--- /dev/null
+From 2952ce25dc49a8ca4f82ba01e896fb29f191ed69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Apr 2025 13:36:55 -0500
+Subject: ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit e1bdbbc98279164d910d2de82a745f090a8b249f ]
+
+acpi_register_lps0_dev() and acpi_unregister_lps0_dev() may be used
+in drivers that don't require CONFIG_SUSPEND or compile on !X86.
+
+Add prototypes for those cases.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202502191627.fRgoBwcZ-lkp@intel.com/
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://patch.msgid.link/20250407183656.1503446-1-superm1@kernel.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/acpi.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 4d5ee84c468ba..f826bb59556af 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -1110,13 +1110,13 @@ void acpi_os_set_prepare_extended_sleep(int (*func)(u8 sleep_state,
+
+ acpi_status acpi_os_prepare_extended_sleep(u8 sleep_state,
+ u32 val_a, u32 val_b);
+-#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86)
+ struct acpi_s2idle_dev_ops {
+ struct list_head list_node;
+ void (*prepare)(void);
+ void (*check)(void);
+ void (*restore)(void);
+ };
++#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86)
+ int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg);
+ void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg);
+ int acpi_get_lps0_constraint(struct acpi_device *adev);
+@@ -1125,6 +1125,13 @@ static inline int acpi_get_lps0_constraint(struct device *dev)
+ {
+ return ACPI_STATE_UNKNOWN;
+ }
++static inline int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg)
++{
++ return -ENODEV;
++}
++static inline void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg)
++{
++}
+ #endif /* CONFIG_SUSPEND && CONFIG_X86 */
+ void arch_reserve_mem_area(acpi_physical_address addr, size_t size);
+ #else
+--
+2.39.5
+
--- /dev/null
+From 7c42eca17be295128e30b4a6fd13a82b72e90c35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 12:41:45 +1000
+Subject: ACPI: battery: negate current when discharging
+
+From: Peter Marheine <pmarheine@chromium.org>
+
+[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ]
+
+The ACPI specification requires that battery rate is always positive,
+but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW
+(Documentation/ABI/testing/sysfs-class-power) specifies that it should
+be negative when a battery is discharging. When reporting CURRENT_NOW,
+massage the value to match the documented ABI.
+
+This only changes the sign of `current_now` and not `power_now` because
+documentation doesn't describe any particular meaning for `power_now` so
+leaving `power_now` unchanged is less likely to confuse userspace
+unnecessarily, whereas becoming consistent with the documented ABI is
+worth potentially confusing clients that read `current_now`.
+
+Signed-off-by: Peter Marheine <pmarheine@chromium.org>
+Link: https://patch.msgid.link/20250508024146.1436129-1-pmarheine@chromium.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 65fa3444367a1..6a7ac34d73bda 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -243,10 +243,23 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ break;
+ case POWER_SUPPLY_PROP_CURRENT_NOW:
+ case POWER_SUPPLY_PROP_POWER_NOW:
+- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
++ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) {
+ ret = -ENODEV;
+- else
+- val->intval = battery->rate_now * 1000;
++ break;
++ }
++
++ val->intval = battery->rate_now * 1000;
++ /*
++ * When discharging, the current should be reported as a
++ * negative number as per the power supply class interface
++ * definition.
++ */
++ if (psp == POWER_SUPPLY_PROP_CURRENT_NOW &&
++ (battery->state & ACPI_BATTERY_STATE_DISCHARGING) &&
++ acpi_battery_handle_discharging(battery)
++ == POWER_SUPPLY_STATUS_DISCHARGING)
++ val->intval = -val->intval;
++
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN:
+ case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN:
+--
+2.39.5
+
--- /dev/null
+From 00231c4d6870d66518c7f5ef20a7eb3511696c52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 May 2025 20:51:11 +0200
+Subject: ACPI: bus: Bail out if acpi_kobj registration fails
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 94a370fc8def6038dbc02199db9584b0b3690f1a ]
+
+The ACPI sysfs code will fail to initialize if acpi_kobj is NULL,
+together with some ACPI drivers.
+
+Follow the other firmware subsystems and bail out if the kobject
+cannot be registered.
+
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20250518185111.3560-2-W_Armin@gmx.de
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/bus.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 16917dc3ad604..6234055d25984 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1444,8 +1444,10 @@ static int __init acpi_init(void)
+ }
+
+ acpi_kobj = kobject_create_and_add("acpi", firmware_kobj);
+- if (!acpi_kobj)
+- pr_debug("%s: kset create error\n", __func__);
++ if (!acpi_kobj) {
++ pr_err("Failed to register kobject\n");
++ return -ENOMEM;
++ }
+
+ init_prmt();
+ acpi_init_pcc();
+--
+2.39.5
+
--- /dev/null
+From c8336decfba274759d355cfc8a5b08872787527e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 21:21:05 +0200
+Subject: ACPICA: Apply pack(1) to union aml_resource
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tamir Duberstein <tamird@gmail.com>
+
+[ Upstream commit eedf3e3c2f2af55dca42b0ea81dffb808211d269 ]
+
+ACPICA commit 1c28da2242783579d59767617121035dafba18c3
+
+This was originally done in NetBSD:
+https://github.com/NetBSD/src/commit/b69d1ac3f7702f67edfe412e4392f77d09804910
+and is the correct alternative to the smattering of `memcpy`s I
+previously contributed to this repository.
+
+This also sidesteps the newly strict checks added in UBSAN:
+https://github.com/llvm/llvm-project/commit/792674400f6f04a074a3827349ed0e2ac10067f6
+
+Before this change we see the following UBSAN stack trace in Fuchsia:
+
+ #0 0x000021afcfdeca5e in acpi_rs_get_address_common(struct acpi_resource*, union aml_resource*) ../../third_party/acpica/source/components/resources/rsaddr.c:329 <platform-bus-x86.so>+0x6aca5e
+ #1.2 0x000021982bc4af3c in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x41f3c
+ #1.1 0x000021982bc4af3c in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x41f3c
+ #1 0x000021982bc4af3c in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:395 <libclang_rt.asan.so>+0x41f3c
+ #2 0x000021982bc4bb6f in handletype_mismatch_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:137 <libclang_rt.asan.so>+0x42b6f
+ #3 0x000021982bc4b723 in __ubsan_handle_type_mismatch_v1 compiler-rt/lib/ubsan/ubsan_handlers.cpp:142 <libclang_rt.asan.so>+0x42723
+ #4 0x000021afcfdeca5e in acpi_rs_get_address_common(struct acpi_resource*, union aml_resource*) ../../third_party/acpica/source/components/resources/rsaddr.c:329 <platform-bus-x86.so>+0x6aca5e
+ #5 0x000021afcfdf2089 in acpi_rs_convert_aml_to_resource(struct acpi_resource*, union aml_resource*, struct acpi_rsconvert_info*) ../../third_party/acpica/source/components/resources/rsmisc.c:355 <platform-bus-x86.so>+0x6b2089
+ #6 0x000021afcfded169 in acpi_rs_convert_aml_to_resources(u8*, u32, u32, u8, void**) ../../third_party/acpica/source/components/resources/rslist.c:137 <platform-bus-x86.so>+0x6ad169
+ #7 0x000021afcfe2d24a in acpi_ut_walk_aml_resources(struct acpi_walk_state*, u8*, acpi_size, acpi_walk_aml_callback, void**) ../../third_party/acpica/source/components/utilities/utresrc.c:237 <platform-bus-x86.so>+0x6ed24a
+ #8 0x000021afcfde66b7 in acpi_rs_create_resource_list(union acpi_operand_object*, struct acpi_buffer*) ../../third_party/acpica/source/components/resources/rscreate.c:199 <platform-bus-x86.so>+0x6a66b7
+ #9 0x000021afcfdf6979 in acpi_rs_get_method_data(acpi_handle, const char*, struct acpi_buffer*) ../../third_party/acpica/source/components/resources/rsutils.c:770 <platform-bus-x86.so>+0x6b6979
+ #10 0x000021afcfdf708f in acpi_walk_resources(acpi_handle, char*, acpi_walk_resource_callback, void*) ../../third_party/acpica/source/components/resources/rsxface.c:731 <platform-bus-x86.so>+0x6b708f
+ #11 0x000021afcfa95dcf in acpi::acpi_impl::walk_resources(acpi::acpi_impl*, acpi_handle, const char*, acpi::Acpi::resources_callable) ../../src/devices/board/lib/acpi/acpi-impl.cc:41 <platform-bus-x86.so>+0x355dcf
+ #12 0x000021afcfaa8278 in acpi::device_builder::gather_resources(acpi::device_builder*, acpi::Acpi*, fidl::any_arena&, acpi::Manager*, acpi::device_builder::gather_resources_callback) ../../src/devices/board/lib/acpi/device-builder.cc:84 <platform-bus-x86.so>+0x368278
+ #13 0x000021afcfbddb87 in acpi::Manager::configure_discovered_devices(acpi::Manager*) ../../src/devices/board/lib/acpi/manager.cc:75 <platform-bus-x86.so>+0x49db87
+ #14 0x000021afcf99091d in publish_acpi_devices(acpi::Manager*, zx_device_t*, zx_device_t*) ../../src/devices/board/drivers/x86/acpi-nswalk.cc:95 <platform-bus-x86.so>+0x25091d
+ #15 0x000021afcf9c1d4e in x86::X86::do_init(x86::X86*) ../../src/devices/board/drivers/x86/x86.cc:60 <platform-bus-x86.so>+0x281d4e
+ #16 0x000021afcf9e33ad in λ(x86::X86::ddk_init::(anon class)*) ../../src/devices/board/drivers/x86/x86.cc:77 <platform-bus-x86.so>+0x2a33ad
+ #17 0x000021afcf9e313e in fit::internal::target<(lambda at../../src/devices/board/drivers/x86/x86.cc:76:19), false, false, std::__2::allocator<std::byte>, void>::invoke(void*) ../../sdk/lib/fit/include/lib/fit/internal/function.h:183 <platform-bus-x86.so>+0x2a313e
+ #18 0x000021afcfbab4c7 in fit::internal::function_base<16UL, false, void(), std::__2::allocator<std::byte>>::invoke(const fit::internal::function_base<16UL, false, void (), std::__2::allocator<std::byte> >*) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 <platform-bus-x86.so>+0x46b4c7
+ #19 0x000021afcfbab342 in fit::function_impl<16UL, false, void(), std::__2::allocator<std::byte>>::operator()(const fit::function_impl<16UL, false, void (), std::__2::allocator<std::byte> >*) ../../sdk/lib/fit/include/lib/fit/function.h:315 <platform-bus-x86.so>+0x46b342
+ #20 0x000021afcfcd98c3 in async::internal::retained_task::Handler(async_dispatcher_t*, async_task_t*, zx_status_t) ../../sdk/lib/async/task.cc:24 <platform-bus-x86.so>+0x5998c3
+ #21 0x00002290f9924616 in λ(const driver_runtime::Dispatcher::post_task::(anon class)*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, zx_status_t) ../../src/devices/bin/driver_runtime/dispatcher.cc:789 <libdriver_runtime.so>+0x10a616
+ #22 0x00002290f9924323 in fit::internal::target<(lambda at../../src/devices/bin/driver_runtime/dispatcher.cc:788:7), true, false, std::__2::allocator<std::byte>, void, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request>>, int>::invoke(void*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, int) ../../sdk/lib/fit/include/lib/fit/internal/function.h:128 <libdriver_runtime.so>+0x10a323
+ #23 0x00002290f9904b76 in fit::internal::function_base<24UL, true, void(std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request>>, int), std::__2::allocator<std::byte>>::invoke(const fit::internal::function_base<24UL, true, void (std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, int), std::__2::allocator<std::byte> >*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, int) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 <libdriver_runtime.so>+0xeab76
+ #24 0x00002290f9904831 in fit::callback_impl<24UL, true, void(std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request>>, int), std::__2::allocator<std::byte>>::operator()(fit::callback_impl<24UL, true, void (std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, int), std::__2::allocator<std::byte> >*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, int) ../../sdk/lib/fit/include/lib/fit/function.h:471 <libdriver_runtime.so>+0xea831
+ #25 0x00002290f98d5adc in driver_runtime::callback_request::Call(driver_runtime::callback_request*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >, zx_status_t) ../../src/devices/bin/driver_runtime/callback_request.h:74 <libdriver_runtime.so>+0xbbadc
+ #26 0x00002290f98e1e58 in driver_runtime::Dispatcher::dispatch_callback(driver_runtime::Dispatcher*, std::__2::unique_ptr<driver_runtime::callback_request, std::__2::default_delete<driver_runtime::callback_request> >) ../../src/devices/bin/driver_runtime/dispatcher.cc:1248 <libdriver_runtime.so>+0xc7e58
+ #27 0x00002290f98e4159 in driver_runtime::Dispatcher::dispatch_callbacks(driver_runtime::Dispatcher*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../src/devices/bin/driver_runtime/dispatcher.cc:1308 <libdriver_runtime.so>+0xca159
+ #28 0x00002290f9918414 in λ(const driver_runtime::Dispatcher::create_with_adder::(anon class)*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../src/devices/bin/driver_runtime/dispatcher.cc:353 <libdriver_runtime.so>+0xfe414
+ #29 0x00002290f991812d in fit::internal::target<(lambda at../../src/devices/bin/driver_runtime/dispatcher.cc:351:7), true, false, std::__2::allocator<std::byte>, void, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter>>, fbl::ref_ptr<driver_runtime::Dispatcher>>::invoke(void*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../sdk/lib/fit/include/lib/fit/internal/function.h:128 <libdriver_runtime.so>+0xfe12d
+ #30 0x00002290f9906fc7 in fit::internal::function_base<8UL, true, void(std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter>>, fbl::ref_ptr<driver_runtime::Dispatcher>), std::__2::allocator<std::byte>>::invoke(const fit::internal::function_base<8UL, true, void (std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>), std::__2::allocator<std::byte> >*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 <libdriver_runtime.so>+0xecfc7
+ #31 0x00002290f9906c66 in fit::function_impl<8UL, true, void(std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter>>, fbl::ref_ptr<driver_runtime::Dispatcher>), std::__2::allocator<std::byte>>::operator()(const fit::function_impl<8UL, true, void (std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>), std::__2::allocator<std::byte> >*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../sdk/lib/fit/include/lib/fit/function.h:315 <libdriver_runtime.so>+0xecc66
+ #32 0x00002290f98e73d9 in driver_runtime::Dispatcher::event_waiter::invoke_callback(driver_runtime::Dispatcher::event_waiter*, std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, fbl::ref_ptr<driver_runtime::Dispatcher>) ../../src/devices/bin/driver_runtime/dispatcher.h:543 <libdriver_runtime.so>+0xcd3d9
+ #33 0x00002290f98e700d in driver_runtime::Dispatcher::event_waiter::handle_event(std::__2::unique_ptr<driver_runtime::Dispatcher::event_waiter, std::__2::default_delete<driver_runtime::Dispatcher::event_waiter> >, async_dispatcher_t*, async::wait_base*, zx_status_t, zx_packet_signal_t const*) ../../src/devices/bin/driver_runtime/dispatcher.cc:1442 <libdriver_runtime.so>+0xcd00d
+ #34 0x00002290f9918983 in async_loop_owned_event_handler<driver_runtime::Dispatcher::event_waiter>::handle_event(async_loop_owned_event_handler<driver_runtime::Dispatcher::event_waiter>*, async_dispatcher_t*, async::wait_base*, zx_status_t, zx_packet_signal_t const*) ../../src/devices/bin/driver_runtime/async_loop_owned_event_handler.h:59 <libdriver_runtime.so>+0xfe983
+ #35 0x00002290f9918b9e in async::wait_method<async_loop_owned_event_handler<driver_runtime::Dispatcher::event_waiter>, &async_loop_owned_event_handler<driver_runtime::Dispatcher::event_waiter>::handle_event>::call_handler(async_dispatcher_t*, async_wait_t*, zx_status_t, zx_packet_signal_t const*) ../../sdk/lib/async/include/lib/async/cpp/wait.h:201 <libdriver_runtime.so>+0xfeb9e
+ #36 0x00002290f99bf509 in async_loop_dispatch_wait(async_loop_t*, async_wait_t*, zx_status_t, zx_packet_signal_t const*) ../../sdk/lib/async-loop/loop.c:394 <libdriver_runtime.so>+0x1a5509
+ #37 0x00002290f99b9958 in async_loop_run_once(async_loop_t*, zx_time_t) ../../sdk/lib/async-loop/loop.c:343 <libdriver_runtime.so>+0x19f958
+ #38 0x00002290f99b9247 in async_loop_run(async_loop_t*, zx_time_t, _Bool) ../../sdk/lib/async-loop/loop.c:301 <libdriver_runtime.so>+0x19f247
+ #39 0x00002290f99ba962 in async_loop_run_thread(void*) ../../sdk/lib/async-loop/loop.c:860 <libdriver_runtime.so>+0x1a0962
+ #40 0x000041afd176ef30 in start_c11(void*) ../../zircon/third_party/ulib/musl/pthread/pthread_create.c:63 <libc.so>+0x84f30
+ #41 0x000041afd18a448d in thread_trampoline(uintptr_t, uintptr_t) ../../zircon/system/ulib/runtime/thread.cc:100 <libc.so>+0x1ba48d
+
+Link: https://github.com/acpica/acpica/commit/1c28da22
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/4664267.LvFx2qVVIh@rjwysocki.net
+Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+[ rjw: Pick up the tag from Tamir ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/amlresrc.h | 8 ++++----
+ drivers/acpi/acpica/rsaddr.c | 13 ++++---------
+ drivers/acpi/acpica/rscalc.c | 22 +++++-----------------
+ drivers/acpi/acpica/rslist.c | 12 +++---------
+ drivers/acpi/acpica/utresrc.c | 14 +++++---------
+ 5 files changed, 21 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/acpi/acpica/amlresrc.h b/drivers/acpi/acpica/amlresrc.h
+index 4e88f9fc2a289..b6588b7fa8986 100644
+--- a/drivers/acpi/acpica/amlresrc.h
++++ b/drivers/acpi/acpica/amlresrc.h
+@@ -504,10 +504,6 @@ struct aml_resource_pin_group_config {
+
+ #define AML_RESOURCE_PIN_GROUP_CONFIG_REVISION 1 /* ACPI 6.2 */
+
+-/* restore default alignment */
+-
+-#pragma pack()
+-
+ /* Union of all resource descriptors, so we can allocate the worst case */
+
+ union aml_resource {
+@@ -562,6 +558,10 @@ union aml_resource {
+ u8 byte_item;
+ };
+
++/* restore default alignment */
++
++#pragma pack()
++
+ /* Interfaces used by both the disassembler and compiler */
+
+ void
+diff --git a/drivers/acpi/acpica/rsaddr.c b/drivers/acpi/acpica/rsaddr.c
+index 27384ee245f09..f92010e667cda 100644
+--- a/drivers/acpi/acpica/rsaddr.c
++++ b/drivers/acpi/acpica/rsaddr.c
+@@ -272,18 +272,13 @@ u8
+ acpi_rs_get_address_common(struct acpi_resource *resource,
+ union aml_resource *aml)
+ {
+- struct aml_resource_address address;
+-
+ ACPI_FUNCTION_ENTRY();
+
+- /* Avoid undefined behavior: member access within misaligned address */
+-
+- memcpy(&address, aml, sizeof(address));
+-
+ /* Validate the Resource Type */
+
+- if ((address.resource_type > 2) &&
+- (address.resource_type < 0xC0) && (address.resource_type != 0x0A)) {
++ if ((aml->address.resource_type > 2) &&
++ (aml->address.resource_type < 0xC0) &&
++ (aml->address.resource_type != 0x0A)) {
+ return (FALSE);
+ }
+
+@@ -304,7 +299,7 @@ acpi_rs_get_address_common(struct acpi_resource *resource,
+ /* Generic resource type, just grab the type_specific byte */
+
+ resource->data.address.info.type_specific =
+- address.specific_flags;
++ aml->address.specific_flags;
+ }
+
+ return (TRUE);
+diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
+index 6e7a152d64595..242daf45e20ef 100644
+--- a/drivers/acpi/acpica/rscalc.c
++++ b/drivers/acpi/acpica/rscalc.c
+@@ -608,18 +608,12 @@ acpi_rs_get_list_length(u8 *aml_buffer,
+
+ case ACPI_RESOURCE_NAME_SERIAL_BUS:{
+
+- /* Avoid undefined behavior: member access within misaligned address */
+-
+- struct aml_resource_common_serialbus
+- common_serial_bus;
+- memcpy(&common_serial_bus, aml_resource,
+- sizeof(common_serial_bus));
+-
+ minimum_aml_resource_length =
+ acpi_gbl_resource_aml_serial_bus_sizes
+- [common_serial_bus.type];
++ [aml_resource->common_serial_bus.type];
+ extra_struct_bytes +=
+- common_serial_bus.resource_length -
++ aml_resource->common_serial_bus.
++ resource_length -
+ minimum_aml_resource_length;
+ break;
+ }
+@@ -688,16 +682,10 @@ acpi_rs_get_list_length(u8 *aml_buffer,
+ */
+ if (acpi_ut_get_resource_type(aml_buffer) ==
+ ACPI_RESOURCE_NAME_SERIAL_BUS) {
+-
+- /* Avoid undefined behavior: member access within misaligned address */
+-
+- struct aml_resource_common_serialbus common_serial_bus;
+- memcpy(&common_serial_bus, aml_resource,
+- sizeof(common_serial_bus));
+-
+ buffer_size =
+ acpi_gbl_resource_struct_serial_bus_sizes
+- [common_serial_bus.type] + extra_struct_bytes;
++ [aml_resource->common_serial_bus.type] +
++ extra_struct_bytes;
+ } else {
+ buffer_size =
+ acpi_gbl_resource_struct_sizes[resource_index] +
+diff --git a/drivers/acpi/acpica/rslist.c b/drivers/acpi/acpica/rslist.c
+index 164c96e063c6e..e46efaa889cdd 100644
+--- a/drivers/acpi/acpica/rslist.c
++++ b/drivers/acpi/acpica/rslist.c
+@@ -55,21 +55,15 @@ acpi_rs_convert_aml_to_resources(u8 * aml,
+ aml_resource = ACPI_CAST_PTR(union aml_resource, aml);
+
+ if (acpi_ut_get_resource_type(aml) == ACPI_RESOURCE_NAME_SERIAL_BUS) {
+-
+- /* Avoid undefined behavior: member access within misaligned address */
+-
+- struct aml_resource_common_serialbus common_serial_bus;
+- memcpy(&common_serial_bus, aml_resource,
+- sizeof(common_serial_bus));
+-
+- if (common_serial_bus.type > AML_RESOURCE_MAX_SERIALBUSTYPE) {
++ if (aml_resource->common_serial_bus.type >
++ AML_RESOURCE_MAX_SERIALBUSTYPE) {
+ conversion_table = NULL;
+ } else {
+ /* This is an I2C, SPI, UART, or CSI2 serial_bus descriptor */
+
+ conversion_table =
+ acpi_gbl_convert_resource_serial_bus_dispatch
+- [common_serial_bus.type];
++ [aml_resource->common_serial_bus.type];
+ }
+ } else {
+ conversion_table =
+diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
+index cff7901f7866e..e1cc3d3487508 100644
+--- a/drivers/acpi/acpica/utresrc.c
++++ b/drivers/acpi/acpica/utresrc.c
+@@ -361,20 +361,16 @@ acpi_ut_validate_resource(struct acpi_walk_state *walk_state,
+ aml_resource = ACPI_CAST_PTR(union aml_resource, aml);
+ if (resource_type == ACPI_RESOURCE_NAME_SERIAL_BUS) {
+
+- /* Avoid undefined behavior: member access within misaligned address */
+-
+- struct aml_resource_common_serialbus common_serial_bus;
+- memcpy(&common_serial_bus, aml_resource,
+- sizeof(common_serial_bus));
+-
+ /* Validate the bus_type field */
+
+- if ((common_serial_bus.type == 0) ||
+- (common_serial_bus.type > AML_RESOURCE_MAX_SERIALBUSTYPE)) {
++ if ((aml_resource->common_serial_bus.type == 0) ||
++ (aml_resource->common_serial_bus.type >
++ AML_RESOURCE_MAX_SERIALBUSTYPE)) {
+ if (walk_state) {
+ ACPI_ERROR((AE_INFO,
+ "Invalid/unsupported SerialBus resource descriptor: BusType 0x%2.2X",
+- common_serial_bus.type));
++ aml_resource->common_serial_bus.
++ type));
+ }
+ return (AE_AML_INVALID_RESOURCE_TYPE);
+ }
+--
+2.39.5
+
--- /dev/null
+From 3580f6455d2371dc65b508c1f9320d7caf7a180e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 21:30:27 +0200
+Subject: ACPICA: Avoid sequence overread in call to strncmp()
+
+From: Ahmed Salem <x0rw3ll@gmail.com>
+
+[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]
+
+ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c
+
+ap_get_table_length() checks if tables are valid by
+calling ap_is_valid_header(). The latter then calls
+ACPI_VALIDATE_RSDP_SIG(Table->Signature).
+
+ap_is_valid_header() accepts struct acpi_table_header as an argument, so
+the signature size is always fixed to 4 bytes.
+
+The problem is when the string comparison is between ACPI-defined table
+signature and ACPI_SIG_RSDP. Common ACPI table header specifies the
+Signature field to be 4 bytes long[1], with the exception of the RSDP
+structure whose signature is 8 bytes long "RSD PTR " (including the
+trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would
+then result in a sequence overread[3] as sig would be smaller (4 bytes)
+than the specified bound (8 bytes).
+
+As a workaround, pass the bound conditionally based on the size of the
+signature being passed.
+
+Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1]
+Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2]
+Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3]
+Link: https://github.com/acpica/acpica/commit/8b83a8d8
+Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/actypes.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 80767e8bf3ad4..d323dfffa4bfc 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -527,7 +527,7 @@ typedef u64 acpi_integer;
+
+ /* Support for the special RSDP signature (8 characters) */
+
+-#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8))
++#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8))
+ #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))
+
+ /* Support for OEMx signature (x can be any character) */
+--
+2.39.5
+
--- /dev/null
+From f4cdbfaa6f924bde549ddd8874dae4648da72bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 21:05:24 +0100
+Subject: ACPICA: fix acpi operand cache leak in dswstate.c
+
+From: Seunghun Han <kkamagui@gmail.com>
+
+[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ]
+
+ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination occurs due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[ 0.585957] ACPI: Added _OSI(Module Device)
+>[ 0.587218] ACPI: Added _OSI(Processor Device)
+>[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[ 0.589790] ACPI: Added _OSI(Processor Aggregator Device)
+>[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)
+>[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)
+>[ 0.597858] ACPI: Unable to start the ACPI Interpreter
+>[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+>[ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006
+>[ 0.609177] Call Trace:
+>[ 0.610063] ? dump_stack+0x5c/0x81
+>[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0
+>[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27
+>[ 0.613906] ? acpi_os_delete_cache+0xa/0x10
+>[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b
+>[ 0.619293] ? acpi_terminate+0xa/0x14
+>[ 0.620394] ? acpi_init+0x2af/0x34f
+>[ 0.621616] ? __class_create+0x4c/0x80
+>[ 0.623412] ? video_setup+0x7f/0x7f
+>[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27
+>[ 0.625861] ? do_one_initcall+0x4e/0x1a0
+>[ 0.627513] ? kernel_init_freeable+0x19e/0x21f
+>[ 0.628972] ? rest_init+0x80/0x80
+>[ 0.630043] ? kernel_init+0xa/0x100
+>[ 0.631084] ? ret_from_fork+0x25/0x30
+>[ 0.633343] vgaarb: loaded
+>[ 0.635036] EDAC MC: Ver: 3.0.0
+>[ 0.638601] PCI: Probing PCI hardware
+>[ 0.639833] PCI host bridge to bus 0000:00
+>[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff]
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_
+delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()
+function uses walk_state->operand_index for start position of the top, but
+acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.
+Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Link: https://github.com/acpica/acpica/commit/987a3b5c
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/4999480.31r3eYUQgx@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsutils.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
+index fb9ed5e1da89d..2bdae8a25e084 100644
+--- a/drivers/acpi/acpica/dsutils.c
++++ b/drivers/acpi/acpica/dsutils.c
+@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS];
+ u32 arg_count = 0;
+ u32 index = walk_state->num_operands;
++ u32 prev_num_operands = walk_state->num_operands;
++ u32 new_num_operands;
+ u32 i;
+
+ ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg);
+@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+
+ /* Create the interpreter arguments, in reverse order */
+
++ new_num_operands = index;
+ index--;
+ for (i = 0; i < arg_count; i++) {
+ arg = arguments[index];
+@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ * pop everything off of the operand stack and delete those
+ * objects
+ */
+- acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state);
++ walk_state->num_operands = i;
++ acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state);
++
++ /* Restore operand count */
++ walk_state->num_operands = prev_num_operands;
+
+ ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index));
+ return_ACPI_STATUS(status);
+--
+2.39.5
+
--- /dev/null
+From 059fb31f9a9586e156a290e0cc02c0400758525d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 21:06:21 +0100
+Subject: ACPICA: fix acpi parse and parseext cache leaks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Seunghun Han <kkamagui@gmail.com>
+
+[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ]
+
+ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5
+
+I'm Seunghun Han, and I work for National Security Research Institute of
+South Korea.
+
+I have been doing a research on ACPI and found an ACPI cache leak in ACPI
+early abort cases.
+
+Boot log of ACPI cache leak is as follows:
+[ 0.352414] ACPI: Added _OSI(Module Device)
+[ 0.353182] ACPI: Added _OSI(Processor Device)
+[ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)
+[ 0.353182] ACPI: Added _OSI(Processor Aggregator Device)
+[ 0.356028] ACPI: Unable to start the ACPI Interpreter
+[ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects
+[ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #10
+[ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.361873] Call Trace:
+[ 0.362243] ? dump_stack+0x5c/0x81
+[ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.362944] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.363296] ? acpi_os_delete_cache+0xa/0x10
+[ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b
+[ 0.364000] ? acpi_terminate+0xa/0x14
+[ 0.364000] ? acpi_init+0x2af/0x34f
+[ 0.364000] ? __class_create+0x4c/0x80
+[ 0.364000] ? video_setup+0x7f/0x7f
+[ 0.364000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.364000] ? do_one_initcall+0x4e/0x1a0
+[ 0.364000] ? kernel_init_freeable+0x189/0x20a
+[ 0.364000] ? rest_init+0xc0/0xc0
+[ 0.364000] ? kernel_init+0xa/0x100
+[ 0.364000] ? ret_from_fork+0x25/0x30
+
+I analyzed this memory leak in detail. I found that “Acpi-State” cache and
+“Acpi-Parse” cache were merged because the size of cache objects was same
+slab cache size.
+
+I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked
+using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
+
+Real ACPI cache leak point is as follows:
+[ 0.360101] ACPI: Added _OSI(Module Device)
+[ 0.360101] ACPI: Added _OSI(Processor Device)
+[ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)
+[ 0.361043] ACPI: Added _OSI(Processor Aggregator Device)
+[ 0.364016] ACPI: Unable to start the ACPI Interpreter
+[ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects
+[ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #8
+[ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.372000] Call Trace:
+[ 0.372000] ? dump_stack+0x5c/0x81
+[ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.372000] ? acpi_os_delete_cache+0xa/0x10
+[ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b
+[ 0.372000] ? acpi_terminate+0xa/0x14
+[ 0.372000] ? acpi_init+0x2af/0x34f
+[ 0.372000] ? __class_create+0x4c/0x80
+[ 0.372000] ? video_setup+0x7f/0x7f
+[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.372000] ? do_one_initcall+0x4e/0x1a0
+[ 0.372000] ? kernel_init_freeable+0x189/0x20a
+[ 0.372000] ? rest_init+0xc0/0xc0
+[ 0.372000] ? kernel_init+0xa/0x100
+[ 0.372000] ? ret_from_fork+0x25/0x30
+[ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects
+[ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #8
+[ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.392000] Call Trace:
+[ 0.392000] ? dump_stack+0x5c/0x81
+[ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.392000] ? acpi_os_delete_cache+0xa/0x10
+[ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b
+[ 0.392000] ? acpi_terminate+0xa/0x14
+[ 0.392000] ? acpi_init+0x2af/0x34f
+[ 0.392000] ? __class_create+0x4c/0x80
+[ 0.392000] ? video_setup+0x7f/0x7f
+[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.392000] ? do_one_initcall+0x4e/0x1a0
+[ 0.392000] ? kernel_init_freeable+0x189/0x20a
+[ 0.392000] ? rest_init+0xc0/0xc0
+[ 0.392000] ? kernel_init+0xa/0x100
+[ 0.392000] ? ret_from_fork+0x25/0x30
+
+When early abort is occurred due to invalid ACPI information, Linux kernel
+terminates ACPI by calling acpi_terminate() function. The function calls
+acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_
+cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
+
+But the deletion codes in acpi_ut_delete_caches() function only delete
+slab caches using kmem_cache_destroy() function, therefore the cache
+objects should be flushed before acpi_ut_delete_caches() function.
+
+"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse
+function, acpi_ps_parse_loop(). The function should complete all ops
+using acpi_ps_complete_final_op() when an error occurs due to invalid
+AML codes.
+However, the current implementation of acpi_ps_complete_final_op() does not
+complete all ops when it meets some errors and this cause cache leak.
+
+This cache leak has a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+To fix ACPI cache leak for enhancing security, I made a patch to complete all
+ops unconditionally for acpi_ps_complete_final_op() function.
+
+I hope that this patch improves the security of Linux kernel.
+
+Thank you.
+
+Link: https://github.com/acpica/acpica/commit/8829e70e
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/2363774.ElGaqSPkdT@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------
+ 1 file changed, 15 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c
+index 54471083ba545..0bce1baaa62b3 100644
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -636,7 +636,8 @@ acpi_status
+ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ union acpi_parse_object *op, acpi_status status)
+ {
+- acpi_status status2;
++ acpi_status return_status = status;
++ u8 ascending = TRUE;
+
+ ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state);
+
+@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ op));
+ do {
+ if (op) {
+- if (walk_state->ascending_callback != NULL) {
++ if (ascending && walk_state->ascending_callback != NULL) {
+ walk_state->op = op;
+ walk_state->op_info =
+ acpi_ps_get_opcode_info(op->common.
+@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ }
+
+ if (status == AE_CTRL_TERMINATE) {
+- status = AE_OK;
+-
+- /* Clean up */
+- do {
+- if (op) {
+- status2 =
+- acpi_ps_complete_this_op
+- (walk_state, op);
+- if (ACPI_FAILURE
+- (status2)) {
+- return_ACPI_STATUS
+- (status2);
+- }
+- }
+-
+- acpi_ps_pop_scope(&
+- (walk_state->
+- parser_state),
+- &op,
+- &walk_state->
+- arg_types,
+- &walk_state->
+- arg_count);
+-
+- } while (op);
+-
+- return_ACPI_STATUS(status);
++ ascending = FALSE;
++ return_status = AE_CTRL_TERMINATE;
+ }
+
+ else if (ACPI_FAILURE(status)) {
+
+ /* First error is most important */
+
+- (void)
+- acpi_ps_complete_this_op(walk_state,
+- op);
+- return_ACPI_STATUS(status);
++ ascending = FALSE;
++ return_status = status;
+ }
+ }
+
+- status2 = acpi_ps_complete_this_op(walk_state, op);
+- if (ACPI_FAILURE(status2)) {
+- return_ACPI_STATUS(status2);
++ status = acpi_ps_complete_this_op(walk_state, op);
++ if (ACPI_FAILURE(status)) {
++ ascending = FALSE;
++ if (ACPI_SUCCESS(return_status) ||
++ return_status == AE_CTRL_TERMINATE) {
++ return_status = status;
++ }
+ }
+ }
+
+@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+
+ } while (op);
+
+- return_ACPI_STATUS(status);
++ return_ACPI_STATUS(return_status);
+ }
+--
+2.39.5
+
--- /dev/null
+From 27ab39a2ff69425b9e5321043f26f17ac0a32350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 21:21:52 +0200
+Subject: ACPICA: utilities: Fix overflow check in vsnprintf()
+
+From: gldrk <me@rarity.fan>
+
+[ Upstream commit 12b660251007e00a3e4d47ec62dbe3a7ace7023e ]
+
+ACPICA commit d9d59b7918514ae55063b93f3ec041b1a569bf49
+
+The old version breaks sprintf on 64-bit systems for buffers
+outside [0..UINT32_MAX].
+
+Link: https://github.com/acpica/acpica/commit/d9d59b79
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/4994935.GXAFRqVoOG@rjwysocki.net
+Signed-off-by: gldrk <me@rarity.fan>
+[ rjw: Added the tag from gldrk ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/utprint.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/acpica/utprint.c b/drivers/acpi/acpica/utprint.c
+index 42b30b9f93128..7fad03c5252c3 100644
+--- a/drivers/acpi/acpica/utprint.c
++++ b/drivers/acpi/acpica/utprint.c
+@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args)
+
+ pos = string;
+
+- if (size != ACPI_UINT32_MAX) {
+- end = string + size;
+- } else {
+- end = ACPI_CAST_PTR(char, ACPI_UINT32_MAX);
+- }
++ size = ACPI_MIN(size, ACPI_PTR_DIFF(ACPI_MAX_PTR, string));
++ end = string + size;
+
+ for (; *format; ++format) {
+ if (*format != '%') {
+--
+2.39.5
+
--- /dev/null
+From 6ca1d99a7cdcf5793988d658d85af1c716f14ed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 17:28:33 +0100
+Subject: ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios
+ laptops
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit e43a93c41982e82c1b703dd7fa9c1d965260fbb3 ]
+
+Fixes audio channel assignment from ACPI using configuration table.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250515162848.405055-3-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda_property.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c
+index 61d2314834e7b..d8249d997c2a0 100644
+--- a/sound/pci/hda/cs35l41_hda_property.c
++++ b/sound/pci/hda/cs35l41_hda_property.c
+@@ -31,6 +31,9 @@ struct cs35l41_config {
+ };
+
+ static const struct cs35l41_config cs35l41_config_table[] = {
++ { "10251826", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
++ { "1025182C", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
++ { "10251844", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 },
+ { "10280B27", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 },
+ { "10280B28", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 },
+ { "10280BEB", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 },
+@@ -452,6 +455,9 @@ struct cs35l41_prop_model {
+ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = {
+ { "CLSA0100", NULL, lenovo_legion_no_acpi },
+ { "CLSA0101", NULL, lenovo_legion_no_acpi },
++ { "CSC3551", "10251826", generic_dsd_config },
++ { "CSC3551", "1025182C", generic_dsd_config },
++ { "CSC3551", "10251844", generic_dsd_config },
+ { "CSC3551", "10280B27", generic_dsd_config },
+ { "CSC3551", "10280B28", generic_dsd_config },
+ { "CSC3551", "10280BEB", generic_dsd_config },
+--
+2.39.5
+
--- /dev/null
+From 9165ad86441a94fbf0f87d01e1f7b074966cd46c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 16:00:39 -0700
+Subject: ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
+
+From: Sukrut Bellary <sbellary@baylibre.com>
+
+[ Upstream commit 47fe74098f3dadba2f9cc1e507d813a4aa93f5f3 ]
+
+Don't put the l4ls clk domain to sleep in case of standby.
