first_render_or_compute)),
+ XE_RTP_ACTIONS(SET(TDL_CHICKEN, QID_WAIT_FOR_THREAD_NOT_RUN_DISABLE))
+ },
--- /dev/null
+From 240372edaf854c9136f5ead45f2d8cd9496a9cb3 Mon Sep 17 00:00:00 2001
+From: Nitin Gote <nitin.r.gote@intel.com>
+Date: Thu, 6 Nov 2025 15:35:17 +0530
+Subject: drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg
+
+From: Nitin Gote <nitin.r.gote@intel.com>
+
+commit 240372edaf854c9136f5ead45f2d8cd9496a9cb3 upstream.
+
+Wa_15016589081 applies to Xe3_LPG renderCS
+
+Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
+Link: https://patch.msgid.link/20251106100516.318863-2-nitin.r.gote@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+(cherry picked from commit 715974499a2199bd199fb4630501f55545342ea4)
+Cc: stable@vger.kernel.org # v6.16+
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_wa.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -883,6 +883,11 @@ static const struct xe_rtp_entry_sr lrc_
+ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3003), ENGINE_CLASS(RENDER)),
+ XE_RTP_ACTIONS(SET(COMMON_SLICE_CHICKEN4, SBE_PUSH_CONSTANT_BEHIND_FIX_ENABLE))
+ },
++ { XE_RTP_NAME("15016589081"),
++ XE_RTP_RULES(GRAPHICS_VERSION(3000), GRAPHICS_STEP(A0, B0),
++ ENGINE_CLASS(RENDER)),
++ XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX))
++ },
+ };
+
+ static __maybe_unused const struct xe_rtp_entry oob_was[] = {
--- /dev/null
+From fd3ecda38fe0cb713d167b5477d25f6b350f0514 Mon Sep 17 00:00:00 2001
+From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+Date: Tue, 11 Nov 2025 16:08:01 +0800
+Subject: EDAC/altera: Handle OCRAM ECC enable after warm reset
+
+From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+
+commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream.
+
+The OCRAM ECC is always enabled either by the BootROM or by the Secure Device
+Manager (SDM) during a power-on reset on SoCFPGA.
+
+However, during a warm reset, the OCRAM content is retained to preserve data,
+while the control and status registers are reset to their default values. As
+a result, ECC must be explicitly re-enabled after a warm reset.
+
+Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support")
+Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Dinh Nguyen <dinguyen@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/altera_edac.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1184,10 +1184,22 @@ altr_check_ocram_deps_init(struct altr_e
+ if (ret)
+ return ret;
+
+- /* Verify OCRAM has been initialized */
++ /*
++ * Verify that OCRAM has been initialized.
++ * During a warm reset, OCRAM contents are retained, but the control
++ * and status registers are reset to their default values. Therefore,
++ * ECC must be explicitly re-enabled in the control register.
++ * Error condition: if INITCOMPLETEA is clear and ECC_EN is already set.
++ */
+ if (!ecc_test_bits(ALTR_A10_ECC_INITCOMPLETEA,
+- (base + ALTR_A10_ECC_INITSTAT_OFST)))
+- return -ENODEV;
++ (base + ALTR_A10_ECC_INITSTAT_OFST))) {
++ if (!ecc_test_bits(ALTR_A10_ECC_EN,
++ (base + ALTR_A10_ECC_CTRL_OFST)))
++ ecc_set_bits(ALTR_A10_ECC_EN,
++ (base + ALTR_A10_ECC_CTRL_OFST));
++ else
++ return -ENODEV;
++ }
+
+ /* Enable IRQ on Single Bit Error */
+ writel(ALTR_A10_ECC_SERRINTEN, (base + ALTR_A10_ECC_ERRINTENS_OFST));
--- /dev/null
+From 281326be67252ac5794d1383f67526606b1d6b13 Mon Sep 17 00:00:00 2001
+From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+Date: Tue, 11 Nov 2025 16:13:33 +0800
+Subject: EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
+
+From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+
+commit 281326be67252ac5794d1383f67526606b1d6b13 upstream.
+
+The current single-bit error injection mechanism flips bits directly in ECC RAM
+by performing write and read operations. When the ECC RAM is actively used by
+the Ethernet or USB controller, this approach sometimes trigger a false
+double-bit error.
+
+Switch both Ethernet and USB EDAC devices to use the INTTEST register
+(altr_edac_a10_device_inject_fops) for single-bit error injection, similar to
+the existing double-bit error injection method.
+
+Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support")
+Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Dinh Nguyen <dinguyen@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/altera_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1369,7 +1369,7 @@ static const struct edac_device_prv_data
+ .ue_set_mask = ALTR_A10_ECC_TDERRA,
+ .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
+ .ecc_irq_handler = altr_edac_a10_ecc_irq,
+- .inject_fops = &altr_edac_a10_device_inject2_fops,
++ .inject_fops = &altr_edac_a10_device_inject_fops,
+ };
+
+ #endif /* CONFIG_EDAC_ALTERA_ETHERNET */
+@@ -1459,7 +1459,7 @@ static const struct edac_device_prv_data
+ .ue_set_mask = ALTR_A10_ECC_TDERRA,
+ .set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
+ .ecc_irq_handler = altr_edac_a10_ecc_irq,
+- .inject_fops = &altr_edac_a10_device_inject2_fops,
++ .inject_fops = &altr_edac_a10_device_inject_fops,
+ };
+
+ #endif /* CONFIG_EDAC_ALTERA_USB */
--- /dev/null
+From ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Sun, 9 Nov 2025 16:02:01 +0800
+Subject: LoongArch: Consolidate max_pfn & max_low_pfn calculation
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 upstream.
