--- /dev/null
+From 83a37b6ed8e0c32e52c3e705dd2429de092e15be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 2ceb57d1d58ee..1332089683da0 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ */
+--
+2.51.0
+
--- /dev/null
+From 436b9d153e985492393f671bd7a56cd4456fe692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 8926011604e39..9cd6dac033630 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 19fed56b6ee3f..ebb8b3e5b9a88 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From 6cc4e0c4d5a7e9117ffd866624a4296ce20682f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 6619a71b57bbe..a6f481f1517dd 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1222,7 +1222,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 18f5568c6791ed2d898673c2048b1b638b5fafb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 3673a9e7ba449..e2816c88cfe52 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -4982,8 +4982,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 7be45f02e72dfaac0bdc944bc7f82f7fdd63fb9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 18:33:13 -0700
+Subject: fsdax: switch dax_iomap_rw to use iomap_iter
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit ca289e0b95afa973d204c77a4ad5c37e06145fbf ]
+
+Switch the dax_iomap_rw implementation to use iomap_iter.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Stable-dep-of: 154d1e7ad9e5 ("dax: skip read lock assertion for read-only filesystems")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 49 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 24 insertions(+), 25 deletions(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 3e7e9a57fd28c..6619a71b57bbe 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1104,20 +1104,21 @@ s64 dax_iomap_zero(loff_t pos, u64 length, struct iomap *iomap)
+ return size;
+ }
+
+-static loff_t
+-dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
+- struct iomap *iomap, struct iomap *srcmap)
++static loff_t dax_iomap_iter(const struct iomap_iter *iomi,
++ struct iov_iter *iter)
+ {
++ const struct iomap *iomap = &iomi->iomap;
++ loff_t length = iomap_length(iomi);
++ loff_t pos = iomi->pos;
+ struct block_device *bdev = iomap->bdev;
+ struct dax_device *dax_dev = iomap->dax_dev;
+- struct iov_iter *iter = data;
+ loff_t end = pos + length, done = 0;
+ ssize_t ret = 0;
+ size_t xfer;
+ int id;
+
+ if (iov_iter_rw(iter) == READ) {
+- end = min(end, i_size_read(inode));
++ end = min(end, i_size_read(iomi->inode));
+ if (pos >= end)
+ return 0;
+
+@@ -1134,7 +1135,7 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
+ * written by write(2) is visible in mmap.
+ */
+ if (iomap->flags & IOMAP_F_NEW) {
+- invalidate_inode_pages2_range(inode->i_mapping,
++ invalidate_inode_pages2_range(iomi->inode->i_mapping,
+ pos >> PAGE_SHIFT,
+ (end - 1) >> PAGE_SHIFT);
+ }
+@@ -1210,31 +1211,29 @@ ssize_t
+ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ const struct iomap_ops *ops)
+ {
+- struct address_space *mapping = iocb->ki_filp->f_mapping;
+- struct inode *inode = mapping->host;
+- loff_t pos = iocb->ki_pos, ret = 0, done = 0;
+- unsigned flags = 0;
++ struct iomap_iter iomi = {
++ .inode = iocb->ki_filp->f_mapping->host,
++ .pos = iocb->ki_pos,
++ .len = iov_iter_count(iter),
++ };
++ loff_t done = 0;
++ int ret;
+
+ if (iov_iter_rw(iter) == WRITE) {
+- lockdep_assert_held_write(&inode->i_rwsem);
+- flags |= IOMAP_WRITE;
++ lockdep_assert_held_write(&iomi.inode->i_rwsem);
++ iomi.flags |= IOMAP_WRITE;
+ } else {
+- lockdep_assert_held(&inode->i_rwsem);
++ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+ if (iocb->ki_flags & IOCB_NOWAIT)
+- flags |= IOMAP_NOWAIT;
++ iomi.flags |= IOMAP_NOWAIT;
+
+- while (iov_iter_count(iter)) {
+- ret = iomap_apply(inode, pos, iov_iter_count(iter), flags, ops,
+- iter, dax_iomap_actor);
+- if (ret <= 0)
+- break;
+- pos += ret;
+- done += ret;
+- }
++ while ((ret = iomap_iter(&iomi, ops)) > 0)
++ iomi.processed = dax_iomap_iter(&iomi, iter);
+
+- iocb->ki_pos += done;
++ done = iomi.pos - iocb->ki_pos;
++ iocb->ki_pos = iomi.pos;
+ return done ? done : ret;
+ }
+ EXPORT_SYMBOL_GPL(dax_iomap_rw);
+@@ -1308,7 +1307,7 @@ static vm_fault_t dax_iomap_pte_fault(struct vm_fault *vmf, pfn_t *pfnp,
+ }
+
+ /*
+- * Note that we don't bother to use iomap_apply here: DAX required
++ * Note that we don't bother to use iomap_iter here: DAX required
+ * the file system block size to be equal the page size, which means
+ * that we never have to deal with more than a single extent here.