+Since CM3 PM FW[1](ti-v4.1.y) doesn't wake-up/enable the l4ls clk domain
+upon wake-up, CM3 PM FW fails to wake-up the MPU.
+
+[1] https://git.ti.com/cgit/processor-firmware/ti-amx3-cm3-pm-firmware/
+
+Signed-off-by: Sukrut Bellary <sbellary@baylibre.com>
+Tested-by: Judith Mendez <jm@ti.com>
+Link: https://lore.kernel.org/r/20250318230042.3138542-2-sbellary@baylibre.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/clockdomain.h | 1 +
+ arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +-
+ arch/arm/mach-omap2/cm33xx.c | 14 +++++++++++++-
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h
+index c36fb27212615..86a2f9e5d0ef9 100644
+--- a/arch/arm/mach-omap2/clockdomain.h
++++ b/arch/arm/mach-omap2/clockdomain.h
+@@ -48,6 +48,7 @@
+ #define CLKDM_NO_AUTODEPS (1 << 4)
+ #define CLKDM_ACTIVE_WITH_MPU (1 << 5)
+ #define CLKDM_MISSING_IDLE_REPORTING (1 << 6)
++#define CLKDM_STANDBY_FORCE_WAKEUP BIT(7)
+
+ #define CLKDM_CAN_HWSUP (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO)
+ #define CLKDM_CAN_SWSUP (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP)
+diff --git a/arch/arm/mach-omap2/clockdomains33xx_data.c b/arch/arm/mach-omap2/clockdomains33xx_data.c
+index 87f4e927eb183..c05a3c07d4486 100644
+--- a/arch/arm/mach-omap2/clockdomains33xx_data.c
++++ b/arch/arm/mach-omap2/clockdomains33xx_data.c
+@@ -19,7 +19,7 @@ static struct clockdomain l4ls_am33xx_clkdm = {
+ .pwrdm = { .name = "per_pwrdm" },
+ .cm_inst = AM33XX_CM_PER_MOD,
+ .clkdm_offs = AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET,
+- .flags = CLKDM_CAN_SWSUP,
++ .flags = CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP,
+ };
+
+ static struct clockdomain l3s_am33xx_clkdm = {
+diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
+index acdf72a541c02..a4dd42abda89b 100644
+--- a/arch/arm/mach-omap2/cm33xx.c
++++ b/arch/arm/mach-omap2/cm33xx.c
+@@ -20,6 +20,9 @@
+ #include "cm-regbits-34xx.h"
+ #include "cm-regbits-33xx.h"
+ #include "prm33xx.h"
++#if IS_ENABLED(CONFIG_SUSPEND)
++#include <linux/suspend.h>
++#endif
+
+ /*
+ * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield:
+@@ -328,8 +331,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm)
+ {
+ bool hwsup = false;
+
++#if IS_ENABLED(CONFIG_SUSPEND)
++ /*
++ * In case of standby, Don't put the l4ls clk domain to sleep.
++ * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain
++ * upon wake-up, CM3 PM FW fails to wake-up th MPU.
++ */
++ if (pm_suspend_target_state == PM_SUSPEND_STANDBY &&
++ (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP))
++ return 0;
++#endif
+ hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs);
+-
+ if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP))
+ am33xx_clkdm_sleep(clkdm);
+
+--
+2.39.5
+
--- /dev/null
+From 3dd8afa2505c4614ceff2f82d688723960a5274c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 01:27:41 +0300
+Subject: ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
+
+From: Talhah Peerbhai <talhah.peerbhai@gmail.com>
+
+[ Upstream commit a28206060dc5848a1a2a15b7f6ac6223d869084d ]
+
+Similar to many other Lenovo models with AMD chips, the Lenovo
+Yoga Pro 7 14ASP9 (product name 83HN) requires a specific quirk
+to ensure internal mic detection. This patch adds a quirk fixing this.
+
+Signed-off-by: Talhah Peerbhai <talhah.peerbhai@gmail.com>
+Link: https://patch.msgid.link/20250515222741.144616-1-talhah.peerbhai@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index e632f16c91025..3d9da93d22ee8 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "83AS"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83HN"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+@@ -360,7 +367,7 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"),
+ }
+ },
+- {
++ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+--
+2.39.5
+
--- /dev/null
+From 4f926df9b7d7e17430f3e3b15051ce1bd34d4d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 02:54:23 +0800
+Subject: ASoC: intel/sdw_utils: Assign initial value in
+ asoc_sdw_rt_amp_spk_rtd_init()
+
+From: I Hsin Cheng <richard120310@gmail.com>
+
+[ Upstream commit 5fb3878216aece471af030b33a9fbef3babd8617 ]
+
+Initialize "ret" with "-EINVAL" to handle cases where "strstr()" for
+"codec_dai->component->name_prefix" doesn't find "-1" nor "-2". In that
+case "name_prefix" is invalid because for current implementation it's
+expected to have either "-1" or "-2" in it. (Maybe "-3", "-4" and so on
+in the future.)
+
+Link: https://scan5.scan.coverity.com/#/project-view/36179/10063?selectedIssue=1627120
+Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
+Link: https://patch.msgid.link/20250505185423.680608-1-richard120310@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sdw_utils/soc_sdw_rt_amp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sdw_utils/soc_sdw_rt_amp.c b/sound/soc/sdw_utils/soc_sdw_rt_amp.c
+index 6951dfb565263..b3d6ca2499734 100644
+--- a/sound/soc/sdw_utils/soc_sdw_rt_amp.c
++++ b/sound/soc/sdw_utils/soc_sdw_rt_amp.c
+@@ -190,7 +190,7 @@ int asoc_sdw_rt_amp_spk_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc
+ const struct snd_soc_dapm_route *rt_amp_map;
+ char codec_name[CODEC_NAME_SIZE];
+ struct snd_soc_dai *codec_dai;
+- int ret;
++ int ret = -EINVAL;
+ int i;
+
+ rt_amp_map = get_codec_name_and_route(dai, codec_name);
+--
+2.39.5
+
--- /dev/null
+From 9964413498efedcd80da4acb26990adbf6b1f259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Apr 2025 09:15:05 +1000
+Subject: ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ]
+
+The ISENSE/VSENSE blocks are only powered up when the amplifier
+transitions from shutdown to active. This means that if those controls
+are flipped on while the amplifier is already playing back audio, they
+will have no effect.
+
+Fix this by forcing a power cycle around transitions in those controls.
+
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: James Calligeros <jcalligeros99@gmail.com>
+Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index 863c3f672ba98..0931b6109755f 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -156,11 +156,37 @@ static const struct snd_kcontrol_new isense_switch =
+ static const struct snd_kcontrol_new vsense_switch =
+ SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1);
+
++static int sense_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component);
++
++ /*
++ * Powering up ISENSE/VSENSE requires a trip through the shutdown state.
++ * Do that here to ensure that our changes are applied properly, otherwise
++ * we might end up with non-functional IVSENSE if playback started earlier,
++ * which would break software speaker protection.
++ */
++ switch (event) {
++ case SND_SOC_DAPM_PRE_REG:
++ return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL,
++ TAS2770_PWR_CTRL_MASK,
++ TAS2770_PWR_CTRL_SHUTDOWN);
++ case SND_SOC_DAPM_POST_REG:
++ return tas2770_update_pwr_ctrl(tas2770);
++ default:
++ return 0;
++ }
++}
++
+ static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux),
+- SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch),
+- SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch),
++ SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch,
++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG),
++ SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch,
++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG),
+ SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_OUTPUT("OUT"),
+--
+2.39.5
+
--- /dev/null
+From ff2cd52db550adf20dffcb8aaec3a70bd9198458 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 20:37:44 +0800
+Subject: ASoC: tegra210_ahub: Add check to of_device_get_match_data()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit 04cb269c204398763a620d426cbee43064854000 ]
+
+In tegra_ahub_probe(), check the result of function
+of_device_get_match_data(), return an error code in case it fails.
+
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/tegra/tegra210_ahub.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c
+index 1920b996e9aad..51043e556b3e9 100644
+--- a/sound/soc/tegra/tegra210_ahub.c
++++ b/sound/soc/tegra/tegra210_ahub.c
+@@ -1359,6 +1359,8 @@ static int tegra_ahub_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ ahub->soc_data = of_device_get_match_data(&pdev->dev);
++ if (!ahub->soc_data)
++ return -ENODEV;
+
+ platform_set_drvdata(pdev, ahub);
+
+--
+2.39.5
+
--- /dev/null
+From 2ebf8d7e8c980aa31e923de531bcdb9a33b6e82c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 14:13:54 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
+
+From: Liwei Sun <sunliweis@126.com>
+
+[ Upstream commit 71d9d3522aec301e4a1c4eae4b5e0656fc4a7262 ]
+
+A new variant of MT7922 wireless device has been identified.
+The device introduces itself as MEDIATEK MT7922,
+so treat it as MediaTek device.
+With this patch, btusb driver works as expected:
+[ 3.151162] Bluetooth: Core ver 2.22
+[ 3.151185] Bluetooth: HCI device and connection manager initialized
+[ 3.151189] Bluetooth: HCI socket layer initialized
+[ 3.151191] Bluetooth: L2CAP socket layer initialized
+[ 3.151194] Bluetooth: SCO socket layer initialized
+[ 3.295718] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20241106163512
+[ 4.676634] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
+[ 4.676637] Bluetooth: BNEP filters: protocol multicast
+[ 4.676640] Bluetooth: BNEP socket layer initialized
+[ 5.560453] Bluetooth: hci0: Device setup in 2320660 usecs
+[ 5.560457] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
+[ 5.619197] Bluetooth: hci0: AOSP extensions version v1.00
+[ 5.619204] Bluetooth: hci0: AOSP quality report is supported
+[ 5.619301] Bluetooth: MGMT ver 1.23
+[ 6.741247] Bluetooth: RFCOMM TTY layer initialized
+[ 6.741258] Bluetooth: RFCOMM socket layer initialized
+[ 6.741261] Bluetooth: RFCOMM ver 1.11
+
+lspci output:
+04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter
+
+USB information:
+T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3584 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Liwei Sun <sunliweis@126.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index af2be0271806f..7be13d3c82bcd 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -672,6 +672,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3584), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3605), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3607), .driver_info = BTUSB_MEDIATEK |
+--
+2.39.5
+
--- /dev/null
+From f824c8e77c909b3282bd61653db804fefb032473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 18:16:05 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
+
+From: Jiande Lu <jiande.lu@mediatek.com>
+
+[ Upstream commit 5bd5c716f7ec3e25d8d3b8a7566e192a26f9c7ce ]
+
+Add VID 13d3 & PID 3630 for MediaTek MT7925 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T: Bus=07 Lev=01 Prnt=01 Port=10 Cnt=02 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3630 Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Jiande Lu <jiande.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7be13d3c82bcd..aa63852060500 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -714,6 +714,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x13d3, 0x3630), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Additional Realtek 8723AE Bluetooth devices */
+ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
+--
+2.39.5
+
--- /dev/null
+From c921650c2a4902d8dd5708c6beb6a1dcad9bb88d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 10:24:47 -0700
+Subject: bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 5bccacb4cc32cb835fe2fe100a210332c494e81d ]
+
+The "ref_count" field in struct bnxt_ulp is unused after
+commit a43c26fa2e6c ("RDMA/bnxt_re: Remove the sriov config callback").
+So we can just remove it now.
+
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250417172448.1206107-4-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 5 -----
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h | 1 -
+ 2 files changed, 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+index 546d9a3d7efea..b33c29fdf8fd3 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+@@ -148,7 +148,6 @@ void bnxt_unregister_dev(struct bnxt_en_dev *edev)
+ struct net_device *dev = edev->net;
+ struct bnxt *bp = netdev_priv(dev);
+ struct bnxt_ulp *ulp;
+- int i = 0;
+
+ ulp = edev->ulp_tbl;
+ rtnl_lock();
+@@ -164,10 +163,6 @@ void bnxt_unregister_dev(struct bnxt_en_dev *edev)
+ synchronize_rcu();
+ ulp->max_async_event_id = 0;
+ ulp->async_events_bmap = NULL;
+- while (atomic_read(&ulp->ref_count) != 0 && i < 10) {
+- msleep(100);
+- i++;
+- }
+ mutex_unlock(&edev->en_dev_lock);
+ rtnl_unlock();
+ return;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+index 4f4914f5c84c9..b76a231ca7dac 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+@@ -48,7 +48,6 @@ struct bnxt_ulp {
+ unsigned long *async_events_bmap;
+ u16 max_async_event_id;
+ u16 msix_requested;
+- atomic_t ref_count;
+ };
+
+ struct bnxt_en_dev {
+--
+2.39.5
+
--- /dev/null
+From d9136c11d44b5c17c5fbb66038048c04e53b809a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 May 2025 14:25:34 +0800
+Subject: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit d4965578267e2e81f67c86e2608481e77e9c8569 ]
+
+bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf
+program. When BPF JIT is disabled or under 32-bit host,
+bpf_map_lookup_percpu_elem() will not be inlined. Using it in a
+sleepable bpf program will trigger the warning in
+bpf_map_lookup_percpu_elem(), because the bpf program only holds
+rcu_read_lock_trace lock. Therefore, add the missed check.
+
+Reported-by: syzbot+dce5aae19ae4d6399986@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/bpf/000000000000176a130617420310@google.com/
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20250526062534.1105938-1-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index a05aeb3458964..9173d107758d4 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -129,7 +129,8 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = {
+
+ BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
+ {
+- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
++ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() &&
++ !rcu_read_lock_bh_held());
+ return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From f1c9242be534638a376b93ba8130ffdc6716f1eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 22:57:30 +0200
+Subject: bpf: Pass the same orig_call value to trampoline functions
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 94bde253d3ae5d8a01cb958663b12daef1d06574 ]
+
+There is currently some confusion in the s390x JIT regarding whether
+orig_call can be NULL and what that means. Originally the NULL value
+was used to distinguish the struct_ops case, but this was superseded by
+BPF_TRAMP_F_INDIRECT (see commit 0c970ed2f87c ("s390/bpf: Fix indirect
+trampoline generation").
+
+The remaining reason to have this check is that NULL can actually be
+passed to the arch_bpf_trampoline_size() call - but not to the
+respective arch_prepare_bpf_trampoline()! call - by
+bpf_struct_ops_prepare_trampoline().
+
+Remove this asymmetry by passing stub_func to both functions, so that
+JITs may rely on orig_call never being NULL.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20250512221911.61314-2-iii@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/bpf_struct_ops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
+index 477947456371a..2285b27ce68c7 100644
+--- a/kernel/bpf/bpf_struct_ops.c
++++ b/kernel/bpf/bpf_struct_ops.c
+@@ -577,7 +577,7 @@ int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks,
+ if (model->ret_size > 0)
+ flags |= BPF_TRAMP_F_RET_FENTRY_RET;
+
+- size = arch_bpf_trampoline_size(model, flags, tlinks, NULL);
++ size = arch_bpf_trampoline_size(model, flags, tlinks, stub_func);
+ if (size <= 0)
+ return size ? : -EFAULT;
+
+--
+2.39.5
+
--- /dev/null
+From 4887193abd12735b9cb8419ab3871b4ba3a0b81d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Apr 2025 22:21:20 +0800
+Subject: bpf, sockmap: Fix data lost during EAGAIN retries
+
+From: Jiayuan Chen <jiayuan.chen@linux.dev>
+
+[ Upstream commit 7683167196bd727ad5f3c3fc6a9ca70f54520a81 ]
+
+We call skb_bpf_redirect_clear() to clean _sk_redir before handling skb in
+backlog, but when sk_psock_handle_skb() return EAGAIN due to sk_rcvbuf
+limit, the redirect info in _sk_redir is not recovered.
+
+Fix skb redir loss during EAGAIN retries by restoring _sk_redir
+information using skb_bpf_set_redir().
+
+Before this patch:
+'''
+./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress
+Setting up benchmark 'sockmap'...
+create socket fd c1:13 p1:14 c2:15 p2:16
+Benchmark 'sockmap' started.
+Send Speed 1343.172 MB/s, BPF Speed 1343.238 MB/s, Rcv Speed 65.271 MB/s
+Send Speed 1352.022 MB/s, BPF Speed 1352.088 MB/s, Rcv Speed 0 MB/s
+Send Speed 1354.105 MB/s, BPF Speed 1354.105 MB/s, Rcv Speed 0 MB/s
+Send Speed 1355.018 MB/s, BPF Speed 1354.887 MB/s, Rcv Speed 0 MB/s
+'''
+Due to the high send rate, the RX processing path may frequently hit the
+sk_rcvbuf limit. Once triggered, incorrect _sk_redir will cause the flow
+to mistakenly enter the "!ingress" path, leading to send failures.
+(The Rcv speed depends on tcp_rmem).
+
+After this patch:
+'''
+./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress
+Setting up benchmark 'sockmap'...
+create socket fd c1:13 p1:14 c2:15 p2:16
+Benchmark 'sockmap' started.
+Send Speed 1347.236 MB/s, BPF Speed 1347.367 MB/s, Rcv Speed 65.402 MB/s
+Send Speed 1353.320 MB/s, BPF Speed 1353.320 MB/s, Rcv Speed 65.536 MB/s
+Send Speed 1353.186 MB/s, BPF Speed 1353.121 MB/s, Rcv Speed 65.536 MB/s
+'''
+
+Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
+Link: https://lore.kernel.org/r/20250407142234.47591-2-jiayuan.chen@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index a8d238dd982af..97f52394d1eb1 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -689,7 +689,8 @@ static void sk_psock_backlog(struct work_struct *work)
+ if (ret <= 0) {
+ if (ret == -EAGAIN) {
+ sk_psock_skb_state(psock, state, len, off);
+-
++ /* Restore redir info we cleared before */
++ skb_bpf_set_redir(skb, psock->sk, ingress);
+ /* Delay slightly to prioritize any
+ * other work that might be here.
+ */
+--
+2.39.5
+
--- /dev/null
+From 32bdd81904d5c2a34d7a13561fb62d16139b4c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 15:49:43 +0800
+Subject: bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
+
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+
+[ Upstream commit 53ebef53a657d7957d35dc2b953db64f1bb28065 ]
+
+The calculation of the index used to access the mask field in 'struct
+bpf_raw_tp_null_args' is done with 'int' type, which could overflow when
+the tracepoint being attached has more than 8 arguments.
+
+While none of the tracepoints mentioned in raw_tp_null_args[] currently
+have more than 8 arguments, there do exist tracepoints that had more
+than 8 arguments (e.g. iocost_iocg_forgive_debt), so use the correct
+type for calculation and avoid Smatch static checker warning.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/bpf/20250418074946.35569-1-shung-hsi.yu@suse.com
+
+Closes: https://lore.kernel.org/r/843a3b94-d53d-42db-93d4-be10a4090146@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 2c54c148a94f3..f83bd019db141 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -6684,10 +6684,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
+ /* Is this a func with potential NULL args? */
+ if (strcmp(tname, raw_tp_null_args[i].func))
+ continue;
+- if (raw_tp_null_args[i].mask & (0x1 << (arg * 4)))
++ if (raw_tp_null_args[i].mask & (0x1ULL << (arg * 4)))
+ info->reg_type |= PTR_MAYBE_NULL;
+ /* Is the current arg IS_ERR? */
+- if (raw_tp_null_args[i].mask & (0x2 << (arg * 4)))
++ if (raw_tp_null_args[i].mask & (0x2ULL << (arg * 4)))
+ ptr_err_raw_tp = true;
+ break;
+ }
+--
+2.39.5
+
--- /dev/null
+From 3f22007bc6b9e556aa4b841af3aa990cfd74d62d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 13:32:32 -0700
+Subject: bpftool: Fix cgroup command to only show cgroup bpf programs
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit b69d4413aa1961930fbf9ffad8376d577378daf9 ]
+
+The netkit program is not a cgroup bpf program and should not be shown
+in the output of the "bpftool cgroup show" command.
+
+However, if the netkit device happens to have ifindex 3,
+the "bpftool cgroup show" command will output the netkit
+bpf program as well:
+
+> ip -d link show dev nk1
+3: nk1@if2: ...
+ link/ether ...
+ netkit mode ...
+
+> bpftool net show
+tc:
+nk1(3) netkit/peer tw_ns_nk2phy prog_id 469447
+
+> bpftool cgroup show /sys/fs/cgroup/...
+ID AttachType AttachFlags Name
+... ... ...
+469447 netkit_peer tw_ns_nk2phy
+
+The reason is that the target_fd (which is the cgroup_fd here) and
+the target_ifindex are in a union in the uapi/linux/bpf.h. The bpftool
+iterates all values in "enum bpf_attach_type" which includes
+non cgroup attach types like netkit. The cgroup_fd is usually 3 here,
+so the bug is triggered when the netkit ifindex just happens
+to be 3 as well.
+
+The bpftool's cgroup.c already has a list of cgroup-only attach type
+defined in "cgroup_attach_types[]". This patch fixes it by iterating
+over "cgroup_attach_types[]" instead of "__MAX_BPF_ATTACH_TYPE".
+
+Cc: Quentin Monnet <qmo@kernel.org>
+Reported-by: Takshak Chahande <ctakshak@meta.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/r/20250507203232.1420762-1-martin.lau@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/cgroup.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
+index afab728468bf6..4189c9d74fb06 100644
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -318,11 +318,11 @@ static int show_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
+
+ static int do_show(int argc, char **argv)
+ {
+- enum bpf_attach_type type;
+ int has_attached_progs;
+ const char *path;
+ int cgroup_fd;
+ int ret = -1;
++ unsigned int i;
+
+ query_flags = 0;
+
+@@ -370,14 +370,14 @@ static int do_show(int argc, char **argv)
+ "AttachFlags", "Name");
+
+ btf_vmlinux = libbpf_find_kernel_btf();
+- for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
++ for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) {
+ /*
+ * Not all attach types may be supported, so it's expected,
+ * that some requests will fail.
+ * If we were able to get the show for at least one
+ * attach type, let's return 0.
+ */
+- if (show_bpf_progs(cgroup_fd, type, 0) == 0)
++ if (show_bpf_progs(cgroup_fd, cgroup_attach_types[i], 0) == 0)
+ ret = 0;
+ }
+
+@@ -400,9 +400,9 @@ static int do_show(int argc, char **argv)
+ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ int typeflag, struct FTW *ftw)
+ {
+- enum bpf_attach_type type;
+ int has_attached_progs;
+ int cgroup_fd;
++ unsigned int i;
+
+ if (typeflag != FTW_D)
+ return 0;
+@@ -434,8 +434,8 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ }
+
+ btf_vmlinux = libbpf_find_kernel_btf();
+- for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++)
+- show_bpf_progs(cgroup_fd, type, ftw->level);
++ for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++)
++ show_bpf_progs(cgroup_fd, cgroup_attach_types[i], ftw->level);
+
+ if (errno == EINVAL)
+ /* Last attach type does not support query.
+--
+2.39.5
+
--- /dev/null
+From 3a4dfd88bbb117ec7b7ab02ce4f6ebca6c5b48eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 13:58:14 +0300
+Subject: bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 23d060136841c58c2f9ee8c08ad945d1879ead4b ]
+
+In case the MC firmware runs in debug mode with extensive prints pushed
+to the console, the current timeout of 500ms is not enough.
+Increase the timeout value so that we don't have any chance of wrongly
+assuming that the firmware is not responding when it's just taking more
+time.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20250408105814.2837951-7-ioana.ciornei@nxp.com
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/mc-sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c
+index f2052cd0a0517..b22c59d57c8f0 100644
+--- a/drivers/bus/fsl-mc/mc-sys.c
++++ b/drivers/bus/fsl-mc/mc-sys.c
+@@ -19,7 +19,7 @@
+ /*
+ * Timeout in milliseconds to wait for the completion of an MC command
+ */
+-#define MC_CMD_COMPLETION_TIMEOUT_MS 500
++#define MC_CMD_COMPLETION_TIMEOUT_MS 15000
+
+ /*
+ * usleep_range() min and max values used to throttle down polling
+--
+2.39.5
+
--- /dev/null
+From ea2ada7ef629e1a3792cc522908bdd5dfbfdce50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:30:41 +0530
+Subject: clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
+
+From: Taniya Das <quic_tdas@quicinc.com>
+
+[ Upstream commit 201bf08ba9e26eeb0a96ba3fd5c026f531b31aed ]
+
+Update the force mem core bit for UFS ICE clock and UFS PHY AXI clock to
+force the core on signal to remain active during halt state of the clk.
+If force mem core bit of the clock is not set, the memories of the
+subsystem will not retain the logic across power states. This is
+required for the MCQ feature of UFS.
+
+Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
+Reviewed-by: Imran Shaik <quic_imrashai@quicinc.com>
+Link: https://lore.kernel.org/r/20250414-gcc_ufs_mem_core-v1-2-67b5529b9b5d@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-x1e80100.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-x1e80100.c b/drivers/clk/qcom/gcc-x1e80100.c
+index 009f39139b644..3e44757e25d32 100644
+--- a/drivers/clk/qcom/gcc-x1e80100.c
++++ b/drivers/clk/qcom/gcc-x1e80100.c
+@@ -6753,6 +6753,10 @@ static int gcc_x1e80100_probe(struct platform_device *pdev)
+ /* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */
+ regmap_write(regmap, 0x52224, 0x0);
+
++ /* FORCE_MEM_CORE_ON for ufs phy ice core and gcc ufs phy axi clocks */
++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true);
++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_axi_clk, true);
++
+ return qcom_cc_really_probe(&pdev->dev, &gcc_x1e80100_desc, regmap);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 28b3cea35c2abaa0c00dcd0d6edd9dafd61925e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 22:25:31 +0200
+Subject: clk: rockchip: rk3036: mark ddrphy as critical
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 596a977b34a722c00245801a5774aa79cec4e81d ]
+
+The ddrphy is supplied by the dpll, but due to the limited number of PLLs
+on the rk3036, the dpll also is used for other periperhals, like the GPU.
+
+So it happened, when the Lima driver turned off the gpu clock, this in
+turn also disabled the dpll and thus the ram.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250503202532.992033-4-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3036.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
+index d341ce0708aac..e4af3a9286379 100644
+--- a/drivers/clk/rockchip/clk-rk3036.c
++++ b/drivers/clk/rockchip/clk-rk3036.c
+@@ -431,6 +431,7 @@ static const char *const rk3036_critical_clocks[] __initconst = {
+ "hclk_peri",
+ "pclk_peri",
+ "pclk_ddrupctl",
++ "ddrphy",
+ };
+
+ static void __init rk3036_clk_init(struct device_node *np)
+--
+2.39.5
+
--- /dev/null
+From 171911459b2b1e4cc9b877eb5b34ebd3e3722d80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 14:36:24 -0300
+Subject: clocksource: Fix the CPUs' choice in the watchdog per CPU
+ verification
+
+From: Guilherme G. Piccoli <gpiccoli@igalia.com>
+
+[ Upstream commit 08d7becc1a6b8c936e25d827becabfe3bff72a36 ]
+
+Right now, if the clocksource watchdog detects a clocksource skew, it might
+perform a per CPU check, for example in the TSC case on x86. In other
+words: supposing TSC is detected as unstable by the clocksource watchdog
+running at CPU1, as part of marking TSC unstable the kernel will also run a
+check of TSC readings on some CPUs to be sure it is synced between them
+all.
+
+But that check happens only on some CPUs, not all of them; this choice is
+based on the parameter "verify_n_cpus" and in some random cpumask
+calculation. So, the watchdog runs such per CPU checks on up to
+"verify_n_cpus" random CPUs among all online CPUs, with the risk of
+repeating CPUs (that aren't double checked) in the cpumask random
+calculation.
+
+But if "verify_n_cpus" > num_online_cpus(), it should skip the random
+calculation and just go ahead and check the clocksource sync between
+all online CPUs, without the risk of skipping some CPUs due to
+duplicity in the random cpumask calculation.
+
+Tests in a 4 CPU laptop with TSC skew detected led to some cases of the per
+CPU verification skipping some CPU even with verify_n_cpus=8, due to the
+duplicity on random cpumask generation. Skipping the randomization when the
+number of online CPUs is smaller than verify_n_cpus, solves that.
+
+Suggested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Link: https://lore.kernel.org/all/20250323173857.372390-1-gpiccoli@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/clocksource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 58fb7280cabbe..ae862ad9642cb 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -302,7 +302,7 @@ static void clocksource_verify_choose_cpus(void)
+ {
+ int cpu, i, n = verify_n_cpus;
+
+- if (n < 0) {
++ if (n < 0 || n >= num_online_cpus()) {
+ /* Check all of the CPUs. */
+ cpumask_copy(&cpus_chosen, cpu_online_mask);
+ cpumask_clear_cpu(smp_processor_id(), &cpus_chosen);
+--
+2.39.5
+
--- /dev/null
+From 6107647e41c5ad495554b2f6a3987b462fb041ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 20:53:12 -0700
+Subject: cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
+
+From: Mike Tipton <quic_mdtipton@quicinc.com>
+
+[ Upstream commit 6c9bb86922728c7a4cceb99f131e00dd87514f20 ]
+
+Currently, all SCMI devices with performance domains attempt to register
+a cpufreq driver, even if their performance domains aren't used to
+control the CPUs. The cpufreq framework only supports registering a
+single driver, so only the first device will succeed. And if that device
+isn't used for the CPUs, then cpufreq will scale the wrong domains.
+
+To avoid this, return early from scmi_cpufreq_probe() if the probing
+SCMI device isn't referenced by the CPU device phandles.
+
+This keeps the existing assumption that all CPUs are controlled by a
+single SCMI device.
+
+Signed-off-by: Mike Tipton <quic_mdtipton@quicinc.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 36 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 7e7c1613a67c6..beb660ca240cc 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -367,6 +367,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = {
+ .register_em = scmi_cpufreq_register_em,
+ };
+
++static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
++{
++ struct device_node *scmi_np = dev_of_node(scmi_dev);
++ struct device_node *cpu_np, *np;
++ struct device *cpu_dev;
++ int cpu, idx;
++
++ if (!scmi_np)
++ return false;
++
++ for_each_possible_cpu(cpu) {
++ cpu_dev = get_cpu_device(cpu);
++ if (!cpu_dev)
++ continue;
++
++ cpu_np = dev_of_node(cpu_dev);
++
++ np = of_parse_phandle(cpu_np, "clocks", 0);
++ of_node_put(np);
++
++ if (np == scmi_np)
++ return true;
++
++ idx = of_property_match_string(cpu_np, "power-domain-names", "perf");
++ np = of_parse_phandle(cpu_np, "power-domains", idx);
++ of_node_put(np);
++
++ if (np == scmi_np)
++ return true;
++ }
++
++ return false;
++}
++
+ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+ {
+ int ret;
+@@ -375,7 +409,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+
+ handle = sdev->handle;
+
+- if (!handle)
++ if (!handle || !scmi_dev_used_by_cpus(dev))
+ return -ENODEV;
+
+ perf_ops = handle->devm_protocol_get(sdev, SCMI_PROTOCOL_PERF, &ph);
+--
+2.39.5
+
--- /dev/null
+From 780e07e0db5a0c79386af19a92c1b896f9abc9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 May 2025 07:17:19 -0700
+Subject: emulex/benet: correct command version selection in be_cmd_get_stats()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ]
+
+Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip,
+even if it is BE2. Use 'else if' to prevent multiple assignments, setting
+version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others.
+Fixes potential incorrect version setting when BE2_chip and
+BE3_chip/lancer_chip checks could both be true.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250519141731.691136-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index 51b8377edd1d0..a89aa4ac0a064 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -1609,7 +1609,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
+ /* version 1 of the cmd is not supported only by BE2 */
+ if (BE2_chip(adapter))
+ hdr->version = 0;
+- if (BE3_chip(adapter) || lancer_chip(adapter))
++ else if (BE3_chip(adapter) || lancer_chip(adapter))
+ hdr->version = 1;
+ else
+ hdr->version = 2;
+--
+2.39.5
+
--- /dev/null
+From 3a62d28892b77d4aaaa4e8b004c3c11b6af7b6fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 19:56:38 +0800
+Subject: f2fs: fix to bail out in get_new_segment()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2 ]
+
+------------[ cut here ]------------
+WARNING: CPU: 3 PID: 579 at fs/f2fs/segment.c:2832 new_curseg+0x5e8/0x6dc
+pc : new_curseg+0x5e8/0x6dc
+Call trace:
+ new_curseg+0x5e8/0x6dc
+ f2fs_allocate_data_block+0xa54/0xe28
+ do_write_page+0x6c/0x194
+ f2fs_do_write_node_page+0x38/0x78
+ __write_node_page+0x248/0x6d4
+ f2fs_sync_node_pages+0x524/0x72c
+ f2fs_write_checkpoint+0x4bc/0x9b0
+ __checkpoint_and_complete_reqs+0x80/0x244
+ issue_checkpoint_thread+0x8c/0xec
+ kthread+0x114/0x1bc
+ ret_from_fork+0x10/0x20
+
+get_new_segment() detects inconsistent status in between free_segmap
+and free_secmap, let's record such error into super block, and bail
+out get_new_segment() instead of continue using the segment.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 6 +++++-
+ include/linux/f2fs_fs.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index b9ffb2ee9548a..769a90b609e2c 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -2772,7 +2772,11 @@ static int get_new_segment(struct f2fs_sb_info *sbi,
+ }
+ got_it:
+ /* set it as dirty segment in free segmap */
+- f2fs_bug_on(sbi, test_bit(segno, free_i->free_segmap));
++ if (test_bit(segno, free_i->free_segmap)) {
++ ret = -EFSCORRUPTED;
++ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_CORRUPTED_FREE_BITMAP);
++ goto out_unlock;
++ }
+
+ /* no free section in conventional zone */
+ if (new_sec && pinning &&
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index c24f8bc01045d..5206d63b33860 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -78,6 +78,7 @@ enum stop_cp_reason {
+ STOP_CP_REASON_UPDATE_INODE,
+ STOP_CP_REASON_FLUSH_FAIL,
+ STOP_CP_REASON_NO_SEGMENT,
++ STOP_CP_REASON_CORRUPTED_FREE_BITMAP,
+ STOP_CP_REASON_MAX,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 6f32a1d180cd45a559ca54f77122afa9bb34e205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 13:56:06 +0800
+Subject: f2fs: fix to set atomic write status more clear
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit db03c20c0850dc8d2bcabfa54b9438f7d666c863 ]
+
+1. After we start atomic write in a database file, before committing
+all data, we'd better not set inode w/ vfs dirty status to avoid
+redundant updates, instead, we only set inode w/ atomic dirty status.
+
+2. After we commit all data, before committing metadata, we need to
+clear atomic dirty status, and set vfs dirty status to allow vfs flush
+dirty inode.
+
+Cc: Daeho Jeong <daehojeong@google.com>
+Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/inode.c | 4 +++-
+ fs/f2fs/segment.c | 6 ++++++
+ fs/f2fs/super.c | 4 +++-
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 50e64b7b016dc..06688b9957c81 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -34,7 +34,9 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync)
+ if (f2fs_inode_dirtied(inode, sync))
+ return;
+
+- if (f2fs_is_atomic_file(inode))
++ /* only atomic file w/ FI_ATOMIC_COMMITTED can be set vfs dirty */
++ if (f2fs_is_atomic_file(inode) &&
++ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED))
+ return;
+
+ mark_inode_dirty_sync(inode);
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 769a90b609e2c..449c0acbfabc0 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -370,7 +370,13 @@ static int __f2fs_commit_atomic_write(struct inode *inode)
+ } else {
+ sbi->committed_atomic_block += fi->atomic_write_cnt;
+ set_inode_flag(inode, FI_ATOMIC_COMMITTED);
++
++ /*
++ * inode may has no FI_ATOMIC_DIRTIED flag due to no write
++ * before commit.
++ */
+ if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
++ /* clear atomic dirty status and set vfs dirty status */
+ clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
+ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index b1ab7ee2adf9c..330f89ddb5c8f 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1516,7 +1516,9 @@ int f2fs_inode_dirtied(struct inode *inode, bool sync)
+ }
+ spin_unlock(&sbi->inode_lock[DIRTY_META]);
+
+- if (!ret && f2fs_is_atomic_file(inode))
++ /* if atomic write is not committed, set inode w/ atomic dirty */
++ if (!ret && f2fs_is_atomic_file(inode) &&
++ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED))
+ set_inode_flag(inode, FI_ATOMIC_DIRTIED);
+
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 2edbdecc5ba9d2fbce41e61f2fc75522fc1422b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 13:57:20 +0800
+Subject: f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 70dd07c888451503c3e93b6821e10d1ea1ec9930 ]
+
+.init_{,de}compress_ctx uses kvmalloc() to alloc memory, it will try
+to allocate physically continuous page first, it may cause more memory
+allocation pressure, let's use vmalloc instead to mitigate it.
+
+[Test]
+cd /data/local/tmp
+touch file
+f2fs_io setflags compression file
+f2fs_io getflags file
+for i in $(seq 1 10); do sync; echo 3 > /proc/sys/vm/drop_caches;\
+time f2fs_io write 512 0 4096 zero osync file; truncate -s 0 file;\
+done
+
+[Result]
+Before After Delta
+21.243 21.694 -2.12%
+
+For compression, we recommend to use ioctl to compress file data in
+background for workaround.