+
+Now there 5 places which calculate max_pfn & max_low_pfn:
+1. in fdt_setup() for FDT systems;
+2. in memblock_init() for ACPI systems;
+3. in init_numa_memory() for NUMA systems;
+4. in arch_mem_init() to recalculate for "mem=" cmdline;
+5. in paging_init() to recalculate for NUMA systems.
+
+Since memblock_init() is called both for ACPI and FDT systems, move the
+calculation out of the for_each_efi_memory_desc() loop can eliminate the
+first case. The last case is very questionable (may be derived from the
+MIPS/Loongson code) and breaks the "mem=" cmdline, so should be removed.
+And then the NUMA version of paging_init() can be also eliminated.
+
+After consolidation there are 3 places of calculation:
+1. in memblock_init() for both ACPI and FDT systems;
+2. in init_numa_memory() to recalculate for NUMA systems;
+3. in arch_mem_init() to recalculate for the "mem=" cmdline.
+
+For all cases the calculation is:
+max_pfn = PFN_DOWN(memblock_end_of_DRAM());
+max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn);
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/mem.c | 7 +++----
+ arch/loongarch/kernel/numa.c | 23 ++---------------------
+ arch/loongarch/kernel/setup.c | 5 ++---
+ arch/loongarch/mm/init.c | 2 --
+ 4 files changed, 7 insertions(+), 30 deletions(-)
+
+--- a/arch/loongarch/kernel/mem.c
++++ b/arch/loongarch/kernel/mem.c
+@@ -13,7 +13,7 @@
+ void __init memblock_init(void)
+ {
+ u32 mem_type;
+- u64 mem_start, mem_end, mem_size;
++ u64 mem_start, mem_size;
+ efi_memory_desc_t *md;
+
+ /* Parse memory information */
+@@ -21,7 +21,6 @@ void __init memblock_init(void)
+ mem_type = md->type;
+ mem_start = md->phys_addr;
+ mem_size = md->num_pages << EFI_PAGE_SHIFT;
+- mem_end = mem_start + mem_size;
+
+ switch (mem_type) {
+ case EFI_LOADER_CODE:
+@@ -31,8 +30,6 @@ void __init memblock_init(void)
+ case EFI_PERSISTENT_MEMORY:
+ case EFI_CONVENTIONAL_MEMORY:
+ memblock_add(mem_start, mem_size);
+- if (max_low_pfn < (mem_end >> PAGE_SHIFT))
+- max_low_pfn = mem_end >> PAGE_SHIFT;
+ break;
+ case EFI_PAL_CODE:
+ case EFI_UNUSABLE_MEMORY:
+@@ -49,6 +46,8 @@ void __init memblock_init(void)
+ }
+ }
+
++ max_pfn = PFN_DOWN(memblock_end_of_DRAM());
++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn);
+ memblock_set_current_limit(PFN_PHYS(max_low_pfn));
+
+ /* Reserve the first 2MB */
+--- a/arch/loongarch/kernel/numa.c
++++ b/arch/loongarch/kernel/numa.c
+@@ -272,7 +272,8 @@ int __init init_numa_memory(void)
+ node_mem_init(node);
+ node_set_online(node);
+ }
+- max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
++ max_pfn = PFN_DOWN(memblock_end_of_DRAM());
++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn);
+
+ setup_nr_node_ids();
+ loongson_sysconf.nr_nodes = nr_node_ids;
+@@ -283,26 +284,6 @@ int __init init_numa_memory(void)
+
+ #endif
+
+-void __init paging_init(void)
+-{
+- unsigned int node;
+- unsigned long zones_size[MAX_NR_ZONES] = {0, };
+-
+- for_each_online_node(node) {
+- unsigned long start_pfn, end_pfn;
+-
+- get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
+-
+- if (end_pfn > max_low_pfn)
+- max_low_pfn = end_pfn;
+- }
+-#ifdef CONFIG_ZONE_DMA32
+- zones_size[ZONE_DMA32] = MAX_DMA32_PFN;
+-#endif
+- zones_size[ZONE_NORMAL] = max_low_pfn;
+- free_area_init(zones_size);
+-}
+-
+ int pcibus_to_node(struct pci_bus *bus)
+ {
+ return dev_to_node(&bus->dev);
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -294,8 +294,6 @@ static void __init fdt_setup(void)
+
+ early_init_dt_scan(fdt_pointer, __pa(fdt_pointer));
+ early_init_fdt_reserve_self();
+-
+- max_low_pfn = PFN_PHYS(memblock_end_of_DRAM());
+ #endif
+ }
+
+@@ -390,7 +388,8 @@ static void __init check_kernel_sections
+ static void __init arch_mem_init(char **cmdline_p)
+ {
+ /* Recalculate max_low_pfn for "mem=xxx" */
+- max_pfn = max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
++ max_pfn = PFN_DOWN(memblock_end_of_DRAM());
++ max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn);
+
+ if (usermem)
+ pr_info("User-defined physical RAM map overwrite\n");
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -60,7 +60,6 @@ int __ref page_is_ram(unsigned long pfn)
+ return memblock_is_memory(addr) && !memblock_is_reserved(addr);
+ }
+
+-#ifndef CONFIG_NUMA
+ void __init paging_init(void)
+ {
+ unsigned long max_zone_pfns[MAX_NR_ZONES];
+@@ -72,7 +71,6 @@ void __init paging_init(void)
+
+ free_area_init(max_zone_pfns);
+ }
+-#endif /* !CONFIG_NUMA */
+
+ void __ref free_initmem(void)
+ {
--- /dev/null
+From 4e67526840fc55917581b90f6a4b65849a616dd8 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Sun, 9 Nov 2025 16:02:00 +0800
+Subject: LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 4e67526840fc55917581b90f6a4b65849a616dd8 upstream.