+ */
+@@ -1562,7 +1561,7 @@ static vm_fault_t dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
+ }
+
+ /*
+- * Note that we don't use iomap_apply here. We aren't doing I/O, only
++ * Note that we don't use iomap_iter here. We aren't doing I/O, only
+ * setting up a mapping, so really we're using iomap_begin() as a way
+ * to look up our filesystem block.
+ */
+--
+2.51.0
+
--- /dev/null
+From 2d65cad2e29b923a584bea19358fe98fdb123e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 18:33:07 -0700
+Subject: iomap: add the new iomap_iter model
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit f4b896c213f0752adc828ddc11bd55419ffab248 ]
+
+The iomap_iter struct provides a convenient way to package up and
+maintain all the arguments to the various mapping and operation
+functions. It is operated on using the iomap_iter() function that
+is called in loop until the whole range has been processed. Compared
+to the existing iomap_apply() function this avoid an indirect call
+for each iteration.
+
+For now iomap_iter() calls back into the existing ->iomap_begin and
+->iomap_end methods, but in the future this could be further optimized
+to avoid indirect calls entirely.
+
+Based on an earlier patch from Matthew Wilcox <willy@infradead.org>.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+[djwong: add to apply.c to preserve git history of iomap loop control]
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Stable-dep-of: 154d1e7ad9e5 ("dax: skip read lock assertion for read-only filesystems")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap/apply.c | 74 ++++++++++++++++++++++++++++++++++++++++++-
+ fs/iomap/trace.h | 37 +++++++++++++++++++++-
+ include/linux/iomap.h | 56 ++++++++++++++++++++++++++++++++
+ 3 files changed, 165 insertions(+), 2 deletions(-)
+
+diff --git a/fs/iomap/apply.c b/fs/iomap/apply.c
+index 26ab6563181fc..e82647aef7ead 100644
+--- a/fs/iomap/apply.c
++++ b/fs/iomap/apply.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+ * Copyright (C) 2010 Red Hat, Inc.
+- * Copyright (c) 2016-2018 Christoph Hellwig.
++ * Copyright (c) 2016-2021 Christoph Hellwig.