+
+For decompression, only zstd will be affected.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 23 ++++++++++-------------
+ fs/f2fs/f2fs.h | 5 +++++
+ 2 files changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 7f26440e8595a..b05bb7bfa14c5 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -178,8 +178,7 @@ void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct folio *folio)
+ #ifdef CONFIG_F2FS_FS_LZO
+ static int lzo_init_compress_ctx(struct compress_ctx *cc)
+ {
+- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode),
+- LZO1X_MEM_COMPRESS, GFP_NOFS);
++ cc->private = f2fs_vmalloc(LZO1X_MEM_COMPRESS);
+ if (!cc->private)
+ return -ENOMEM;
+
+@@ -189,7 +188,7 @@ static int lzo_init_compress_ctx(struct compress_ctx *cc)
+
+ static void lzo_destroy_compress_ctx(struct compress_ctx *cc)
+ {
+- kvfree(cc->private);
++ vfree(cc->private);
+ cc->private = NULL;
+ }
+
+@@ -246,7 +245,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc)
+ size = LZ4HC_MEM_COMPRESS;
+ #endif
+
+- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode), size, GFP_NOFS);
++ cc->private = f2fs_vmalloc(size);
+ if (!cc->private)
+ return -ENOMEM;
+
+@@ -261,7 +260,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc)
+
+ static void lz4_destroy_compress_ctx(struct compress_ctx *cc)
+ {
+- kvfree(cc->private);
++ vfree(cc->private);
+ cc->private = NULL;
+ }
+
+@@ -342,8 +341,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc)
+ params = zstd_get_params(level, cc->rlen);
+ workspace_size = zstd_cstream_workspace_bound(¶ms.cParams);
+
+- workspace = f2fs_kvmalloc(F2FS_I_SB(cc->inode),
+- workspace_size, GFP_NOFS);
++ workspace = f2fs_vmalloc(workspace_size);
+ if (!workspace)
+ return -ENOMEM;
+
+@@ -351,7 +349,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc)
+ if (!stream) {
+ f2fs_err_ratelimited(F2FS_I_SB(cc->inode),
+ "%s zstd_init_cstream failed", __func__);
+- kvfree(workspace);
++ vfree(workspace);
+ return -EIO;
+ }
+
+@@ -364,7 +362,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc)
+
+ static void zstd_destroy_compress_ctx(struct compress_ctx *cc)
+ {
+- kvfree(cc->private);
++ vfree(cc->private);
+ cc->private = NULL;
+ cc->private2 = NULL;
+ }
+@@ -423,8 +421,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic)
+
+ workspace_size = zstd_dstream_workspace_bound(max_window_size);
+
+- workspace = f2fs_kvmalloc(F2FS_I_SB(dic->inode),
+- workspace_size, GFP_NOFS);
++ workspace = f2fs_vmalloc(workspace_size);
+ if (!workspace)
+ return -ENOMEM;
+
+@@ -432,7 +429,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic)
+ if (!stream) {
+ f2fs_err_ratelimited(F2FS_I_SB(dic->inode),
+ "%s zstd_init_dstream failed", __func__);
+- kvfree(workspace);
++ vfree(workspace);
+ return -EIO;
+ }
+
+@@ -444,7 +441,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic)
+
+ static void zstd_destroy_decompress_ctx(struct decompress_io_ctx *dic)
+ {
+- kvfree(dic->private);
++ vfree(dic->private);
+ dic->private = NULL;
+ dic->private2 = NULL;
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 1219e37fa7ad3..61b715cc2e231 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3494,6 +3494,11 @@ static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi,
+ return f2fs_kvmalloc(sbi, size, flags | __GFP_ZERO);
+ }
+
++static inline void *f2fs_vmalloc(size_t size)
++{
++ return vmalloc(size);
++}
++
+ static inline int get_extra_isize(struct inode *inode)
+ {
+ return F2FS_I(inode)->i_extra_isize / sizeof(__le32);
+--
+2.39.5
+
--- /dev/null
+From 9c9f99e58e99e2b655ac0a6896f39fdba659e9a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 13:06:47 -0700
+Subject: fbcon: Make sure modelist not set on unregistered console
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit cedc1b63394a866bf8663a3e40f4546f1d28c8d8 ]
+
+It looks like attempting to write to the "store_modes" sysfs node will
+run afoul of unregistered consoles:
+
+UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28
+index -1 is out of range for type 'fb_info *[32]'
+...
+ fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122
+ fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048
+ fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673
+ store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113
+ dev_attr_store+0x55/0x80 drivers/base/core.c:2439
+
+static struct fb_info *fbcon_registered_fb[FB_MAX];
+...
+static signed char con2fb_map[MAX_NR_CONSOLES];
+...
+static struct fb_info *fbcon_info_from_console(int console)
+...
+ return fbcon_registered_fb[con2fb_map[console]];
+
+If con2fb_map contains a -1 things go wrong here. Instead, return NULL,
+as callers of fbcon_info_from_console() are trying to compare against
+existing "info" pointers, so error handling should kick in correctly.
+
+Reported-by: syzbot+a7d4444e7b6e743572f7@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 07d127110ca4c..c98786996c647 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -117,9 +117,14 @@ static signed char con2fb_map_boot[MAX_NR_CONSOLES];
+
+ static struct fb_info *fbcon_info_from_console(int console)
+ {
++ signed char fb;
+ WARN_CONSOLE_UNLOCKED();
+
+- return fbcon_registered_fb[con2fb_map[console]];
++ fb = con2fb_map[console];
++ if (fb < 0 || fb >= ARRAY_SIZE(fbcon_registered_fb))
++ return NULL;
++
++ return fbcon_registered_fb[fb];
+ }
+
+ static int logo_lines;
+--
+2.39.5
+
--- /dev/null
+From 6cdaa9af5799ac4e4a5d58ed5a6419d6cbbf582f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 12:51:16 -0400
+Subject: fs/xattr.c: fix simple_xattr_list()
+
+From: Stephen Smalley <stephen.smalley.work@gmail.com>
+
+[ Upstream commit 800d0b9b6a8b1b354637b4194cc167ad1ce2bdd3 ]
+
+commit 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always
+include security.* xattrs") failed to reset err after the call to
+security_inode_listsecurity(), which returns the length of the
+returned xattr name. This results in simple_xattr_list() incorrectly
+returning this length even if a POSIX acl is also set on the inode.
+
+Reported-by: Collin Funk <collin.funk1@gmail.com>
+Closes: https://lore.kernel.org/selinux/8734ceal7q.fsf@gmail.com/
+Reported-by: Paul Eggert <eggert@cs.ucla.edu>
+Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2369561
+Fixes: 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs")
+
+Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Link: https://lore.kernel.org/20250605165116.2063-1-stephen.smalley.work@gmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xattr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 4f5a45338a83a..0191ac2590e09 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -1341,6 +1341,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
+ buffer += err;
+ }
+ remaining_size -= err;
++ err = 0;
+
+ read_lock(&xattrs->lock);
+ for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {
+--
+2.39.5
+
--- /dev/null
+From 372c5cd9bd353951cce76169b97ea6b35a4b7da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 08:49:44 +0800
+Subject: gpiolib: of: Add polarity quirk for s5m8767
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 4e310626eb4df52a31a142c1360fead0fcbd3793 ]
+
+This is prepare patch for switching s5m8767 regulator driver to
+use GPIO descriptor. DTS for exynos5250 spring incorrectly specifies
+"active low" polarity for the DVS and DS line. But per datasheet,
+they are actually active high. So add polarity quirk for it.
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250327004945.563765-1-peng.fan@oss.nxp.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-of.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 626daedb01698..36f8c7bb79d81 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -215,6 +215,15 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np,
+ */
+ { "lantiq,pci-xway", "gpio-reset", false },
+ #endif
++#if IS_ENABLED(CONFIG_REGULATOR_S5M8767)
++ /*
++ * According to S5M8767, the DVS and DS pin are
++ * active-high signals. However, exynos5250-spring.dts use
++ * active-low setting.
++ */
++ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-dvs-gpios", true },
++ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-ds-gpios", true },
++#endif
+ #if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005)
+ /*
+ * DTS for Nokia N900 incorrectly specified "active high"
+--
+2.39.5
+
--- /dev/null
+From f18a74db88133bf7c55d8ca4a581af0942e3fd92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 15:34:20 +1300
+Subject: hid-asus: check ROG Ally MCU version and warn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 00e005c952f74f50a3f86af96f56877be4685e14 ]
+
+ASUS have fixed suspend issues arising from a flag not being cleared in
+the MCU FW in both the ROG Ally 1 and the ROG Ally X.
+
+Implement a check and a warning to encourage users to update the FW to
+a minimum supported version.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250323023421.78012-2-luke@ljones.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-asus.c | 107 ++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 105 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index bcdd168cdc6d7..c5bdf0f1b32f7 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -52,6 +52,10 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");
+ #define FEATURE_KBD_LED_REPORT_ID1 0x5d
+ #define FEATURE_KBD_LED_REPORT_ID2 0x5e
+
++#define ROG_ALLY_REPORT_SIZE 64
++#define ROG_ALLY_X_MIN_MCU 313
++#define ROG_ALLY_MIN_MCU 319
++
+ #define SUPPORT_KBD_BACKLIGHT BIT(0)
+
+ #define MAX_TOUCH_MAJOR 8
+@@ -84,6 +88,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");
+ #define QUIRK_MEDION_E1239T BIT(10)
+ #define QUIRK_ROG_NKEY_KEYBOARD BIT(11)
+ #define QUIRK_ROG_CLAYMORE_II_KEYBOARD BIT(12)
++#define QUIRK_ROG_ALLY_XPAD BIT(13)
+
+ #define I2C_KEYBOARD_QUIRKS (QUIRK_FIX_NOTEBOOK_REPORT | \
+ QUIRK_NO_INIT_REPORTS | \
+@@ -534,9 +539,99 @@ static bool asus_kbd_wmi_led_control_present(struct hid_device *hdev)
+ return !!(value & ASUS_WMI_DSTS_PRESENCE_BIT);
+ }
+
++/*
++ * We don't care about any other part of the string except the version section.
++ * Example strings: FGA80100.RC72LA.312_T01, FGA80100.RC71LS.318_T01
++ * The bytes "5a 05 03 31 00 1a 13" and possibly more come before the version
++ * string, and there may be additional bytes after the version string such as
++ * "75 00 74 00 65 00" or a postfix such as "_T01"
++ */
++static int mcu_parse_version_string(const u8 *response, size_t response_size)
++{
++ const u8 *end = response + response_size;
++ const u8 *p = response;
++ int dots, err, version;
++ char buf[4];
++
++ dots = 0;
++ while (p < end && dots < 2) {
++ if (*p++ == '.')
++ dots++;
++ }
++
++ if (dots != 2 || p >= end || (p + 3) >= end)
++ return -EINVAL;
++
++ memcpy(buf, p, 3);
++ buf[3] = '\0';
++
++ err = kstrtoint(buf, 10, &version);
++ if (err || version < 0)
++ return -EINVAL;
++
++ return version;
++}
++
++static int mcu_request_version(struct hid_device *hdev)
++{
++ u8 *response __free(kfree) = kzalloc(ROG_ALLY_REPORT_SIZE, GFP_KERNEL);
++ const u8 request[] = { 0x5a, 0x05, 0x03, 0x31, 0x00, 0x20 };
++ int ret;
++
++ if (!response)
++ return -ENOMEM;
++
++ ret = asus_kbd_set_report(hdev, request, sizeof(request));
++ if (ret < 0)
++ return ret;
++
++ ret = hid_hw_raw_request(hdev, FEATURE_REPORT_ID, response,
++ ROG_ALLY_REPORT_SIZE, HID_FEATURE_REPORT,
++ HID_REQ_GET_REPORT);
++ if (ret < 0)
++ return ret;
++
++ ret = mcu_parse_version_string(response, ROG_ALLY_REPORT_SIZE);
++ if (ret < 0) {
++ pr_err("Failed to parse MCU version: %d\n", ret);
++ print_hex_dump(KERN_ERR, "MCU: ", DUMP_PREFIX_NONE,
++ 16, 1, response, ROG_ALLY_REPORT_SIZE, false);
++ }
++
++ return ret;
++}
++
++static void validate_mcu_fw_version(struct hid_device *hdev, int idProduct)
++{
++ int min_version, version;
++
++ version = mcu_request_version(hdev);
++ if (version < 0)
++ return;
++
++ switch (idProduct) {
++ case USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY:
++ min_version = ROG_ALLY_MIN_MCU;
++ break;
++ case USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X:
++ min_version = ROG_ALLY_X_MIN_MCU;
++ break;
++ default:
++ min_version = 0;
++ }
++
++ if (version < min_version) {
++ hid_warn(hdev,
++ "The MCU firmware version must be %d or greater to avoid issues with suspend.\n",
++ min_version);
++ }
++}
++
+ static int asus_kbd_register_leds(struct hid_device *hdev)
+ {
+ struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
++ struct usb_interface *intf;
++ struct usb_device *udev;
+ unsigned char kbd_func;
+ int ret;
+
+@@ -560,6 +655,14 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
+ if (ret < 0)
+ return ret;
+ }
++
++ if (drvdata->quirks & QUIRK_ROG_ALLY_XPAD) {
++ intf = to_usb_interface(hdev->dev.parent);
++ udev = interface_to_usbdev(intf);
++ validate_mcu_fw_version(hdev,
++ le16_to_cpu(udev->descriptor.idProduct));
++ }
++
+ } else {
+ /* Initialize keyboard */
+ ret = asus_kbd_init(hdev, FEATURE_KBD_REPORT_ID);
+@@ -1280,10 +1383,10 @@ static const struct hid_device_id asus_devices[] = {
+ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY),
+- QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD},
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
+- QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD),
+ QUIRK_ROG_CLAYMORE_II_KEYBOARD },
+--
+2.39.5
+
--- /dev/null
+From a29d0bcee9ddaa3aa29bf05d7d7cf4bfbb6f5199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 10:33:03 +0800
+Subject: i2c: designware: Invoke runtime suspend on quick slave
+ re-registration
+
+From: Tan En De <ende.tan@starfivetech.com>
+
+[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ]
+
+Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure
+the runtime suspend is invoked immediately when unregistering a slave.
+This prevents a race condition where suspend was skipped when
+unregistering and registering slave in quick succession.
+
+For example, consider the rapid sequence of
+`delete_device -> new_device -> delete_device -> new_device`.
+In this sequence, it is observed that the dw_i2c_plat_runtime_suspend()
+might not be invoked after `delete_device` operation.
+
+This is because after `delete_device` operation, when the
+pm_runtime_put() is about to trigger suspend, the following `new_device`
+operation might race and cancel the suspend.
+
+If that happens, during the `new_device` operation,
+dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which
+means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped.
+Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is
+skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect
+the interrupt mask register using devmem, it will show as zero.
+
+Example shell script to reproduce the issue:
+```
+ #!/bin/sh
+
+ SLAVE_LADDR=0x1010
+ SLAVE_BUS=13
+ NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device
+ DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device
+
+ # Create initial device
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+ sleep 2
+
+ # Rapid sequence of
+ # delete_device -> new_device -> delete_device -> new_device
+ echo $SLAVE_LADDR > $DELETE_DEVICE
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+ echo $SLAVE_LADDR > $DELETE_DEVICE
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+
+ # Using devmem to inspect IC_INTR_MASK will show as zero
+```
+
+Signed-off-by: Tan En De <ende.tan@starfivetech.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-slave.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
+index f0f0f1f2131d0..602e98e61cc01 100644
+--- a/drivers/i2c/busses/i2c-designware-slave.c
++++ b/drivers/i2c/busses/i2c-designware-slave.c
+@@ -94,7 +94,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
+ i2c_dw_disable(dev);
+ synchronize_irq(dev->irq);
+ dev->slave = NULL;
+- pm_runtime_put(dev->dev);
++ pm_runtime_put_sync_suspend(dev->dev);
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From d805642091fed403fa94b4f06facd702757f5e60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 19:32:50 +0000
+Subject: i2c: npcm: Add clock toggle recovery
+
+From: Tali Perry <tali.perry1@gmail.com>
+
+[ Upstream commit 38010591a0fc3203f1cee45b01ab358b72dd9ab2 ]
+
+During init of the bus, the module checks that the bus is idle.
+If one of the lines are stuck try to recover them first before failing.
+Sometimes SDA and SCL are low if improper reset occurs (e.g., reboot).
+
+Signed-off-by: Tali Perry <tali.perry1@gmail.com>
+Signed-off-by: Mohammed Elbadry <mohammed.0.elbadry@gmail.com>
+Reviewed-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Link: https://lore.kernel.org/r/20250328193252.1570811-1-mohammed.0.elbadry@gmail.com
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c
+index a693ebb64edf4..7b6eb2bfb412e 100644
+--- a/drivers/i2c/busses/i2c-npcm7xx.c
++++ b/drivers/i2c/busses/i2c-npcm7xx.c
+@@ -1969,10 +1969,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode,
+
+ /* Check HW is OK: SDA and SCL should be high at this point. */
+ if ((npcm_i2c_get_SDA(&bus->adap) == 0) || (npcm_i2c_get_SCL(&bus->adap) == 0)) {
+- dev_err(bus->dev, "I2C%d init fail: lines are low\n", bus->num);
+- dev_err(bus->dev, "SDA=%d SCL=%d\n", npcm_i2c_get_SDA(&bus->adap),
+- npcm_i2c_get_SCL(&bus->adap));
+- return -ENXIO;
++ dev_warn(bus->dev, " I2C%d SDA=%d SCL=%d, attempting to recover\n", bus->num,
++ npcm_i2c_get_SDA(&bus->adap), npcm_i2c_get_SCL(&bus->adap));
++ if (npcm_i2c_recovery_tgclk(&bus->adap)) {
++ dev_err(bus->dev, "I2C%d init fail: SDA=%d SCL=%d\n",
++ bus->num, npcm_i2c_get_SDA(&bus->adap),
++ npcm_i2c_get_SCL(&bus->adap));
++ return -ENXIO;
++ }
+ }
+
+ npcm_i2c_int_enable(bus, true);
+--
+2.39.5
+
--- /dev/null
+From 91439fbfa287090697f9c54a1cf60b519634c5ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 11:03:20 +0530
+Subject: i2c: tegra: check msg length in SMBUS block read
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit a6e04f05ce0b070ab39d5775580e65c7d943da0b ]
+
+For SMBUS block read, do not continue to read if the message length
+passed from the device is '0' or greater than the maximum allowed bytes.
+
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250424053320.19211-1-akhilrajeev@nvidia.com
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-tegra.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 1df5b42041427..89ce8a62b37c6 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -1395,6 +1395,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE);
+ if (ret)
+ break;
++
++ /* Validate message length before proceeding */
++ if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX)
++ break;
++
+ /* Set the msg length from first byte */
+ msgs[i].len += msgs[i].buf[0];
+ dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len);
+--
+2.39.5
+
--- /dev/null
+From 01844ffee6b50a2e276de22bad16d4cc57c6e8de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 14:16:02 +0900
+Subject: i40e: fix MMIO write access to an invalid page in i40e_clear_hw
+
+From: Kyungwook Boo <bookyungwook@gmail.com>
+
+[ Upstream commit 015bac5daca978448f2671478c553ce1f300c21e ]
+
+When the device sends a specific input, an integer underflow can occur, leading
+to MMIO write access to an invalid page.
+
+Prevent the integer underflow by changing the type of related variables.
+
+Signed-off-by: Kyungwook Boo <bookyungwook@gmail.com>
+Link: https://lore.kernel.org/lkml/ffc91764-1142-4ba2-91b6-8c773f6f7095@gmail.com/T/
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index e8031f1a9b4fc..2f5a850148676 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -817,10 +817,11 @@ int i40e_pf_reset(struct i40e_hw *hw)
+ void i40e_clear_hw(struct i40e_hw *hw)
+ {
+ u32 num_queues, base_queue;
+- u32 num_pf_int;
+- u32 num_vf_int;
++ s32 num_pf_int;
++ s32 num_vf_int;
+ u32 num_vfs;
+- u32 i, j;
++ s32 i;
++ u32 j;
+ u32 val;
+ u32 eol = 0x7ff;
+
+--
+2.39.5
+
--- /dev/null
+From c4fc8283020908edb7f976689b2cb8a7407f0d1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 09:50:35 +0100
+Subject: ice: fix check for existing switch rule
+
+From: Mateusz Pacuszka <mateuszx.pacuszka@intel.com>
+
+[ Upstream commit a808691df39b52cd9db861b118e88e18b63e2299 ]
+
+In case the rule already exists and another VSI wants to subscribe to it
+new VSI list is being created and both VSIs are moved to it.
+Currently, the check for already existing VSI with the same rule is done
+based on fdw_id.hw_vsi_id, which applies only to LOOKUP_RX flag.
+Change it to vsi_handle. This is software VSI ID, but it can be applied
+here, because vsi_map itself is also based on it.
+
+Additionally change return status in case the VSI already exists in the
+VSI map to "Already exists". Such case should be handled by the caller.
+
+Signed-off-by: Mateusz Pacuszka <mateuszx.pacuszka@intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 0e740342e2947..c5430363e7081 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -3146,7 +3146,7 @@ ice_add_update_vsi_list(struct ice_hw *hw,
+ u16 vsi_handle_arr[2];
+
+ /* A rule already exists with the new VSI being added */
+- if (cur_fltr->fwd_id.hw_vsi_id == new_fltr->fwd_id.hw_vsi_id)
++ if (cur_fltr->vsi_handle == new_fltr->vsi_handle)
+ return -EEXIST;
+
+ vsi_handle_arr[0] = cur_fltr->vsi_handle;
+@@ -5977,7 +5977,7 @@ ice_adv_add_update_vsi_list(struct ice_hw *hw,
+
+ /* A rule already exists with the new VSI being added */
+ if (test_bit(vsi_handle, m_entry->vsi_list_info->vsi_map))
+- return 0;
++ return -EEXIST;
+
+ /* Update the previously created VSI list set with
+ * the new VSI ID passed in
+--
+2.39.5
+
--- /dev/null
+From e1fa6e46de8139d54449ea067136f858d61ca7d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 12:30:32 -0500
+Subject: iommu/amd: Allow matching ACPI HID devices without matching UIDs
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 51c33f333bbf7bdb6aa2a327e3a3e4bbb2591511 ]
+
+A BIOS upgrade has changed the IVRS DTE UID for a device that no
+longer matches the UID in the SSDT. In this case there is only
+one ACPI device on the system with that _HID but the _UID mismatch.
+
+IVRS:
+```
+ Subtable Type : F0 [Device Entry: ACPI HID Named Device]
+ Device ID : 0060
+Data Setting (decoded below) : 40
+ INITPass : 0
+ EIntPass : 0
+ NMIPass : 0
+ Reserved : 0
+ System MGMT : 0
+ LINT0 Pass : 1
+ LINT1 Pass : 0
+ ACPI HID : "MSFT0201"
+ ACPI CID : 0000000000000000
+ UID Format : 02
+ UID Length : 09
+ UID : "\_SB.MHSP"
+```
+
+SSDT:
+```
+Device (MHSP)
+{
+ Name (_ADR, Zero) // _ADR: Address
+ Name (_HID, "MSFT0201") // _HID: Hardware ID
+ Name (_UID, One) // _UID: Unique ID
+```
+
+To handle this case; while enumerating ACPI devices in
+get_acpihid_device_id() count the number of matching ACPI devices with
+a matching _HID. If there is exactly one _HID match then accept it even
+if the UID doesn't match. Other operating systems allow this, but the
+current IVRS spec leaves some ambiguity whether to allow or disallow it.
+This should be clarified in future revisions of the spec. Output
+'Firmware Bug' for this case to encourage it to be solved in the BIOS.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/20250512173129.1274275-1-superm1@kernel.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index f61e48f237324..4428a9557f295 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -107,7 +107,9 @@ static inline int get_acpihid_device_id(struct device *dev,
+ struct acpihid_map_entry **entry)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(dev);
+- struct acpihid_map_entry *p;
++ struct acpihid_map_entry *p, *p1 = NULL;
++ int hid_count = 0;
++ bool fw_bug;
+
+ if (!adev)
+ return -ENODEV;
+@@ -115,12 +117,33 @@ static inline int get_acpihid_device_id(struct device *dev,
+ list_for_each_entry(p, &acpihid_map, list) {
+ if (acpi_dev_hid_uid_match(adev, p->hid,
+ p->uid[0] ? p->uid : NULL)) {
+- if (entry)
+- *entry = p;
+- return p->devid;
++ p1 = p;
++ fw_bug = false;
++ hid_count = 1;
++ break;
++ }
++
++ /*
++ * Count HID matches w/o UID, raise FW_BUG but allow exactly one match
++ */
++ if (acpi_dev_hid_match(adev, p->hid)) {
++ p1 = p;
++ hid_count++;
++ fw_bug = true;
+ }
+ }
+- return -EINVAL;
++
++ if (!p1)
++ return -EINVAL;
++ if (fw_bug)
++ dev_err_once(dev, FW_BUG "No ACPI device matched UID, but %d device%s matched HID.\n",
++ hid_count, hid_count > 1 ? "s" : "");
++ if (hid_count > 1)
++ return -EINVAL;
++ if (entry)
++ *entry = p1;
++
++ return p1->devid;
+ }
+
+ static inline int get_device_sbdf_id(struct device *dev)
+--
+2.39.5
+
--- /dev/null
+From 5c57eec2d5d5b9652d7af2ae8a88cf37144d1295 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 20:10:48 -0700
+Subject: iommu/amd: Ensure GA log notifier callbacks finish running before
+ module unload
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 94c721ea03c7078163f41dbaa101ac721ddac329 ]
+
+Synchronize RCU when unregistering KVM's GA log notifier to ensure all
+in-flight interrupt handlers complete before KVM-the module is unloaded.
+
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Link: https://lore.kernel.org/r/20250315031048.2374109-1-seanjc@google.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 4428a9557f295..23e78a034da8f 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -861,6 +861,14 @@ int amd_iommu_register_ga_log_notifier(int (*notifier)(u32))
+ {
+ iommu_ga_log_notifier = notifier;
+
++ /*
++ * Ensure all in-flight IRQ handlers run to completion before returning
++ * to the caller, e.g. to ensure module code isn't unloaded while it's
++ * being executed in the IRQ handler.
++ */
++ if (!notifier)
++ synchronize_rcu();
++
+ return 0;
+ }
+ EXPORT_SYMBOL(amd_iommu_register_ga_log_notifier);
+--
+2.39.5
+
--- /dev/null
+From e0306a299613538fb9381ee64c818dbd06df4b1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 11:27:24 +0200
+Subject: ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ]
+
+The statistics are incremented with raw_cpu_inc() assuming it always
+happens with bottom half disabled. Without per-CPU locking in
+local_bh_disable() on PREEMPT_RT this is no longer true.
+
+Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about
+preemption.
+
+Cc: David Ahern <dsahern@kernel.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://patch.msgid.link/20250512092736.229935-4-bigeasy@linutronix.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 41b320f0c20eb..88d7c96bfac06 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -189,7 +189,11 @@ const __u8 ip_tos2prio[16] = {
+ EXPORT_SYMBOL(ip_tos2prio);
+
+ static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
++#ifndef CONFIG_PREEMPT_RT
+ #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
++#else
++#define RT_CACHE_STAT_INC(field) this_cpu_inc(rt_cache_stat.field)
++#endif
+
+ #ifdef CONFIG_PROC_FS
+ static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
+--
+2.39.5
+
--- /dev/null
+From 55884d90b1aea1950a39f96fc4f360362400f6f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 16:50:21 +0200
+Subject: isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
+
+From: Jonas 'Sortie' Termansen <sortie@maxsi.org>
+
+[ Upstream commit 5ea45f54c8d6ca2a95b7bd450ee9eb253310bfd3 ]
+
+This change implements the Rock Ridge TF entry LONG_FORM bit, which uses
+the ISO 9660 17-byte date format (up to year 9999, with 10ms precision)
+instead of the 7-byte date format (up to year 2155, with 1s precision).
+
+Previously the LONG_FORM bit was ignored; and isofs would entirely
+misinterpret the date as the wrong format, resulting in garbage
+timestamps on the filesystem.
+
+The Y2038 issue in iso_date() is fixed by returning a struct timespec64
+instead of an int.
+
+parse_rock_ridge_inode_internal() is fixed so it does proper bounds
+checks of the TF entry timestamps.
+
+Signed-off-by: Jonas 'Sortie' Termansen <sortie@maxsi.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20250411145022.2292255-1-sortie@maxsi.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/isofs/inode.c | 7 +++++--
+ fs/isofs/isofs.h | 4 +++-
+ fs/isofs/rock.c | 40 ++++++++++++++++++++++-----------------
+ fs/isofs/rock.h | 6 +-----
+ fs/isofs/util.c | 49 +++++++++++++++++++++++++++++++-----------------
+ 5 files changed, 64 insertions(+), 42 deletions(-)
+
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 47038e6608123..d5da9817df9b3 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -1275,6 +1275,7 @@ static int isofs_read_inode(struct inode *inode, int relocated)
+ unsigned long offset;
+ struct iso_inode_info *ei = ISOFS_I(inode);
+ int ret = -EIO;
++ struct timespec64 ts;
+
+ block = ei->i_iget5_block;
+ bh = sb_bread(inode->i_sb, block);
+@@ -1387,8 +1388,10 @@ static int isofs_read_inode(struct inode *inode, int relocated)
+ inode->i_ino, de->flags[-high_sierra]);
+ }
+ #endif
+- inode_set_mtime_to_ts(inode,
+- inode_set_atime_to_ts(inode, inode_set_ctime(inode, iso_date(de->date, high_sierra), 0)));
++ ts = iso_date(de->date, high_sierra ? ISO_DATE_HIGH_SIERRA : 0);
++ inode_set_ctime_to_ts(inode, ts);
++ inode_set_atime_to_ts(inode, ts);
++ inode_set_mtime_to_ts(inode, ts);
+
+ ei->i_first_extent = (isonum_733(de->extent) +
+ isonum_711(de->ext_attr_length));
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 2d55207c9a990..5065558375333 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -106,7 +106,9 @@ static inline unsigned int isonum_733(u8 *p)
+ /* Ignore bigendian datum due to broken mastering programs */
+ return get_unaligned_le32(p);
+ }
+-extern int iso_date(u8 *, int);
++#define ISO_DATE_HIGH_SIERRA (1 << 0)
++#define ISO_DATE_LONG_FORM (1 << 1)
++struct timespec64 iso_date(u8 *p, int flags);
+
+ struct inode; /* To make gcc happy */
+
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index dbf911126e610..576498245b9d7 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -412,7 +412,12 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+ }
+ }
+ break;
+- case SIG('T', 'F'):
++ case SIG('T', 'F'): {
++ int flags, size, slen;
++
++ flags = rr->u.TF.flags & TF_LONG_FORM ? ISO_DATE_LONG_FORM : 0;
++ size = rr->u.TF.flags & TF_LONG_FORM ? 17 : 7;
++ slen = rr->len - 5;
+ /*
+ * Some RRIP writers incorrectly place ctime in the
+ * TF_CREATE field. Try to handle this correctly for
+@@ -420,27 +425,28 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+ */
+ /* Rock ridge never appears on a High Sierra disk */
+ cnt = 0;
+- if (rr->u.TF.flags & TF_CREATE) {
+- inode_set_ctime(inode,
+- iso_date(rr->u.TF.times[cnt++].time, 0),
+- 0);
++ if ((rr->u.TF.flags & TF_CREATE) && size <= slen) {
++ inode_set_ctime_to_ts(inode,
++ iso_date(rr->u.TF.data + size * cnt++, flags));
++ slen -= size;
+ }
+- if (rr->u.TF.flags & TF_MODIFY) {
+- inode_set_mtime(inode,
+- iso_date(rr->u.TF.times[cnt++].time, 0),
+- 0);
++ if ((rr->u.TF.flags & TF_MODIFY) && size <= slen) {
++ inode_set_mtime_to_ts(inode,
++ iso_date(rr->u.TF.data + size * cnt++, flags));
++ slen -= size;
+ }
+- if (rr->u.TF.flags & TF_ACCESS) {
+- inode_set_atime(inode,
+- iso_date(rr->u.TF.times[cnt++].time, 0),
+- 0);
++ if ((rr->u.TF.flags & TF_ACCESS) && size <= slen) {
++ inode_set_atime_to_ts(inode,
++ iso_date(rr->u.TF.data + size * cnt++, flags));
++ slen -= size;
+ }
+- if (rr->u.TF.flags & TF_ATTRIBUTES) {
+- inode_set_ctime(inode,
+- iso_date(rr->u.TF.times[cnt++].time, 0),
+- 0);
++ if ((rr->u.TF.flags & TF_ATTRIBUTES) && size <= slen) {
++ inode_set_ctime_to_ts(inode,
++ iso_date(rr->u.TF.data + size * cnt++, flags));
++ slen -= size;
+ }
+ break;
++ }
+ case SIG('S', 'L'):
+ {
+ int slen;
+diff --git a/fs/isofs/rock.h b/fs/isofs/rock.h
+index 7755e587f7785..c0856fa9bb6a4 100644
+--- a/fs/isofs/rock.h
++++ b/fs/isofs/rock.h
+@@ -65,13 +65,9 @@ struct RR_PL_s {
+ __u8 location[8];
+ };
+
+-struct stamp {
+- __u8 time[7]; /* actually 6 unsigned, 1 signed */
+-} __attribute__ ((packed));
+-
+ struct RR_TF_s {
+ __u8 flags;
+- struct stamp times[]; /* Variable number of these beasts */
++ __u8 data[];
+ } __attribute__ ((packed));
+
+ /* Linux-specific extension for transparent decompression */
+diff --git a/fs/isofs/util.c b/fs/isofs/util.c
+index e88dba7216618..42f479da0b282 100644
+--- a/fs/isofs/util.c
++++ b/fs/isofs/util.c
+@@ -16,29 +16,44 @@
+ * to GMT. Thus we should always be correct.
+ */
+
+-int iso_date(u8 *p, int flag)
++struct timespec64 iso_date(u8 *p, int flags)
+ {
+ int year, month, day, hour, minute, second, tz;
+- int crtime;
++ struct timespec64 ts;
++
++ if (flags & ISO_DATE_LONG_FORM) {
++ year = (p[0] - '0') * 1000 +
++ (p[1] - '0') * 100 +
++ (p[2] - '0') * 10 +
++ (p[3] - '0') - 1900;
++ month = ((p[4] - '0') * 10 + (p[5] - '0'));
++ day = ((p[6] - '0') * 10 + (p[7] - '0'));
++ hour = ((p[8] - '0') * 10 + (p[9] - '0'));
++ minute = ((p[10] - '0') * 10 + (p[11] - '0'));
++ second = ((p[12] - '0') * 10 + (p[13] - '0'));
++ ts.tv_nsec = ((p[14] - '0') * 10 + (p[15] - '0')) * 10000000;
++ tz = p[16];
++ } else {
++ year = p[0];
++ month = p[1];
++ day = p[2];
++ hour = p[3];
++ minute = p[4];
++ second = p[5];
++ ts.tv_nsec = 0;
++ /* High sierra has no time zone */
++ tz = flags & ISO_DATE_HIGH_SIERRA ? 0 : p[6];
++ }
+
+- year = p[0];
+- month = p[1];
+- day = p[2];
+- hour = p[3];
+- minute = p[4];
+- second = p[5];
+- if (flag == 0) tz = p[6]; /* High sierra has no time zone */
+- else tz = 0;
+-
+ if (year < 0) {
+- crtime = 0;
++ ts.tv_sec = 0;
+ } else {
+- crtime = mktime64(year+1900, month, day, hour, minute, second);
++ ts.tv_sec = mktime64(year+1900, month, day, hour, minute, second);
+
+ /* sign extend */
+ if (tz & 0x80)
+ tz |= (-1 << 8);
+-
++
+ /*
+ * The timezone offset is unreliable on some disks,
+ * so we make a sanity check. In no case is it ever
+@@ -65,7 +80,7 @@ int iso_date(u8 *p, int flag)
+ * for pointing out the sign error.
+ */
+ if (-52 <= tz && tz <= 52)
+- crtime -= tz * 15 * 60;
++ ts.tv_sec -= tz * 15 * 60;
+ }
+- return crtime;
+-}
++ return ts;
++}
+--
+2.39.5
+
--- /dev/null
+From a7b932b596a957a9de2a5df45d4cddcd97e9b262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 13:12:00 +0300
+Subject: ixgbe: Fix unreachable retry logic in combined and byte I2C write
+ functions
+
+From: Rand Deeb <rand.sec96@gmail.com>
+
+[ Upstream commit cdcb3804eeda24d588348bbab6766cf14fddbeaa ]
+
+The current implementation of `ixgbe_write_i2c_combined_generic_int` and
+`ixgbe_write_i2c_byte_generic_int` sets `max_retry` to `1`, which makes
+the condition `retry < max_retry` always evaluate to `false`. This renders
+the retry mechanism ineffective, as the debug message and retry logic are
+never executed.
+
+This patch increases `max_retry` to `3` in both functions, aligning them
+with the retry logic in `ixgbe_read_i2c_combined_generic_int`. This
+ensures that the retry mechanism functions as intended, improving
+robustness in case of I2C write failures.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+index 07eaa3c3f4d36..530e4319a2e89 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+@@ -167,7 +167,7 @@ int ixgbe_write_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr,
+ u16 reg, u16 val, bool lock)
+ {
+ u32 swfw_mask = hw->phy.phy_semaphore_mask;
+- int max_retry = 1;
++ int max_retry = 3;
+ int retry = 0;
+ u8 reg_high;
+ u8 csum;
+@@ -2284,7 +2284,7 @@ static int ixgbe_write_i2c_byte_generic_int(struct ixgbe_hw *hw, u8 byte_offset,
+ u8 dev_addr, u8 data, bool lock)
+ {
+ u32 swfw_mask = hw->phy.phy_semaphore_mask;
+- u32 max_retry = 1;
++ u32 max_retry = 3;
+ u32 retry = 0;
+ int status;
+
+--
+2.39.5
+
--- /dev/null
+From 1a01a14a5442d03cb042153ddf1699bbf5d46bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 17:10:42 +0100
+Subject: libbpf: Add identical pointer detection to btf_dedup_is_equiv()
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 8e64c387c942229c551d0f23de4d9993d3a2acb6 ]
+
+Recently as a side-effect of
+
+commit ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro")
+
+issues were observed in deduplication between modules and kernel BTF
+such that a large number of kernel types were not deduplicated so
+were found in module BTF (task_struct, bpf_prog etc). The root cause
+appeared to be a failure to dedup struct types, specifically those
+with members that were pointers with __percpu annotations.
+
+The issue in dedup is at the point that we are deduplicating structures,
+we have not yet deduplicated reference types like pointers. If multiple
+copies of a pointer point at the same (deduplicated) integer as in this
+case, we do not see them as identical. Special handling already exists
+to deal with structures and arrays, so add pointer handling here too.