+
+Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but
+hardware hope physical addresses. Now it works well because the high
+bits are ignored above PA_BITS (48 bits), but explicitly use physical
+addresses can avoid potential bugs. So fix it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/traps.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/kernel/traps.c
++++ b/arch/loongarch/kernel/traps.c
+@@ -1131,8 +1131,8 @@ static void configure_exception_vector(v
+ tlbrentry = (unsigned long)exception_handlers + 80*VECSIZE;
+
+ csr_write64(eentry, LOONGARCH_CSR_EENTRY);
+- csr_write64(eentry, LOONGARCH_CSR_MERRENTRY);
+- csr_write64(tlbrentry, LOONGARCH_CSR_TLBRENTRY);
++ csr_write64(__pa(eentry), LOONGARCH_CSR_MERRENTRY);
++ csr_write64(__pa(tlbrentry), LOONGARCH_CSR_TLBRENTRY);
+ }
+
+ void per_cpu_trap_init(int cpu)
--- /dev/null
+From 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 Mon Sep 17 00:00:00 2001
+From: "Mario Limonciello (AMD)" <superm1@kernel.org>
+Date: Wed, 5 Nov 2025 22:51:05 -0600
+Subject: PM: hibernate: Emit an error when image writing fails
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+commit 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 upstream.
+
+If image writing fails, a return code is passed up to the caller, but
+none of the callers log anything to the log and so the only record
+of it is the return code that userspace gets.
+
+Adjust the logging so that the image size and speed of writing is
+only emitted on success and if there is an error, it's saved to the
+logs.
+
+Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression")
+Reported-by: Askar Safin <safinaskar@gmail.com>
+Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Tested-by: Askar Safin <safinaskar@gmail.com>
+Cc: 6.9+ <stable@vger.kernel.org> # 6.9+
+[ rjw: Added missing braces after "else", changelog edits ]
+Link: https://patch.msgid.link/20251106045158.3198061-2-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/power/swap.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -877,11 +877,14 @@ out_finish:
+ stop = ktime_get();
+ if (!ret)
+ ret = err2;
+- if (!ret)
++ if (!ret) {
++ swsusp_show_speed(start, stop, nr_to_write, "Wrote");
++ pr_info("Image size after compression: %d kbytes\n",
++ (atomic_read(&compressed_size) / 1024));
+ pr_info("Image saving done\n");
+- swsusp_show_speed(start, stop, nr_to_write, "Wrote");
+- pr_info("Image size after compression: %d kbytes\n",
+- (atomic_read(&compressed_size) / 1024));
++ } else {
++ pr_err("Image saving failed: %d\n", ret);
++ }
+
+ out_clean:
+ hib_finish_batch(&hb);
--- /dev/null
+From 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce Mon Sep 17 00:00:00 2001
+From: "Mario Limonciello (AMD)" <superm1@kernel.org>
+Date: Wed, 5 Nov 2025 22:51:06 -0600
+Subject: PM: hibernate: Use atomic64_t for compressed_size variable
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+commit 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce upstream.
+
+`compressed_size` can overflow, showing nonsensical values.
+
+Change from `atomic_t` to `atomic64_t` to prevent overflow.
+
+Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression")
+Reported-by: Askar Safin <safinaskar@gmail.com>
+Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Tested-by: Askar Safin <safinaskar@gmail.com>
+Cc: 6.9+ <stable@vger.kernel.org> # 6.9+
+Link: https://patch.msgid.link/20251106045158.3198061-3-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/power/swap.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -635,7 +635,7 @@ struct cmp_data {
+ };
+
+ /* Indicates the image size after compression */
+-static atomic_t compressed_size = ATOMIC_INIT(0);
++static atomic64_t compressed_size = ATOMIC_INIT(0);
+
+ /*
+ * Compression function that runs in its own thread.
+@@ -664,7 +664,7 @@ static int compress_threadfn(void *data)
+ d->ret = crypto_acomp_compress(d->cr);
+ d->cmp_len = d->cr->dlen;
+
+- atomic_set(&compressed_size, atomic_read(&compressed_size) + d->cmp_len);
++ atomic64_add(d->cmp_len, &compressed_size);
+ atomic_set_release(&d->stop, 1);
+ wake_up(&d->done);
+ }
+@@ -696,7 +696,7 @@ static int save_compressed_image(struct
+
+ hib_init_batch(&hb);
+
+- atomic_set(&compressed_size, 0);
++ atomic64_set(&compressed_size, 0);
+
+ /*
+ * We'll limit the number of threads for compression to limit memory
+@@ -879,8 +879,8 @@ out_finish:
+ ret = err2;
+ if (!ret) {
+ swsusp_show_speed(start, stop, nr_to_write, "Wrote");
+- pr_info("Image size after compression: %d kbytes\n",
+- (atomic_read(&compressed_size) / 1024));
++ pr_info("Image size after compression: %lld kbytes\n",
++ (atomic64_read(&compressed_size) / 1024));
+ pr_info("Image saving done\n");
+ } else {
+ pr_err("Image saving failed: %d\n", ret);
--- /dev/null
+From 7458f72cc28f9eb0de811effcb5376d0ec19094a Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Fri, 17 Oct 2025 12:03:20 +0100
+Subject: pmdomain: arm: scmi: Fix genpd leak on provider registration failure
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+commit 7458f72cc28f9eb0de811effcb5376d0ec19094a upstream.