+ */
+ #include <linux/module.h>
+ #include <linux/compiler.h>
+@@ -97,3 +97,75 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
+
+ return written ? written : ret;
+ }
++
++static inline int iomap_iter_advance(struct iomap_iter *iter)
++{
++ /* handle the previous iteration (if any) */
++ if (iter->iomap.length) {
++ if (iter->processed <= 0)
++ return iter->processed;
++ if (WARN_ON_ONCE(iter->processed > iomap_length(iter)))
++ return -EIO;
++ iter->pos += iter->processed;
++ iter->len -= iter->processed;
++ if (!iter->len)
++ return 0;
++ }
++
++ /* clear the state for the next iteration */
++ iter->processed = 0;
++ memset(&iter->iomap, 0, sizeof(iter->iomap));
++ memset(&iter->srcmap, 0, sizeof(iter->srcmap));
++ return 1;
++}
++
++static inline void iomap_iter_done(struct iomap_iter *iter)
++{
++ WARN_ON_ONCE(iter->iomap.offset > iter->pos);
++ WARN_ON_ONCE(iter->iomap.length == 0);
++ WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos);
++
++ trace_iomap_iter_dstmap(iter->inode, &iter->iomap);
++ if (iter->srcmap.type != IOMAP_HOLE)
++ trace_iomap_iter_srcmap(iter->inode, &iter->srcmap);
++}
++
++/**
++ * iomap_iter - iterate over a ranges in a file
++ * @iter: iteration structue
++ * @ops: iomap ops provided by the file system
++ *
++ * Iterate over filesystem-provided space mappings for the provided file range.
++ *
++ * This function handles cleanup of resources acquired for iteration when the
++ * filesystem indicates there are no more space mappings, which means that this
++ * function must be called in a loop that continues as long it returns a
++ * positive value. If 0 or a negative value is returned, the caller must not
++ * return to the loop body. Within a loop body, there are two ways to break out
++ * of the loop body: leave @iter.processed unchanged, or set it to a negative
++ * errno.
++ */
++int iomap_iter(struct iomap_iter *iter, const struct iomap_ops *ops)
++{
++ int ret;
++
++ if (iter->iomap.length && ops->iomap_end) {
++ ret = ops->iomap_end(iter->inode, iter->pos, iomap_length(iter),
++ iter->processed > 0 ? iter->processed : 0,
++ iter->flags, &iter->iomap);
++ if (ret < 0 && !iter->processed)
++ return ret;
++ }
++
++ trace_iomap_iter(iter, ops, _RET_IP_);
++ ret = iomap_iter_advance(iter);
++ if (ret <= 0)
++ return ret;
++
++ ret = ops->iomap_begin(iter->inode, iter->pos, iter->len, iter->flags,
++ &iter->iomap, &iter->srcmap);
++ if (ret < 0)
++ return ret;
++ iomap_iter_done(iter);
++ return 1;
++}
+diff --git a/fs/iomap/trace.h b/fs/iomap/trace.h
+index fdc7ae388476f..52b850b4d3f44 100644
+--- a/fs/iomap/trace.h
++++ b/fs/iomap/trace.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ /*
+- * Copyright (c) 2009-2019 Christoph Hellwig
++ * Copyright (c) 2009-2021 Christoph Hellwig
+ *
+ * NOTE: none of these tracepoints shall be consider a stable kernel ABI
+ * as they can change at any time.
+@@ -140,6 +140,8 @@ DEFINE_EVENT(iomap_class, name, \
+ TP_ARGS(inode, iomap))
+ DEFINE_IOMAP_EVENT(iomap_apply_dstmap);
+ DEFINE_IOMAP_EVENT(iomap_apply_srcmap);
++DEFINE_IOMAP_EVENT(iomap_iter_dstmap);
++DEFINE_IOMAP_EVENT(iomap_iter_srcmap);
+
+ TRACE_EVENT(iomap_apply,
+ TP_PROTO(struct inode *inode, loff_t pos, loff_t length,
+@@ -179,6 +181,39 @@ TRACE_EVENT(iomap_apply,