+
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index 4a486798fe4c0..b770702dab372 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -4176,6 +4176,19 @@ static bool btf_dedup_identical_structs(struct btf_dedup *d, __u32 id1, __u32 id
+ return true;
+ }
+
++static bool btf_dedup_identical_ptrs(struct btf_dedup *d, __u32 id1, __u32 id2)
++{
++ struct btf_type *t1, *t2;
++
++ t1 = btf_type_by_id(d->btf, id1);
++ t2 = btf_type_by_id(d->btf, id2);
++
++ if (!btf_is_ptr(t1) || !btf_is_ptr(t2))
++ return false;
++
++ return t1->type == t2->type;
++}
++
+ /*
+ * Check equivalence of BTF type graph formed by candidate struct/union (we'll
+ * call it "candidate graph" in this description for brevity) to a type graph
+@@ -4308,6 +4321,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
+ */
+ if (btf_dedup_identical_structs(d, hypot_type_id, cand_id))
+ return 1;
++ /* A similar case is again observed for PTRs. */
++ if (btf_dedup_identical_ptrs(d, hypot_type_id, cand_id))
++ return 1;
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From dedd2e4bae5f0300c9b4f9f399dc8abca62140ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 May 2025 17:59:34 +0100
+Subject: libbpf/btf: Fix string handling to support multi-split BTF
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 4e29128a9acec2a622734844bedee013e2901bdf ]
+
+libbpf handling of split BTF has been written largely with the
+assumption that multiple splits are possible, i.e. split BTF on top of
+split BTF on top of base BTF. One area where this does not quite work
+is string handling in split BTF; the start string offset should be the
+base BTF string section length + the base BTF string offset. This
+worked in the past because for a single split BTF with base the start
+string offset was always 0.
+
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250519165935.261614-2-alan.maguire@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index 27e7bfae953bd..4a486798fe4c0 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -995,7 +995,7 @@ static struct btf *btf_new_empty(struct btf *base_btf)
+ if (base_btf) {
+ btf->base_btf = base_btf;
+ btf->start_id = btf__type_cnt(base_btf);
+- btf->start_str_off = base_btf->hdr->str_len;
++ btf->start_str_off = base_btf->hdr->str_len + base_btf->start_str_off;
+ btf->swapped_endian = base_btf->swapped_endian;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 74af135362d05c54b4916bf6e9a0c7b3e0cb429c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 12:32:20 +0100
+Subject: libbpf: Check bpf_map_skeleton link for NULL
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit d0445d7dd3fd9b15af7564c38d7aa3cbc29778ee ]
+
+Avoid dereferencing bpf_map_skeleton's link field if it's NULL.
+If BPF map skeleton is created with the size, that indicates containing
+link field, but the field was not actually initialized with valid
+bpf_link pointer, libbpf crashes. This may happen when using libbpf-rs
+skeleton.
+Skeleton loading may still progress, but user needs to attach struct_ops
+map separately.
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250514113220.219095-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index bb24f6bac2073..1290314da6761 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -13971,6 +13971,12 @@ int bpf_object__attach_skeleton(struct bpf_object_skeleton *s)
+ }
+
+ link = map_skel->link;
++ if (!link) {
++ pr_warn("map '%s': BPF map skeleton link is uninitialized\n",
++ bpf_map__name(map));
++ continue;
++ }
++
+ if (*link)
+ continue;
+
+--
+2.39.5
+
--- /dev/null
+From 48c112c00d120266b25e5224c77b828f22665f5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 May 2025 14:35:51 -0700
+Subject: Make 'cc-option' work correctly for the -Wno-xyzzy pattern
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 550ccb178de2f379f5e1a1833dd6f4bdafef4b68 ]
+
+This is the follow-up to commit a79be02bba5c ("Fix mis-uses of
+'cc-option' for warning disablement") where I mentioned that the best
+fix would be to just make 'cc-option' a bit smarter, and work for all
+compiler options, including the '-Wno-xyzzy' pattern that it used to
+accept unknown options for.
+
+It turns out that fixing cc-option is pretty straightforward: just
+rewrite any '-Wno-xyzzy' option pattern to use '-Wxyzzy' instead for
+testing.
+
+That makes the whole artificial distinction between 'cc-option' and
+'cc-disable-warning' go away, and we can happily forget about the odd
+build rule that you have to treat compiler options that disable warnings
+specially.
+
+The 'cc-disable-warning' helper remains as a backwards compatibility
+syntax for now, but is implemented in terms of the new and improved
+cc-option.
+
+Acked-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Thomas Weißschuh <linux@weissschuh.net>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.compiler | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler
+index c6cd729b65cbf..05685b3df9e5e 100644
+--- a/scripts/Makefile.compiler
++++ b/scripts/Makefile.compiler
+@@ -43,7 +43,7 @@ as-instr = $(call try-run,\
+ # __cc-option
+ # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586)
+ __cc-option = $(call try-run,\
+- $(1) -Werror $(2) $(3) -c -x c /dev/null -o "$$TMP",$(3),$(4))
++ $(1) -Werror $(2) $(3:-Wno-%=-W%) -c -x c /dev/null -o "$$TMP",$(3),$(4))
+
+ # cc-option
+ # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -57,7 +57,7 @@ cc-option-yn = $(if $(call cc-option,$1),y,n)
+
+ # cc-disable-warning
+ # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
+-cc-disable-warning = $(if $(call cc-option,-W$(strip $1)),-Wno-$(strip $1))
++cc-disable-warning = $(call cc-option,-Wno-$(strip $1))
+
+ # gcc-min-version
+ # Usage: cflags-$(call gcc-min-version, 70100) += -foo
+--
+2.39.5
+
--- /dev/null
+From d5ab022c614c3004942dde269ad35c1dde6661e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 17:13:37 -0500
+Subject: mmc: Add quirk to disable DDR50 tuning
+
+From: Erick Shepherd <erick.shepherd@ni.com>
+
+[ Upstream commit 9510b38dc0ba358c93cbf5ee7c28820afb85937b ]
+
+Adds the MMC_QUIRK_NO_UHS_DDR50_TUNING quirk and updates
+mmc_execute_tuning() to return 0 if that quirk is set. This fixes an
+issue on certain Swissbit SD cards that do not support DDR50 tuning
+where tuning requests caused I/O errors to be thrown.
+
+Signed-off-by: Erick Shepherd <erick.shepherd@ni.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250331221337.1414534-1-erick.shepherd@ni.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/card.h | 6 ++++++
+ drivers/mmc/core/quirks.h | 10 ++++++++++
+ drivers/mmc/core/sd.c | 32 ++++++++++++++++++++++++--------
+ include/linux/mmc/card.h | 1 +
+ 4 files changed, 41 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
+index 3205feb1e8ff6..9cbdd240c3a7d 100644
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -89,6 +89,7 @@ struct mmc_fixup {
+ #define CID_MANFID_MICRON 0x13
+ #define CID_MANFID_SAMSUNG 0x15
+ #define CID_MANFID_APACER 0x27
++#define CID_MANFID_SWISSBIT 0x5D
+ #define CID_MANFID_KINGSTON 0x70
+ #define CID_MANFID_HYNIX 0x90
+ #define CID_MANFID_KINGSTON_SD 0x9F
+@@ -294,4 +295,9 @@ static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c)
+ return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY;
+ }
+
++static inline int mmc_card_no_uhs_ddr50_tuning(const struct mmc_card *c)
++{
++ return c->quirks & MMC_QUIRK_NO_UHS_DDR50_TUNING;
++}
++
+ #endif
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 89b512905be14..7f893bafaa607 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -34,6 +34,16 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = {
+ MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY,
+ EXT_CSD_REV_ANY),
+
++ /*
++ * Swissbit series S46-u cards throw I/O errors during tuning requests
++ * after the initial tuning request expectedly times out. This has
++ * only been observed on cards manufactured on 01/2019 that are using
++ * Bay Trail host controllers.
++ */
++ _FIXUP_EXT("0016G", CID_MANFID_SWISSBIT, 0x5342, 2019, 1,
++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++ MMC_QUIRK_NO_UHS_DDR50_TUNING, EXT_CSD_REV_ANY),
++
+ END_FIXUP
+ };
+
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 63915541c0e49..916ae9996e9d7 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -613,6 +613,29 @@ static int sd_set_current_limit(struct mmc_card *card, u8 *status)
+ return 0;
+ }
+
++/*
++ * Determine if the card should tune or not.
++ */
++static bool mmc_sd_use_tuning(struct mmc_card *card)
++{
++ /*
++ * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and
++ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
++ */
++ if (mmc_host_is_spi(card->host))
++ return false;
++
++ switch (card->host->ios.timing) {
++ case MMC_TIMING_UHS_SDR50:
++ case MMC_TIMING_UHS_SDR104:
++ return true;
++ case MMC_TIMING_UHS_DDR50:
++ return !mmc_card_no_uhs_ddr50_tuning(card);
++ }
++
++ return false;
++}
++
+ /*
+ * UHS-I specific initialization procedure
+ */
+@@ -656,14 +679,7 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card)
+ if (err)
+ goto out;
+
+- /*
+- * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and
+- * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+- */
+- if (!mmc_host_is_spi(card->host) &&
+- (card->host->ios.timing == MMC_TIMING_UHS_SDR50 ||
+- card->host->ios.timing == MMC_TIMING_UHS_DDR50 ||
+- card->host->ios.timing == MMC_TIMING_UHS_SDR104)) {
++ if (mmc_sd_use_tuning(card)) {
+ err = mmc_execute_tuning(card);
+
+ /*
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index eb67d3d5ff5b2..2e455b20c37c2 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -295,6 +295,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */
+ #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16) /* Don't flush cache until the write has occurred */
+ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17) /* Disable broken SD poweroff notify support */
++#define MMC_QUIRK_NO_UHS_DDR50_TUNING (1<<18) /* Disable DDR50 tuning */
+
+ bool written_flag; /* Indicates eMMC has been written since power on */
+ bool reenable_cmdq; /* Re-enable Command Queue */
+--
+2.39.5
+
--- /dev/null
+From 3fb85d6675c9d765525e92b40edc296cfd7914ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 19:25:17 +0800
+Subject: mmc: sdhci-esdhc-imx: Save tuning value when card stays powered in
+ suspend
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+[ Upstream commit c63d25cdc59ae2891b39ba2da950910291d9bcbf ]
+
+For SoCs like i.MX6UL(L/Z) and i.MX7D, USDHC powers off completely during
+system power management (PM), causing the internal tuning status to be
+lost. To address this, save the tuning value when system suspend and
+restore it for any command issued after system resume when re-tuning is
+held.
+
+A typical case involves SDIO WiFi devices with the MMC_PM_KEEP_POWER and
+MMC_PM_WAKE_SDIO_IRQ flag, which retain power during system PM. To
+conserve power, WiFi switches to 1-bit mode and restores 4-bit mode upon
+resume. As per the specification, tuning commands are not supported in
+1-bit mode. When sending CMD52 to restore 4-bit mode, re-tuning must be
+held. However, CMD52 still requires a correct sample point to avoid CRC
+errors, necessitating preservation of the previous tuning value.
+
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250328112517.2624806-1-ziniu.wang_1@nxp.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 88 +++++++++++++++++++++++++++++-
+ 1 file changed, 86 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index d84aa20f03589..7a0b7bfa1bb69 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -80,6 +80,8 @@
+ #define ESDHC_TUNE_CTRL_STEP 1
+ #define ESDHC_TUNE_CTRL_MIN 0
+ #define ESDHC_TUNE_CTRL_MAX ((1 << 7) - 1)
++#define ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK GENMASK(30, 24)
++#define ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK GENMASK(14, 8)
+
+ /* strobe dll register */
+ #define ESDHC_STROBE_DLL_CTRL 0x70
+@@ -234,6 +236,7 @@ struct esdhc_platform_data {
+ unsigned int tuning_step; /* The delay cell steps in tuning procedure */
+ unsigned int tuning_start_tap; /* The start delay cell point in tuning procedure */
+ unsigned int strobe_dll_delay_target; /* The delay cell for strobe pad (read clock) */
++ unsigned int saved_tuning_delay_cell; /* save the value of tuning delay cell */
+ };
+
+ struct esdhc_soc_data {
+@@ -1056,7 +1059,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ {
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+- u32 ctrl;
++ u32 ctrl, tuning_ctrl;
+ int ret;
+
+ /* Reset the tuning circuit */
+@@ -1070,6 +1073,16 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ writel(0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+ writel(ctrl, host->ioaddr + ESDHC_MIX_CTRL);
++ /*
++ * enable the std tuning just in case it cleared in
++ * sdhc_esdhc_tuning_restore.
++ */
++ tuning_ctrl = readl(host->ioaddr + ESDHC_TUNING_CTRL);
++ if (!(tuning_ctrl & ESDHC_STD_TUNING_EN)) {
++ tuning_ctrl |= ESDHC_STD_TUNING_EN;
++ writel(tuning_ctrl, host->ioaddr + ESDHC_TUNING_CTRL);
++ }
++
+ ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
+ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
+@@ -1148,7 +1161,8 @@ static void esdhc_prepare_tuning(struct sdhci_host *host, u32 val)
+ reg |= ESDHC_MIX_CTRL_EXE_TUNE | ESDHC_MIX_CTRL_SMPCLK_SEL |
+ ESDHC_MIX_CTRL_FBCLK_SEL;
+ writel(reg, host->ioaddr + ESDHC_MIX_CTRL);
+- writel(val << 8, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
++ writel(FIELD_PREP(ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK, val),
++ host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ dev_dbg(mmc_dev(host->mmc),
+ "tuning with delay 0x%x ESDHC_TUNE_CTRL_STATUS 0x%x\n",
+ val, readl(host->ioaddr + ESDHC_TUNE_CTRL_STATUS));
+@@ -1556,6 +1570,57 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host)
+ }
+ }
+
++static void sdhc_esdhc_tuning_save(struct sdhci_host *host)
++{
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
++ u32 reg;
++
++ /*
++ * SD/eMMC do not need this tuning save because it will re-init
++ * after system resume back.
++ * Here save the tuning delay value for SDIO device since it may
++ * keep power during system PM. And for usdhc, only SDR50 and
++ * SDR104 mode for SDIO device need to do tuning, and need to
++ * save/restore.
++ */
++ if (host->timing == MMC_TIMING_UHS_SDR50 ||
++ host->timing == MMC_TIMING_UHS_SDR104) {
++ reg = readl(host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
++ reg = FIELD_GET(ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK, reg);
++ imx_data->boarddata.saved_tuning_delay_cell = reg;
++ }
++}
++
++static void sdhc_esdhc_tuning_restore(struct sdhci_host *host)
++{
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
++ u32 reg;
++
++ if (host->timing == MMC_TIMING_UHS_SDR50 ||
++ host->timing == MMC_TIMING_UHS_SDR104) {
++ /*
++ * restore the tuning delay value actually is a
++ * manual tuning method, so clear the standard
++ * tuning enable bit here. Will set back this
++ * ESDHC_STD_TUNING_EN in esdhc_reset_tuning()
++ * when trigger re-tuning.
++ */
++ reg = readl(host->ioaddr + ESDHC_TUNING_CTRL);
++ reg &= ~ESDHC_STD_TUNING_EN;
++ writel(reg, host->ioaddr + ESDHC_TUNING_CTRL);
++
++ reg = readl(host->ioaddr + ESDHC_MIX_CTRL);
++ reg |= ESDHC_MIX_CTRL_SMPCLK_SEL | ESDHC_MIX_CTRL_FBCLK_SEL;
++ writel(reg, host->ioaddr + ESDHC_MIX_CTRL);
++
++ writel(FIELD_PREP(ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK,
++ imx_data->boarddata.saved_tuning_delay_cell),
++ host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
++ }
++}
++
+ static void esdhc_cqe_enable(struct mmc_host *mmc)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+@@ -1887,6 +1952,15 @@ static int sdhci_esdhc_suspend(struct device *dev)
+ if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+ mmc_retune_needed(host->mmc);
+
++ /*
++ * For the device need to keep power during system PM, need
++ * to save the tuning delay value just in case the usdhc
++ * lost power during system PM.
++ */
++ if (mmc_card_keep_power(host->mmc) && mmc_card_wake_sdio_irq(host->mmc) &&
++ esdhc_is_usdhc(imx_data))
++ sdhc_esdhc_tuning_save(host);
++
+ ret = sdhci_suspend_host(host);
+ if (ret)
+ return ret;
+@@ -1903,6 +1977,8 @@ static int sdhci_esdhc_suspend(struct device *dev)
+ static int sdhci_esdhc_resume(struct device *dev)
+ {
+ struct sdhci_host *host = dev_get_drvdata(dev);
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+ int ret;
+
+ ret = pinctrl_pm_select_default_state(dev);
+@@ -1916,6 +1992,14 @@ static int sdhci_esdhc_resume(struct device *dev)
+ if (ret)
+ return ret;
+
++ /*
++ * restore the saved tuning delay value for the device which keep
++ * power during system PM.
++ */
++ if (mmc_card_keep_power(host->mmc) && mmc_card_wake_sdio_irq(host->mmc) &&
++ esdhc_is_usdhc(imx_data))
++ sdhc_esdhc_tuning_restore(host);
++
+ if (host->mmc->caps2 & MMC_CAP2_CQE)
+ ret = cqhci_resume(host->mmc);
+
+--
+2.39.5
+
--- /dev/null
+From e7b2e0eed97523373f036ae00465bcb19358fc1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 21:48:10 +0800
+Subject: net: atlantic: generate software timestamp just before the doorbell
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit 285ad7477559b6b5ceed10ba7ecfed9d17c0e7c6 ]
+
+Make sure the call of skb_tx_timestamp is as close as possible to the
+doorbell.
+
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Link: https://patch.msgid.link/20250510134812.48199-2-kerneljasonxing@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 -
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index c1d1673c5749d..b565189e59139 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -123,7 +123,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd
+ }
+ #endif
+
+- skb_tx_timestamp(skb);
+ return aq_nic_xmit(aq_nic, skb);
+ }
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 71e50fc65c147..b0994bd05874a 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -898,6 +898,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
+
+ frags = aq_nic_map_skb(self, skb, ring);
+
++ skb_tx_timestamp(skb);
++
+ if (likely(frags)) {
+ err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw,
+ ring, frags);
+--
+2.39.5
+
--- /dev/null
+From b070b1d5a63eae67689f4c8eba769bcdbcdef033 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 15:43:12 +0200
+Subject: net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
+ functions
+
+From: Yong Wang <yongwang@nvidia.com>
+
+[ Upstream commit 4b30ae9adb047dd0a7982975ec3933c529537026 ]
+
+When a bridge port STP state is changed from BLOCKING/DISABLED to
+FORWARDING, the port's igmp query timer will NOT re-arm itself if the
+bridge has been configured as per-VLAN multicast snooping.
+
+Solve this by choosing the correct multicast context(s) to enable/disable
+port multicast based on whether per-VLAN multicast snooping is enabled or
+not, i.e. using per-{port, VLAN} context in case of per-VLAN multicast
+snooping by re-implementing br_multicast_enable_port() and
+br_multicast_disable_port() functions.
+
+Before the patch, the IGMP query does not happen in the last step of the
+following test sequence, i.e. no growth for tx counter:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # bridge link set dev swp1 state 0
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge link set dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+
+After the patch, the IGMP query happens in the last step of the test:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # bridge link set dev swp1 state 0
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge link set dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+3
+
+Signed-off-by: Yong Wang <yongwang@nvidia.com>
+Reviewed-by: Andy Roulin <aroulin@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_multicast.c | 77 +++++++++++++++++++++++++++++++++++----
+ 1 file changed, 69 insertions(+), 8 deletions(-)
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 7a91897ac6e87..733ff6b758f69 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -2105,12 +2105,17 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ }
+ }
+
+-void br_multicast_enable_port(struct net_bridge_port *port)
++static void br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ {
+- struct net_bridge *br = port->br;
++ struct net_bridge *br = pmctx->port->br;
+
+ spin_lock_bh(&br->multicast_lock);
+- __br_multicast_enable_port_ctx(&port->multicast_ctx);
++ if (br_multicast_port_ctx_is_vlan(pmctx) &&
++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) {
++ spin_unlock_bh(&br->multicast_lock);
++ return;
++ }
++ __br_multicast_enable_port_ctx(pmctx);
+ spin_unlock_bh(&br->multicast_lock);
+ }
+
+@@ -2137,11 +2142,67 @@ static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ br_multicast_rport_del_notify(pmctx, del);
+ }
+
++static void br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx)
++{
++ struct net_bridge *br = pmctx->port->br;
++
++ spin_lock_bh(&br->multicast_lock);
++ if (br_multicast_port_ctx_is_vlan(pmctx) &&
++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) {
++ spin_unlock_bh(&br->multicast_lock);
++ return;
++ }
++
++ __br_multicast_disable_port_ctx(pmctx);
++ spin_unlock_bh(&br->multicast_lock);
++}
++
++static void br_multicast_toggle_port(struct net_bridge_port *port, bool on)
++{
++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
++ if (br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) {
++ struct net_bridge_vlan_group *vg;
++ struct net_bridge_vlan *vlan;
++
++ rcu_read_lock();
++ vg = nbp_vlan_group_rcu(port);
++ if (!vg) {
++ rcu_read_unlock();
++ return;
++ }
++
++ /* iterate each vlan, toggle vlan multicast context */
++ list_for_each_entry_rcu(vlan, &vg->vlan_list, vlist) {
++ struct net_bridge_mcast_port *pmctx =
++ &vlan->port_mcast_ctx;
++ u8 state = br_vlan_get_state(vlan);
++ /* enable vlan multicast context when state is
++ * LEARNING or FORWARDING
++ */
++ if (on && br_vlan_state_allowed(state, true))
++ br_multicast_enable_port_ctx(pmctx);
++ else
++ br_multicast_disable_port_ctx(pmctx);
++ }
++ rcu_read_unlock();
++ return;
++ }
++#endif
++ /* toggle port multicast context when vlan snooping is disabled */
++ if (on)
++ br_multicast_enable_port_ctx(&port->multicast_ctx);
++ else
++ br_multicast_disable_port_ctx(&port->multicast_ctx);
++}
++
++void br_multicast_enable_port(struct net_bridge_port *port)
++{
++ br_multicast_toggle_port(port, true);
++}
++
+ void br_multicast_disable_port(struct net_bridge_port *port)
+ {
+- spin_lock_bh(&port->br->multicast_lock);
+- __br_multicast_disable_port_ctx(&port->multicast_ctx);
+- spin_unlock_bh(&port->br->multicast_lock);
++ br_multicast_toggle_port(port, false);
+ }
+
+ static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
+@@ -4330,9 +4391,9 @@ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on,
+ __br_multicast_open(&br->multicast_ctx);
+ list_for_each_entry(p, &br->port_list, list) {
+ if (on)
+- br_multicast_disable_port(p);
++ br_multicast_disable_port_ctx(&p->multicast_ctx);
+ else
+- br_multicast_enable_port(p);
++ br_multicast_enable_port_ctx(&p->multicast_ctx);
+ }
+
+ list_for_each_entry(vlan, &vg->vlan_list, vlist)
+--
+2.39.5
+
--- /dev/null
+From dfd9062f968204ee727d742a9c051e50f477d69f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 15:43:13 +0200
+Subject: net: bridge: mcast: update multicast contex when vlan state is
+ changed
+
+From: Yong Wang <yongwang@nvidia.com>
+
+[ Upstream commit 6c131043eaf1be2a6cc2d228f92ceb626fbcc0f3 ]
+
+When the vlan STP state is changed, which could be manipulated by
+"bridge vlan" commands, similar to port STP state, this also impacts
+multicast behaviors such as igmp query. In the scenario of per-VLAN
+snooping, there's a need to update the corresponding multicast context
+to re-arm the port query timer when vlan state becomes "forwarding" etc.
+
+Update br_vlan_set_state() function to enable vlan multicast context
+in such scenario.
+
+Before the patch, the IGMP query does not happen in the last step of the
+following test sequence, i.e. no growth for tx counter:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # sleep 1
+ # bridge vlan set vid 1 dev swp1 state 4
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge vlan set vid 1 dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+
+After the patch, the IGMP query happens in the last step of the test:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # sleep 1
+ # bridge vlan set vid 1 dev swp1 state 4
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge vlan set vid 1 dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+3
+
+Signed-off-by: Yong Wang <yongwang@nvidia.com>
+Reviewed-by: Andy Roulin <aroulin@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_mst.c | 4 ++--
+ net/bridge/br_multicast.c | 26 ++++++++++++++++++++++++++
+ net/bridge/br_private.h | 11 ++++++++++-
+ 3 files changed, 38 insertions(+), 3 deletions(-)
+
+diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c
+index 1820f09ff59ce..3f24b4ee49c27 100644
+--- a/net/bridge/br_mst.c
++++ b/net/bridge/br_mst.c
+@@ -80,10 +80,10 @@ static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg,
+ if (br_vlan_get_state(v) == state)
+ return;
+
+- br_vlan_set_state(v, state);
+-
+ if (v->vid == vg->pvid)
+ br_vlan_set_pvid_state(vg, state);
++
++ br_vlan_set_state(v, state);
+ }
+
+ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state,
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index b2ae0d2434d2e..7a91897ac6e87 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -4211,6 +4211,32 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+ #endif
+ }
+
++void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state)
++{
++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
++ struct net_bridge *br;
++
++ if (!br_vlan_should_use(v))
++ return;
++
++ if (br_vlan_is_master(v))
++ return;
++
++ br = v->port->br;
++
++ if (!br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED))
++ return;
++
++ if (br_vlan_state_allowed(state, true))
++ br_multicast_enable_port_ctx(&v->port_mcast_ctx);
++
++ /* Multicast is not disabled for the vlan when it goes in
++ * blocking state because the timers will expire and stop by
++ * themselves without sending more queries.
++ */
++#endif
++}
++
+ void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on)
+ {
+ struct net_bridge *br;
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index df502cc1191c3..6a1bce8959afa 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -1053,6 +1053,7 @@ void br_multicast_port_ctx_init(struct net_bridge_port *port,
+ struct net_bridge_vlan *vlan,
+ struct net_bridge_mcast_port *pmctx);
+ void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pmctx);
++void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state);
+ void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on);
+ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on,
+ struct netlink_ext_ack *extack);
+@@ -1503,6 +1504,11 @@ static inline void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pm
+ {
+ }
+
++static inline void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v,
++ u8 state)
++{
++}
++
+ static inline void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan,
+ bool on)
+ {
+@@ -1854,7 +1860,9 @@ bool br_vlan_global_opts_can_enter_range(const struct net_bridge_vlan *v_curr,
+ bool br_vlan_global_opts_fill(struct sk_buff *skb, u16 vid, u16 vid_range,
+ const struct net_bridge_vlan *v_opts);
+
+-/* vlan state manipulation helpers using *_ONCE to annotate lock-free access */
++/* vlan state manipulation helpers using *_ONCE to annotate lock-free access,
++ * while br_vlan_set_state() may access data protected by multicast_lock.
++ */
+ static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v)
+ {
+ return READ_ONCE(v->state);
+@@ -1863,6 +1871,7 @@ static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v)
+ static inline void br_vlan_set_state(struct net_bridge_vlan *v, u8 state)
+ {
+ WRITE_ONCE(v->state, state);
++ br_multicast_update_vlan_mcast_ctx(v, state);
+ }
+
+ static inline u8 br_vlan_get_pvid_state(const struct net_bridge_vlan_group *vg)
+--
+2.39.5
+
--- /dev/null
+From f54d8c6a5cb3051593e73f4ac08fe52b47a43a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 16:53:31 +0900
+Subject: net: dlink: add synchronization for stats update
+
+From: Moon Yeounsu <yyyynoom@gmail.com>
+
+[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ]
+
+This patch synchronizes code that accesses from both user-space
+and IRQ contexts. The `get_stats()` function can be called from both
+context.
+
+`dev->stats.tx_errors` and `dev->stats.collisions` are also updated
+in the `tx_errors()` function. Therefore, these fields must also be
+protected by synchronized.
+
+There is no code that accessses `dev->stats.tx_errors` between the
+previous and updated lines, so the updating point can be moved.
+
+Signed-off-by: Moon Yeounsu <yyyynoom@gmail.com>
+Link: https://patch.msgid.link/20250515075333.48290-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++-
+ drivers/net/ethernet/dlink/dl2k.h | 2 ++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 6bf8a7aeef908..787218d60c6b1 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent)
+ np->ioaddr = ioaddr;
+ np->chip_id = chip_idx;
+ np->pdev = pdev;
++
++ spin_lock_init(&np->stats_lock);
+ spin_lock_init (&np->tx_lock);
+ spin_lock_init (&np->rx_lock);
+
+@@ -865,7 +867,6 @@ tx_error (struct net_device *dev, int tx_status)
+ frame_id = (tx_status & 0xffff0000);
+ printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n",
+ dev->name, tx_status, frame_id);
+- dev->stats.tx_errors++;
+ /* Ttransmit Underrun */
+ if (tx_status & 0x10) {
+ dev->stats.tx_fifo_errors++;
+@@ -902,9 +903,15 @@ tx_error (struct net_device *dev, int tx_status)
+ rio_set_led_mode(dev);
+ /* Let TxStartThresh stay default value */
+ }
++
++ spin_lock(&np->stats_lock);
+ /* Maximum Collisions */
+ if (tx_status & 0x08)
+ dev->stats.collisions++;
++
++ dev->stats.tx_errors++;
++ spin_unlock(&np->stats_lock);
++
+ /* Restart the Tx */
+ dw32(MACCtrl, dr16(MACCtrl) | TxEnable);
+ }
+@@ -1073,7 +1080,9 @@ get_stats (struct net_device *dev)
+ int i;
+ #endif
+ unsigned int stat_reg;
++ unsigned long flags;
+
++ spin_lock_irqsave(&np->stats_lock, flags);
+ /* All statistics registers need to be acknowledged,
+ else statistic overflow could cause problems */
+
+@@ -1123,6 +1132,9 @@ get_stats (struct net_device *dev)
+ dr16(TCPCheckSumErrors);
+ dr16(UDPCheckSumErrors);
+ dr16(IPCheckSumErrors);
++
++ spin_unlock_irqrestore(&np->stats_lock, flags);
++
+ return &dev->stats;
+ }
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index 0e33e2eaae960..56aff2f0bdbfa 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
++++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -372,6 +372,8 @@ struct netdev_private {
+ struct pci_dev *pdev;
+ void __iomem *ioaddr;
+ void __iomem *eeprom_addr;
++ // To ensure synchronization when stats are updated.
++ spinlock_t stats_lock;
+ spinlock_t tx_lock;
+ spinlock_t rx_lock;
+ unsigned int rx_buf_sz; /* Based on MTU+slack. */
+--
+2.39.5
+
--- /dev/null
+From 30011cbd7b7327c31f1f055af1afbaa29888ba60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 11:26:58 +0200
+Subject: net: ethernet: cortina: Use TOE/TSO on all TCP
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 6a07e3af4973402fa199a80036c10060b922c92c ]
+
+It is desireable to push the hardware accelerator to also
+process non-segmented TCP frames: we pass the skb->len
+to the "TOE/TSO" offloader and it will handle them.
+
+Without this quirk the driver becomes unstable and lock
+up and and crash.
+
+I do not know exactly why, but it is probably due to the
+TOE (TCP offload engine) feature that is coupled with the
+segmentation feature - it is not possible to turn one
+part off and not the other, either both TOE and TSO are
+active, or neither of them.
+
+Not having the TOE part active seems detrimental, as if
+that hardware feature is not really supposed to be turned
+off.
+
+The datasheet says:
+
+ "Based on packet parsing and TCP connection/NAT table
+ lookup results, the NetEngine puts the packets
+ belonging to the same TCP connection to the same queue
+ for the software to process. The NetEngine puts
+ incoming packets to the buffer or series of buffers
+ for a jumbo packet. With this hardware acceleration,
+ IP/TCP header parsing, checksum validation and
+ connection lookup are offloaded from the software
+ processing."
+
+After numerous tests with the hardware locking up after
+something between minutes and hours depending on load
+using iperf3 I have concluded this is necessary to stabilize
+the hardware.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://patch.msgid.link/20250408-gemini-ethernet-tso-always-v1-1-e669f932359c@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cortina/gemini.c | 37 +++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 73e1c71c5092e..92833eefc04b4 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -1143,6 +1143,7 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
+ struct gmac_txdesc *txd;
+ skb_frag_t *skb_frag;
+ dma_addr_t mapping;
++ bool tcp = false;
+ void *buffer;
+ u16 mss;
+ int ret;
+@@ -1150,6 +1151,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
+ word1 = skb->len;
+ word3 = SOF_BIT;
+
++ /* Determine if we are doing TCP */
++ if (skb->protocol == htons(ETH_P_IP))
++ tcp = (ip_hdr(skb)->protocol == IPPROTO_TCP);
++ else
++ /* IPv6 */
++ tcp = (ipv6_hdr(skb)->nexthdr == IPPROTO_TCP);
++
+ mss = skb_shinfo(skb)->gso_size;
+ if (mss) {
+ /* This means we are dealing with TCP and skb->len is the
+@@ -1162,8 +1170,26 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
+ mss, skb->len);
+ word1 |= TSS_MTU_ENABLE_BIT;
+ word3 |= mss;
++ } else if (tcp) {
++ /* Even if we are not using TSO, use the hardware offloader
++ * for transferring the TCP frame: this hardware has partial
++ * TCP awareness (called TOE - TCP Offload Engine) and will
++ * according to the datasheet put packets belonging to the
++ * same TCP connection in the same queue for the TOE/TSO
++ * engine to process. The engine will deal with chopping
++ * up frames that exceed ETH_DATA_LEN which the
++ * checksumming engine cannot handle (see below) into
++ * manageable chunks. It flawlessly deals with quite big
++ * frames and frames containing custom DSA EtherTypes.
++ */
++ mss = netdev->mtu + skb_tcp_all_headers(skb);
++ mss = min(mss, skb->len);
++ netdev_dbg(netdev, "TOE/TSO len %04x mtu %04x mss %04x\n",
++ skb->len, netdev->mtu, mss);
++ word1 |= TSS_MTU_ENABLE_BIT;
++ word3 |= mss;
+ } else if (skb->len >= ETH_FRAME_LEN) {
+- /* Hardware offloaded checksumming isn't working on frames
++ /* Hardware offloaded checksumming isn't working on non-TCP frames
+ * bigger than 1514 bytes. A hypothesis about this is that the
+ * checksum buffer is only 1518 bytes, so when the frames get
+ * bigger they get truncated, or the last few bytes get
+@@ -1180,21 +1206,16 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
+ }
+
+ if (skb->ip_summed == CHECKSUM_PARTIAL) {
+- int tcp = 0;
+-
+ /* We do not switch off the checksumming on non TCP/UDP
+ * frames: as is shown from tests, the checksumming engine
+ * is smart enough to see that a frame is not actually TCP
+ * or UDP and then just pass it through without any changes
+ * to the frame.
+ */
+- if (skb->protocol == htons(ETH_P_IP)) {
++ if (skb->protocol == htons(ETH_P_IP))
+ word1 |= TSS_IP_CHKSUM_BIT;
+- tcp = ip_hdr(skb)->protocol == IPPROTO_TCP;
+- } else { /* IPv6 */
++ else
+ word1 |= TSS_IPV6_ENABLE_BIT;
+- tcp = ipv6_hdr(skb)->nexthdr == IPPROTO_TCP;
+- }
+
+ word1 |= tcp ? TSS_TCP_CHKSUM_BIT : TSS_UDP_CHKSUM_BIT;
+ }
+--
+2.39.5
+
--- /dev/null
+From 2e3b3bc829f0498fe513a36f58bfd673b1cc8115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 10:43:36 +0200
+Subject: net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit 09737cb80b8686ffca4ed1805fee745d5c85604d ]
+
+of_get_mac_address() might fetch the MAC address from NVMEM and that
+driver might not have been loaded. In that case, -EPROBE_DEFER is
+returned. Right now, this will trigger an immediate fallback to
+am65_cpsw_am654_get_efuse_macid() possibly resulting in a random MAC
+address although the MAC address is stored in the referenced NVMEM.
+
+Fix it by handling the -EPROBE_DEFER return code correctly. This also
+means that the creation of the MDIO device has to be moved to a later
+stage as -EPROBE_DEFER must not be returned after child devices are
+created.
+
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250414084336.4017237-3-mwalle@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 61788a43cb861..393cc5192e90d 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2693,7 +2693,9 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
+ goto of_node_put;
+
+ ret = of_get_mac_address(port_np, port->slave.mac_addr);
+- if (ret) {
++ if (ret == -EPROBE_DEFER) {
++ goto of_node_put;
++ } else if (ret) {
+ am65_cpsw_am654_get_efuse_macid(port_np,
+ port->port_id,
+ port->slave.mac_addr);
+@@ -3586,6 +3588,16 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ am65_cpsw_nuss_get_ver(common);
++
++ ret = am65_cpsw_nuss_init_host_p(common);
++ if (ret)
++ goto err_pm_clear;
++
++ ret = am65_cpsw_nuss_init_slave_ports(common);
++ if (ret)
++ goto err_pm_clear;
++
+ node = of_get_child_by_name(dev->of_node, "mdio");
+ if (!node) {
+ dev_warn(dev, "MDIO node not found\n");
+@@ -3602,16 +3614,6 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)
+ }
+ of_node_put(node);
+
+- am65_cpsw_nuss_get_ver(common);
+-
+- ret = am65_cpsw_nuss_init_host_p(common);
+- if (ret)
+- goto err_of_clear;
+-
+- ret = am65_cpsw_nuss_init_slave_ports(common);
+- if (ret)
+- goto err_of_clear;
+-
+ /* init common data */
+ ale_params.dev = dev;
+ ale_params.ale_ageout = AM65_CPSW_ALE_AGEOUT_DEFAULT;
+--
+2.39.5
+
--- /dev/null
+From 9144163f30ded3d5de05dc635ef1867c9b87baa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 May 2025 23:03:26 +0530
+Subject: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
+
+From: Rengarajan S <rengarajan.s@microchip.com>
+
+[ Upstream commit 3b9935586a9b54d2da27901b830d3cf46ad66a1e ]
+
+Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb
+and 64 Kb respectively. Adjust max size definitions and return correct
+EEPROM length based on device. Also prevent out-of-bound read/write.