+
+If of_genpd_add_provider_onecell() fails during probe, the previously
+created generic power domains are not removed, leading to a memory leak
+and potential kernel crash later in genpd_debug_add().
+
+Add proper error handling to unwind the initialized domains before
+returning from probe to ensure all resources are correctly released on
+failure.
+
+Example crash trace observed without this fix:
+
+ | Unable to handle kernel paging request at virtual address fffffffffffffc70
+ | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT
+ | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
+ | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ | pc : genpd_debug_add+0x2c/0x160
+ | lr : genpd_debug_init+0x74/0x98
+ | Call trace:
+ | genpd_debug_add+0x2c/0x160 (P)
+ | genpd_debug_init+0x74/0x98
+ | do_one_initcall+0xd0/0x2d8
+ | do_initcall_level+0xa0/0x140
+ | do_initcalls+0x60/0xa8
+ | do_basic_setup+0x28/0x40
+ | kernel_init_freeable+0xe8/0x170
+ | kernel_init+0x2c/0x140
+ | ret_from_fork+0x10/0x20
+
+Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd")
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/arm/scmi_pm_domain.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/pmdomain/arm/scmi_pm_domain.c
++++ b/drivers/pmdomain/arm/scmi_pm_domain.c
+@@ -41,7 +41,7 @@ static int scmi_pd_power_off(struct gene
+
+ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ {
+- int num_domains, i;
++ int num_domains, i, ret;
+ struct device *dev = &sdev->dev;
+ struct device_node *np = dev->of_node;
+ struct scmi_pm_domain *scmi_pd;
+@@ -108,9 +108,18 @@ static int scmi_pm_domain_probe(struct s
+ scmi_pd_data->domains = domains;
+ scmi_pd_data->num_domains = num_domains;
+
++ ret = of_genpd_add_provider_onecell(np, scmi_pd_data);
++ if (ret)
++ goto err_rm_genpds;
++
+ dev_set_drvdata(dev, scmi_pd_data);
+
+- return of_genpd_add_provider_onecell(np, scmi_pd_data);
++ return 0;
++err_rm_genpds:
++ for (i = num_domains - 1; i >= 0; i--)
++ pm_genpd_remove(domains[i]);
++
++ return ret;
+ }
+
+ static void scmi_pm_domain_remove(struct scmi_device *sdev)
--- /dev/null
+From bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Tue, 28 Oct 2025 11:16:20 +0800
+Subject: pmdomain: imx: Fix reference count leak in imx_gpc_remove
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 upstream.
+
+of_get_child_by_name() returns a node pointer with refcount incremented, we
+should use of_node_put() on it when not needed anymore. Add the missing
+of_node_put() to avoid refcount leak.
+
+Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/imx/gpc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pmdomain/imx/gpc.c
++++ b/drivers/pmdomain/imx/gpc.c
+@@ -537,6 +537,8 @@ static void imx_gpc_remove(struct platfo
+ return;
+ }
+ }
++
++ of_node_put(pgc_node);
+ }
+
+ static struct platform_driver imx_gpc_driver = {
--- /dev/null
+From 90c82941adf1986364e0f82c35cf59f2bf5f6a1d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@linaro.org>
+Date: Thu, 16 Oct 2025 16:58:37 +0100
+Subject: pmdomain: samsung: plug potential memleak during probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Draszik <andre.draszik@linaro.org>
+
+commit 90c82941adf1986364e0f82c35cf59f2bf5f6a1d upstream.
+
+of_genpd_add_provider_simple() could fail, in which case this code
+leaks the domain name, pd->pd.name.
+
+Use devm_kstrdup_const() to plug this leak. As a side-effect, we can
+simplify existing error handling.
+
+Fixes: c09a3e6c97f0 ("soc: samsung: pm_domains: Convert to regular platform driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: André Draszik <andre.draszik@linaro.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/samsung/exynos-pm-domains.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/pmdomain/samsung/exynos-pm-domains.c
++++ b/drivers/pmdomain/samsung/exynos-pm-domains.c
+@@ -92,13 +92,14 @@ static const struct of_device_id exynos_
+ { },
+ };
+
+-static const char *exynos_get_domain_name(struct device_node *node)
++static const char *exynos_get_domain_name(struct device *dev,
++ struct device_node *node)
+ {
+ const char *name;
+
+ if (of_property_read_string(node, "label", &name) < 0)
+ name = kbasename(node->full_name);
+- return kstrdup_const(name, GFP_KERNEL);
++ return devm_kstrdup_const(dev, name, GFP_KERNEL);
+ }
+
+ static int exynos_pd_probe(struct platform_device *pdev)
+@@ -115,15 +116,13 @@ static int exynos_pd_probe(struct platfo
+ if (!pd)
+ return -ENOMEM;
+
+- pd->pd.name = exynos_get_domain_name(np);
++ pd->pd.name = exynos_get_domain_name(dev, np);
+ if (!pd->pd.name)
+ return -ENOMEM;
+
+ pd->base = of_iomap(np, 0);
+- if (!pd->base) {
+- kfree_const(pd->pd.name);
++ if (!pd->base)
+ return -ENODEV;
+- }
+
+ pd->pd.power_off = exynos_pd_power_off;
+ pd->pd.power_on = exynos_pd_power_on;
--- /dev/null
+From fccac54b0d3d0602f177bb79f203ae6fbea0e32a Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Mon, 27 Oct 2025 13:55:15 +0100
+Subject: pmdomain: samsung: Rework legacy splash-screen handover workaround
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit fccac54b0d3d0602f177bb79f203ae6fbea0e32a upstream.