+ __entry->actor)
+ );
+
++TRACE_EVENT(iomap_iter,
++ TP_PROTO(struct iomap_iter *iter, const void *ops,
++ unsigned long caller),
++ TP_ARGS(iter, ops, caller),
++ TP_STRUCT__entry(
++ __field(dev_t, dev)
++ __field(u64, ino)
++ __field(loff_t, pos)
++ __field(loff_t, length)
++ __field(unsigned int, flags)
++ __field(const void *, ops)
++ __field(unsigned long, caller)
++ ),
++ TP_fast_assign(
++ __entry->dev = iter->inode->i_sb->s_dev;
++ __entry->ino = iter->inode->i_ino;
++ __entry->pos = iter->pos;
++ __entry->length = iomap_length(iter);
++ __entry->flags = iter->flags;
++ __entry->ops = ops;
++ __entry->caller = caller;
++ ),
++ TP_printk("dev %d:%d ino 0x%llx pos %lld length %lld flags %s (0x%x) ops %ps caller %pS",
++ MAJOR(__entry->dev), MINOR(__entry->dev),
++ __entry->ino,
++ __entry->pos,
++ __entry->length,
++ __print_flags(__entry->flags, "|", IOMAP_FLAGS_STRINGS),
++ __entry->flags,
++ __entry->ops,
++ (void *)__entry->caller)
++);
++
+ #endif /* _IOMAP_TRACE_H */
+
+ #undef TRACE_INCLUDE_PATH
+diff --git a/include/linux/iomap.h b/include/linux/iomap.h
+index 5bd3cac4df9cb..5100a139d2efd 100644
+--- a/include/linux/iomap.h
++++ b/include/linux/iomap.h
+@@ -143,6 +143,62 @@ struct iomap_ops {
+ ssize_t written, unsigned flags, struct iomap *iomap);
+ };
+
++/**
++ * struct iomap_iter - Iterate through a range of a file
++ * @inode: Set at the start of the iteration and should not change.
++ * @pos: The current file position we are operating on. It is updated by
++ * calls to iomap_iter(). Treat as read-only in the body.
++ * @len: The remaining length of the file segment we're operating on.
++ * It is updated at the same time as @pos.
++ * @processed: The number of bytes processed by the body in the most recent
++ * iteration, or a negative errno. 0 causes the iteration to stop.
++ * @flags: Zero or more of the iomap_begin flags above.
++ * @iomap: Map describing the I/O iteration
++ * @srcmap: Source map for COW operations
++ */
++struct iomap_iter {
++ struct inode *inode;
++ loff_t pos;
++ u64 len;
++ s64 processed;
++ unsigned flags;
++ struct iomap iomap;
++ struct iomap srcmap;
++};
++
++int iomap_iter(struct iomap_iter *iter, const struct iomap_ops *ops);
++
++/**
++ * iomap_length - length of the current iomap iteration
++ * @iter: iteration structure
++ *
++ * Returns the length that the operation applies to for the current iteration.
++ */
++static inline u64 iomap_length(const struct iomap_iter *iter)
++{
++ u64 end = iter->iomap.offset + iter->iomap.length;
++
++ if (iter->srcmap.type != IOMAP_HOLE)
++ end = min(end, iter->srcmap.offset + iter->srcmap.length);
++ return min(iter->len, end - iter->pos);
++}
++
++/**
++ * iomap_iter_srcmap - return the source map for the current iomap iteration
++ * @i: iteration structure
++ *
++ * Write operations on file systems with reflink support might require a
++ * source and a destination map. This function retourns the source map
++ * for a given operation, which may or may no be identical to the destination
++ * map in &i->iomap.
++ */
++static inline struct iomap *iomap_iter_srcmap(struct iomap_iter *i)
++{
++ if (i->srcmap.type != IOMAP_HOLE)
++ return &i->srcmap;
++ return &i->iomap;
++}
++
+ /*
+ * Main iomap iterator function.