+
+Signed-off-by: Rengarajan S <rengarajan.s@microchip.com>
+Link: https://patch.msgid.link/20250523173326.18509-1-rengarajan.s@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/microchip/lan743x_ethtool.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_ethtool.c b/drivers/net/ethernet/microchip/lan743x_ethtool.c
+index 1a1cbd034eda0..2acd9c3531dea 100644
+--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
++++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
+@@ -18,6 +18,8 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define MAX_EEPROM_SIZE (512)
+ #define MAX_OTP_SIZE (1024)
++#define MAX_HS_OTP_SIZE (8 * 1024)
++#define MAX_HS_EEPROM_SIZE (64 * 1024)
+ #define OTP_INDICATOR_1 (0xF3)
+ #define OTP_INDICATOR_2 (0xF7)
+
+@@ -272,6 +274,9 @@ static int lan743x_hs_otp_read(struct lan743x_adapter *adapter, u32 offset,
+ int ret;
+ int i;
+
++ if (offset + length > MAX_HS_OTP_SIZE)
++ return -EINVAL;
++
+ ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT);
+ if (ret < 0)
+ return ret;
+@@ -320,6 +325,9 @@ static int lan743x_hs_otp_write(struct lan743x_adapter *adapter, u32 offset,
+ int ret;
+ int i;
+
++ if (offset + length > MAX_HS_OTP_SIZE)
++ return -EINVAL;
++
+ ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT);
+ if (ret < 0)
+ return ret;
+@@ -497,6 +505,9 @@ static int lan743x_hs_eeprom_read(struct lan743x_adapter *adapter,
+ u32 val;
+ int i;
+
++ if (offset + length > MAX_HS_EEPROM_SIZE)
++ return -EINVAL;
++
+ retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT);
+ if (retval < 0)
+ return retval;
+@@ -539,6 +550,9 @@ static int lan743x_hs_eeprom_write(struct lan743x_adapter *adapter,
+ u32 val;
+ int i;
+
++ if (offset + length > MAX_HS_EEPROM_SIZE)
++ return -EINVAL;
++
+ retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT);
+ if (retval < 0)
+ return retval;
+@@ -604,9 +618,9 @@ static int lan743x_ethtool_get_eeprom_len(struct net_device *netdev)
+ struct lan743x_adapter *adapter = netdev_priv(netdev);
+
+ if (adapter->flags & LAN743X_ADAPTER_FLAG_OTP)
+- return MAX_OTP_SIZE;
++ return adapter->is_pci11x1x ? MAX_HS_OTP_SIZE : MAX_OTP_SIZE;
+
+- return MAX_EEPROM_SIZE;
++ return adapter->is_pci11x1x ? MAX_HS_EEPROM_SIZE : MAX_EEPROM_SIZE;
+ }
+
+ static int lan743x_ethtool_get_eeprom(struct net_device *netdev,
+--
+2.39.5
+
--- /dev/null
+From e24c32af11d3805e2a58c51c6d87c94a4333e6a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 May 2025 21:20:31 -0600
+Subject: net: macb: Check return value of dma_set_mask_and_coherent()
+
+From: Sergio Perez Gonzalez <sperezglz@gmail.com>
+
+[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ]
+
+Issue flagged by coverity. Add a safety check for the return value
+of dma_set_mask_and_coherent, go to a safe exit if it returns error.
+
+Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754
+Signed-off-by: Sergio Perez Gonzalez <sperezglz@gmail.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index ae100ed8ed6b9..3c2a7919b1289 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -5117,7 +5117,11 @@ static int macb_probe(struct platform_device *pdev)
+
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
+- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
++ if (err) {
++ dev_err(&pdev->dev, "failed to set DMA mask\n");
++ goto err_out_free_netdev;
++ }
+ bp->hw_dma_cap |= HW_DMA_CAP_64B;
+ }
+ #endif
+--
+2.39.5
+
--- /dev/null
+From 9cf032461168cd8a47d323bf265c2b5343a4b6b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 17:34:42 +0800
+Subject: net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit b86bcfee30576b752302c55693fff97242b35dfd ]
+
+As mlx4 has implemented skb_tx_timestamp() in mlx4_en_xmit(), the
+SOFTWARE flag is surely needed when users are trying to get timestamp
+information.
+
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250510093442.79711-1-kerneljasonxing@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index cd17a3f4faf83..a68cd3f0304c6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1897,6 +1897,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev,
+ if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) {
+ info->so_timestamping |=
+ SOF_TIMESTAMPING_TX_HARDWARE |
++ SOF_TIMESTAMPING_TX_SOFTWARE |
+ SOF_TIMESTAMPING_RX_HARDWARE |
+ SOF_TIMESTAMPING_RAW_HARDWARE;
+
+--
+2.39.5
+
--- /dev/null
+From 772023e6df796be5d24f381bfd6ccb995fe55c0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 12:25:38 +0300
+Subject: net/mlx5: HWS, Fix IP version decision
+
+From: Vlad Dogaru <vdogaru@nvidia.com>
+
+[ Upstream commit 5f2f8d8b6800e4fc760c2eccec9b2bd2cacf80cf ]
+
+Unify the check for IP version when creating a definer. A given matcher
+is deemed to match on IPv6 if any of the higher order (>31) bits of
+source or destination address mask are set.
+
+A single packet cannot mix IP versions between source and destination
+addresses, so it makes no sense that they would be decided on
+independently.
+
+Signed-off-by: Vlad Dogaru <vdogaru@nvidia.com>
+Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20250422092540.182091-2-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mlx5/core/steering/hws/mlx5hws_definer.c | 38 ++++++++-----------
+ 1 file changed, 16 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
+index 72b19b05c0cf4..0d0591ba41fdb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
+@@ -508,9 +508,9 @@ static int
+ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ u32 *match_param)
+ {
+- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set;
+ struct mlx5hws_definer_fc *fc = cd->fc;
+ struct mlx5hws_definer_fc *curr_fc;
++ bool is_ipv6, smac_set, dmac_set;
+ u32 *s_ipv6, *d_ipv6;
+
+ if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) ||
+@@ -572,10 +572,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ outer_headers.dst_ipv4_dst_ipv6.ipv6_layout);
+
+ /* Assume IPv6 is used if ipv6 bits are set */
+- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2];
+- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
++ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] ||
++ d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
+
+- if (is_s_ipv6) {
++ if (is_ipv6) {
+ /* Handle IPv6 source address */
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O,
+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96,
+@@ -589,13 +589,6 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_O,
+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
+ ipv6_src_outer.ipv6_address_31_0);
+- } else {
+- /* Handle IPv4 source address */
+- HWS_SET_HDR(fc, match_param, IPV4_SRC_O,
+- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
+- ipv4_src_dest_outer.source_address);
+- }
+- if (is_d_ipv6) {
+ /* Handle IPv6 destination address */
+ HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_O,
+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96,
+@@ -610,6 +603,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0,
+ ipv6_dst_outer.ipv6_address_31_0);
+ } else {
++ /* Handle IPv4 source address */
++ HWS_SET_HDR(fc, match_param, IPV4_SRC_O,
++ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
++ ipv4_src_dest_outer.source_address);
+ /* Handle IPv4 destination address */
+ HWS_SET_HDR(fc, match_param, IPV4_DST_O,
+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0,
+@@ -667,9 +664,9 @@ static int
+ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ u32 *match_param)
+ {
+- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set;
+ struct mlx5hws_definer_fc *fc = cd->fc;
+ struct mlx5hws_definer_fc *curr_fc;
++ bool is_ipv6, smac_set, dmac_set;
+ u32 *s_ipv6, *d_ipv6;
+
+ if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) ||
+@@ -730,10 +727,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ inner_headers.dst_ipv4_dst_ipv6.ipv6_layout);
+
+ /* Assume IPv6 is used if ipv6 bits are set */
+- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2];
+- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
++ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] ||
++ d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
+
+- if (is_s_ipv6) {
++ if (is_ipv6) {
+ /* Handle IPv6 source address */
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I,
+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96,
+@@ -747,13 +744,6 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_I,
+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
+ ipv6_src_inner.ipv6_address_31_0);
+- } else {
+- /* Handle IPv4 source address */
+- HWS_SET_HDR(fc, match_param, IPV4_SRC_I,
+- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
+- ipv4_src_dest_inner.source_address);
+- }
+- if (is_d_ipv6) {
+ /* Handle IPv6 destination address */
+ HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_I,
+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96,
+@@ -768,6 +758,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0,
+ ipv6_dst_inner.ipv6_address_31_0);
+ } else {
++ /* Handle IPv4 source address */
++ HWS_SET_HDR(fc, match_param, IPV4_SRC_I,
++ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0,
++ ipv4_src_dest_inner.source_address);
+ /* Handle IPv4 destination address */
+ HWS_SET_HDR(fc, match_param, IPV4_DST_I,
+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0,
+--
+2.39.5
+
--- /dev/null
+From 72326064a4dae93ef8a2f30cb10d7a63a81afe7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 12:25:39 +0300
+Subject: net/mlx5: HWS, Harden IP version definer checks
+
+From: Vlad Dogaru <vdogaru@nvidia.com>
+
+[ Upstream commit 6991a975e416154576b0f5f06256aec13e23b0a7 ]
+
+Replicate some sanity checks that firmware does, since hardware steering
+does not go through firmware.
+
+When creating a definer, disallow matching on IP addresses without also
+matching on IP version. The latter can be satisfied by matching either
+on the version field in the IP header, or on the ethertype field.
+
+Also refuse to match IPv4 IHL alongside IPv6.
+
+Signed-off-by: Vlad Dogaru <vdogaru@nvidia.com>
+Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20250422092540.182091-3-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mlx5/core/steering/hws/mlx5hws_definer.c | 44 ++++++++++++++++++-
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
+index 0d0591ba41fdb..fc9ba534d5d97 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_definer.c
+@@ -508,9 +508,9 @@ static int
+ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ u32 *match_param)
+ {
++ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set;
+ struct mlx5hws_definer_fc *fc = cd->fc;
+ struct mlx5hws_definer_fc *curr_fc;
+- bool is_ipv6, smac_set, dmac_set;
+ u32 *s_ipv6, *d_ipv6;
+
+ if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) ||
+@@ -520,6 +520,20 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ return -EINVAL;
+ }
+
++ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param,
++ outer_headers.src_ipv4_src_ipv6,
++ 0x80) ||
++ HWS_IS_FLD_SET_SZ(match_param,
++ outer_headers.dst_ipv4_dst_ipv6, 0x80);
++ ip_ver_set = HWS_IS_FLD_SET(match_param, outer_headers.ip_version) ||
++ HWS_IS_FLD_SET(match_param, outer_headers.ethertype);
++
++ if (ip_addr_set && !ip_ver_set) {
++ mlx5hws_err(cd->ctx,
++ "Unsupported match on IP address without version or ethertype\n");
++ return -EINVAL;
++ }
++
+ /* L2 Check ethertype */
+ HWS_SET_HDR(fc, match_param, ETH_TYPE_O,
+ outer_headers.ethertype,
+@@ -575,6 +589,12 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd,
+ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] ||
+ d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
+
++ /* IHL is an IPv4-specific field. */
++ if (is_ipv6 && HWS_IS_FLD_SET(match_param, outer_headers.ipv4_ihl)) {
++ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n");
++ return -EINVAL;
++ }
++
+ if (is_ipv6) {
+ /* Handle IPv6 source address */
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O,
+@@ -664,9 +684,9 @@ static int
+ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ u32 *match_param)
+ {
++ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set;
+ struct mlx5hws_definer_fc *fc = cd->fc;
+ struct mlx5hws_definer_fc *curr_fc;
+- bool is_ipv6, smac_set, dmac_set;
+ u32 *s_ipv6, *d_ipv6;
+
+ if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) ||
+@@ -676,6 +696,20 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ return -EINVAL;
+ }
+
++ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param,
++ inner_headers.src_ipv4_src_ipv6,
++ 0x80) ||
++ HWS_IS_FLD_SET_SZ(match_param,
++ inner_headers.dst_ipv4_dst_ipv6, 0x80);
++ ip_ver_set = HWS_IS_FLD_SET(match_param, inner_headers.ip_version) ||
++ HWS_IS_FLD_SET(match_param, inner_headers.ethertype);
++
++ if (ip_addr_set && !ip_ver_set) {
++ mlx5hws_err(cd->ctx,
++ "Unsupported match on IP address without version or ethertype\n");
++ return -EINVAL;
++ }
++
+ /* L2 Check ethertype */
+ HWS_SET_HDR(fc, match_param, ETH_TYPE_I,
+ inner_headers.ethertype,
+@@ -730,6 +764,12 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd,
+ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] ||
+ d_ipv6[0] || d_ipv6[1] || d_ipv6[2];
+
++ /* IHL is an IPv4-specific field. */
++ if (is_ipv6 && HWS_IS_FLD_SET(match_param, inner_headers.ipv4_ihl)) {
++ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n");
++ return -EINVAL;
++ }
++
+ if (is_ipv6) {
+ /* Handle IPv6 source address */
+ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I,
+--
+2.39.5
+
--- /dev/null
+From 8bf3237537de1cebd68a90d0fc24527c794c8eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 11:27:22 +0200
+Subject: net: page_pool: Don't recycle into cache on PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 32471b2f481dea8624f27669d36ffd131d24b732 ]
+
+With preemptible softirq and no per-CPU locking in local_bh_disable() on
+PREEMPT_RT the consumer can be preempted while a skb is returned.
+
+Avoid the race by disabling the recycle into the cache on PREEMPT_RT.
+
+Cc: Jesper Dangaard Brouer <hawk@kernel.org>
+Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://patch.msgid.link/20250512092736.229935-2-bigeasy@linutronix.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 0f23b3126bdaf..b1c3e0ad6dbf4 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -829,6 +829,10 @@ static bool page_pool_napi_local(const struct page_pool *pool)
+ const struct napi_struct *napi;
+ u32 cpuid;
+
++ /* On PREEMPT_RT the softirq can be preempted by the consumer */
++ if (IS_ENABLED(CONFIG_PREEMPT_RT))
++ return false;
++
+ if (unlikely(!in_softirq()))
+ return false;
+
+--
+2.39.5
+
--- /dev/null
+From df0c01f12de3dcff9dd8569d625a7fa6193521e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 21:48:12 +0800
+Subject: net: stmmac: generate software timestamp just before the doorbell
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit 33d4cc81fcd930fdbcca7ac9e8959225cbec0a5e ]
+
+Make sure the call of skb_tx_timestamp is as close as possbile to the
+doorbell.
+
+The patch also adjusts the order of setting SKBTX_IN_PROGRESS and
+generate software timestamp so that without SOF_TIMESTAMPING_OPT_TX_SWHW
+being set the software and hardware timestamps will not appear in the
+error queue of socket nearly at the same time (Please see __skb_tstamp_tx()).
+
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Link: https://patch.msgid.link/20250510134812.48199-4-kerneljasonxing@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index f68e3ece919cc..0250c5cb28ff2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4424,8 +4424,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (priv->sarc_type)
+ stmmac_set_desc_sarc(priv, first, priv->sarc_type);
+
+- skb_tx_timestamp(skb);
+-
+ if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+ priv->hwts_tx_en)) {
+ /* declare that device is doing timestamping */
+@@ -4460,6 +4458,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
++ skb_tx_timestamp(skb);
+
+ stmmac_flush_tx_descriptors(priv, queue);
+ stmmac_tx_timer_arm(priv, queue);
+@@ -4703,8 +4702,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (priv->sarc_type)
+ stmmac_set_desc_sarc(priv, first, priv->sarc_type);
+
+- skb_tx_timestamp(skb);
+-
+ /* Ready to fill the first descriptor and set the OWN bit w/o any
+ * problems because all the descriptors are actually ready to be
+ * passed to the DMA engine.
+@@ -4751,7 +4748,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
+
+ stmmac_enable_dma_transmission(priv, priv->ioaddr, queue);
+-
++ skb_tx_timestamp(skb);
+ stmmac_flush_tx_descriptors(priv, queue);
+ stmmac_tx_timer_arm(priv, queue);
+
+--
+2.39.5
+
--- /dev/null
+From 1a89d660591618e11808272f7d6333c0f68955b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 14:04:34 +0200
+Subject: net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit 4ecf56f4b66011b583644bf9a62188d05dfcd78c ]
+
+The MSE102x doesn't provide any interrupt register, so the only way
+to handle the level interrupt is to fetch the whole packet from
+the MSE102x internal buffer via SPI. So in cases the interrupt
+handler fails to do this, it should return IRQ_NONE. This allows
+the core to disable the interrupt in case the issue persists
+and prevent an interrupt storm.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://patch.msgid.link/20250509120435.43646-6-wahrenst@gmx.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/vertexcom/mse102x.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/vertexcom/mse102x.c b/drivers/net/ethernet/vertexcom/mse102x.c
+index e4d993f313740..545177e84c0eb 100644
+--- a/drivers/net/ethernet/vertexcom/mse102x.c
++++ b/drivers/net/ethernet/vertexcom/mse102x.c
+@@ -306,7 +306,7 @@ static void mse102x_dump_packet(const char *msg, int len, const char *data)
+ data, len, true);
+ }
+
+-static void mse102x_rx_pkt_spi(struct mse102x_net *mse)
++static irqreturn_t mse102x_rx_pkt_spi(struct mse102x_net *mse)
+ {
+ struct sk_buff *skb;
+ unsigned int rxalign;
+@@ -327,7 +327,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse)
+ mse102x_tx_cmd_spi(mse, CMD_CTR);
+ ret = mse102x_rx_cmd_spi(mse, (u8 *)&rx);
+ if (ret)
+- return;
++ return IRQ_NONE;
+
+ cmd_resp = be16_to_cpu(rx);
+ if ((cmd_resp & CMD_MASK) != CMD_RTS) {
+@@ -360,7 +360,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse)
+ rxalign = ALIGN(rxlen + DET_SOF_LEN + DET_DFT_LEN, 4);
+ skb = netdev_alloc_skb_ip_align(mse->ndev, rxalign);
+ if (!skb)
+- return;
++ return IRQ_NONE;
+
+ /* 2 bytes Start of frame (before ethernet header)
+ * 2 bytes Data frame tail (after ethernet frame)
+@@ -370,7 +370,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse)
+ if (mse102x_rx_frame_spi(mse, rxpkt, rxlen, drop)) {
+ mse->ndev->stats.rx_errors++;
+ dev_kfree_skb(skb);
+- return;
++ return IRQ_HANDLED;
+ }
+
+ if (netif_msg_pktdata(mse))
+@@ -381,6 +381,8 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse)
+
+ mse->ndev->stats.rx_packets++;
+ mse->ndev->stats.rx_bytes += rxlen;
++
++ return IRQ_HANDLED;
+ }
+
+ static int mse102x_tx_pkt_spi(struct mse102x_net *mse, struct sk_buff *txb,
+@@ -512,12 +514,13 @@ static irqreturn_t mse102x_irq(int irq, void *_mse)
+ {
+ struct mse102x_net *mse = _mse;
+ struct mse102x_net_spi *mses = to_mse102x_spi(mse);
++ irqreturn_t ret;
+
+ mutex_lock(&mses->lock);
+- mse102x_rx_pkt_spi(mse);
++ ret = mse102x_rx_pkt_spi(mse);
+ mutex_unlock(&mses->lock);
+
+- return IRQ_HANDLED;
++ return ret;
+ }
+
+ static int mse102x_net_open(struct net_device *ndev)
+--
+2.39.5
+
--- /dev/null
+From 0b40921940432794028148b5051c400bad67982c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 00:27:31 +0000
+Subject: netdevsim: Mark NAPI ID on skb in nsim_rcv
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit f71c549b26a33fd62f1e9c7deeba738bfc73fbfc ]
+
+Previously, nsim_rcv was not marking the NAPI ID on the skb, leading to
+applications seeing a napi ID of 0 when using SO_INCOMING_NAPI_ID.
+
+To add to the userland confusion, netlink appears to correctly report
+the NAPI IDs for netdevsim queues but the resulting file descriptor from
+a call to accept() was reporting a NAPI ID of 0.
+
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Link: https://patch.msgid.link/20250424002746.16891-2-jdamato@fastly.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/netdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index 79b898311819d..ee2a7b2f6268d 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -25,6 +25,7 @@
+ #include <net/pkt_cls.h>
+ #include <net/rtnetlink.h>
+ #include <net/udp_tunnel.h>
++#include <net/busy_poll.h>
+
+ #include "netdevsim.h"
+
+@@ -341,6 +342,7 @@ static int nsim_rcv(struct nsim_rq *rq, int budget)
+ break;
+
+ skb = skb_dequeue(&rq->skb_queue);
++ skb_mark_napi_id(skb, &rq->napi);
+ netif_receive_skb(skb);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 78ac96455e502d9ebb9cc9b2c6ee53ede9d5347e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 21:52:44 +0200
+Subject: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit b85e3367a5716ed3662a4fe266525190d2af76df ]
+
+Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof()
+when resizing hashtable because __GFP_NOWARN is unset.
+
+Similar to:
+
+ b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX")
+
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index 0529e4ef75207..c5855069bdaba 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -663,6 +663,9 @@ static int pipapo_realloc_mt(struct nft_pipapo_field *f,
+ check_add_overflow(rules, extra, &rules_alloc))
+ return -EOVERFLOW;
+
++ if (rules_alloc > (INT_MAX / sizeof(*new_mt)))
++ return -ENOMEM;
++
+ new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL_ACCOUNT);
+ if (!new_mt)
+ return -ENOMEM;
+@@ -1499,6 +1502,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old)
+ src->groups * NFT_PIPAPO_BUCKETS(src->bb));
+
+ if (src->rules > 0) {
++ if (src->rules_alloc > (INT_MAX / sizeof(*src->mt)))
++ goto out_mt;
++
+ dst->mt = kvmalloc_array(src->rules_alloc,
+ sizeof(*src->mt),
+ GFP_KERNEL_ACCOUNT);
+--
+2.39.5
+
--- /dev/null
+From 1b47438f5c10c181f6b614cbf942993c3f5567c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 11:26:02 +0800
+Subject: octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 9c056ec6dd1654b1420dafbbe2a69718850e6ff2 ]
+
+The cn10k_free_matchall_ipolicer() calls the cn10k_map_unmap_rq_policer()
+for each queue in a for loop without checking for any errors.
+
+Check the return value of the cn10k_map_unmap_rq_policer() function during
+each loop, and report a warning if the function fails.
+
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250408032602.2909-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+index 7417087b6db59..a2807a1e4f4a6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+@@ -352,9 +352,12 @@ int cn10k_free_matchall_ipolicer(struct otx2_nic *pfvf)
+ mutex_lock(&pfvf->mbox.lock);
+
+ /* Remove RQ's policer mapping */
+- for (qidx = 0; qidx < hw->rx_queues; qidx++)
+- cn10k_map_unmap_rq_policer(pfvf, qidx,
+- hw->matchall_ipolicer, false);
++ for (qidx = 0; qidx < hw->rx_queues; qidx++) {
++ rc = cn10k_map_unmap_rq_policer(pfvf, qidx, hw->matchall_ipolicer, false);
++ if (rc)
++ dev_warn(pfvf->dev, "Failed to unmap RQ %d's policer (error %d).",
++ qidx, rc);
++ }
+
+ rc = cn10k_free_leaf_profile(pfvf, hw->matchall_ipolicer);
+
+--
+2.39.5
+
--- /dev/null
+From 5eb2e3ac62831fae8647f65108d462cbfcef7a80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 10:08:24 +0200
+Subject: openvswitch: Stricter validation for the userspace action
+
+From: Eelco Chaudron <echaudro@redhat.com>
+
+[ Upstream commit 88906f55954131ed2d3974e044b7fb48129b86ae ]
+
+This change enhances the robustness of validate_userspace() by ensuring
+that all Netlink attributes are fully contained within the parent
+attribute. The previous use of nla_parse_nested_deprecated() could
+silently skip trailing or malformed attributes, as it stops parsing at
+the first invalid entry.
+
+By switching to nla_parse_deprecated_strict(), we make sure only fully
+validated attributes are copied for later use.
+
+Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Acked-by: Ilya Maximets <i.maximets@ovn.org>
+Link: https://patch.msgid.link/67eb414e2d250e8408bb8afeb982deca2ff2b10b.1747037304.git.echaudro@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/flow_netlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 305daf57a4f9d..865d5e5a0784f 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -3049,7 +3049,8 @@ static int validate_userspace(const struct nlattr *attr)
+ struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
+ int error;
+
+- error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr,
++ error = nla_parse_deprecated_strict(a, OVS_USERSPACE_ATTR_MAX,
++ nla_data(attr), nla_len(attr),
+ userspace_policy, NULL);
+ if (error)
+ return error;
+--
+2.39.5
+
--- /dev/null
+From d639ed3f0b0a91123d798caf83a9f1de3d5ede58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:38 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_pmx_set_by_name()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 4229c28323db141eda69cb99427be75d3edba071 ]
+
+The regmap_update_bits() function can fail, so propagate its error
+up to the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-7-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 4ce11c74fec1f..aa6bb1c0d9fa7 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -358,9 +358,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev,
+
+ val = grp->val[func];
+
+- regmap_update_bits(info->regmap, reg, mask, val);
+-
+- return 0;
++ return regmap_update_bits(info->regmap, reg, mask, val);
+ }
+
+ static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev,
+--
+2.39.5
+
--- /dev/null
+From def799622aa29b0a384c746342cb779b7cee16b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:36 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_pmx_gpio_set_direction()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit bfa0ff804ffa8b1246ade8be08de98c9eb19d16f ]
+
+The armada_37xx_gpio_direction_{in,out}put() functions can fail, so
+propagate their error values back to the stack instead of silently
+ignoring those.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-5-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index c8437d45a3135..f242d24d72b8d 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -472,16 +472,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
+ {
+ struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
+ struct gpio_chip *chip = range->gc;
++ int ret;
+
+ dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n",
+ offset, range->name, offset, input ? "input" : "output");
+
+ if (input)
+- armada_37xx_gpio_direction_input(chip, offset);
++ ret = armada_37xx_gpio_direction_input(chip, offset);
+ else
+- armada_37xx_gpio_direction_output(chip, offset, 0);
++ ret = armada_37xx_gpio_direction_output(chip, offset, 0);
+
+- return 0;
++ return ret;
+ }
+
+ static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev,
+--
+2.39.5
+
--- /dev/null
+From ec7864077f1f9bc1613a1493b2ffb5fc640919d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:35 +0200
+Subject: pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 57273ff8bb16f3842c2597b5bbcd49e7fa12edf7 ]
+
+The regmap_read() function can fail, so propagate its error up to
+the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-4-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index f242d24d72b8d..53b6eb7486593 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -443,11 +443,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
+ unsigned int reg = INPUT_VAL;
+ unsigned int val, mask;
++ int ret;
+
+ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+
+- regmap_read(info->regmap, reg, &val);
++ ret = regmap_read(info->regmap, reg, &val);
++ if (ret)
++ return ret;
+
+ return (val & mask) != 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 8fb4e6de064b025ca73b076ee40271b9c28c5560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:37 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_gpio_get_direction()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 6481c0a83367b0672951ccc876fbae7ee37b594b ]
+
+The regmap_read() function can fail, so propagate its error up to
+the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-6-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index aa6bb1c0d9fa7..c8437d45a3135 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -400,10 +400,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip,
+ struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
+ unsigned int reg = OUTPUT_EN;
+ unsigned int val, mask;
++ int ret;
+
+ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+- regmap_read(info->regmap, reg, &val);
++ ret = regmap_read(info->regmap, reg, &val);
++ if (ret)
++ return ret;
+
+ if (val & mask)
+ return GPIO_LINE_DIRECTION_OUT;
+--
+2.39.5
+
--- /dev/null
+From 289b2898f8578897e70e9723c82f7bce922bf172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 16:17:45 +0100
+Subject: pinctrl: mcp23s08: Reset all pins to input at probe
+
+From: Mike Looijmans <mike.looijmans@topic.nl>
+
+[ Upstream commit 3ede3f8b4b4b399b0ca41e44959f80d5cf84fc98 ]
+
+At startup, the driver just assumes that all registers have their
+default values. But after a soft reset, the chip will just be in the
+state it was, and some pins may have been configured as outputs. Any
+modification of the output register will cause these pins to be driven
+low, which leads to unexpected/unwanted effects. To prevent this from
+happening, set the chip's IO configuration register to a known safe
+mode (all inputs) before toggling any other bits.
+
+Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
+Link: https://lore.kernel.org/20250314151803.28903-1-mike.looijmans@topic.nl
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-mcp23s08.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index 70d7485ada364..60fcd53830a7d 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -636,6 +636,14 @@ int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
+
+ mcp->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+
++ /*
++ * Reset the chip - we don't really know what state it's in, so reset
++ * all pins to input first to prevent surprises.
++ */
++ ret = mcp_write(mcp, MCP_IODIR, mcp->chip.ngpio == 16 ? 0xFFFF : 0xFF);
++ if (ret < 0)
++ return ret;
++
+ /* verify MCP_IOCON.SEQOP = 0, so sequential reads work,
+ * and MCP_IOCON.HAEN = 1, so we work with all chips.
+ */
+--
+2.39.5
+
--- /dev/null
+From 6425c5039035e0b9adb6936cbce9655351b7b85d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:30:55 -0400
+Subject: platform-msi: Add msi_remove_device_irq_domain() in
+ platform_device_msi_free_irqs_all()
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 9a958e1fd40d6fae8c66385687a00ebd9575a7d2 ]
+
+platform_device_msi_init_and_alloc_irqs() performs two tasks: allocating
+the MSI domain for a platform device, and allocate a number of MSIs in that
+domain.
+
+platform_device_msi_free_irqs_all() only frees the MSIs, and leaves the MSI
+domain alive.
+
+Given that platform_device_msi_init_and_alloc_irqs() is the sole tool a
+platform device has to allocate platform MSIs, it makes sense for
+platform_device_msi_free_irqs_all() to teardown the MSI domain at the same
+time as the MSIs.
+
+This avoids warnings and unexpected behaviours when a driver repeatedly
+allocates and frees MSIs.
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250414-ep-msi-v18-1-f69b49917464@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform-msi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
+index 0e60dd650b5e0..70db08f3ac6fa 100644
+--- a/drivers/base/platform-msi.c
++++ b/drivers/base/platform-msi.c
+@@ -95,5 +95,6 @@ EXPORT_SYMBOL_GPL(platform_device_msi_init_and_alloc_irqs);
+ void platform_device_msi_free_irqs_all(struct device *dev)
+ {
+ msi_domain_free_irqs_all(dev, MSI_DEFAULT_DOMAIN);
++ msi_remove_device_irq_domain(dev, MSI_DEFAULT_DOMAIN);
+ }
+ EXPORT_SYMBOL_GPL(platform_device_msi_free_irqs_all);
+--
+2.39.5
+
--- /dev/null
+From 95601872c78ac70f6846aa7df7aa49d58545a667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 08:24:08 -0500
+Subject: platform/x86/amd: pmc: Clear metrics table at start of cycle
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 4dbd11796f3a8eb95647507befc41995458a4023 ]
+
+The area of memory that contains the metrics table may contain garbage
+when the cycle starts. This normally doesn't matter because the cycle
+itself will populate it with valid data, however commit 9f5595d5f03fd
+("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep
+cycles") started to use it during the check() phase. Depending upon
+what garbage is in the table it's possible that the system will wait
+2.5 seconds for even the first cycle, which will be visible to a user.
+
+To prevent this from happening explicitly clear the table when logging
+is started.
+
+Fixes: 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250603132412.3555302-1-superm1@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
+index dc071b4257d7b..357a46fdffeda 100644
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -393,6 +393,8 @@ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev)
+ return -ENOMEM;
+ }
+
++ memset_io(dev->smu_virt_addr, 0, sizeof(struct smu_metrics));
++
+ /* Start the logging */
+ amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_RESET, false);
+ amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_START, false);
+--
+2.39.5
+
--- /dev/null
+From 8c4dec95f2544d8211a150ba090f8657eb38940f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 19:34:56 -0500
+Subject: platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running
+ twice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 93103d56650d7a38ed37ba4041578310f82776ae ]
+
+If any of the tee init fails, pass up the errors and clear the tee_ctx
+pointer. This will prevent cleaning up multiple times.
+
+Fixes: ac052d8c08f9d ("platform/x86/amd/pmf: Add PMF TEE interface")
+Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/20250512211154.2510397-3-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250522003457.1516679-3-superm1@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/tee-if.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
+index b6bcc1d57f968..a9b195ec6f33f 100644
+--- a/drivers/platform/x86/amd/pmf/tee-if.c
++++ b/drivers/platform/x86/amd/pmf/tee-if.c
+@@ -422,12 +422,12 @@ static int amd_pmf_ta_open_session(struct tee_context *ctx, u32 *id, const uuid_
+ rc = tee_client_open_session(ctx, &sess_arg, NULL);
+ if (rc < 0 || sess_arg.ret != 0) {
+ pr_err("Failed to open TEE session err:%#x, rc:%d\n", sess_arg.ret, rc);
+- return rc;
++ return rc ?: -EINVAL;
+ }
+
+ *id = sess_arg.session;
+
+- return rc;
++ return 0;
+ }
+
+ static int amd_pmf_register_input_device(struct amd_pmf_dev *dev)
+@@ -462,7 +462,9 @@ static int amd_pmf_tee_init(struct amd_pmf_dev *dev, const uuid_t *uuid)
+ dev->tee_ctx = tee_client_open_context(NULL, amd_pmf_amdtee_ta_match, NULL, NULL);
+ if (IS_ERR(dev->tee_ctx)) {
+ dev_err(dev->dev, "Failed to open TEE context\n");
+- return PTR_ERR(dev->tee_ctx);
++ ret = PTR_ERR(dev->tee_ctx);
++ dev->tee_ctx = NULL;
++ return ret;
+ }
+
+ ret = amd_pmf_ta_open_session(dev->tee_ctx, &dev->session_id, uuid);
+@@ -502,9 +504,12 @@ static int amd_pmf_tee_init(struct amd_pmf_dev *dev, const uuid_t *uuid)
+
+ static void amd_pmf_tee_deinit(struct amd_pmf_dev *dev)
+ {
++ if (!dev->tee_ctx)
++ return;
+ tee_shm_free(dev->fw_shm_pool);
+ tee_client_close_session(dev->tee_ctx, dev->session_id);
+ tee_client_close_context(dev->tee_ctx);
++ dev->tee_ctx = NULL;
+ }
+
+ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
+--
+2.39.5
+
--- /dev/null
+From 4f8084cf5f5d01395e57f66cefa7527afa1315d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 13:46:56 -0500
+Subject: platform/x86: dell_rbu: Fix list usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 ]
+
+Pass the correct list head to list_for_each_entry*() when looping through
+the packet list.
+
+Without this patch, reading the packet data via sysfs will show the data
+incorrectly (because it starts at the wrong packet), and clearing the
+packet list will result in a NULL pointer dereference.
+
+Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()")
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell_rbu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c
+index 9f51e0fcab04e..4d2b5f6dd513f 100644
+--- a/drivers/platform/x86/dell/dell_rbu.c
++++ b/drivers/platform/x86/dell/dell_rbu.c
+@@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length)
+ remaining_bytes = *pread_length;
+ bytes_read = rbu_data.packet_read_count;
+
+- list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) {
++ list_for_each_entry(newpacket, &packet_data_head.list, list) {
+ bytes_copied = do_packet_read(pdest, newpacket,
+ remaining_bytes, bytes_read, &temp_count);
+ remaining_bytes -= bytes_copied;
+@@ -315,7 +315,7 @@ static void packet_empty_list(void)
+ {
+ struct packet_data *newpacket, *tmp;
+
+- list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) {
++ list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) {
+ list_del(&newpacket->list);
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From bf4a33ee855e7c6221dbaeccf634000f88b8254c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 13:46:58 -0500
+Subject: platform/x86: dell_rbu: Stop overwriting data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 ]
+
+The dell_rbu driver will use memset() to clear the data held by each
+packet when it is no longer needed (when the driver is unloaded, the
+packet size is changed, etc).
+
+The amount of memory that is cleared (before this patch) is the normal
+packet size. However, the last packet in the list may be smaller.
+
+Fix this to only clear the memory actually used by each packet, to prevent
+it from writing past the end of data buffer.
+
+Because the packet data buffers are allocated with __get_free_pages() (in
+page-sized increments), this bug could only result in a buffer being
+overwritten when a packet size larger than one page is used. The only user
+of the dell_rbu module should be the Dell BIOS update program, which uses
+a packet size of 4096, so no issues should be seen without the patch, it
+just blocks the possiblity.
+
+Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver")
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell_rbu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c
+index 4d2b5f6dd513f..fee20866b41e4 100644
+--- a/drivers/platform/x86/dell/dell_rbu.c
++++ b/drivers/platform/x86/dell/dell_rbu.c
+@@ -322,7 +322,7 @@ static void packet_empty_list(void)
+ * zero out the RBU packet memory before freeing
+ * to make sure there are no stale RBU packets left in memory
+ */
+- memset(newpacket->data, 0, rbu_data.packetsize);
++ memset(newpacket->data, 0, newpacket->length);
+ set_memory_wb((unsigned long)newpacket->data,
+ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+--
+2.39.5
+
--- /dev/null
+From 3c7e9fd14ee1de45e2aac8a88472d5c1957f089c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 12:11:25 +0530
+Subject: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
+
+From: Charan Teja Kalla <quic_charante@quicinc.com>
+
+[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ]
+
+pm_runtime_put_autosuspend() schedules a hrtimer to expire
+at "dev->power.timer_expires". If the hrtimer's callback,
+pm_suspend_timer_fn(), observes that the current time equals
+"dev->power.timer_expires", it unexpectedly bails out instead of
+proceeding with runtime suspend.
+
+pm_suspend_timer_fn():
+
+ if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
+ dev->power.timer_expires = 0;
+ rpm_suspend(..)
+ }
+
+Additionally, as ->timer_expires is not cleared, all the future auto
+suspend requests will not schedule hrtimer to perform auto suspend.
+
+rpm_suspend():
+
+ if ((rpmflags & RPM_AUTO) &&...) {
+ if (!(dev->power.timer_expires && ...) { <-- this will fail.
+ hrtimer_start_range_ns(&dev->power.suspend_timer,...);
+ }
+ }
+
+Fix this by as well checking if current time reaches the set expiration.
+
+Co-developed-by: Patrick Daly <quic_pdaly@quicinc.com>
+Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
+Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
+Link: https://patch.msgid.link/20250515064125.1211561-1-quic_charante@quicinc.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/runtime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 04113adb092b5..99f25d6b2027a 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1003,7 +1003,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer)
+ * If 'expires' is after the current time, we've been called
+ * too early.