+
+Limit the workaround for the lack of the proper splash-screen handover
+handling to the legacy ARM 32bit systems and replace forcing a sync_state
+by explicite power domain shutdown. This approach lets compiler to
+optimize it out on newer ARM 64bit systems.
+
+Suggested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Fixes: 0745658aebbe ("pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/samsung/exynos-pm-domains.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pmdomain/samsung/exynos-pm-domains.c b/drivers/pmdomain/samsung/exynos-pm-domains.c
+index f53e1bd24798..5c3aa8983087 100644
+--- a/drivers/pmdomain/samsung/exynos-pm-domains.c
++++ b/drivers/pmdomain/samsung/exynos-pm-domains.c
+@@ -128,6 +128,15 @@ static int exynos_pd_probe(struct platform_device *pdev)
+ pd->pd.power_on = exynos_pd_power_on;
+ pd->local_pwr_cfg = pm_domain_cfg->local_pwr_cfg;
+
++ /*
++ * Some Samsung platforms with bootloaders turning on the splash-screen
++ * and handing it over to the kernel, requires the power-domains to be
++ * reset during boot.
++ */
++ if (IS_ENABLED(CONFIG_ARM) &&
++ of_device_is_compatible(np, "samsung,exynos4210-pd"))
++ exynos_pd_power_off(&pd->pd);
++
+ on = readl_relaxed(pd->base + 0x4) & pd->local_pwr_cfg;
+
+ pm_genpd_init(&pd->pd, NULL, !on);
+@@ -146,15 +155,6 @@ static int exynos_pd_probe(struct platform_device *pdev)
+ parent.np, child.np);
+ }
+
+- /*
+- * Some Samsung platforms with bootloaders turning on the splash-screen
+- * and handing it over to the kernel, requires the power-domains to be
+- * reset during boot. As a temporary hack to manage this, let's enforce
+- * a sync_state.
+- */
+- if (!ret)
+- of_genpd_sync_state(np);
+-
+ pm_runtime_enable(dev);
+ return ret;
+ }
+--
+2.52.0
+
--- /dev/null
+From 63c643aa7b7287fdbb0167063785f89ece3f000f Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:40 +0100
+Subject: selftests: mptcp: connect: fix fallback note due to OoO
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 63c643aa7b7287fdbb0167063785f89ece3f000f upstream.
+
+The "fallback due to TCP OoO" was never printed because the stat_ooo_now
+variable was checked twice: once in the parent if-statement, and one in
+the child one. The second condition was then always true then, and the
+'else' branch was never taken.
+
+The idea is that when there are more ACK + MP_CAPABLE than expected, the
+test either fails if there was no out of order packets, or a notice is
+printed.
+
+Fixes: 69ca3d29a755 ("mptcp: update selftest for fallback due to OoO")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+@@ -492,7 +492,7 @@ do_transfer()
+ "than expected (${expect_synrx})"
+ retc=1
+ fi
+- if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ] && [ ${stat_ooo_now} -eq 0 ]; then
++ if [ ${stat_ackrx_now_l} -lt ${expect_ackrx} ]; then
+ if [ ${stat_ooo_now} -eq 0 ]; then
+ mptcp_lib_pr_fail "lower MPC ACK rx (${stat_ackrx_now_l})" \
+ "than expected (${expect_ackrx})"
--- /dev/null
+From ee79980f7a428ec299f6261bea4c1084dcbc9631 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:44 +0100
+Subject: selftests: mptcp: connect: trunc: read all recv data
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit ee79980f7a428ec299f6261bea4c1084dcbc9631 upstream.
+
+MPTCP Join "fastclose server" selftest is sometimes failing because the
+client output file doesn't have the expected size, e.g. 296B instead of
+1024B.
+
+When looking at a packet trace when this happens, the server sent the
+expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE.
+It is then strange to see the client only receiving 296B, which would
+mean it only got a part of the second packet. The problem is then not on
+the networking side, but rather on the data reception side.
+
+When mptcp_connect is launched with '-f -1', it means the connection
+might stop before having sent everything, because a reset has been
+received. When this happens, the program was directly stopped. But it is
+also possible there are still some data to read, simply because the
+previous 'read' step was done with a buffer smaller than the pending
+data, see do_rnd_read(). In this case, it is important to read what's
+left in the kernel buffers before stopping without error like before.
+
+SIGPIPE is now ignored, not to quit the app before having read
+everything.
+
+Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
+@@ -710,8 +710,14 @@ static int copyfd_io_poll(int infd, int
+
+ bw = do_rnd_write(peerfd, winfo->buf + winfo->off, winfo->len);
+ if (bw < 0) {
+- if (cfg_rcv_trunc)
+- return 0;
++ /* expected reset, continue to read */
++ if (cfg_rcv_trunc &&
++ (errno == ECONNRESET ||
++ errno == EPIPE)) {
++ fds.events &= ~POLLOUT;
++ continue;
++ }
++
+ perror("write");
+ return 111;
+ }
+@@ -737,8 +743,10 @@ static int copyfd_io_poll(int infd, int
+ }
+
+ if (fds.revents & (POLLERR | POLLNVAL)) {
+- if (cfg_rcv_trunc)
+- return 0;
++ if (cfg_rcv_trunc) {
++ fds.events &= ~(POLLERR | POLLNVAL);
++ continue;
++ }
+ fprintf(stderr, "Unexpected revents: "
+ "POLLERR/POLLNVAL(%x)\n", fds.revents);
+ return 5;
+@@ -1433,7 +1441,7 @@ static void parse_opts(int argc, char **
+ */
+ if (cfg_truncate < 0) {
+ cfg_rcv_trunc = true;
+- signal(SIGPIPE, handle_signal);
++ signal(SIGPIPE, SIG_IGN);
+ }
+ break;
+ case 'j':
--- /dev/null
+From 6457595db9870298ee30b6d75287b8548e33fe19 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:42 +0100
+Subject: selftests: mptcp: join: endpoints: longer transfer
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 6457595db9870298ee30b6d75287b8548e33fe19 upstream.