+ */
+--
+2.51.0
+
--- /dev/null
+From 85a247baa7f195d41a73d1caa772fc4b81de1662 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 0af58c4dcebc1..dc85a742f97cb 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -499,25 +499,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 3de502472eca80a1312c61fea90065e53440c926 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index cedf72924f19e..d7a037d32bcc2 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -468,6 +468,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index cf9184928eded..6a85200002969 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -553,20 +553,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index bd27204725ed8..6efad8d6653b6 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1277,8 +1277,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 859bc9f1d5a1e73530dd3d809b1c04332779e156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:07:42 +0100
+Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
+
+Convert `lan78xx_init_mac_address` to return error codes and handle
+failures in register read and write operations. Update `lan78xx_reset`
+to check for errors during MAC address initialization and propagate them
+appropriately.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 3e3c67dc6bf74..c3aa3f75ab914 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1710,13 +1710,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = {
+ .get_regs = lan78xx_get_regs,
+ };
+
+-static void lan78xx_init_mac_address(struct lan78xx_net *dev)
++static int lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+ u8 addr[6];
++ int ret;
++
++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ if (ret < 0)
++ return ret;
+
+- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ if (ret < 0)
++ return ret;
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1749,14 +1755,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ if (ret < 0)
++ return ret;
+ }
+
+- lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ if (ret < 0)
++ return ret;
+
+ eth_hw_addr_set(dev->net, addr);
++
++ return 0;
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2655,7 +2673,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- lan78xx_init_mac_address(dev);
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
+
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+--
+2.51.0
+
--- /dev/null
+From a245640545a4024a765fc5c051adf50808bfd408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index c3aa3f75ab914..fd5fa64cbe932 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2673,10 +2673,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -2685,6 +2681,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From dea6bc9f6687f6beebf6c4d849945094d2e572dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Oct 2021 14:32:24 -0700
+Subject: net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit af804e6db9f60b923ff5149d9bf782e0baa82a2b ]
+
+Commit 406f42fa0d3c ("net-next: When a bond have a massive amount
+of VLANs...") introduced a rbtree for faster Ethernet address look
+up. To maintain netdev->dev_addr in this tree we need to make all
+the writes to it got through appropriate helpers.
+
+Convert net/usb from ether_addr_copy() to eth_hw_addr_set():
+
+ @@
+ expression dev, np;
+ @@
+ - ether_addr_copy(dev->dev_addr, np)
+ + eth_hw_addr_set(dev, np)
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/aqc111.c | 2 +-
+ drivers/net/usb/lan78xx.c | 4 ++--
+ drivers/net/usb/r8152.c | 2 +-
+ drivers/net/usb/rndis_host.c | 2 +-
+ drivers/net/usb/rtl8150.c | 2 +-
+ 5 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
+index 485959771431d..ab9431ea295ad 100644
+--- a/drivers/net/usb/aqc111.c
++++ b/drivers/net/usb/aqc111.c
+@@ -720,7 +720,7 @@ static int aqc111_bind(struct usbnet *dev, struct usb_interface *intf)
+ if (ret)
+ goto out;
+
+- ether_addr_copy(dev->net->dev_addr, dev->net->perm_addr);
++ eth_hw_addr_set(dev->net, dev->net->perm_addr);
+
+ /* Set Rx urb size */
+ dev->rx_urb_size = URB_SIZE;
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index cabe6cdd6903a..3e3c67dc6bf74 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1756,7 +1756,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
+
+- ether_addr_copy(dev->net->dev_addr, addr);
++ eth_hw_addr_set(dev->net, addr);
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2331,7 +2331,7 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ if (!is_valid_ether_addr(addr->sa_data))
+ return -EADDRNOTAVAIL;
+
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
++ eth_hw_addr_set(netdev, addr->sa_data);