+ */
+- if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
++ if (expires > 0 && expires <= ktime_get_mono_fast_ns()) {
+ dev->power.timer_expires = 0;
+ rpm_suspend(dev, dev->power.timer_autosuspends ?
+ (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
+--
+2.39.5
+
--- /dev/null
+From 15dc4db4f402103a58c5786a5ce7f1ad8d5ce9a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 14:06:13 +0200
+Subject: pmdomain: core: Reset genpd->states to avoid freeing invalid data
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 99012014c902cd9ad85fd288d8a107f33a69855e ]
+
+If genpd_alloc_data() allocates data for the default power-states for the
+genpd, let's make sure to also reset the pointer in the error path. This
+makes sure a genpd provider driver doesn't end up trying to free the data
+again, but using an invalid pointer.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20250402120613.1116711-1-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pmdomain/core.c b/drivers/pmdomain/core.c
+index 8b1f894f5e790..2643525a572bb 100644
+--- a/drivers/pmdomain/core.c
++++ b/drivers/pmdomain/core.c
+@@ -2228,8 +2228,10 @@ static int genpd_alloc_data(struct generic_pm_domain *genpd)
+ return 0;
+ put:
+ put_device(&genpd->dev);
+- if (genpd->free_states == genpd_free_default_power_state)
++ if (genpd->free_states == genpd_free_default_power_state) {
+ kfree(genpd->states);
++ genpd->states = NULL;
++ }
+ free:
+ if (genpd_is_cpu_domain(genpd))
+ free_cpumask_var(genpd->cpus);
+--
+2.39.5
+
--- /dev/null
+From 5262416eeb751e20b0b0e2d4eea4194aab585b58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 11:40:47 +0800
+Subject: power: supply: bq27xxx: Retrieve again when busy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jerry Lv <Jerry.Lv@axis.com>
+
+[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ]
+
+Multiple applications may access the battery gauge at the same time, so
+the gauge may be busy and EBUSY will be returned. The driver will set a
+flag to record the EBUSY state, and this flag will be kept until the next
+periodic update. When this flag is set, bq27xxx_battery_get_property()
+will just return ENODEV until the flag is updated.
+
+Even if the gauge was busy during the last accessing attempt, returning
+ENODEV is not ideal, and can cause confusion in the applications layer.
+
+Instead, retry accessing the I2C to update the flag is as expected, for
+the gauge typically recovers from busy state within a few milliseconds.
+If still failed to access the gauge, the real error code would be returned
+instead of ENODEV (as suggested by Pali Rohár).
+
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jerry Lv <Jerry.Lv@axis.com>
+Link: https://lore.kernel.org/r/20250415-foo-fix-v2-1-5b45a395e4cc@axis.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq27xxx_battery.c | 2 +-
+ drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 1a20c775489c7..871f03d160c53 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -2062,7 +2062,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,
+ mutex_unlock(&di->lock);
+
+ if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0)
+- return -ENODEV;
++ return di->cache.flags;
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_STATUS:
+diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
+index ba0d22d904295..868e95f0887e1 100644
+--- a/drivers/power/supply/bq27xxx_battery_i2c.c
++++ b/drivers/power/supply/bq27xxx_battery_i2c.c
+@@ -6,6 +6,7 @@
+ * Andrew F. Davis <afd@ti.com>
+ */
+
++#include <linux/delay.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+@@ -31,6 +32,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,
+ struct i2c_msg msg[2];
+ u8 data[2];
+ int ret;
++ int retry = 0;
+
+ if (!client->adapter)
+ return -ENODEV;
+@@ -47,7 +49,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,
+ else
+ msg[1].len = 2;
+
+- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
++ do {
++ ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
++ if (ret == -EBUSY && ++retry < 3) {
++ /* sleep 10 milliseconds when busy */
++ usleep_range(10000, 11000);
++ continue;
++ }
++ break;
++ } while (1);
++
+ if (ret < 0)
+ return ret;
+
+--
+2.39.5
+
--- /dev/null
+From 2c75db04de59a5ec0a32ee72fa8392a5e59521f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Apr 2025 22:27:29 +0200
+Subject: power: supply: collie: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c73d19f89cb03c43abbbfa3b9caa1b8fc719764c ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20250406202730.55096-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/collie_battery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/collie_battery.c b/drivers/power/supply/collie_battery.c
+index 68390bd1004f0..3daf7befc0bf6 100644
+--- a/drivers/power/supply/collie_battery.c
++++ b/drivers/power/supply/collie_battery.c
+@@ -440,6 +440,7 @@ static int collie_bat_probe(struct ucb1x00_dev *dev)
+
+ static void collie_bat_remove(struct ucb1x00_dev *dev)
+ {
++ device_init_wakeup(&ucb->dev, 0);
+ free_irq(gpiod_to_irq(collie_bat_main.gpio_full), &collie_bat_main);
+ power_supply_unregister(collie_bat_bu.psy);
+ power_supply_unregister(collie_bat_main.psy);
+--
+2.39.5
+
--- /dev/null
+From c737fcafdae5792e836c9cf118b6c21ca2434b7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 09:02:39 +0300
+Subject: power: supply: max17040: adjust thermal channel scaling
+
+From: Svyatoslav Ryhel <clamor95@gmail.com>
+
+[ Upstream commit d055f51731744243b244aafb1720f793a5b61f7b ]
+
+IIO thermal channel is in millidegree while power supply framework expects
+decidegree values. Adjust scaling to get correct readings.
+
+Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
+Link: https://lore.kernel.org/r/20250430060239.12085-2-clamor95@gmail.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max17040_battery.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c
+index 51310f6e4803b..c1640bc6accd2 100644
+--- a/drivers/power/supply/max17040_battery.c
++++ b/drivers/power/supply/max17040_battery.c
+@@ -410,8 +410,9 @@ static int max17040_get_property(struct power_supply *psy,
+ if (!chip->channel_temp)
+ return -ENODATA;
+
+- iio_read_channel_processed_scale(chip->channel_temp,
+- &val->intval, 10);
++ iio_read_channel_processed(chip->channel_temp, &val->intval);
++ val->intval /= 100; /* Convert from milli- to deci-degree */
++
+ break;
+ default:
+ return -EINVAL;
+--
+2.39.5
+
--- /dev/null
+From cd288e4c8b024827177b62eeec9b3dafe90f6f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 02:29:28 -0400
+Subject: powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
+ recovery
+
+From: Narayana Murty N <nnmlinux@linux.ibm.com>
+
+[ Upstream commit 33bc69cf6655cf60829a803a45275f11a74899e5 ]
+
+VFIO EEH recovery for PCI passthrough devices fails on PowerNV and pseries
+platforms due to missing host-side PE bridge reconfiguration. In the
+current implementation, eeh_pe_configure() only performs RTAS or OPAL-based
+bridge reconfiguration for native host devices, but skips it entirely for
+PEs managed through VFIO in guest passthrough scenarios.
+
+This leads to incomplete EEH recovery when a PCI error affects a
+passthrough device assigned to a QEMU/KVM guest. Although VFIO triggers the
+EEH recovery flow through VFIO_EEH_PE_ENABLE ioctl, the platform-specific
+bridge reconfiguration step is silently bypassed. As a result, the PE's
+config space is not fully restored, causing subsequent config space access
+failures or EEH freeze-on-access errors inside the guest.
+
+This patch fixes the issue by ensuring that eeh_pe_configure() always
+invokes the platform's configure_bridge() callback (e.g.,
+pseries_eeh_phb_configure_bridge) even for VFIO-managed PEs. This ensures
+that RTAS or OPAL calls to reconfigure the PE bridge are correctly issued
+on the host side, restoring the PE's configuration space after an EEH
+event.
+
+This fix is essential for reliable EEH recovery in QEMU/KVM guests using
+VFIO PCI passthrough on PowerNV and pseries systems.
+
+Tested with:
+- QEMU/KVM guest using VFIO passthrough (IBM Power9,(lpar)Power11 host)
+- Injected EEH errors with pseries EEH errinjct tool on host, recovery
+ verified on qemu guest.
+- Verified successful config space access and CAP_EXP DevCtl restoration
+ after recovery
+
+Fixes: 212d16cdca2d ("powerpc/eeh: EEH support for VFIO PCI device")
+Signed-off-by: Narayana Murty N <nnmlinux@linux.ibm.com>
+Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Reviewed-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250508062928.146043-1-nnmlinux@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 83fe99861eb17..ca7f7bb2b4786 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -1509,6 +1509,8 @@ int eeh_pe_configure(struct eeh_pe *pe)
+ /* Invalid PE ? */
+ if (!pe)
+ return -ENODEV;
++ else
++ ret = eeh_ops->configure_bridge(pe);
+
+ return ret;
+ }
+--
+2.39.5
+
--- /dev/null
+From 142a4e931ff0c49f6b67b825eaa6202f479c907d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 20:14:55 +0200
+Subject: powerpc/vdso: Fix build of VDSO32 with pcrel
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit b93755f408325170edb2156c6a894ed1cae5f4f6 ]
+
+Building vdso32 on power10 with pcrel leads to following errors:
+
+ VDSO32A arch/powerpc/kernel/vdso/gettimeofday-32.o
+ arch/powerpc/kernel/vdso/gettimeofday.S: Assembler messages:
+ arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: syntax error; found `@', expected `,'
+ arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here
+ arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: junk at end of line: `@notoc'
+ arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here
+ ...
+ make[2]: *** [arch/powerpc/kernel/vdso/Makefile:85: arch/powerpc/kernel/vdso/gettimeofday-32.o] Error 1
+ make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2
+
+Once the above is fixed, the following happens:
+
+ VDSO32C arch/powerpc/kernel/vdso/vgettimeofday-32.o
+ cc1: error: '-mpcrel' requires '-mcmodel=medium'
+ make[2]: *** [arch/powerpc/kernel/vdso/Makefile:89: arch/powerpc/kernel/vdso/vgettimeofday-32.o] Error 1
+ make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2
+ make: *** [Makefile:251: __sub-make] Error 2
+
+Make sure pcrel version of CFUNC() macro is used only for powerpc64
+builds and remove -mpcrel for powerpc32 builds.
+
+Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/1fa3453f07d42a50a70114da9905bf7b73304fca.1747073669.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ppc_asm.h | 2 +-
+ arch/powerpc/kernel/vdso/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index 02897f4b0dbf8..b891910fce8a6 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -183,7 +183,7 @@
+ /*
+ * Used to name C functions called from asm
+ */
+-#ifdef CONFIG_PPC_KERNEL_PCREL
++#if defined(__powerpc64__) && defined(CONFIG_PPC_KERNEL_PCREL)
+ #define CFUNC(name) name@notoc
+ #else
+ #define CFUNC(name) name
+diff --git a/arch/powerpc/kernel/vdso/Makefile b/arch/powerpc/kernel/vdso/Makefile
+index c568cad6a22e6..6ba68b28ed870 100644
+--- a/arch/powerpc/kernel/vdso/Makefile
++++ b/arch/powerpc/kernel/vdso/Makefile
+@@ -53,7 +53,7 @@ ldflags-$(CONFIG_LD_ORPHAN_WARN) += -Wl,--orphan-handling=$(CONFIG_LD_ORPHAN_WAR
+ ldflags-y += $(filter-out $(CC_AUTO_VAR_INIT_ZERO_ENABLER) $(CC_FLAGS_FTRACE) -Wa$(comma)%, $(KBUILD_CFLAGS))
+
+ CC32FLAGS := -m32
+-CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc
++CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc -mpcrel
+ ifdef CONFIG_CC_IS_CLANG
+ # This flag is supported by clang for 64-bit but not 32-bit so it will cause
+ # an unused command line flag warning for this file.
+--
+2.39.5
+
--- /dev/null
+From ebd05647e2a1e2aabad9211a9f251f4d01962846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 18:54:53 +0800
+Subject: RDMA/hns: initialize db in update_srq_db()
+
+From: Chen Linxuan <chenlinxuan@uniontech.com>
+
+[ Upstream commit ffe1cee21f8b533ae27c3a31bfa56b8c1b27fa6e ]
+
+On x86_64 with gcc version 13.3.0, I compile
+drivers/infiniband/hw/hns/hns_roce_hw_v2.c with:
+
+ make defconfig
+ ./scripts/kconfig/merge_config.sh .config <(
+ echo CONFIG_COMPILE_TEST=y
+ echo CONFIG_HNS3=m
+ echo CONFIG_INFINIBAND=m
+ echo CONFIG_INFINIBAND_HNS_HIP08=m
+ )
+ make KCFLAGS="-fno-inline-small-functions -fno-inline-functions-called-once" \
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.o
+
+Then I get a compile error:
+
+ CALL scripts/checksyscalls.sh
+ DESCEND objtool
+ INSTALL libsubcmd_headers
+ CC [M] drivers/infiniband/hw/hns/hns_roce_hw_v2.o
+ In file included from drivers/infiniband/hw/hns/hns_roce_hw_v2.c:47:
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c: In function 'update_srq_db':
+ drivers/infiniband/hw/hns/hns_roce_common.h:74:17: error: 'db' is used uninitialized [-Werror=uninitialized]
+ 74 | *((__le32 *)_ptr + (field_h) / 32) &= \
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ drivers/infiniband/hw/hns/hns_roce_common.h:90:17: note: in expansion of macro '_hr_reg_clear'
+ 90 | _hr_reg_clear(ptr, field_type, field_h, field_l); \
+ | ^~~~~~~~~~~~~
+ drivers/infiniband/hw/hns/hns_roce_common.h:95:39: note: in expansion of macro '_hr_reg_write'
+ 95 | #define hr_reg_write(ptr, field, val) _hr_reg_write(ptr, field, val)
+ | ^~~~~~~~~~~~~
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c:948:9: note: in expansion of macro 'hr_reg_write'
+ 948 | hr_reg_write(&db, DB_TAG, srq->srqn);
+ | ^~~~~~~~~~~~
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c:946:31: note: 'db' declared here
+ 946 | struct hns_roce_v2_db db;
+ | ^~
+ cc1: all warnings being treated as errors
+
+Signed-off-by: Chen Linxuan <chenlinxuan@uniontech.com>
+Co-developed-by: Winston Wen <wentao@uniontech.com>
+Signed-off-by: Winston Wen <wentao@uniontech.com>
+Link: https://patch.msgid.link/FF922C77946229B6+20250411105459.90782-5-chenlinxuan@uniontech.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 985b9d7d69f20..81e44b7381229 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -942,7 +942,7 @@ static void fill_wqe_idx(struct hns_roce_srq *srq, unsigned int wqe_idx)
+ static void update_srq_db(struct hns_roce_srq *srq)
+ {
+ struct hns_roce_dev *hr_dev = to_hr_dev(srq->ibsrq.device);
+- struct hns_roce_v2_db db;
++ struct hns_roce_v2_db db = {};
+
+ hr_reg_write(&db, DB_TAG, srq->srqn);
+ hr_reg_write(&db, DB_CMD, HNS_ROCE_V2_SRQ_DB);
+--
+2.39.5
+
--- /dev/null
+From c16579676674647d29cee622115105486aacde30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 11:06:34 +0200
+Subject: Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect
+ devices first"
+
+From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+
+[ Upstream commit 36305857b1ead8f6ca033a913162ebc09bee0b43 ]
+
+This reverts commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6.
+
+It breaks target-module@2b300050 ("ti,sysc-omap2") probe on AM62x in a case
+when minimally-configured system tries to network-boot:
+
+[ 6.888776] probe of 2b300050.target-module returned 517 after 258 usecs
+[ 17.129637] probe of 2b300050.target-module returned 517 after 708 usecs
+[ 17.137397] platform 2b300050.target-module: deferred probe pending: (reason unknown)
+[ 26.878471] Waiting up to 100 more seconds for network.
+
+There are minimal configurations possible when the deferred device is not
+being probed any more (because everything else has been successfully
+probed) and deferral lists are not processed any more.
+
+Stable mmc enumeration can be achieved by filling /aliases node properly
+(4700a00755fb commit's rationale).
+
+After revert:
+
+[ 9.006816] IP-Config: Complete:
+[ 9.010058] device=lan0, ...
+
+Tested-by: Andreas Kemnade <andreas@kemnade.info> # GTA04, Panda, BT200
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Link: https://lore.kernel.org/r/20250401090643.2776793-1-alexander.sverdlin@siemens.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 49 -------------------------------------------
+ 1 file changed, 49 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 270a94a06e05c..f715c8d281293 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -677,51 +677,6 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata)
+ return 0;
+ }
+
+-/* Interconnect instances to probe before l4_per instances */
+-static struct resource early_bus_ranges[] = {
+- /* am3/4 l4_wkup */
+- { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, },
+- /* omap4/5 and dra7 l4_cfg */
+- { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, },
+- /* omap4 l4_wkup */
+- { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, },
+- /* omap5 and dra7 l4_wkup without dra7 dcan segment */
+- { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, },
+-};
+-
+-static atomic_t sysc_defer = ATOMIC_INIT(10);
+-
+-/**
+- * sysc_defer_non_critical - defer non_critical interconnect probing
+- * @ddata: device driver data
+- *
+- * We want to probe l4_cfg and l4_wkup interconnect instances before any
+- * l4_per instances as l4_per instances depend on resources on l4_cfg and
+- * l4_wkup interconnects.
+- */
+-static int sysc_defer_non_critical(struct sysc *ddata)
+-{
+- struct resource *res;
+- int i;
+-
+- if (!atomic_read(&sysc_defer))
+- return 0;
+-
+- for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) {
+- res = &early_bus_ranges[i];
+- if (ddata->module_pa >= res->start &&
+- ddata->module_pa <= res->end) {
+- atomic_set(&sysc_defer, 0);
+-
+- return 0;
+- }
+- }
+-
+- atomic_dec_if_positive(&sysc_defer);
+-
+- return -EPROBE_DEFER;
+-}
+-
+ static struct device_node *stdout_path;
+
+ static void sysc_init_stdout_path(struct sysc *ddata)
+@@ -947,10 +902,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
+ if (error)
+ return error;
+
+- error = sysc_defer_non_critical(ddata);
+- if (error)
+- return error;
+-
+ sysc_check_children(ddata);
+
+ if (!of_property_present(np, "reg"))
+--
+2.39.5
+
--- /dev/null
+From 8571183140225d086d6a3299b05d85e2af503bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 20:39:28 +0200
+Subject: Revert "mac80211: Dynamically set CoDel parameters per station"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@toke.dk>
+
+[ Upstream commit 4876376988081d636a4c4e5f03a5556386b49087 ]
+
+This reverts commit 484a54c2e597dbc4ace79c1687022282905afba0. The CoDel
+parameter change essentially disables CoDel on slow stations, with some
+questionable assumptions, as Dave pointed out in [0]. Quoting from
+there:
+
+ But here are my pithy comments as to why this part of mac80211 is so
+ wrong...
+
+ static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+ {
+ - if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+
+ 1) sta->local->num_sta is the number of associated, rather than
+ active, stations. "Active" stations in the last 50ms or so, might have
+ been a better thing to use, but as most people have far more than that
+ associated, we end up with really lousy codel parameters, all the
+ time. Mistake numero uno!
+
+ 2) The STA_SLOW_THRESHOLD was completely arbitrary in 2016.
+
+ - sta->cparams.target = MS2TIME(50);
+
+ This, by itself, was probably not too bad. 30ms might have been
+ better, at the time, when we were battling powersave etc, but 20ms was
+ enough, really, to cover most scenarios, even where we had low rate
+ 2Ghz multicast to cope with. Even then, codel has a hard time finding
+ any sane drop rate at all, with a target this high.
+
+ - sta->cparams.interval = MS2TIME(300);
+
+ But this was horrible, a total mistake, that is leading to codel being
+ completely ineffective in almost any scenario on clients or APS.
+ 100ms, even 80ms, here, would be vastly better than this insanity. I'm
+ seeing 5+seconds of delay accumulated in a bunch of otherwise happily
+ fq-ing APs....
+
+ 100ms of observed jitter during a flow is enough. Certainly (in 2016)
+ there were interactions with powersave that I did not understand, and
+ still don't, but if you are transmitting in the first place, powersave
+ shouldn't be a problemmmm.....
+
+ - sta->cparams.ecn = false;
+
+ At the time we were pretty nervous about ecn, I'm kind of sanguine
+ about it now, and reliably indicating ecn seems better than turning it
+ off for any reason.
+
+ [...]
+
+ In production, on p2p wireless, I've had 8ms and 80ms for target and
+ interval for years now, and it works great.
+
+I think Dave's arguments above are basically sound on the face of it,
+and various experimentation with tighter CoDel parameters in the OpenWrt
+community have show promising results[1]. So I don't think there's any
+reason to keep this parameter fiddling; hence this revert.
+
+[0] https://lore.kernel.org/linux-wireless/CAA93jw6NJ2cmLmMauz0xAgC2MGbBq6n0ZiZzAdkK0u4b+O2yXg@mail.gmail.com/
+[1] https://forum.openwrt.org/t/reducing-multiplexing-latencies-still-further-in-wifi/133605/130
+
+Suggested-By: Dave Taht <dave.taht@gmail.com>
+In-memory-of: Dave Taht <dave.taht@gmail.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Link: https://patch.msgid.link/20250403183930.197716-1-toke@toke.dk
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/mac80211.h | 16 ----------------
+ net/mac80211/debugfs_sta.c | 6 ------
+ net/mac80211/rate.c | 2 --
+ net/mac80211/sta_info.c | 28 ----------------------------
+ net/mac80211/sta_info.h | 11 -----------
+ net/mac80211/tx.c | 9 +--------
+ 6 files changed, 1 insertion(+), 71 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index fee854892bec5..8e70941602064 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -5311,22 +5311,6 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
+ struct ieee80211_tx_rate *dest,
+ int max_rates);
+
+-/**
+- * ieee80211_sta_set_expected_throughput - set the expected tpt for a station
+- *
+- * Call this function to notify mac80211 about a change in expected throughput
+- * to a station. A driver for a device that does rate control in firmware can
+- * call this function when the expected throughput estimate towards a station
+- * changes. The information is used to tune the CoDel AQM applied to traffic
+- * going towards that station (which can otherwise be too aggressive and cause
+- * slow stations to starve).
+- *
+- * @pubsta: the station to set throughput for.
+- * @thr: the current expected throughput in kbps.
+- */
+-void ieee80211_sta_set_expected_throughput(struct ieee80211_sta *pubsta,
+- u32 thr);
+-
+ /**
+ * ieee80211_tx_rate_update - transmit rate update callback
+ *
+diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
+index 1e9389c49a57d..e6f937cfedcf6 100644
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -152,12 +152,6 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf,
+ spin_lock_bh(&local->fq.lock);
+ rcu_read_lock();
+
+- p += scnprintf(p,
+- bufsz + buf - p,
+- "target %uus interval %uus ecn %s\n",
+- codel_time_to_us(sta->cparams.target),
+- codel_time_to_us(sta->cparams.interval),
+- sta->cparams.ecn ? "yes" : "no");
+ p += scnprintf(p,
+ bufsz + buf - p,
+ "tid ac backlog-bytes backlog-packets new-flows drops marks overlimit collisions tx-bytes tx-packets flags\n");
+diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
+index 3dc9752188d58..1b045b62961f5 100644
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -971,8 +971,6 @@ int rate_control_set_rates(struct ieee80211_hw *hw,
+ if (sta->uploaded)
+ drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
+
+- ieee80211_sta_set_expected_throughput(pubsta, sta_get_expected_throughput(sta));
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(rate_control_set_rates);
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 49095f19a0f22..4eb45e08b97e7 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -18,7 +18,6 @@
+ #include <linux/timer.h>
+ #include <linux/rtnetlink.h>
+
+-#include <net/codel.h>
+ #include <net/mac80211.h>
+ #include "ieee80211_i.h"
+ #include "driver-ops.h"
+@@ -683,12 +682,6 @@ __sta_info_alloc(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+
+- sta->cparams.ce_threshold = CODEL_DISABLED_THRESHOLD;
+- sta->cparams.target = MS2TIME(20);
+- sta->cparams.interval = MS2TIME(100);
+- sta->cparams.ecn = true;
+- sta->cparams.ce_threshold_selector = 0;
+- sta->cparams.ce_threshold_mask = 0;
+
+ sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
+
+@@ -2878,27 +2871,6 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ return sta->deflink.status_stats.last_ack;
+ }
+
+-static void sta_update_codel_params(struct sta_info *sta, u32 thr)
+-{
+- if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
+- sta->cparams.target = MS2TIME(50);
+- sta->cparams.interval = MS2TIME(300);
+- sta->cparams.ecn = false;
+- } else {
+- sta->cparams.target = MS2TIME(20);
+- sta->cparams.interval = MS2TIME(100);
+- sta->cparams.ecn = true;
+- }
+-}
+-
+-void ieee80211_sta_set_expected_throughput(struct ieee80211_sta *pubsta,
+- u32 thr)
+-{
+- struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+-
+- sta_update_codel_params(sta, thr);
+-}
+-
+ int ieee80211_sta_allocate_link(struct sta_info *sta, unsigned int link_id)
+ {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 9195d5a2de0a8..a9cfeeb13e53f 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -466,14 +466,6 @@ struct ieee80211_fragment_cache {
+ unsigned int next;
+ };
+
+-/*
+- * The bandwidth threshold below which the per-station CoDel parameters will be
+- * scaled to be more lenient (to prevent starvation of slow stations). This
+- * value will be scaled by the number of active stations when it is being
+- * applied.
+- */
+-#define STA_SLOW_THRESHOLD 6000 /* 6 Mbps */
+-
+ /**
+ * struct link_sta_info - Link STA information
+ * All link specific sta info are stored here for reference. This can be
+@@ -619,7 +611,6 @@ struct link_sta_info {
+ * @sta: station information we share with the driver
+ * @sta_state: duplicates information about station state (for debug)
+ * @rcu_head: RCU head used for freeing this station struct
+- * @cparams: CoDel parameters for this station.
+ * @reserved_tid: reserved TID (if any, otherwise IEEE80211_TID_UNRESERVED)
+ * @amsdu_mesh_control: track the mesh A-MSDU format used by the peer:
+ *
+@@ -710,8 +701,6 @@ struct sta_info {
+ struct dentry *debugfs_dir;
+ #endif
+
+- struct codel_params cparams;
+-
+ u8 reserved_tid;
+ s8 amsdu_mesh_control;
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index ef16ff149730a..00c309e7768e1 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1401,16 +1401,9 @@ static struct sk_buff *fq_tin_dequeue_func(struct fq *fq,
+
+ local = container_of(fq, struct ieee80211_local, fq);
+ txqi = container_of(tin, struct txq_info, tin);
++ cparams = &local->cparams;
+ cstats = &txqi->cstats;
+
+- if (txqi->txq.sta) {
+- struct sta_info *sta = container_of(txqi->txq.sta,
+- struct sta_info, sta);
+- cparams = &sta->cparams;
+- } else {
+- cparams = &local->cparams;
+- }
+-
+ if (flow == &tin->default_flow)
+ cvars = &txqi->def_cvars;
+ else
+--
+2.39.5
+
--- /dev/null
+From 7a2dc2797f19f511c7fd0c6ff774733a8f549f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:47:59 -0700
+Subject: scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
+ commands
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126 ]
+
+In lpfc_check_sli_ndlp(), the get_job_els_rsp64_did remote_id assignment
+does not apply for GEN_REQUEST64 commands as it only has meaning for a
+ELS_REQUEST64 command. So, if (iocb->ndlp == ndlp) is false, we could
+erroneously return the wrong value. Fix by replacing the fallthrough
+statement with a break statement before the remote_id check.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20250425194806.3585-2-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index f2e4237ff3d99..34f77b250387c 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -5082,7 +5082,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba,
+ case CMD_GEN_REQUEST64_CR:
+ if (iocb->ndlp == ndlp)
+ return 1;
+- fallthrough;
++ break;
+ case CMD_ELS_REQUEST64_CR:
+ if (remote_id == ndlp->nlp_DID)
+ return 1;
+--
+2.39.5
+
--- /dev/null
+From 9fd075eb99c01845d896133ca0b56060d5431706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 13:34:22 +0200
+Subject: scsi: lpfc: Use memcpy() for BIOS version
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit ae82eaf4aeea060bb736c3e20c0568b67c701d7d ]
+
+The strlcat() with FORTIFY support is triggering a panic because it
+thinks the target buffer will overflow although the correct target
+buffer size is passed in.
+
+Anyway, instead of memset() with 0 followed by a strlcat(), just use
+memcpy() and ensure that the resulting buffer is NULL terminated.
+
+BIOSVersion is only used for the lpfc_printf_log() which expects a
+properly terminated string.
+
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Link: https://lore.kernel.org/r/20250409-fix-lpfc-bios-str-v1-1-05dac9e51e13@kernel.org
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 6748fba48a07e..4dccbaeb63283 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -6020,9 +6020,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba)
+ phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr);
+ phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr);
+
+- memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion));
+- strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str,
++ memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str,
+ sizeof(phba->BIOSVersion));
++ phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0';
+
+ lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+ "3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, "
+--
+2.39.5
+
--- /dev/null
+From 00247bc4e886ab5273b1d99f338670a720e6adc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 13:32:26 -0500
+Subject: scsi: smartpqi: Add new PCI IDs
+
+From: David Strahan <david.strahan@microchip.com>
+
+[ Upstream commit 01b8bdddcfab035cf70fd9981cb20593564cd15d ]
+
+Add in support for more PCI devices.
+
+All PCI ID entries in Hex.
+
+Add PCI IDs for Ramaxel controllers:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ Ramaxel SmartHBA RX8238-16i 9005 028f 1018 8238
+ Ramaxel SSSRAID card 9005 028f 1f3f 0610
+
+Add PCI ID for Alibaba controller:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ HBA AS1340 9005 028f 1ded 3301
+
+Add PCI IDs for Inspur controller:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ RT0800M6E2i 9005 028f 1bd4 00a3
+
+Add PCI IDs for Delta controllers:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ThinkSystem 4450-8i SAS/SATA/NVMe PCIe Gen4 9005 028f 1d49 0222
+24Gb HBA
+ThinkSystem 4450-16i SAS/SATA/NVMe PCIe Gen4 9005 028f 1d49 0223
+24Gb HBA
+ThinkSystem 4450-8e SAS/SATA PCIe Gen4 9005 028f 1d49 0224
+24Gb HBA
+ThinkSystem RAID 4450-16e PCIe Gen4 24Gb 9005 028f 1d49 0225
+Adapter HBA
+ThinkSystem RAID 5450-16i PCIe Gen4 24Gb Adapter 9005 028f 1d49 0521
+ThinkSystem RAID 9450-8i 4GB Flash PCIe Gen4 9005 028f 1d49 0624
+24Gb Adapter
+ThinkSystem RAID 9450-16i 4GB Flash PCIe Gen4 9005 028f 1d49 0625
+24Gb Adapter
+ThinkSystem RAID 9450-16i 4GB Flash PCIe Gen4 9005 028f 1d49 0626
+24Gb Adapter
+ThinkSystem RAID 9450-32i 8GB Flash PCIe Gen4 9005 028f 1d49 0627
+24Gb Adapter
+ThinkSystem RAID 9450-16e 4GB Flash PCIe Gen4 9005 028f 1d49 0628
+24Gb Adapter
+
+Add PCI ID for Cloudnine Controller:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ SmartHBA P6600-24i 9005 028f 1f51 100b
+
+Add PCI IDs for Hurraydata Controllers:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ HRDT TrustHBA H4100-8i 9005 028f 207d 4044
+ HRDT TrustHBA H4100-8e 9005 028f 207d 4054
+ HRDT TrustHBA H4100-16i 9005 028f 207d 4084
+ HRDT TrustHBA H4100-16e 9005 028f 207d 4094
+ HRDT TrustRAID D3152s-8i 9005 028f 207d 4140
+ HRDT TrustRAID D3154s-8i 9005 028f 207d 4240
+
+Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
+Reviewed-by: Scott Teel <scott.teel@microchip.com>
+Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com>
+Signed-off-by: David Strahan <david.strahan@microchip.com>
+Signed-off-by: Don Brace <don.brace@microchip.com>
+Link: https://lore.kernel.org/r/20250423183229.538572-3-don.brace@microchip.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 84 +++++++++++++++++++++++++++
+ 1 file changed, 84 insertions(+)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 8cc9f924a8ae6..c5a21e369e167 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -9708,6 +9708,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1bd4, 0x0089)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x1bd4, 0x00a3)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1ff9, 0x00a1)
+@@ -10044,6 +10048,30 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_ADAPTEC2, 0x14f0)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4044)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4054)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4084)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4094)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4140)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4240)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_ADVANTECH, 0x8312)
+@@ -10260,6 +10288,14 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1cc4, 0x0201)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x1018, 0x8238)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x1f3f, 0x0610)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_LENOVO, 0x0220)
+@@ -10268,10 +10304,30 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_LENOVO, 0x0221)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0222)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0223)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0224)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0225)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_LENOVO, 0x0520)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0521)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_LENOVO, 0x0522)
+@@ -10292,6 +10348,26 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_LENOVO, 0x0623)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0624)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0625)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0626)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0627)
++ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ PCI_VENDOR_ID_LENOVO, 0x0628)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1014, 0x0718)
+@@ -10320,6 +10396,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1137, 0x0300)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x1ded, 0x3301)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1ff9, 0x0045)
+@@ -10468,6 +10548,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1f51, 0x100a)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x1f51, 0x100b)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x1f51, 0x100e)
+--
+2.39.5
+
--- /dev/null
+From 7a4bd8e860ef11cad0eb669c6c4868491c18fe84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 10:17:28 +0200
+Subject: sctp: Do not wake readers in __sctp_write_space()
+
+From: Petr Malat <oss@malat.biz>
+
+[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ]
+
+Function __sctp_write_space() doesn't set poll key, which leads to
+ep_poll_callback() waking up all waiters, not only these waiting
+for the socket being writable. Set the key properly using
+wake_up_interruptible_poll(), which is preferred over the sync
+variant, as writers are not woken up before at least half of the
+queue is available. Also, TCP does the same.
+
+Signed-off-by: Petr Malat <oss@malat.biz>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20250516081727.1361451-1-oss@malat.biz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 53725ee7ba06d..b301d64d9d80f 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -9100,7 +9100,8 @@ static void __sctp_write_space(struct sctp_association *asoc)
+ wq = rcu_dereference(sk->sk_wq);
+ if (wq) {
+ if (waitqueue_active(&wq->wait))
+- wake_up_interruptible(&wq->wait);
++ wake_up_interruptible_poll(&wq->wait, EPOLLOUT |
++ EPOLLWRNORM | EPOLLWRBAND);
+
+ /* Note that we try to include the Async I/O support
+ * here by modeling from the current TCP/UDP code.