+
+In rare cases, when the test environment is very slow, some userspace
+tests can fail because some expected events have not been seen.
+
+Because the tests are expecting a long on-going connection, and they are
+not waiting for the end of the transfer, it is fine to make the
+connection longer. This connection will be killed at the end, after the
+verifications, so making it longer doesn't change anything, apart from
+avoid it to end before the end of the verifications
+
+To play it safe, all endpoints tests not waiting for the end of the
+transfer are now sharing a longer file (128KB) at slow speed.
+
+Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case")
+Cc: stable@vger.kernel.org
+Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases")
+Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd")
+Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints")
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3757,7 +3757,7 @@ endpoint_tests()
+ pm_nl_set_limits $ns1 2 2
+ pm_nl_set_limits $ns2 2 2
+ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
+- { speed=slow \
++ { test_linkfail=128 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+
+@@ -3784,7 +3784,7 @@ endpoint_tests()
+ pm_nl_set_limits $ns2 0 3
+ pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
+ pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow
+- { test_linkfail=4 speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+
+@@ -3862,7 +3862,7 @@ endpoint_tests()
+ # broadcast IP: no packet for this address will be received on ns1
+ pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
+ pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
+- { test_linkfail=4 speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+
+@@ -3935,7 +3935,7 @@ endpoint_tests()
+ # broadcast IP: no packet for this address will be received on ns1
+ pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal
+ pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
+- { test_linkfail=4 speed=20 \
++ { test_linkfail=128 speed=20 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+
--- /dev/null
+From 852b644acbce1529307a4bb283752c4e77b5cda7 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:45 +0100
+Subject: selftests: mptcp: join: properly kill background tasks
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 852b644acbce1529307a4bb283752c4e77b5cda7 upstream.
+
+The 'run_tests' function is executed in the background, but killing its
+associated PID would not kill the children tasks running in the
+background.
+
+To properly kill all background tasks, 'kill -- -PID' could be used, but
+this requires kill from procps-ng. Instead, all children tasks are
+listed using 'ps', and 'kill' is called with all PIDs of this group.
+
+Fixes: 31ee4ad86afd ("selftests: mptcp: join: stop transfer when check is done (part 1)")
+Cc: stable@vger.kernel.org
+Fixes: 04b57c9e096a ("selftests: mptcp: join: stop transfer when check is done (part 2)")
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 +++++++++---------
+ tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 +++++++++++++++++++++
+ 2 files changed, 30 insertions(+), 9 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3645,7 +3645,7 @@ userspace_tests()
+ chk_mptcp_info subflows 0 subflows 0
+ chk_subflows_total 1 1
+ kill_events_pids
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+
+ # userspace pm create destroy subflow
+@@ -3673,7 +3673,7 @@ userspace_tests()
+ chk_mptcp_info subflows 0 subflows 0
+ chk_subflows_total 1 1
+ kill_events_pids
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+
+ # userspace pm create id 0 subflow
+@@ -3694,7 +3694,7 @@ userspace_tests()
+ chk_mptcp_info subflows 1 subflows 1
+ chk_subflows_total 2 2
+ kill_events_pids
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+
+ # userspace pm remove initial subflow
+@@ -3718,7 +3718,7 @@ userspace_tests()
+ chk_mptcp_info subflows 1 subflows 1
+ chk_subflows_total 1 1
+ kill_events_pids
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+
+ # userspace pm send RM_ADDR for ID 0
+@@ -3744,7 +3744,7 @@ userspace_tests()
+ chk_mptcp_info subflows 1 subflows 1
+ chk_subflows_total 1 1
+ kill_events_pids
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+ }
+
+@@ -3774,7 +3774,7 @@ endpoint_tests()
+ pm_nl_add_endpoint $ns2 10.0.2.2 flags signal
+ pm_nl_check_endpoint "modif is allowed" \
+ $ns2 10.0.2.2 id 1 flags signal
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+ fi
+
+ if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT &&
+@@ -3829,7 +3829,7 @@ endpoint_tests()
+ chk_mptcp_info subflows 3 subflows 3
+ done
+
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+
+ kill_events_pids
+ chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
+@@ -3903,7 +3903,7 @@ endpoint_tests()
+ wait_mpj $ns2
+ chk_subflow_nr "after re-re-add ID 0" 3
+ chk_mptcp_info subflows 3 subflows 3
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+
+ kill_events_pids
+ chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1
+@@ -3951,7 +3951,7 @@ endpoint_tests()
+ wait_mpj $ns2
+ pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal
+ wait_mpj $ns2
+- mptcp_lib_kill_wait $tests_pid
++ mptcp_lib_kill_group_wait $tests_pid
+
+ join_syn_tx=3 join_connect_err=1 \
+ chk_join_nr 2 2 2
+--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+@@ -350,6 +350,27 @@ mptcp_lib_kill_wait() {
+ wait "${1}" 2>/dev/null
+ }
+
++# $1: PID
++mptcp_lib_pid_list_children() {
++ local curr="${1}"
++ # evoke 'ps' only once
++ local pids="${2:-"$(ps o pid,ppid)"}"
++
++ echo "${curr}"
++
++ local pid
++ for pid in $(echo "${pids}" | awk "\$2 == ${curr} { print \$1 }"); do
++ mptcp_lib_pid_list_children "${pid}" "${pids}"
++ done
++}
++
++# $1: PID
++mptcp_lib_kill_group_wait() {
++ # Some users might not have procps-ng: cannot use "kill -- -PID"
++ mptcp_lib_pid_list_children "${1}" | xargs -r kill &>/dev/null
++ wait "${1}" 2>/dev/null
++}
++
+ # $1: IP address
+ mptcp_lib_is_v6() {
+ [ -z "${1##*:*}" ]
--- /dev/null
+From aea73bae662a0e184393d6d7d0feb18d2577b9b9 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:41 +0100
+Subject: selftests: mptcp: join: rm: set backup flag
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit aea73bae662a0e184393d6d7d0feb18d2577b9b9 upstream.