+
+ addr_lo = netdev->dev_addr[0] |
+ netdev->dev_addr[1] << 8 |
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 0d6f10c9bb139..57565fb2c0a11 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -1545,7 +1545,7 @@ static int set_ethernet_addr(struct r8152 *tp)
+ return ret;
+
+ if (tp->version == RTL_VER_01)
+- ether_addr_copy(dev->dev_addr, sa.sa_data);
++ eth_hw_addr_set(dev, sa.sa_data);
+ else
+ ret = rtl8152_set_mac_address(dev, &sa);
+
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index 1ff723e15d523..a244796fcaa44 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -422,7 +422,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
+ if (bp[0] & 0x02)
+ eth_hw_addr_random(net);
+ else
+- ether_addr_copy(net->dev_addr, bp);
++ eth_hw_addr_set(net, bp);
+
+ /* set a nonzero filter to enable data transfers */
+ memset(u.set, 0, sizeof *u.set);
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index c0f5e8ab1e34e..84252487ae49a 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -270,7 +270,7 @@ static void set_ethernet_addr(rtl8150_t *dev)
+ ret = get_registers(dev, IDR, sizeof(node_id), node_id);
+
+ if (!ret) {
+- ether_addr_copy(dev->netdev->dev_addr, node_id);
++ eth_hw_addr_set(dev->netdev, node_id);
+ } else {
+ eth_hw_addr_random(dev->netdev);
+ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
+--
+2.51.0
+
--- /dev/null
+From 3f1369cf8e5e6847a6942dda8a54e639fc7bd840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index b60add52f4497..9fb8fdd5b2619 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4979,8 +4979,9 @@ static int __maybe_unused rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_net_resume(tp);
+--
+2.51.0
+
--- /dev/null
+From 9a3a348c34a6bf26323ac9b99a388c0fcf3ad8be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 12:18:16 +0100
+Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
+
+Standardize scheduler load-balancing function names on the
+sched_balance_() prefix.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 802c97a05f57e..952a3fd41a6fe 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3907,7 +3907,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf);
+
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+@@ -4234,7 +4234,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -7065,7 +7065,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+ if (rq->nr_running)
+ return 1;
+
+- return newidle_balance(rq, rf) != 0;
++ return sched_balance_newidle(rq, rf) != 0;
+ }
+ #endif /* CONFIG_SMP */
+
+@@ -7356,10 +7356,10 @@ done: __maybe_unused;
+ if (!rf)
+ return NULL;
+
+- new_tasks = newidle_balance(rq, rf);
++ new_tasks = sched_balance_newidle(rq, rf);
+
+ /*
+- * Because newidle_balance() releases (and re-acquires) rq->lock, it is
++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+ * possible for any higher priority task to appear. In that case we
+ * must re-start the pick_next_entity() loop.
+ */
+@@ -10090,7 +10090,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ ld_moved = 0;
+
+ /*
+- * newidle_balance() disregards balance intervals, so we could
++ * sched_balance_newidle() disregards balance intervals, so we could
+ * repeatedly reach this code, which would lead to balance_interval
+ * skyrocketting in a short amount of time. Skip the balance_interval
+ * increase logic to avoid that.
+@@ -10808,7 +10808,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * newidle_balance is called by schedule() if this_cpu is about to become
++ * sched_balance_newidle is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ *
+ * Returns:
+@@ -10816,7 +10816,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ * 0 - failed, no new tasks
+ * > 0 - success, new (fair) tasks present
+ */
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+--
+2.51.0
+
--- /dev/null
+From 5cf3116d64fd425845cb4597993b5fd8a59e1556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 952a3fd41a6fe..c11d59bea0ea8 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7353,21 +7353,21 @@ done: __maybe_unused;
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
--- /dev/null
+From c9d02a90727a10536bbe4be630ea0321784d62f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 11:06:41 +1300
+Subject: sched/fair: Trivial correction of the newidle_balance() comment
+
+From: Barry Song <song.bao.hua@hisilicon.com>
+
+[ Upstream commit 5b78f2dc315354c05300795064f587366a02c6ff ]
+
+idle_balance() has been renamed to newidle_balance(). To differentiate
+with nohz_idle_balance, it seems refining the comment will be helpful
+for the readers of the code.