+--
+2.39.5
+
iio-adc-ad7944-mask-high-bits-on-direct-read.patch
iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch
iio-adc-ad7606_spi-fix-reg-write-value-mask.patch
+acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch
+asoc-amd-yc-add-quirk-for-lenovo-yoga-pro-7-14asp9.patch
+clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch
+tools-nolibc-use-intmax-definitions-from-compiler.patch
+power-supply-collie-fix-wakeup-source-leaks-on-devic.patch
+mmc-add-quirk-to-disable-ddr50-tuning.patch
+acpica-avoid-sequence-overread-in-call-to-strncmp.patch
+mmc-sdhci-esdhc-imx-save-tuning-value-when-card-stay.patch
+asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch
+asoc-intel-sdw_utils-assign-initial-value-in-asoc_sd.patch
+acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch
+acpi-add-missing-prototype-for-non-config_suspend-co.patch
+acpica-fix-acpi-parse-and-parseext-cache-leaks.patch
+acpica-apply-pack-1-to-union-aml_resource.patch
+alsa-hda-cs35l41-fix-swapped-l-r-audio-channels-for-.patch
+power-supply-bq27xxx-retrieve-again-when-busy.patch
+pmdomain-core-reset-genpd-states-to-avoid-freeing-in.patch
+acpica-utilities-fix-overflow-check-in-vsnprintf.patch
+platform-msi-add-msi_remove_device_irq_domain-in-pla.patch
+asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch
+make-cc-option-work-correctly-for-the-wno-xyzzy-patt.patch
+gpiolib-of-add-polarity-quirk-for-s5m8767.patch
+pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch
+tools-nolibc-use-pselect6_time64-if-available.patch
+power-supply-max17040-adjust-thermal-channel-scaling.patch
+acpi-battery-negate-current-when-discharging.patch
+net-macb-check-return-value-of-dma_set_mask_and_cohe.patch
+net-lan743x-modify-the-eeprom-and-otp-size-for-pci1x.patch
+tipc-use-kfree_sensitive-for-aead-cleanup.patch
+f2fs-use-vmalloc-instead-of-kvmalloc-in-.init_-de-co.patch
+bpf-check-rcu_read_lock_trace_held-in-bpf_map_lookup.patch
+bluetooth-btusb-add-new-vid-pid-13d3-3584-for-mt7922.patch
+i2c-designware-invoke-runtime-suspend-on-quick-slave.patch
+wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch
+emulex-benet-correct-command-version-selection-in-be.patch
+bluetooth-btusb-add-new-vid-pid-13d3-3630-for-mt7925.patch
+wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch
+wifi-mt76-mt7921-add-160-mhz-ap-for-mt7922-device.patch
+wifi-mt76-mt7925-introduce-thermal-protection.patch
+wifi-mac80211-validate-scan_flag_ap-in-scan-request-.patch
+sctp-do-not-wake-readers-in-__sctp_write_space.patch
+libbpf-btf-fix-string-handling-to-support-multi-spli.patch
+cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch
+i2c-tegra-check-msg-length-in-smbus-block-read.patch
+i2c-npcm-add-clock-toggle-recovery.patch
+clk-qcom-gcc-x1e80100-set-force-mem-core-for-ufs-clo.patch
+net-dlink-add-synchronization-for-stats-update.patch
+wifi-ath12k-fix-macro-definition-hal_rx_msdu_pkt_len.patch
+wifi-ath12k-fix-a-possible-dead-lock-caused-by-ab-ba.patch
+wifi-ath11k-fix-qmi-memory-reuse-logic.patch
+iommu-amd-allow-matching-acpi-hid-devices-without-ma.patch
+wifi-rtw89-leave-idle-mode-when-setting-wep-encrypti.patch
+tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch
+tcp-remove-zero-tcp-ts-samples-for-autotuning.patch
+tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch
+tcp-add-receive-queue-awareness-in-tcp_rcv_space_adj.patch
+x86-sgx-prevent-attempts-to-reclaim-poisoned-pages.patch
+ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch
+net-page_pool-don-t-recycle-into-cache-on-preempt_rt.patch
+xfrm-validate-assignment-of-maximal-possible-seq-num.patch
+openvswitch-stricter-validation-for-the-userspace-ac.patch
+net-atlantic-generate-software-timestamp-just-before.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28044
+bpf-pass-the-same-orig_call-value-to-trampoline-func.patch
+net-stmmac-generate-software-timestamp-just-before-t.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-13955
+libbpf-check-bpf_map_skeleton-link-for-null.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-20863
+net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch
+net-vertexcom-mse102x-return-code-for-mse102x_rx_pkt.patch
+wireless-purelifi-plfxlc-fix-memory-leak-in-plfxlc_u.patch
+wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch
+bpftool-fix-cgroup-command-to-only-show-cgroup-bpf-p.patch
+clk-rockchip-rk3036-mark-ddrphy-as-critical.patch
+hid-asus-check-rog-ally-mcu-version-and-warn.patch
+wifi-iwlwifi-mvm-fix-beacon-cck-flag.patch
+f2fs-fix-to-bail-out-in-get_new_segment.patch
+netfilter-nft_set_pipapo-clamp-maximum-map-bucket-si.patch
+libbpf-add-identical-pointer-detection-to-btf_dedup_.patch
+scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch
+scsi-smartpqi-add-new-pci-ids.patch
+iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch
+wifi-iwlwifi-pcie-make-sure-to-lock-rxq-read.patch
+wifi-rtw89-8922a-fix-tx-fail-with-wrong-vco-setting.patch
+wifi-mac80211_hwsim-prevent-tsf-from-setting-if-beac.patch
+netdevsim-mark-napi-id-on-skb-in-nsim_rcv.patch
+net-mlx5-hws-fix-ip-version-decision.patch
+bpf-use-proper-type-to-calculate-bpf_raw_tp_null_arg.patch
+wifi-mac80211-vlan-traffic-in-multicast-path.patch
+revert-mac80211-dynamically-set-codel-parameters-per.patch
+wifi-iwlwifi-add-missing-module_firmware-for-qu-c0-j.patch
+net-bridge-mcast-update-multicast-contex-when-vlan-s.patch
+net-bridge-mcast-re-implement-br_multicast_-enable-d.patch
+vxlan-do-not-treat-dst-cache-initialization-errors-a.patch
+bnxt_en-remove-unused-field-ref_count-in-struct-bnxt.patch
+wifi-ath12k-using-msdu-end-descriptor-to-check-for-r.patch
+net-ethernet-ti-am65-cpsw-handle-eprobe_defer.patch
+software-node-correct-a-oob-check-in-software_node_g.patch
+isofs-fix-y2038-and-y2156-issues-in-rock-ridge-tf-en.patch
+pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch
+wifi-ath12k-fix-failed-to-set-mhi-state-error-during.patch
+scsi-lpfc-use-memcpy-for-bios-version.patch
+sock-correct-error-checking-condition-for-assign-rel.patch
+i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch
+ixgbe-fix-unreachable-retry-logic-in-combined-and-by.patch
+rdma-hns-initialize-db-in-update_srq_db.patch
+ice-fix-check-for-existing-switch-rule.patch
+usbnet-asix-ax88772-leave-the-carrier-control-to-phy.patch
+f2fs-fix-to-set-atomic-write-status-more-clear.patch
+bpf-sockmap-fix-data-lost-during-eagain-retries.patch
+net-ethernet-cortina-use-toe-tso-on-all-tcp.patch
+octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch
+wifi-ath11k-determine-pm-policy-based-on-machine-mod.patch
+wifi-ath12k-fix-link-valid-field-initialization-in-t.patch
+wifi-ath12k-fix-incorrect-ce-addresses.patch
+wifi-ath12k-pass-correct-values-of-center-freq1-and-.patch
+net-mlx5-hws-harden-ip-version-definer-checks.patch
+fbcon-make-sure-modelist-not-set-on-unregistered-con.patch
+watchdog-da9052_wdt-respect-twdmin.patch
+bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch
+arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch
+tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch
+revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch
+fs-xattr.c-fix-simple_xattr_list.patch
+platform-x86-amd-pmc-clear-metrics-table-at-start-of.patch
+platform-x86-amd-pmf-prevent-amd_pmf_tee_deinit-from.patch
+platform-x86-dell_rbu-fix-list-usage.patch
+platform-x86-dell_rbu-stop-overwriting-data-buffer.patch
+powerpc-vdso-fix-build-of-vdso32-with-pcrel.patch
+powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch
--- /dev/null
+From 2367aafa1c8b7ab78549db8c87960822e0106ae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Apr 2025 09:01:27 +0800
+Subject: sock: Correct error checking condition for
+ (assign|release)_proto_idx()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit faeefc173be40512341b102cf1568aa0b6571acd ]
+
+(assign|release)_proto_idx() wrongly check find_first_zero_bit() failure
+by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
+
+Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
+
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://patch.msgid.link/20250410-fix_net-v2-1-d69e7c5739a4@quicinc.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3c5386c76d6fe..9c63da2829f6e 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3930,7 +3930,7 @@ static int assign_proto_idx(struct proto *prot)
+ {
+ prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
+
+- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
++ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
+ pr_err("PROTO_INUSE_NR exhausted\n");
+ return -ENOSPC;
+ }
+@@ -3941,7 +3941,7 @@ static int assign_proto_idx(struct proto *prot)
+
+ static void release_proto_idx(struct proto *prot)
+ {
+- if (prot->inuse_idx != PROTO_INUSE_NR - 1)
++ if (prot->inuse_idx != PROTO_INUSE_NR)
+ clear_bit(prot->inuse_idx, proto_inuse_idx);
+ }
+ #else
+--
+2.39.5
+
--- /dev/null
+From e94584b414b9241eda09bea05414108e9a9fdc6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 19:36:52 +0800
+Subject: software node: Correct a OOB check in
+ software_node_get_reference_args()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ]
+
+software_node_get_reference_args() wants to get @index-th element, so
+the property value requires at least '(index + 1) * sizeof(*ref)' bytes
+but that can not be guaranteed by current OOB check, and may cause OOB
+for malformed property.
+
+Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.
+
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index eb6eb25b343ba..53b3f0061ad12 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -529,7 +529,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,
+ if (prop->is_inline)
+ return -EINVAL;
+
+- if (index * sizeof(*ref) >= prop->length)
++ if ((index + 1) * sizeof(*ref) > prop->length)
+ return -ENOENT;
+
+ ref_array = prop->pointer;
+--
+2.39.5
+
--- /dev/null
+From c9676d44251492ad2657d695ea2c8948e5c9a08e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:12 +0000
+Subject: tcp: add receive queue awareness in tcp_rcv_space_adjust()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ea33537d82921e71f852ea2ed985acc562125efe ]
+
+If the application can not drain fast enough a TCP socket queue,
+tcp_rcv_space_adjust() can overestimate tp->rcvq_space.space.
+
+Then sk->sk_rcvbuf can grow and hit tcp_rmem[2] for no good reason.
+
+Fix this by taking into acount the number of available bytes.
+
+Keeping sk->sk_rcvbuf at the right size allows better cache efficiency.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/tcp.h | 2 +-
+ net/ipv4/tcp_input.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 6a5e08b937b31..5f56fa8780131 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -336,7 +336,7 @@ struct tcp_sock {
+ } rcv_rtt_est;
+ /* Receiver queue space */
+ struct {
+- u32 space;
++ int space;
+ u32 seq;
+ u64 time;
+ } rcvq_space;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 7e772b6cb45b6..c59c1cc1a8fed 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -749,8 +749,7 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
+ void tcp_rcv_space_adjust(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+- u32 copied;
+- int time;
++ int time, inq, copied;
+
+ trace_tcp_rcv_space_adjust(sk);
+
+@@ -761,6 +760,9 @@ void tcp_rcv_space_adjust(struct sock *sk)
+
+ /* Number of bytes copied to user in last RTT */
+ copied = tp->copied_seq - tp->rcvq_space.seq;
++ /* Number of bytes in receive queue. */
++ inq = tp->rcv_nxt - tp->copied_seq;
++ copied -= inq;
+ if (copied <= tp->rcvq_space.space)
+ goto new_measure;
+
+--
+2.39.5
+
--- /dev/null
+From d41e5470b04f41f87411c9aebedc2fd6cb6b4fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:15 +0000
+Subject: tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ]
+
+tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT
+in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust()
+
+When TCP TS are enabled, tcp_rcv_rtt_update() is using
+EWMA to smooth the samples.
+
+Change this to immediately latch the incoming value if it
+is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust()
+does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index d29219e067b7f..cf4fef18a9cad 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -665,10 +665,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss);
+ */
+ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ {
+- u32 new_sample = tp->rcv_rtt_est.rtt_us;
+- long m = sample;
++ u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us;
++ long m = sample << 3;
+
+- if (new_sample != 0) {
++ if (old_sample == 0 || m < old_sample) {
++ new_sample = m;
++ } else {
+ /* If we sample in larger samples in the non-timestamp
+ * case, we could grossly overestimate the RTT especially
+ * with chatty applications or bulk transfer apps which
+@@ -679,17 +681,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ * else with timestamps disabled convergence takes too
+ * long.
+ */
+- if (!win_dep) {
+- m -= (new_sample >> 3);
+- new_sample += m;
+- } else {
+- m <<= 3;
+- if (m < new_sample)
+- new_sample = m;
+- }
+- } else {
+- /* No previous measure. */
+- new_sample = m << 3;
++ if (win_dep)
++ return;
++ new_sample = old_sample - (old_sample >> 3) + sample;
+ }
+
+ tp->rcv_rtt_est.rtt_us = new_sample;
+--
+2.39.5
+
--- /dev/null
+From 1bd1daebff79ed100cbce18f89ec6f2fd8c891b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:14 +0000
+Subject: tcp: fix initial tp->rcvq_space.space value for passive TS enabled
+ flows
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ]
+
+tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows
+before the call to tcp_init_transfer() / tcp_init_buffer_space().
+
+Otherwise tp->rcvq_space.space is off by 120 bytes
+(TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED).
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-7-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 61ada4682094f..7e772b6cb45b6 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6835,6 +6835,9 @@ tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ if (!tp->srtt_us)
+ tcp_synack_rtt_meas(sk, req);
+
++ if (tp->rx_opt.tstamp_ok)
++ tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
++
+ if (req) {
+ tcp_rcv_synrecv_state_fastopen(sk);
+ } else {
+@@ -6860,9 +6863,6 @@ tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
+ tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
+
+- if (tp->rx_opt.tstamp_ok)
+- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
+-
+ if (!inet_csk(sk)->icsk_ca_ops->cong_control)
+ tcp_update_pacing_rate(sk);
+
+--
+2.39.5
+
--- /dev/null
+From e140423f7a6b2f539db497e3022c9fb20283f1dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:13 +0000
+Subject: tcp: remove zero TCP TS samples for autotuning
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit d59fc95be9d0fd05ed3ccc11b4a2f832bdf2ee03 ]
+
+For TCP flows using ms RFC 7323 timestamp granularity
+tcp_rcv_rtt_update() can be fed with 1 ms samples, breaking
+TCP autotuning for data center flows with sub ms RTT.
+
+Instead, rely on the window based samples, fed by tcp_rcv_rtt_measure()
+
+tcp_rcvbuf_grow() for a 10 second TCP_STREAM sesssion now looks saner.
+We can see rcvbuf is kept at a reasonable value.
+
+ 222.234976: tcp:tcp_rcvbuf_grow: time=348 rtt_us=330 copied=110592 inq=0 space=40960 ooo=0 scaling_ratio=230 rcvbuf=131072 ...
+ 222.235276: tcp:tcp_rcvbuf_grow: time=300 rtt_us=288 copied=126976 inq=0 space=110592 ooo=0 scaling_ratio=230 rcvbuf=246187 ...
+ 222.235569: tcp:tcp_rcvbuf_grow: time=294 rtt_us=288 copied=184320 inq=0 space=126976 ooo=0 scaling_ratio=230 rcvbuf=282659 ...
+ 222.235833: tcp:tcp_rcvbuf_grow: time=264 rtt_us=244 copied=373760 inq=0 space=184320 ooo=0 scaling_ratio=230 rcvbuf=410312 ...
+ 222.236142: tcp:tcp_rcvbuf_grow: time=308 rtt_us=219 copied=424960 inq=20480 space=373760 ooo=0 scaling_ratio=230 rcvbuf=832022 ...
+ 222.236378: tcp:tcp_rcvbuf_grow: time=236 rtt_us=219 copied=692224 inq=49152 space=404480 ooo=0 scaling_ratio=230 rcvbuf=900407 ...
+ 222.236602: tcp:tcp_rcvbuf_grow: time=225 rtt_us=219 copied=730112 inq=49152 space=643072 ooo=0 scaling_ratio=230 rcvbuf=1431534 ...
+ 222.237050: tcp:tcp_rcvbuf_grow: time=229 rtt_us=219 copied=1160192 inq=49152 space=680960 ooo=0 scaling_ratio=230 rcvbuf=1515876 ...
+ 222.237618: tcp:tcp_rcvbuf_grow: time=305 rtt_us=218 copied=2228224 inq=49152 space=1111040 ooo=0 scaling_ratio=230 rcvbuf=2473271 ...
+ 222.238591: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=3063808 inq=360448 space=2179072 ooo=0 scaling_ratio=230 rcvbuf=4850803 ...
+ 222.240647: tcp:tcp_rcvbuf_grow: time=260 rtt_us=218 copied=2752512 inq=0 space=2703360 ooo=0 scaling_ratio=230 rcvbuf=6017914 ...
+ 222.243535: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=2834432 inq=49152 space=2752512 ooo=0 scaling_ratio=230 rcvbuf=6127331 ...
+ 222.245108: tcp:tcp_rcvbuf_grow: time=240 rtt_us=218 copied=2883584 inq=49152 space=2785280 ooo=0 scaling_ratio=230 rcvbuf=6200275 ...
+ 222.245333: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=2859008 inq=0 space=2834432 ooo=0 scaling_ratio=230 rcvbuf=6309692 ...
+ 222.301021: tcp:tcp_rcvbuf_grow: time=222 rtt_us=218 copied=2883584 inq=0 space=2859008 ooo=0 scaling_ratio=230 rcvbuf=6364400 ...
+ 222.989242: tcp:tcp_rcvbuf_grow: time=225 rtt_us=218 copied=2899968 inq=0 space=2883584 ooo=0 scaling_ratio=230 rcvbuf=6419108 ...
+ 224.139553: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=3014656 inq=65536 space=2899968 ooo=0 scaling_ratio=230 rcvbuf=6455580 ...
+ 224.584608: tcp:tcp_rcvbuf_grow: time=232 rtt_us=218 copied=3014656 inq=49152 space=2949120 ooo=0 scaling_ratio=230 rcvbuf=6564997 ...
+ 230.145560: tcp:tcp_rcvbuf_grow: time=223 rtt_us=218 copied=2981888 inq=0 space=2965504 ooo=0 scaling_ratio=230 rcvbuf=6601469 ...
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-6-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index cf4fef18a9cad..61ada4682094f 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -707,7 +707,7 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
+ tp->rcv_rtt_est.time = tp->tcp_mstamp;
+ }
+
+-static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp)
++static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp, u32 min_delta)
+ {
+ u32 delta, delta_us;
+
+@@ -717,7 +717,7 @@ static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp)
+
+ if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
+ if (!delta)
+- delta = 1;
++ delta = min_delta;
+ delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+ return delta_us;
+ }
+@@ -735,9 +735,9 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
+
+ if (TCP_SKB_CB(skb)->end_seq -
+ TCP_SKB_CB(skb)->seq >= inet_csk(sk)->icsk_ack.rcv_mss) {
+- s32 delta = tcp_rtt_tsopt_us(tp);
++ s32 delta = tcp_rtt_tsopt_us(tp, 0);
+
+- if (delta >= 0)
++ if (delta > 0)
+ tcp_rcv_rtt_update(tp, delta, 0);
+ }
+ }
+@@ -3220,7 +3220,7 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+ */
+ if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp &&
+ tp->rx_opt.rcv_tsecr && flag & FLAG_ACKED)
+- seq_rtt_us = ca_rtt_us = tcp_rtt_tsopt_us(tp);
++ seq_rtt_us = ca_rtt_us = tcp_rtt_tsopt_us(tp, 1);
+
+ rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */
+ if (seq_rtt_us < 0)
+--
+2.39.5
+
--- /dev/null
+From 2ea59e3bc9c4d607b20badf6bbc47b43be177712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 15:06:43 +0200
+Subject: tee: Prevent size calculation wraparound on 32-bit kernels
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 39bb67edcc582b3b386a9ec983da67fa8a10ec03 ]
+
+The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on
+32-bit kernels: Multiplying a user-provided 32-bit value with the
+size of a structure can wrap around on such platforms.
+
+Fix it by using saturating arithmetic for the size calculation.
+
+This has no security consequences because, in all users of
+TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks
+for wrapping.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index d113679b1e2d7..acc7998758ad8 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -10,6 +10,7 @@
+ #include <linux/fs.h>
+ #include <linux/idr.h>
+ #include <linux/module.h>
++#include <linux/overflow.h>
+ #include <linux/slab.h>
+ #include <linux/tee_core.h>
+ #include <linux/uaccess.h>
+@@ -19,7 +20,7 @@
+
+ #define TEE_NUM_DEVICES 32
+
+-#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
++#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x)))
+
+ #define TEE_UUID_NS_NAME_SIZE 128
+
+@@ -487,7 +488,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx,
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+@@ -565,7 +566,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx,
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+@@ -699,7 +700,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx,
+ if (get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len)
++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+@@ -798,7 +799,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx,
+ get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len)
++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+--
+2.39.5
+
--- /dev/null
+From 168280432e4d3c03ce830b0cec5eba173860a9a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 May 2025 11:47:17 +0000
+Subject: tipc: use kfree_sensitive() for aead cleanup
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit c8ef20fe7274c5766a317f9193b70bed717b6b3d ]
+
+The tipc_aead_free() function currently uses kfree() to release the aead
+structure. However, this structure contains sensitive information, such
+as key's SALT value, which should be securely erased from memory to
+prevent potential leakage.
+
+To enhance security, replace kfree() with kfree_sensitive() when freeing
+the aead structure. This change ensures that sensitive data is explicitly
+cleared before memory deallocation, aligning with the approach used in
+tipc_aead_init() and adhering to best practices for handling confidential
+information.
+
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
+Link: https://patch.msgid.link/20250523114717.4021518-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index 79f91b6ca8c84..ea5bb131ebd06 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp)
+ }
+ free_percpu(aead->tfm_entry);
+ kfree_sensitive(aead->key);
+- kfree(aead);
++ kfree_sensitive(aead);
+ }
+
+ static int tipc_aead_users(struct tipc_aead __rcu *aead)
+--
+2.39.5
+
--- /dev/null
+From 875e235984371adb76ac2bb54c2987aa3bb411c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 11:00:39 +0200
+Subject: tools/nolibc: use intmax definitions from compiler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit e5407c0820ea5fa7117b85ed32b724af73156d63 ]
+
+The printf format checking in the compiler uses the intmax types from
+the compiler, not libc. This can lead to compiler errors.
+
+Instead use the types already provided by the compiler.
+
+Example issue with clang 19 for arm64:
+
+nolibc-test.c:30:2: error: format specifies type 'uintmax_t' (aka 'unsigned long') but the argument has type 'uintmax_t' (aka 'unsigned long long') [-Werror,-Wformat]
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/stdint.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/include/nolibc/stdint.h b/tools/include/nolibc/stdint.h
+index cd79ddd6170e0..b052ad6303c38 100644
+--- a/tools/include/nolibc/stdint.h
++++ b/tools/include/nolibc/stdint.h
+@@ -39,8 +39,8 @@ typedef size_t uint_fast32_t;
+ typedef int64_t int_fast64_t;
+ typedef uint64_t uint_fast64_t;
+
+-typedef int64_t intmax_t;
+-typedef uint64_t uintmax_t;
++typedef __INTMAX_TYPE__ intmax_t;
++typedef __UINTMAX_TYPE__ uintmax_t;
+
+ /* limits of integral types */
+
+--
+2.39.5
+
--- /dev/null
+From e51291bdfe4d13052e2d920ded8828768d49b60a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 11:00:40 +0200
+Subject: tools/nolibc: use pselect6_time64 if available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 248ddc80b145515286bfb75d08034ad4c0fdb08e ]
+
+riscv32 does not have any of the older select systemcalls.
+Use pselect6_time64 instead.
+poll() is also used to implement sleep().
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/sys.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h
+index 7b82bc3cf1074..ab5b9ff285c03 100644
+--- a/tools/include/nolibc/sys.h
++++ b/tools/include/nolibc/sys.h
+@@ -981,6 +981,14 @@ int sys_select(int nfds, fd_set *rfds, fd_set *wfds, fd_set *efds, struct timeva
+ t.tv_nsec = timeout->tv_usec * 1000;
+ }
+ return my_syscall6(__NR_pselect6, nfds, rfds, wfds, efds, timeout ? &t : NULL, NULL);
++#elif defined(__NR_pselect6_time64)
++ struct __kernel_timespec t;
++
++ if (timeout) {
++ t.tv_sec = timeout->tv_sec;
++ t.tv_nsec = timeout->tv_usec * 1000;
++ }
++ return my_syscall6(__NR_pselect6_time64, nfds, rfds, wfds, efds, timeout ? &t : NULL, NULL);
+ #else
+ return __nolibc_enosys(__func__, nfds, rfds, wfds, efds, timeout);
+ #endif
+--
+2.39.5
+
--- /dev/null
+From b0c0f378a82a6b8117b95c23aec0fbfae9211595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 13:59:41 +0200
+Subject: usbnet: asix AX88772: leave the carrier control to phylink
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Hałasa <khalasa@piap.pl>
+
+[ Upstream commit 4145f00227ee80f21ab274e9cd9c09758e9bcf3d ]
+
+ASIX AX88772B based USB 10/100 Ethernet adapter doesn't come
+up ("carrier off"), despite the built-in 100BASE-FX PHY positive link
+indication. The internal PHY is configured (using EEPROM) in fixed
+100 Mbps full duplex mode.
+
+The primary problem appears to be using carrier_netif_{on,off}() while,
+at the same time, delegating carrier management to phylink. Use only the
+latter and remove "manual control" in the asix driver.
+
+I don't have any other AX88772 board here, but the problem doesn't seem
+specific to a particular board or settings - it's probably
+timing-dependent.
+
+Remove unused asix_adjust_link() as well.
+
+Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
+Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/m3plhmdfte.fsf_-_@t19.piap.pl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/asix.h | 1 -
+ drivers/net/usb/asix_common.c | 22 ----------------------
+ drivers/net/usb/asix_devices.c | 17 ++++-------------
+ 3 files changed, 4 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h
+index 74162190bccc1..8531b804021aa 100644
+--- a/drivers/net/usb/asix.h
++++ b/drivers/net/usb/asix.h
+@@ -224,7 +224,6 @@ int asix_write_rx_ctl(struct usbnet *dev, u16 mode, int in_pm);
+
+ u16 asix_read_medium_status(struct usbnet *dev, int in_pm);
+ int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm);
+-void asix_adjust_link(struct net_device *netdev);
+
+ int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm);
+
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 72ffc89b477ad..7fd763917ae2c 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -414,28 +414,6 @@ int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm)
+ return ret;
+ }
+
+-/* set MAC link settings according to information from phylib */
+-void asix_adjust_link(struct net_device *netdev)
+-{
+- struct phy_device *phydev = netdev->phydev;
+- struct usbnet *dev = netdev_priv(netdev);
+- u16 mode = 0;
+-
+- if (phydev->link) {
+- mode = AX88772_MEDIUM_DEFAULT;
+-
+- if (phydev->duplex == DUPLEX_HALF)
+- mode &= ~AX_MEDIUM_FD;
+-
+- if (phydev->speed != SPEED_100)
+- mode &= ~AX_MEDIUM_PS;
+- }
+-
+- asix_write_medium_mode(dev, mode, 0);
+- phy_print_status(phydev);
+- usbnet_link_change(dev, phydev->link, 0);
+-}
+-
+ int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm)
+ {
+ int ret;
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index da24941a6e444..9b0318fb50b55 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -752,7 +752,6 @@ static void ax88772_mac_link_down(struct phylink_config *config,
+ struct usbnet *dev = netdev_priv(to_net_dev(config->dev));
+
+ asix_write_medium_mode(dev, 0, 0);
+- usbnet_link_change(dev, false, false);
+ }
+
+ static void ax88772_mac_link_up(struct phylink_config *config,
+@@ -783,7 +782,6 @@ static void ax88772_mac_link_up(struct phylink_config *config,
+ m |= AX_MEDIUM_RFC;
+
+ asix_write_medium_mode(dev, m, 0);
+- usbnet_link_change(dev, true, false);
+ }
+
+ static const struct phylink_mac_ops ax88772_phylink_mac_ops = {
+@@ -1350,10 +1348,9 @@ static const struct driver_info ax88772_info = {
+ .description = "ASIX AX88772 USB 2.0 Ethernet",
+ .bind = ax88772_bind,
+ .unbind = ax88772_unbind,
+- .status = asix_status,
+ .reset = ax88772_reset,
+ .stop = ax88772_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | FLAG_MULTI_PACKET,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
+ .rx_fixup = asix_rx_fixup_common,
+ .tx_fixup = asix_tx_fixup,
+ };
+@@ -1362,11 +1359,9 @@ static const struct driver_info ax88772b_info = {
+ .description = "ASIX AX88772B USB 2.0 Ethernet",
+ .bind = ax88772_bind,
+ .unbind = ax88772_unbind,
+- .status = asix_status,
+ .reset = ax88772_reset,
+ .stop = ax88772_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+- FLAG_MULTI_PACKET,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
+ .rx_fixup = asix_rx_fixup_common,
+ .tx_fixup = asix_tx_fixup,
+ .data = FLAG_EEPROM_MAC,
+@@ -1376,11 +1371,9 @@ static const struct driver_info lxausb_t1l_info = {
+ .description = "Linux Automation GmbH USB 10Base-T1L",
+ .bind = ax88772_bind,
+ .unbind = ax88772_unbind,
+- .status = asix_status,
+ .reset = ax88772_reset,
+ .stop = ax88772_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+- FLAG_MULTI_PACKET,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
+ .rx_fixup = asix_rx_fixup_common,
+ .tx_fixup = asix_tx_fixup,
+ .data = FLAG_EEPROM_MAC,
+@@ -1412,10 +1405,8 @@ static const struct driver_info hg20f9_info = {
+ .description = "HG20F9 USB 2.0 Ethernet",
+ .bind = ax88772_bind,
+ .unbind = ax88772_unbind,
+- .status = asix_status,
+ .reset = ax88772_reset,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+- FLAG_MULTI_PACKET,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET,
+ .rx_fixup = asix_rx_fixup_common,
+ .tx_fixup = asix_tx_fixup,
+ .data = FLAG_EEPROM_MAC,
+--
+2.39.5
+
--- /dev/null
+From 40b228390a95a80c2fb565a1bb5ff24ddaeac2be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 15:11:41 +0300
+Subject: vxlan: Do not treat dst cache initialization errors as fatal
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 20c76dadc783759fd3819d289c72be590660cc8b ]
+
+FDB entries are allocated in an atomic context as they can be added from
+the data path when learning is enabled.
+
+After converting the FDB hash table to rhashtable, the insertion rate
+will be much higher (*) which will entail a much higher rate of per-CPU
+allocations via dst_cache_init().
+
+When adding a large number of entries (e.g., 256k) in a batch, a small
+percentage (< 0.02%) of these per-CPU allocations will fail [1]. This
+does not happen with the current code since the insertion rate is low
+enough to give the per-CPU allocator a chance to asynchronously create
+new chunks of per-CPU memory.
+
+Given that:
+
+a. Only a small percentage of these per-CPU allocations fail.
+
+b. The scenario where this happens might not be the most realistic one.
+
+c. The driver can work correctly without dst caches. The dst_cache_*()
+APIs first check that the dst cache was properly initialized.
+
+d. The dst caches are not always used (e.g., 'tos inherit').
+
+It seems reasonable to not treat these allocation failures as fatal.
+
+Therefore, do not bail when dst_cache_init() fails and suppress warnings
+by specifying '__GFP_NOWARN'.
+
+[1] percpu: allocation failed, size=40 align=8 atomic=1, atomic alloc failed, no space left
+
+(*) 97% reduction in average latency of vxlan_fdb_update() when adding
+256k entries in a batch.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250415121143.345227-14-idosch@nvidia.com
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
+index 474faccf75fd9..1a70770938001 100644
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -605,10 +605,10 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
+ if (rd == NULL)
+ return -ENOMEM;
+
+- if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) {
+- kfree(rd);
+- return -ENOMEM;
+- }
++ /* The driver can work correctly without a dst cache, so do not treat
++ * dst cache initialization errors as fatal.
++ */
++ dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN);
+
+ rd->remote_ip = *ip;
+ rd->remote_port = port;
+--
+2.39.5
+
--- /dev/null
+From a7b6b07e905c02d04f0499d9041e964b4b1f6287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 09:29:51 +0100
+Subject: watchdog: da9052_wdt: respect TWDMIN
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 325f510fcd9cda5a44bcb662b74ba4e3dabaca10 ]
+
+We have to wait at least the minimium time for the watchdog window
+(TWDMIN) before writings to the wdt register after the
+watchdog is activated.
+Otherwise the chip will assert TWD_ERROR and power down to reset mode.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-4-a38a560fef0e@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/da9052_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c
+index d708c091bf1b1..180526220d8c4 100644
+--- a/drivers/watchdog/da9052_wdt.c
++++ b/drivers/watchdog/da9052_wdt.c
+@@ -164,6 +164,7 @@ static int da9052_wdt_probe(struct platform_device *pdev)
+ da9052_wdt = &driver_data->wdt;
+
+ da9052_wdt->timeout = DA9052_DEF_TIMEOUT;
++ da9052_wdt->min_hw_heartbeat_ms = DA9052_TWDMIN;
+ da9052_wdt->info = &da9052_wdt_info;
+ da9052_wdt->ops = &da9052_wdt_ops;
+ da9052_wdt->parent = dev;
+--
+2.39.5
+
--- /dev/null
+From 970936d362886dd5467c9c00d665830a58d7c5e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 13:32:24 +0800
+Subject: wifi: ath11k: determine PM policy based on machine model
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit ce8669a27016354dfa8bf3c954255cb9f3583bae ]
+
+To handle the Lenovo unexpected wakeup issue [1], previously we revert
+commit 166a490f59ac ("wifi: ath11k: support hibernation"). So currently
+WLAN target is put into WoWLAN mode during suspend. This is a temporary
+solution as it does not work on machines where WLAN power is cut off.
+
+The thought here is that we do WoWLAN suspend on Lenovo machines while
+do non-WoWLAN suspend (which is done in the reverted commit) on other
+machines. This requires us to identify Lenovo machines from others.
+For that purpose, read board vendor and product name from DMI interface,
+match it against all known affected machines. If there is a match, choose
+WoWLAN suspend mode, else choose non-WoWLAN mode. Save the mode in ab
+for later reference.
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=219196
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
+
+Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Tested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Link: https://patch.msgid.link/20250328-ath11k-bring-hibernation-back-v3-1-23405ae23431@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.c | 55 ++++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/core.h | 7 ++++
+ 2 files changed, 62 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
+index 8002fb32a2cc1..2ec1771262fd9 100644
+--- a/drivers/net/wireless/ath/ath11k/core.c
++++ b/drivers/net/wireless/ath/ath11k/core.c
+@@ -811,6 +811,52 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
+ },
+ };
+
++static const struct dmi_system_id ath11k_pm_quirk_table[] = {
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21J4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21K4"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21K6"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21K8"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21KA"),
++ },
++ },
++ {
++ .driver_data = (void *)ATH11K_PM_WOW,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
++ },
++ },
++ {}
++};
++
+ static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab)
+ {
+ WARN_ON(!ab->hw_params.single_pdev_only);
+@@ -2197,8 +2243,17 @@ EXPORT_SYMBOL(ath11k_core_pre_init);
+
+ int ath11k_core_init(struct ath11k_base *ab)
+ {
++ const struct dmi_system_id *dmi_id;
+ int ret;
+
++ dmi_id = dmi_first_match(ath11k_pm_quirk_table);
++ if (dmi_id)
++ ab->pm_policy = (kernel_ulong_t)dmi_id->driver_data;
++ else
++ ab->pm_policy = ATH11K_PM_DEFAULT;
++
++ ath11k_dbg(ab, ATH11K_DBG_BOOT, "pm policy %u\n", ab->pm_policy);
++
+ ret = ath11k_core_soc_create(ab);
+ if (ret) {
+ ath11k_err(ab, "failed to create soc core: %d\n", ret);
+diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
+index fcdec14eb3cfa..09fdb7be0e197 100644
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -891,6 +891,11 @@ struct ath11k_msi_config {
+ u16 hw_rev;
+ };
+
++enum ath11k_pm_policy {
++ ATH11K_PM_DEFAULT,
++ ATH11K_PM_WOW,
++};
++
+ /* Master structure to hold the hw data which may be used in core module */
+ struct ath11k_base {
+ enum ath11k_hw_rev hw_rev;
+@@ -1053,6 +1058,8 @@ struct ath11k_base {
+ } testmode;
+ #endif
+
++ enum ath11k_pm_policy pm_policy;
++
+ /* must be last */
+ u8 drv_priv[] __aligned(sizeof(void *));
+ };
+--
+2.39.5
+
--- /dev/null
+From a60a4f7661f3605a82f5d4a2d72773fdf47d3c24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 13:02:41 +0500
+Subject: wifi: ath11k: Fix QMI memory reuse logic
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit cd2e7bae92bd7e65063ab8d04721d2b711ba4cbe ]
+
+Firmware requests 2 segments at first. The first segment is of 6799360
+whose allocation fails due to dma remapping not available. The success
+is returned to firmware. Then firmware asks for 22 smaller segments
+instead of 2 big ones. Those get allocated successfully. At suspend/
+hibernation time, these segments aren't freed as they will be reused
+by firmware after resuming.
+
+After resuming, the firmware asks for the 2 segments again with the
+first segment of 6799360 size. Since chunk->vaddr is not NULL, the
+type and size are compared with the previous type and size to know if
+it can be reused or not. Unfortunately, it is detected that it cannot
+be reused and this first smaller segment is freed. Then we continue to
+allocate 6799360 size memory which fails and ath11k_qmi_free_target_mem_chunk()
+is called which frees the second smaller segment as well. Later success
+is returned to firmware which asks for 22 smaller segments again. But
+as we had freed 2 segments already, we'll allocate the first 2 new
+smaller segments again and reuse the remaining 20. Hence 20 small
+segments are being reused instead of 22.
+
+Add skip logic when vaddr is set, but size/type don't match. Use the
+same skip and success logic as used when dma_alloc_coherent() fails.
+By skipping, the possibility of resume failure due to kernel failing to
+allocate memory for QMI can be avoided.
+
+ kernel: ath11k_pci 0000:03:00.0: failed to allocate dma memory for qmi (524288 B type 1)
+ ath11k_pci 0000:03:00.0: failed to allocate qmi target memory: -22
+
+Tested-on: WCN6855 WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6
+
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Reviewed-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Link: https://patch.msgid.link/20250428080242.466901-1-usama.anjum@collabora.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
+index 7a22483b35cd9..a5555c959dec9 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1989,6 +1989,15 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab)
+ chunk->prev_size == chunk->size)
+ continue;
+
++ if (ab->qmi.mem_seg_count <= ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT) {
++ ath11k_dbg(ab, ATH11K_DBG_QMI,
++ "size/type mismatch (current %d %u) (prev %d %u), try later with small size\n",
++ chunk->size, chunk->type,
++ chunk->prev_size, chunk->prev_type);
++ ab->qmi.target_mem_delayed = true;
++ return 0;
++ }
++
+ /* cannot reuse the existing chunk */
+ dma_free_coherent(ab->dev, chunk->prev_size,
+ chunk->vaddr, chunk->paddr);
+--
+2.39.5
+
--- /dev/null
+From 3bf64195990fec431b3666b6b2c26739bf6702e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 10:55:34 +0800
+Subject: wifi: ath12k: fix a possible dead lock caused by ab->base_lock
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit ef115c265a21e3c11deee7f73bd1061775a7bf20 ]
+
+spin_lock/spin_unlock are used in ath12k_reg_chan_list_event
+to acquire/release ab->base_lock. For now this is safe because
+that function is only called in soft IRQ context.
+
+But ath12k_reg_chan_list_event() will be called from process
+context in an upcoming patch, and this can result in a deadlock
+if ab->base_lock is acquired in process context and then soft
+IRQ occurs on the same CPU and tries to acquire that lock.