+
+Some of these 'remove' tests rarely fail because a subflow has been
+reset instead of cleanly removed. This can happen when one extra subflow
+which has never carried data is being closed (FIN) on one side, while
+the other is sending data for the first time.
+
+To avoid such subflows to be used right at the end, the backup flag has
+been added. With that, data will be only carried on the initial subflow.
+
+Fixes: d2c4333a801c ("selftests: mptcp: add testcases for removing addrs")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 54 ++++++++++++------------
+ 1 file changed, 27 insertions(+), 27 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -2347,7 +2347,7 @@ remove_tests()
+ if reset "remove single subflow"; then
+ pm_nl_set_limits $ns1 0 1
+ pm_nl_set_limits $ns2 0 1
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ addr_nr_ns2=-1 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 1 1 1
+@@ -2360,8 +2360,8 @@ remove_tests()
+ if reset "remove multiple subflows"; then
+ pm_nl_set_limits $ns1 0 2
+ pm_nl_set_limits $ns2 0 2
+- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ addr_nr_ns2=-2 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 2 2 2
+@@ -2372,7 +2372,7 @@ remove_tests()
+ # single address, remove
+ if reset "remove single address"; then
+ pm_nl_set_limits $ns1 0 1
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
+ pm_nl_set_limits $ns2 1 1
+ addr_nr_ns1=-1 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+@@ -2385,9 +2385,9 @@ remove_tests()
+ # subflow and signal, remove
+ if reset "remove subflow and signal"; then
+ pm_nl_set_limits $ns1 0 2
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
+ pm_nl_set_limits $ns2 1 2
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
+ addr_nr_ns1=-1 addr_nr_ns2=-1 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 2 2 2
+@@ -2399,10 +2399,10 @@ remove_tests()
+ # subflows and signal, remove
+ if reset "remove subflows and signal"; then
+ pm_nl_set_limits $ns1 0 3
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
+ pm_nl_set_limits $ns2 1 3
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
+ addr_nr_ns1=-1 addr_nr_ns2=-2 speed=10 \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 3 3 3
+@@ -2414,9 +2414,9 @@ remove_tests()
+ # addresses remove
+ if reset "remove addresses"; then
+ pm_nl_set_limits $ns1 3 3
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250
+- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250
++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
++ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup
+ pm_nl_set_limits $ns2 3 3
+ addr_nr_ns1=-3 speed=10 \
+ run_tests $ns1 $ns2 10.0.1.1
+@@ -2429,10 +2429,10 @@ remove_tests()
+ # invalid addresses remove
+ if reset "remove invalid addresses"; then
+ pm_nl_set_limits $ns1 3 3
+- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup
+ # broadcast IP: no packet for this address will be received on ns1
+- pm_nl_add_endpoint $ns1 224.0.0.1 flags signal
+- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
++ pm_nl_add_endpoint $ns1 224.0.0.1 flags signal,backup
++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
+ pm_nl_set_limits $ns2 2 2
+ addr_nr_ns1=-3 speed=10 \
+ run_tests $ns1 $ns2 10.0.1.1
+@@ -2446,10 +2446,10 @@ remove_tests()
+ # subflows and signal, flush
+ if reset "flush subflows and signal"; then
+ pm_nl_set_limits $ns1 0 3
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup
+ pm_nl_set_limits $ns2 1 3
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
+ addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 3 3 3
+@@ -2462,9 +2462,9 @@ remove_tests()
+ if reset "flush subflows"; then
+ pm_nl_set_limits $ns1 3 3
+ pm_nl_set_limits $ns2 3 3
+- pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow id 150
+- pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow
+- pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow
++ pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup id 150
++ pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
++ pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow,backup
+ addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+ chk_join_nr 3 3 3
+@@ -2481,9 +2481,9 @@ remove_tests()
+ # addresses flush
+ if reset "flush addresses"; then
+ pm_nl_set_limits $ns1 3 3
+- pm_nl_add_endpoint $ns1 10.0.2.1 flags signal id 250
+- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+- pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.2.1 flags signal,backup id 250
++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
++ pm_nl_add_endpoint $ns1 10.0.4.1 flags signal,backup
+ pm_nl_set_limits $ns2 3 3
+ addr_nr_ns1=-8 addr_nr_ns2=-8 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
+@@ -2496,9 +2496,9 @@ remove_tests()
+ # invalid addresses flush
+ if reset "flush invalid addresses"; then
+ pm_nl_set_limits $ns1 3 3
+- pm_nl_add_endpoint $ns1 10.0.12.1 flags signal
+- pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+- pm_nl_add_endpoint $ns1 10.0.14.1 flags signal
++ pm_nl_add_endpoint $ns1 10.0.12.1 flags signal,backup
++ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal,backup
++ pm_nl_add_endpoint $ns1 10.0.14.1 flags signal,backup
+ pm_nl_set_limits $ns2 3 3
+ addr_nr_ns1=-8 speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
--- /dev/null
+From 290493078b96ce2ce3e60f55c23654acb678042a Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Mon, 10 Nov 2025 19:23:43 +0100
+Subject: selftests: mptcp: join: userspace: longer transfer
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 290493078b96ce2ce3e60f55c23654acb678042a upstream.