+
+Signed-off-by: Barry Song <song.bao.hua@hisilicon.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20201202220641.22752-1-song.bao.hua@hisilicon.com
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 9f8cb265589b3..802c97a05f57e 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10808,7 +10808,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * idle_balance is called by schedule() if this_cpu is about to become
++ * newidle_balance is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ *
+ * Returns:
+--
+2.51.0
+
media-lirc-fix-error-handling-in-lirc_register.patch
xen-events-update-virq_to_irq-on-migration.patch
hid-multitouch-fix-sticky-fingers.patch
+iomap-add-the-new-iomap_iter-model.patch
+fsdax-switch-dax_iomap_rw-to-use-iomap_iter.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch
+net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+sched-fair-trivial-correction-of-the-newidle_balance.patch
+sched-balancing-rename-newidle_balance-sched_balance.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
--- /dev/null
+From 236f18a004bc74d6f47b1f39fc302c8433437afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 32e38ac5ee2bd..88e8d6543948e 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2177,7 +2177,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2239,9 +2240,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From 7b8919e431e4e0b51ba44808b0300494ba78826f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index a7e8f13bb9761..e8be9e5a244fd 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5821,7 +5821,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5962,9 +5962,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From d8551f7d29121f523ff50008e8ace08bf70f540f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 63517995c692a..f22b32b4c8022 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -185,12 +185,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From ca24c97199be91c7ac3e21298e816239307f81b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index e519a0160668e..a300d1ac13a88 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1056,6 +1056,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1110,6 +1117,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From acd43b177ba68246acd4abe0595d86ec21dc3bb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 011d0f0c39415..dc70256ca2203 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
+--
+2.51.0
+
--- /dev/null
+From 5e7b3bed30a92c1aad262404558fd4deb17ca252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:16:45 +0800
+Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
+
+From: Jiaming Zhang <r772577952@gmail.com>
+
+[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
+
+In try_to_register_card(), the return value of usb_ifnum_to_if() is
+passed directly to usb_interface_claimed() without a NULL check, which
+will lead to a NULL pointer dereference when creating an invalid
+USB audio device. Fix this by adding a check to ensure the interface
+pointer is valid before passing it to usb_interface_claimed().
+
+Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration")
+Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/
+Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index bec6d41a143d2..33ffa62032ab9 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -753,10 +753,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)
+ */
+ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
+ {
++ struct usb_interface *iface;
++
+ if (check_delayed_register_option(chip) == ifnum ||
+- chip->last_iface == ifnum ||
+- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface)))
++ chip->last_iface == ifnum)
++ return snd_card_register(chip->card);
++
++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface);
++ if (iface && usb_interface_claimed(iface))
+ return snd_card_register(chip->card);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 501dcb8b461da69bf3947970894971cbfc9bbe4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index af04c035633ff..32397517807b0 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 19fed56b6ee3f..ebb8b3e5b9a88 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From fa63c9f277a2d8a3878324f12251a1e862e014fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 17:46:32 +0200
+Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
+
+Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to
+m_can_platform") moved the PM runtime enable from the m_can core
+driver into the m_can_platform.
+
+That patch forgot to move the pm_runtime_disable() to
+m_can_plat_remove(), so that unloading the m_can_platform driver
+causes an "Unbalanced pm_runtime_enable!" error message.
+
+Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the
+problem.
+
+Cc: Patrik Flykt <patrik.flykt@linux.intel.com>
+Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index de6d8e01bf2e8..71cf3662128a1 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -170,7 +170,7 @@ static int m_can_plat_remove(struct platform_device *pdev)
+ struct m_can_classdev *mcan_class = &priv->cdev;
+
+ m_can_class_unregister(mcan_class);
+-
++ pm_runtime_disable(mcan_class->dev);
+ m_can_class_free_dev(mcan_class->net);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From cb6ce603b3da5ee478fa2d01efff59f56a587ace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 4ab1c493c73f1..504114394995c 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1285,7 +1285,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2d163fa4a5775d988c09bf527fcb0ede3b73cdf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:18:59 +0200
+Subject: doc: fix seg6_flowlabel path
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
+
+This sysctl is not per interface; it's global per netns.