+
+Fix it by using spin_lock_bh and spin_unlock_bh instead.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250418-ath12k-6g-lp-vlp-v1-1-c869c86cad60@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 17ac54047f9a7..c38d3493c6911 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -5784,7 +5784,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk
+ goto fallback;
+ }
+
+- spin_lock(&ab->base_lock);
++ spin_lock_bh(&ab->base_lock);
+ if (test_bit(ATH12K_FLAG_REGISTERED, &ab->dev_flags)) {
+ /* Once mac is registered, ar is valid and all CC events from
+ * fw is considered to be received due to user requests
+@@ -5808,7 +5808,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk
+ ab->default_regd[pdev_idx] = regd;
+ }
+ ab->dfs_region = reg_info->dfs_region;
+- spin_unlock(&ab->base_lock);
++ spin_unlock_bh(&ab->base_lock);
+
+ goto mem_free;
+
+--
+2.39.5
+
--- /dev/null
+From eae3d7ff5fa793aec2a98ada763fde984b61a34c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 11:36:31 +0530
+Subject: wifi: ath12k: fix failed to set mhi state error during reboot with
+ hardware grouping
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit dce7aec6b1f74b0a46b901ab8de1f7bd0515f733 ]
+
+With hardware grouping, during reboot, whenever a device is removed, it
+powers down itself and all its partner devices in the same group. Now this
+is done by all devices and hence there is multiple power down for devices
+and hence the following error messages can be seen:
+
+ath12k_pci 0002:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0)
+ath12k_pci 0002:01:00.0: failed to set mhi state: POWER_OFF(3)
+ath12k_pci 0002:01:00.0: failed to set mhi state DEINIT(1) in current mhi state (0x0)
+ath12k_pci 0002:01:00.0: failed to set mhi state: DEINIT(1)
+ath12k_pci 0003:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0)
+ath12k_pci 0003:01:00.0: failed to set mhi state: POWER_OFF(3)
+ath12k_pci 0003:01:00.0: failed to set mhi state DEINIT(1) in current mhi state (0x0)
+ath12k_pci 0003:01:00.0: failed to set mhi state: DEINIT(1)
+ath12k_pci 0004:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0)
+ath12k_pci 0004:01:00.0: failed to set mhi state: POWER_OFF(3)
+
+To prevent this, check if the ATH12K_PCI_FLAG_INIT_DONE flag is already
+set before powering down. If it is set, it indicates that another partner
+device has already performed the power down, and this device can skip this
+step.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250408-fix_reboot_issues_with_hw_grouping-v4-3-95e7bf048595@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
+index 26f4b440c26d2..0f0e13c3dd463 100644
+--- a/drivers/net/wireless/ath/ath12k/pci.c
++++ b/drivers/net/wireless/ath/ath12k/pci.c
+@@ -1301,6 +1301,9 @@ void ath12k_pci_power_down(struct ath12k_base *ab, bool is_suspend)
+ {
+ struct ath12k_pci *ab_pci = ath12k_pci_priv(ab);
+
++ if (!test_bit(ATH12K_PCI_FLAG_INIT_DONE, &ab_pci->flags))
++ return;
++
+ /* restore aspm in case firmware bootup fails */
+ ath12k_pci_aspm_restore(ab_pci);
+
+--
+2.39.5
+
--- /dev/null
+From 30c246dcd340b931f0e976c5ba4c424368c4e8f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 16:22:39 +0530
+Subject: wifi: ath12k: fix incorrect CE addresses
+
+From: Balamurugan S <quic_bselvara@quicinc.com>
+
+[ Upstream commit 60031d9c3589c7983fd1deb4a4c0bebf0929890e ]
+
+In the current ath12k implementation, the CE addresses
+CE_HOST_IE_ADDRESS and CE_HOST_IE_2_ADDRESS are incorrect. These
+values were inherited from ath11k, but ath12k does not currently use
+them.
+
+However, the Ath12k AHB support relies on these addresses. Therefore,
+correct the CE addresses for ath12k.
+
+Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00210-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Balamurugan S <quic_bselvara@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Link: https://patch.msgid.link/20250321-ath12k-ahb-v12-2-bb389ed76ae5@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/ce.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h
+index 857bc5f9e946a..f9547a3945e44 100644
+--- a/drivers/net/wireless/ath/ath12k/ce.h
++++ b/drivers/net/wireless/ath/ath12k/ce.h
+@@ -1,7 +1,7 @@
+ /* SPDX-License-Identifier: BSD-3-Clause-Clear */
+ /*
+ * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #ifndef ATH12K_CE_H
+@@ -39,8 +39,8 @@
+ #define PIPEDIR_INOUT_H2H 4 /* bidirectional, host to host */
+
+ /* CE address/mask */
+-#define CE_HOST_IE_ADDRESS 0x00A1803C
+-#define CE_HOST_IE_2_ADDRESS 0x00A18040
++#define CE_HOST_IE_ADDRESS 0x75804C
++#define CE_HOST_IE_2_ADDRESS 0x758050
+ #define CE_HOST_IE_3_ADDRESS CE_HOST_IE_ADDRESS
+
+ #define CE_HOST_IE_3_SHIFT 0xC
+--
+2.39.5
+
--- /dev/null
+From 3af1e14db0e9a08a6c1abf05632f2e2ef3f338e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 11:55:09 +0530
+Subject: wifi: ath12k: fix link valid field initialization in the monitor Rx
+
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+
+[ Upstream commit 2826139f9295821fe2b049318a1cc057ec003131 ]
+
+Currently, the link_valid field is not initialized in the monitor Rx path.
+This can result in random values for the link_valid and link_id leads to
+undefined behaviour in mac80211. Therefore, initialize the link_valid
+field in the monitor Rx path.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+Tested-by: Nicolas Escande <nico.escande@gmail.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Link: https://patch.msgid.link/20250324062518.2752822-2-quic_periyasa@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index 6a88745369447..7bfd323cdf244 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -1080,6 +1080,8 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
+ bool is_mcbc = rxcb->is_mcbc;
+ bool is_eapol_tkip = rxcb->is_eapol;
+
++ status->link_valid = 0;
++
+ if ((status->encoding == RX_ENC_HE) && !(status->flag & RX_FLAG_RADIOTAP_HE) &&
+ !(status->flag & RX_FLAG_SKIP_MONITOR)) {
+ he = skb_push(msdu, sizeof(known));
+--
+2.39.5
+
--- /dev/null
+From fd95db07678af649b0c6dc2d1116fcf1c3b84019 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 10:34:39 +0800
+Subject: wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit a69bbf89d751ba2d6da21d773c4e29c91c5e53c4 ]
+
+Currently, HAL_RX_MSDU_PKT_LENGTH_GET uses u32_get_bits to obtain the
+MSDU length from the MSDU description.
+
+This is not right. Because all halphy descriptions are little endian.
+
+So use le32_get_bits for HAL_RX_MSDU_PKT_LENGTH_GET.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250421023444.1778-9-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/hal_desc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h
+index c68998e9667c9..8cbe28950d0c0 100644
+--- a/drivers/net/wireless/ath/ath12k/hal_desc.h
++++ b/drivers/net/wireless/ath/ath12k/hal_desc.h
+@@ -705,7 +705,7 @@ enum hal_rx_msdu_desc_reo_dest_ind {
+ #define RX_MSDU_DESC_INFO0_DECAP_FORMAT GENMASK(30, 29)
+
+ #define HAL_RX_MSDU_PKT_LENGTH_GET(val) \
+- (u32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH))
++ (le32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH))
+
+ struct rx_msdu_desc {
+ __le32 info0;
+--
+2.39.5
+
--- /dev/null
+From 330799afd051db5c71d84a81101cc7f895390129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 15:23:14 +0530
+Subject: wifi: ath12k: Pass correct values of center freq1 and center freq2
+ for 160 MHz
+
+From: Suraj P Kizhakkethil <quic_surapk@quicinc.com>
+
+[ Upstream commit b1b01e46a3db5ad44d1e4691ba37c1e0832cd5cf ]
+
+Currently, for 160 MHz bandwidth, center frequency1 and
+center frequency2 are not passed correctly to the firmware.
+Set center frequency1 as the center frequency
+of the primary 80 MHz channel segment and center frequency2 as
+the center frequency of the 160 MHz channel and pass the values
+to the firmware.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Suraj P Kizhakkethil <quic_surapk@quicinc.com>
+Reviewed-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250304095315.3050325-2-quic_surapk@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index c38d3493c6911..5c2130f77dac6 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -980,14 +980,24 @@ int ath12k_wmi_vdev_down(struct ath12k *ar, u8 vdev_id)
+ static void ath12k_wmi_put_wmi_channel(struct ath12k_wmi_channel_params *chan,
+ struct wmi_vdev_start_req_arg *arg)
+ {
++ u32 center_freq1 = arg->band_center_freq1;
++
+ memset(chan, 0, sizeof(*chan));
+
+ chan->mhz = cpu_to_le32(arg->freq);
+- chan->band_center_freq1 = cpu_to_le32(arg->band_center_freq1);
+- if (arg->mode == MODE_11AC_VHT80_80)
++ chan->band_center_freq1 = cpu_to_le32(center_freq1);
++ if (arg->mode == MODE_11BE_EHT160) {
++ if (arg->freq > center_freq1)
++ chan->band_center_freq1 = cpu_to_le32(center_freq1 + 40);
++ else
++ chan->band_center_freq1 = cpu_to_le32(center_freq1 - 40);
++
++ chan->band_center_freq2 = cpu_to_le32(center_freq1);
++ } else if (arg->mode == MODE_11BE_EHT80_80) {
+ chan->band_center_freq2 = cpu_to_le32(arg->band_center_freq2);
+- else
++ } else {
+ chan->band_center_freq2 = 0;
++ }
+
+ chan->info |= le32_encode_bits(arg->mode, WMI_CHAN_INFO_MODE);
+ if (arg->passive)
+--
+2.39.5
+
--- /dev/null
+From 3064818ba9642ef833b9ed53fa174c65658f2cde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 11:45:22 +0530
+Subject: wifi: ath12k: using msdu end descriptor to check for rx multicast
+ packets
+
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+
+[ Upstream commit cb7433cc5cd4d07175dbc41f5a19966e9fae48be ]
+
+Currently, the RX multicast broadcast packet check is performed using
+bit 15 from the info6 field of the MPDU start descriptor. This check
+can also be done using bit 9 from the info5 field of the MSDU end
+descriptor. However, in some scenarios multicast bit is not set when
+fetched from MPDU start descriptor.
+Therefore, checking the RX multicast broadcast packet from the MSDU
+end descriptor is more reliable as it is per MSDU.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250411061523.859387-2-quic_sarishar@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/hal.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
+index ae386c6490594..3afb11c7bf18e 100644
+--- a/drivers/net/wireless/ath/ath12k/hal.c
++++ b/drivers/net/wireless/ath/ath12k/hal.c
+@@ -449,8 +449,8 @@ static u8 *ath12k_hw_qcn9274_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
+
+ static bool ath12k_hw_qcn9274_rx_desc_is_da_mcbc(struct hal_rx_desc *desc)
+ {
+- return __le32_to_cpu(desc->u.qcn9274.mpdu_start.info6) &
+- RX_MPDU_START_INFO6_MCAST_BCAST;
++ return __le16_to_cpu(desc->u.qcn9274.msdu_end.info5) &
++ RX_MSDU_END_INFO5_DA_IS_MCBC;
+ }
+
+ static void ath12k_hw_qcn9274_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
+@@ -902,8 +902,8 @@ static u8 *ath12k_hw_qcn9274_compact_rx_desc_mpdu_start_addr2(struct hal_rx_desc
+
+ static bool ath12k_hw_qcn9274_compact_rx_desc_is_da_mcbc(struct hal_rx_desc *desc)
+ {
+- return __le32_to_cpu(desc->u.qcn9274_compact.mpdu_start.info6) &
+- RX_MPDU_START_INFO6_MCAST_BCAST;
++ return __le16_to_cpu(desc->u.qcn9274_compact.msdu_end.info5) &
++ RX_MSDU_END_INFO5_DA_IS_MCBC;
+ }
+
+ static void ath12k_hw_qcn9274_compact_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
+--
+2.39.5
+
--- /dev/null
+From 7d90f4280e3c4f6370eadb40750941f2a14453f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 20:02:27 +0200
+Subject: wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Víctor Gonzalo <victor.gonzalo@anddroptable.net>
+
+[ Upstream commit 2b801487ac3be7bec561ae62d1a6c4d6f5283f8c ]
+
+The module metadata for the firmware file iwlwifi-Qu-c0-jf-b0-* is missing.
+
+Signed-off-by: Víctor Gonzalo <victor.gonzalo@anddroptable.net>
+Link: https://patch.msgid.link/20240313180227.2224780-1-victor.gonzalo@anddroptable.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index 2e2fcb3807efb..10d647fbc971e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -44,6 +44,8 @@
+ IWL_QU_C_HR_B_FW_PRE "-" __stringify(api) ".ucode"
+ #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
+ IWL_QU_B_JF_B_FW_PRE "-" __stringify(api) ".ucode"
++#define IWL_QU_C_JF_B_MODULE_FIRMWARE(api) \
++ IWL_QU_C_JF_B_FW_PRE "-" __stringify(api) ".ucode"
+ #define IWL_CC_A_MODULE_FIRMWARE(api) \
+ IWL_CC_A_FW_PRE "-" __stringify(api) ".ucode"
+
+@@ -423,6 +425,7 @@ const struct iwl_cfg iwl_cfg_quz_a0_hr_b0 = {
+ MODULE_FIRMWARE(IWL_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_QU_C_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_QU_C_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_QUZ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_QUZ_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+--
+2.39.5
+
--- /dev/null
+From f2278d513bd8f3d779d8e5d2851cb95795a04812 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 21:56:47 +0300
+Subject: wifi: iwlwifi: mvm: fix beacon CCK flag
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 8d7f08922a8cb621aa5d00bdce6a7afe57af1665 ]
+
+The beacon CCK flag should be set for any CCK rate, not
+just for 1 Mbps. Fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Ilan Peer <ilan.peer@intel.com>
+Link: https://patch.msgid.link/20250505215513.fe18b7d92d7d.I7bb40a92cea102677b695beb1e2a62a5ea72678b@changeid
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index e96ddaeeeeff5..d013de30e7ed6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2012-2014, 2018-2024 Intel Corporation
++ * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (C) 2015-2017 Intel Deutschland GmbH
+ */
+@@ -962,7 +962,7 @@ u16 iwl_mvm_mac_ctxt_get_beacon_flags(const struct iwl_fw *fw, u8 rate_idx)
+ u16 flags = iwl_mvm_mac80211_idx_to_hwrate(fw, rate_idx);
+ bool is_new_rate = iwl_fw_lookup_cmd_ver(fw, BEACON_TEMPLATE_CMD, 0) > 10;
+
+- if (rate_idx <= IWL_FIRST_CCK_RATE)
++ if (rate_idx <= IWL_LAST_CCK_RATE)
+ flags |= is_new_rate ? IWL_MAC_BEACON_CCK
+ : IWL_MAC_BEACON_CCK_V1;
+
+--
+2.39.5
+
--- /dev/null
+From 29218f9c01c0a11572fd46530036079813002d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 15:38:30 +0300
+Subject: wifi: iwlwifi: pcie: make sure to lock rxq->read
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1cc2c48c4af81bed5ddbe9f2c9d6e20fa163acf9 ]
+
+rxq->read is accessed without the rxq->lock in a few places,
+Make sure to have the lock there.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Tested-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Link: https://patch.msgid.link/20250424153620.73725f207aaa.I1a3e4b6c5fd370e029fdacfcdc9ee335788afa98@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 18d7d59ae5814..462ebe088b3c1 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2726,6 +2726,8 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
+ for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) {
+ struct iwl_rxq *rxq = &trans_pcie->rxq[i];
+
++ spin_lock_bh(&rxq->lock);
++
+ pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n",
+ i);
+ pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n",
+@@ -2746,6 +2748,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
+ pos += scnprintf(buf + pos, bufsz - pos,
+ "\tclosed_rb_num: Not Allocated\n");
+ }
++ spin_unlock_bh(&rxq->lock);
+ }
+ ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+ kfree(buf);
+@@ -3410,8 +3413,11 @@ iwl_trans_pcie_dump_data(struct iwl_trans *trans, u32 dump_mask,
+ /* Dump RBs is supported only for pre-9000 devices (1 queue) */
+ struct iwl_rxq *rxq = &trans_pcie->rxq[0];
+ /* RBs */
++ spin_lock_bh(&rxq->lock);
+ num_rbs = iwl_get_closed_rb_stts(trans, rxq);
+ num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK;
++ spin_unlock_bh(&rxq->lock);
++
+ len += num_rbs * (sizeof(*data) +
+ sizeof(struct iwl_fw_error_dump_rb) +
+ (PAGE_SIZE << trans_pcie->rx_page_order));
+--
+2.39.5
+
--- /dev/null
+From 29ae57d6c474a8d92f3e2107b1f89181cbc7f7a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 21:10:42 +0200
+Subject: wifi: mac80211: do not offer a mesh path if forwarding is disabled
+
+From: Benjamin Berg <benjamin@sipsolutions.net>
+
+[ Upstream commit cf1b684a06170d253b47d6a5287821de976435bd ]
+
+When processing a PREQ the code would always check whether we have a
+mesh path locally and reply accordingly. However, when forwarding is
+disabled then we should not reply with this information as we will not
+forward data packets down that path.
+
+Move the check for dot11MeshForwarding up in the function and skip the
+mesh path lookup in that case. In the else block, set forward to false
+so that the rest of the function becomes a no-op and the
+dot11MeshForwarding check does not need to be duplicated.
+
+This explains an effect observed in the Freifunk community where mesh
+forwarding is disabled. In that case a mesh with three STAs and only bad
+links in between them, individual STAs would occionally have indirect
+mpath entries. This should not have happened.
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Reviewed-by: Rouven Czerwinski <rouven@czerwinskis.de>
+Link: https://patch.msgid.link/20250430191042.3287004-1-benjamin@sipsolutions.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 2922a9fec950d..ba8aeb47bffd7 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -636,7 +636,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ mesh_path_add_gate(mpath);
+ }
+ rcu_read_unlock();
+- } else {
++ } else if (ifmsh->mshcfg.dot11MeshForwarding) {
+ rcu_read_lock();
+ mpath = mesh_path_lookup(sdata, target_addr);
+ if (mpath) {
+@@ -654,6 +654,8 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+ rcu_read_unlock();
++ } else {
++ forward = false;
+ }
+
+ if (reply) {
+@@ -671,7 +673,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+
+- if (forward && ifmsh->mshcfg.dot11MeshForwarding) {
++ if (forward) {
+ u32 preq_id;
+ u8 hopcount;
+
+--
+2.39.5
+
--- /dev/null
+From 82a656cd77effb80fb677927abf8dfb18d16753c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 16:02:07 +0530
+Subject: wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 78a7a126dc5b8e3c5a3d4da9f513e0236d2dc1a3 ]
+
+When an AP interface is already beaconing, a subsequent scan is not allowed
+unless the user space explicitly sets the flag NL80211_SCAN_FLAG_AP in the
+scan request. If this flag is not set, the scan request will be returned
+with the error code -EOPNOTSUPP. However, this restriction currently
+applies only to non-ML interfaces. For ML interfaces, scans are allowed
+without this flag being explicitly set by the user space which is wrong.
+This is because the beaconing check currently uses only the deflink, which
+does not get set during MLO.
+
+Hence to fix this, during MLO, use the existing helper
+ieee80211_num_beaconing_links() to know if any of the link is beaconing.
+
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250516-bug_fix_mlo_scan-v2-1-12e59d9110ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index f11fd360b422d..cf2b8a05c3389 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2876,7 +2876,7 @@ static int ieee80211_scan(struct wiphy *wiphy,
+ * the frames sent while scanning on other channel will be
+ * lost)
+ */
+- if (sdata->deflink.u.ap.beacon &&
++ if (ieee80211_num_beaconing_links(sdata) &&
+ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+ !(req->flags & NL80211_SCAN_FLAG_AP)))
+ return -EOPNOTSUPP;
+--
+2.39.5
+
--- /dev/null
+From 9654cc9573994d32369c3ea68fd9faa549a03b71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 14:31:25 -0700
+Subject: wifi: mac80211: VLAN traffic in multicast path
+
+From: Muna Sinada <muna.sinada@oss.qualcomm.com>
+
+[ Upstream commit 1a4a6a22552ca9d723f28a1fe35eab1b9b3d8b33 ]
+
+Currently for MLO, sending out multicast frames on each link is handled by
+mac80211 only when IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX flag is not set.
+
+Dynamic VLAN multicast traffic utilizes software encryption.
+Due to this, mac80211 should handle transmitting multicast frames on
+all links for multicast VLAN traffic.
+
+Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250325213125.1509362-4-muna.sinada@oss.qualcomm.com
+[remove unnecessary parentheses]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 0ff8b56f58070..ef16ff149730a 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4523,8 +4523,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
+ NULL);
+ } else if (ieee80211_vif_is_mld(&sdata->vif) &&
+- sdata->vif.type == NL80211_IFTYPE_AP &&
+- !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) {
++ ((sdata->vif.type == NL80211_IFTYPE_AP &&
++ !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) ||
++ (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
++ !sdata->wdev.use_4addr))) {
+ ieee80211_mlo_multicast_tx(dev, skb);
+ } else {
+ normal:
+--
+2.39.5
+
--- /dev/null
+From ec2239089833412b80a87d2ef80d83251a4cced4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 22:15:53 +0800
+Subject: wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit c575f5374be7a5c4be4acb9fe6be3a4669d94674 ]
+
+Setting tsf is meaningless if beacon is disabled, so check that beacon
+is enabled before setting tsf.
+
+Reported-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=064815c6cd721082a52a
+Tested-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Link: https://patch.msgid.link/tencent_3609AC2EFAAED68CA5A7E3C6D212D1C67806@qq.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
+index 4a2b7c9921bc6..6fcc21f596ea7 100644
+--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
++++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
+@@ -1229,6 +1229,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
+ /* MLD not supported here */
+ u32 bcn_int = data->link_data[0].beacon_int;
+ u64 delta = abs(tsf - now);
++ struct ieee80211_bss_conf *conf;
++
++ conf = link_conf_dereference_protected(vif, data->link_data[0].link_id);
++ if (conf && !conf->enable_beacon)
++ return;
+
+ /* adjust after beaconing with new timestamp at old TBTT */
+ if (tsf > now) {
+--
+2.39.5
+
--- /dev/null
+From adc1458fcc90484a709a1d36f47b54e15def8a64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 16:39:14 +0200
+Subject: wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
+
+From: Henk Vergonet <henk.vergonet@gmail.com>
+
+[ Upstream commit 3c0e4f606d8693795a2c965d6f4987b1bfc31097 ]
+
+Adds support for:
+ - LiteOn WN4516R
+ - LiteOn WN4519R
+ Both use:
+ - A nonstandard USB connector
+ - Mediatek chipset MT7600U
+ - ASIC revision: 76320044
+
+Disabled VHT support on ASIC revision 76320044:
+
+ This fixes the 5G connectibity issue on LiteOn WN4519R module
+ see https://github.com/openwrt/mt76/issues/971
+
+ And may also fix the 5G issues on the XBox One Wireless Adapter
+ see https://github.com/openwrt/mt76/issues/200
+
+ I have looked at the FCC info related to the MT7632U chip as mentioned in here:
+ https://github.com/openwrt/mt76/issues/459
+ These confirm the chipset does not support 'ac' mode and hence VHT should be turned of.
+
+Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250418143914.31384-1-henk.vergonet@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 ++
+ .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 ++++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+index 84ef80ab4afbf..96cecc576a986 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = {
+ { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */
+ { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */
+ { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */
++ { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */
++ { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */
+ { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */
+ { USB_DEVICE(0x0846, 0x9014) }, /* Netgear WNDA3100v3 */
+ { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
+index 33a14365ec9b9..3b55628115115 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
+@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev)
+ {
+ struct ieee80211_hw *hw = mt76_hw(dev);
+ struct mt76_usb *usb = &dev->mt76.usb;
++ bool vht;
+ int err;
+
+ INIT_DELAYED_WORK(&dev->cal_work, mt76x2u_phy_calibrate);
+@@ -217,7 +218,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev)
+
+ /* check hw sg support in order to enable AMSDU */
+ hw->max_tx_fragments = dev->mt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;
+- err = mt76_register_device(&dev->mt76, true, mt76x02_rates,
++ switch (dev->mt76.rev) {
++ case 0x76320044:
++ /* these ASIC revisions do not support VHT */
++ vht = false;
++ break;
++ default:
++ vht = true;
++ break;
++ }
++
++ err = mt76_register_device(&dev->mt76, vht, mt76x02_rates,
+ ARRAY_SIZE(mt76x02_rates));
+ if (err)
+ goto fail;
+--
+2.39.5
+
--- /dev/null
+From ff30a2b87e7a4adbbf7f536bb2c48bfe770424f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 19:53:09 -0500
+Subject: wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
+
+From: Samuel Williams <sam8641@gmail.com>
+
+[ Upstream commit 7011faebe543f8f094fdb3281d0ec9e1eab81309 ]
+
+This allows mt7922 in hostapd mode to transmit up to 1.4 Gbps.
+
+Signed-off-by: Samuel Williams <sam8641@gmail.com>
+Link: https://patch.msgid.link/20250511005316.1118961-1-sam8641@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 6a3629f71caaa..9c245c23a2d73 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -83,6 +83,11 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,
+ he_cap_elem->phy_cap_info[9] |=
+ IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU |
+ IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU;
++
++ if (is_mt7922(phy->mt76->dev)) {
++ he_cap_elem->phy_cap_info[0] |=
++ IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++ }
+ break;
+ case NL80211_IFTYPE_STATION:
+ he_cap_elem->mac_cap_info[1] |=
+--
+2.39.5
+
--- /dev/null
+From 938fe379a13e662afe4c212bcbc3c45d93097c8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 16:21:17 +0800
+Subject: wifi: mt76: mt7925: introduce thermal protection
+
+From: Leon Yen <leon.yen@mediatek.com>
+
+[ Upstream commit 1d81e893b422a6f0ae70f8648867c2e73edfb413 ]
+
+Add thermal protection to prevent the chip from possible overheating
+due to prolonged high traffic and adverse operating conditions.
+
+Signed-off-by: Leon Yen <leon.yen@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Link: https://patch.msgid.link/20250509082117.453819-1-mingyen.hsieh@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7925/init.c | 6 ++++++
+ .../net/wireless/mediatek/mt76/mt7925/mcu.c | 20 ++++++++++++++++++-
+ .../net/wireless/mediatek/mt76/mt7925/mcu.h | 1 +
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+index 039949b344b98..14553dcc61c57 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+@@ -204,6 +204,12 @@ static void mt7925_init_work(struct work_struct *work)
+ return;
+ }
+
++ ret = mt7925_mcu_set_thermal_protect(dev);
++ if (ret) {
++ dev_err(dev->mt76.dev, "thermal protection enable failed\n");
++ return;
++ }
++
+ /* we support chip reset now */
+ dev->hw_init_done = true;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index a19c108ad4b5c..57a1db394dda4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -961,6 +961,23 @@ int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
+ }
+ EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep);
+
++int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev)
++{
++ char cmd[64];
++ int ret = 0;
++
++ snprintf(cmd, sizeof(cmd), "ThermalProtGband %d %d %d %d %d %d %d %d %d %d",
++ 0, 100, 90, 80, 30, 1, 1, 115, 105, 5);
++ ret = mt7925_mcu_chip_config(dev, cmd);
++
++ snprintf(cmd, sizeof(cmd), "ThermalProtAband %d %d %d %d %d %d %d %d %d %d",
++ 1, 100, 90, 80, 30, 1, 1, 115, 105, 5);
++ ret |= mt7925_mcu_chip_config(dev, cmd);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(mt7925_mcu_set_thermal_protect);
++
+ int mt7925_run_firmware(struct mt792x_dev *dev)
+ {
+ int err;
+@@ -3288,7 +3305,8 @@ int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ else
+ uni_txd->option = MCU_CMD_UNI_EXT_ACK;
+
+- if (cmd == MCU_UNI_CMD(HIF_CTRL))
++ if (cmd == MCU_UNI_CMD(HIF_CTRL) ||
++ cmd == MCU_UNI_CMD(CHIP_CONFIG))
+ uni_txd->option &= ~MCU_CMD_ACK;
+
+ goto exit;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+index 887427e0760ae..780c5921679aa 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+@@ -635,6 +635,7 @@ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
+ int mt7925_mcu_set_timing(struct mt792x_phy *phy,
+ struct ieee80211_bss_conf *link_conf);
+ int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable);
++int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev);
+ int mt7925_mcu_set_channel_domain(struct mt76_phy *phy);
+ int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable);
+ int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif *mvif,
+--
+2.39.5
+
--- /dev/null
+From 6ad0faca4dc2767294750ce1c9a45a596ac76d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 11:29:47 +0800
+Subject: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit 80fda1cd7b0a1edd0849dc71403a070d0922118d ]
+
+IEEE 802.11 fragmentation can only be applied to unicast frames.
+Therefore, drop fragments with multicast or broadcast RA. This patch
+addresses vulnerabilities such as CVE-2020-26145.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Link: https://patch.msgid.link/20250515032952.1653494-4-shayne.chen@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index ef2d7eaaaffdd..0990a3d481f2d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -623,6 +623,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
+ }
+
++ /* IEEE 802.11 fragmentation can only be applied to unicast frames.
++ * Hence, drop fragments with multicast/broadcast RA.
++ * This check fixes vulnerabilities, like CVE-2020-26145.
++ */
++ if ((ieee80211_has_morefrags(fc) || seq_ctrl & IEEE80211_SCTL_FRAG) &&
++ FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) != MT_RXD3_NORMAL_U2M)
++ return -EINVAL;
++
+ hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
+ if (hdr_trans && ieee80211_has_morefrags(fc)) {
+ if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap))
+--
+2.39.5
+
--- /dev/null
+From f080442d579c0c4102f694b13c25d947992d2bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 16:12:39 +0800
+Subject: wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit 20aac091a15dc7229ef1a268253fe36bb6b2be39 ]
+
+An incorrect Voltage Controlled Oscillator (VCO) setting
+may cause Synthesizer (SYN) unlock, which may lead to a
+failure in the TX authentication request.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250416081241.36138-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c
+index 28907df7407d5..c958d6ab24d32 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c
+@@ -77,11 +77,6 @@ void rtw8922a_ctl_band_ch_bw(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy,
+ RR_CFGCH_BAND0 | RR_CFGCH_CH);
+ rf_reg[path][i] |= u32_encode_bits(central_ch, RR_CFGCH_CH);
+
+- if (band == RTW89_BAND_2G)
+- rtw89_write_rf(rtwdev, path, RR_SMD, RR_VCO2, 0x0);
+- else
+- rtw89_write_rf(rtwdev, path, RR_SMD, RR_VCO2, 0x1);
+-
+ switch (band) {
+ case RTW89_BAND_2G:
+ default:
+--
+2.39.5
+
--- /dev/null
+From 1880fa0bf5723fdbfd9c2efa7821d7ab332cb5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 11:12:03 +0800
+Subject: wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
+
+From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+
+[ Upstream commit d105652b33245162867ac769bea336976e67efb8 ]
+
+Due to mac80211 triggering the hardware to enter idle mode, it fails
+to install WEP key causing connected station can't ping successfully.
+Currently, it forces the hardware to leave idle mode before driver
+adding WEP keys.
+
+Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250507031203.8256-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/cam.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/cam.c b/drivers/net/wireless/realtek/rtw89/cam.c
+index 8d140b94cb440..0c8ea5e629e6a 100644
+--- a/drivers/net/wireless/realtek/rtw89/cam.c
++++ b/drivers/net/wireless/realtek/rtw89/cam.c
+@@ -6,6 +6,7 @@
+ #include "debug.h"
+ #include "fw.h"
+ #include "mac.h"
++#include "ps.h"
+
+ static struct sk_buff *
+ rtw89_cam_get_sec_key_cmd(struct rtw89_dev *rtwdev,
+@@ -447,9 +448,11 @@ int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev,
+
+ switch (key->cipher) {
+ case WLAN_CIPHER_SUITE_WEP40:
++ rtw89_leave_ips_by_hwflags(rtwdev);
+ hw_key_type = RTW89_SEC_KEY_TYPE_WEP40;
+ break;
+ case WLAN_CIPHER_SUITE_WEP104:
++ rtw89_leave_ips_by_hwflags(rtwdev);
+ hw_key_type = RTW89_SEC_KEY_TYPE_WEP104;
+ break;
+ case WLAN_CIPHER_SUITE_CCMP:
+--
+2.39.5
+
--- /dev/null
+From 1b55533a771953315a76a231bda4baf5d4f78b4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Apr 2025 10:57:45 +0100
+Subject: wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
+
+From: Salah Triki <salah.triki@gmail.com>
+
+[ Upstream commit 63a9a727d373fa5b8ce509eef50dbc45e0f745b9 ]
+
+Add usb_free_urb() in the error path to prevent memory leak.
+
+Signed-off-by: Salah Triki <salah.triki@gmail.com>
+Link: https://patch.msgid.link/aA3_maPlEJzO7wrL@pc
+[fix subject]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/purelifi/plfxlc/usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c
+index 56d1139ba8bcc..7e7bfa532ed25 100644
+--- a/drivers/net/wireless/purelifi/plfxlc/usb.c
++++ b/drivers/net/wireless/purelifi/plfxlc/usb.c
+@@ -503,8 +503,10 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer,
+ (void *)buffer, buffer_len, complete_fn, context);
+
+ r = usb_submit_urb(urb, GFP_ATOMIC);
+- if (r)
++ if (r) {
++ usb_free_urb(urb);
+ dev_err(&udev->dev, "Async write submit failed (%d)\n", r);
++ }
+
+ return r;
+ }
+--
+2.39.5
+
--- /dev/null
+From 26208b68a3eabfd7908c23cb3847ce3d6f9da958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 01:04:29 +0200
+Subject: x86/sgx: Prevent attempts to reclaim poisoned pages
+
+From: Andrew Zaborowski <andrew.zaborowski@intel.com>
+
+[ Upstream commit ed16618c380c32c68c06186d0ccbb0d5e0586e59 ]
+
+TL;DR: SGX page reclaim touches the page to copy its contents to
+secondary storage. SGX instructions do not gracefully handle machine
+checks. Despite this, the existing SGX code will try to reclaim pages
+that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages.
+
+The longer story:
+
+Pages used by an enclave only get epc_page->poison set in
+arch_memory_failure() but they currently stay on sgx_active_page_list until
+sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched.
+
+epc_page->poison is not checked in the reclaimer logic meaning that, if other
+conditions are met, an attempt will be made to reclaim an EPC page that was
+poisoned. This is bad because 1. we don't want that page to end up added
+to another enclave and 2. it is likely to cause one core to shut down
+and the kernel to panic.
+
+Specifically, reclaiming uses microcode operations including "EWB" which
+accesses the EPC page contents to encrypt and write them out to non-SGX
+memory. Those operations cannot handle MCEs in their accesses other than
+by putting the executing core into a special shutdown state (affecting
+both threads with HT.) The kernel will subsequently panic on the
+remaining cores seeing the core didn't enter MCE handler(s) in time.
+
+Call sgx_unmark_page_reclaimable() to remove the affected EPC page from
+sgx_active_page_list on memory error to stop it being considered for
+reclaiming.
+
+Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume
+it's better to add code in the less likely paths.
+
+The affected EPC page is not added to &node->sgx_poison_page_list until
+later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd.
+Membership on other lists doesn't change to avoid changing any of the
+lists' semantics except for sgx_active_page_list. There's a "TBD" comment
+in arch_memory_failure() about pre-emptive actions, the goal here is not
+to address everything that it may imply.
+
+This also doesn't completely close the time window when a memory error
+notification will be fatal (for a not previously poisoned EPC page) --
+the MCE can happen after sgx_reclaim_pages() has selected its candidates
+or even *inside* a microcode operation (actually easy to trigger due to
+the amount of time spent in them.)
+
+The spinlock in sgx_unmark_page_reclaimable() is safe because
+memory_failure() runs in process context and no spinlocks are held,
+explicitly noted in a mm/memory-failure.c comment.
+
+Signed-off-by: Andrew Zaborowski <andrew.zaborowski@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: balrogg@gmail.com
+Cc: linux-sgx@vger.kernel.org
+Link: https://lore.kernel.org/r/20250508230429.456271-1-andrew.zaborowski@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/sgx/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
+index 9ace84486499b..147ea26dfdad6 100644
+--- a/arch/x86/kernel/cpu/sgx/main.c
++++ b/arch/x86/kernel/cpu/sgx/main.c
+@@ -719,6 +719,8 @@ int arch_memory_failure(unsigned long pfn, int flags)
+ goto out;
+ }
+
++ sgx_unmark_page_reclaimable(page);
++
+ /*
+ * TBD: Add additional plumbing to enable pre-emptive
+ * action for asynchronous poison notification. Until
+--
+2.39.5
+
--- /dev/null
+From 93e1d4bd99fdd93821f42f92bbd7587484193a6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 13:56:22 +0300
+Subject: xfrm: validate assignment of maximal possible SEQ number
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit e86212b6b13a20c5ad404c5597933f57fd0f1519 ]
+
+Users can set any seq/seq_hi/oseq/oseq_hi values. The XFRM core code
+doesn't prevent from them to set even 0xFFFFFFFF, however this value
+will cause for traffic drop.
+
+Is is happening because SEQ numbers here mean that packet with such
+number was processed and next number should be sent on the wire. In this
+case, the next number will be 0, and it means overflow which causes to
+(expected) packet drops.
+
+While it can be considered as misconfiguration and handled by XFRM
+datapath in the same manner as any other SEQ number, let's add
+validation to easy for packet offloads implementations which need to
+configure HW with next SEQ to send and not with current SEQ like it is
+done in core code.
+
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 52 +++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index da2a1c00ca8a6..d41e5642625e3 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -178,11 +178,27 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
+ "Replay seq and seq_hi should be 0 for output SA");
+ return -EINVAL;
+ }
+- if (rs->oseq_hi && !(p->flags & XFRM_STATE_ESN)) {
+- NL_SET_ERR_MSG(
+- extack,
+- "Replay oseq_hi should be 0 in non-ESN mode for output SA");
+- return -EINVAL;
++
++ if (!(p->flags & XFRM_STATE_ESN)) {
++ if (rs->oseq_hi) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay oseq_hi should be 0 in non-ESN mode for output SA");
++ return -EINVAL;
++ }
++ if (rs->oseq == U32_MAX) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay oseq should be less than 0xFFFFFFFF in non-ESN mode for output SA");
++ return -EINVAL;
++ }
++ } else {
++ if (rs->oseq == U32_MAX && rs->oseq_hi == U32_MAX) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay oseq and oseq_hi should be less than 0xFFFFFFFF for output SA");
++ return -EINVAL;
++ }
+ }
+ if (rs->bmp_len) {
+ NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA");
+@@ -196,11 +212,27 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
+ "Replay oseq and oseq_hi should be 0 for input SA");
+ return -EINVAL;
+ }
+- if (rs->seq_hi && !(p->flags & XFRM_STATE_ESN)) {
+- NL_SET_ERR_MSG(
+- extack,
+- "Replay seq_hi should be 0 in non-ESN mode for input SA");
+- return -EINVAL;
++ if (!(p->flags & XFRM_STATE_ESN)) {
++ if (rs->seq_hi) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay seq_hi should be 0 in non-ESN mode for input SA");
++ return -EINVAL;
++ }
++
++ if (rs->seq == U32_MAX) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay seq should be less than 0xFFFFFFFF in non-ESN mode for input SA");
++ return -EINVAL;
++ }
++ } else {
++ if (rs->seq == U32_MAX && rs->seq_hi == U32_MAX) {
++ NL_SET_ERR_MSG(
++ extack,
++ "Replay seq and seq_hi should be less than 0xFFFFFFFF for input SA");
++ return -EINVAL;
++ }
+ }
+ }
+
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