+
+In rare cases, when the test environment is very slow, some userspace
+tests can fail because some expected events have not been seen.
+
+Because the tests are expecting a long on-going connection, and they are
+not waiting for the end of the transfer, it is fine to make the
+connection longer. This connection will be killed at the end, after the
+verifications, so making it longer doesn't change anything, apart from
+avoid it to end before the end of the verifications
+
+To play it safe, all userspace tests not waiting for the end of the
+transfer are now sharing a longer file (128KB) at slow speed.
+
+Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer")
+Cc: stable@vger.kernel.org
+Fixes: b2e2248f365a ("selftests: mptcp: userspace pm create id 0 subflow")
+Fixes: e3b47e460b4b ("selftests: mptcp: userspace pm remove initial subflow")
+Fixes: b9fb176081fb ("selftests: mptcp: userspace pm send RM_ADDR for ID 0")
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-4-a4332c714e10@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3620,7 +3620,7 @@ userspace_tests()
+ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+ set_userspace_pm $ns1
+ pm_nl_set_limits $ns2 2 2
+- { speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+ wait_mpj $ns1
+@@ -3653,7 +3653,7 @@ userspace_tests()
+ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+ set_userspace_pm $ns2
+ pm_nl_set_limits $ns1 0 1
+- { speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+ wait_mpj $ns2
+@@ -3681,7 +3681,7 @@ userspace_tests()
+ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+ set_userspace_pm $ns2
+ pm_nl_set_limits $ns1 0 1
+- { speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+ wait_mpj $ns2
+@@ -3702,7 +3702,7 @@ userspace_tests()
+ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+ set_userspace_pm $ns2
+ pm_nl_set_limits $ns1 0 1
+- { speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+ wait_mpj $ns2
+@@ -3726,7 +3726,7 @@ userspace_tests()
+ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
+ set_userspace_pm $ns1
+ pm_nl_set_limits $ns2 1 1
+- { speed=5 \
++ { test_linkfail=128 speed=5 \
+ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
+ local tests_pid=$!
+ wait_mpj $ns1
gendwarfksyms-skip-files-with-no-exports.patch
io_uring-rw-ensure-allocated-iovec-gets-cleared-for-early-failure.patch
ftrace-fix-bpf-fexit-with-livepatch.patch
+loongarch-consolidate-max_pfn-max_low_pfn-calculation.patch
+loongarch-use-physical-addresses-for-csr_merrentry-csr_tlbrentry.patch
+edac-altera-handle-ocram-ecc-enable-after-warm-reset.patch
+edac-altera-use-inttest-register-for-ethernet-and-usb-sbe-injection.patch
+pm-hibernate-emit-an-error-when-image-writing-fails.patch
+pm-hibernate-use-atomic64_t-for-compressed_size-variable.patch
+btrfs-zoned-fix-conventional-zone-capacity-calculation.patch
+btrfs-zoned-fix-stripe-width-calculation.patch
+btrfs-scrub-put-bio-after-errors-in-scrub_raid56_parity_stripe.patch
+btrfs-do-not-update-last_log_commit-when-logging-inode-due-to-a-new-name.patch
+btrfs-release-root-after-error-in-data_reloc_print_warning_inode.patch
+drm-amdkfd-relax-checks-for-over-allocation-of-save-area.patch
+drm-amdgpu-fix-lock-warning-in-amdgpu_userq_fence_driver_process.patch
+drm-amdgpu-disable-peer-to-peer-access-for-dcc-enabled-gc12-vram-surfaces.patch
+drm-i915-psr-fix-pipe-to-vblank-conversion.patch
+drm-xe-xe3lpg-extend-wa_15016589081-for-xe3lpg.patch
+drm-xe-xe3-extend-wa_14023061436.patch
+drm-xe-xe3-add-wa_14024681466-for-xe3_lpg.patch
+pmdomain-arm-scmi-fix-genpd-leak-on-provider-registration-failure.patch
+pmdomain-imx-fix-reference-count-leak-in-imx_gpc_remove.patch
+pmdomain-samsung-plug-potential-memleak-during-probe.patch
+pmdomain-samsung-rework-legacy-splash-screen-handover-workaround.patch
+selftests-mptcp-connect-fix-fallback-note-due-to-ooo.patch
+selftests-mptcp-join-rm-set-backup-flag.patch
+selftests-mptcp-join-endpoints-longer-transfer.patch
+selftests-mptcp-connect-trunc-read-all-recv-data.patch
+selftests-mptcp-join-userspace-longer-transfer.patch
+selftests-mptcp-join-properly-kill-background-tasks.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