+
+Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst")
+Reported-by: Philippe Guibert <philippe.guibert@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/seg6-sysctl.rst | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst
+index 07c20e470bafe..1b6af4779be11 100644
+--- a/Documentation/networking/seg6-sysctl.rst
++++ b/Documentation/networking/seg6-sysctl.rst
+@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER
+
+ Default is 0.
+
++/proc/sys/net/ipv6/seg6_* variables:
++====================================
++
+ seg6_flowlabel - INTEGER
+ Controls the behaviour of computing the flowlabel of outer
+ IPv6 header in case of SR T.encaps
+--
+2.51.0
+
--- /dev/null
+From 70dc121a31f6c3eb10f8a5e3da4b85560e7a6aa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 2d1f37aefdbd1..e25032ad16be7 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -5387,8 +5387,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c1655ba4bcba2c46812b2c3207ee5d40a3e8084d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index ca8bfd1b8278e..59db32dcf9f3d 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -499,25 +499,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 4a925ddf41d555884da98fafe9b61a6fe2d64eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index d8b9942f1afd9..7ca06cf6e0f79 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -467,6 +467,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 9f9b7768cd192..7ddadf779004e 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -553,20 +553,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5955fca601b3a..ccdea44438940 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1247,8 +1247,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From ceb365e650c723362371b80af45df99511d32cf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 14:17:41 +0200
+Subject: net: tls: wait for async completion on last message
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ]
+
+When asynchronous encryption is used KTLS sends out the final data at
+proto->close time. This becomes problematic when the task calling
+close() receives a signal. In this case it can happen that
+tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the
+final data is not sent.
+
+The described situation happens when KTLS is used in conjunction with
+io_uring, as io_uring uses task_work_add() to add work to the current
+userspace task. A discussion of the problem along with a reproducer can
+be found in [1] and [2]
+
+Fix this by waiting for the asynchronous encryption to be completed on
+the final message. With this there is no data left to be sent at close
+time.
+
+[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/
+[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 6b0fd0e5fc880..d2cb19f5cb8bc 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1164,7 +1164,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+
+ if (!num_async) {
+ goto send_end;
+- } else if (num_zc) {
++ } else if (num_zc || eor) {
+ int err;
+
+ /* Wait for pending encryptions to get completed */
+--
+2.51.0
+
--- /dev/null
+From 2f451670de3bbcf2250c964d71af587f48bf7c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:07:42 +0100
+Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
+
+Convert `lan78xx_init_mac_address` to return error codes and handle
+failures in register read and write operations. Update `lan78xx_reset`
+to check for errors during MAC address initialization and propagate them
+appropriately.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 4be15489a2c2a..182a4dbd8cf26 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1773,13 +1773,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = {
+ .get_regs = lan78xx_get_regs,
+ };
+
+-static void lan78xx_init_mac_address(struct lan78xx_net *dev)
++static int lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+ u8 addr[6];
++ int ret;
++
++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ if (ret < 0)
++ return ret;
+
+- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ if (ret < 0)
++ return ret;
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1812,14 +1818,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ if (ret < 0)
++ return ret;
+ }
+
+- lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ if (ret < 0)
++ return ret;
+
+ eth_hw_addr_set(dev->net, addr);
++
++ return 0;
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2718,7 +2736,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- lan78xx_init_mac_address(dev);
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
+
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+--
+2.51.0
+
--- /dev/null
+From 4fd25d722aef6ab7e8495114e9dfd5dd3b396ebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 182a4dbd8cf26..174d94bdaae64 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2736,10 +2736,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -2748,6 +2744,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 2abdcacb1d5f69988036f5ec4651f09a0353682f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Oct 2021 14:32:24 -0700
+Subject: net: usb: use eth_hw_addr_set() instead of ether_addr_copy()
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit af804e6db9f60b923ff5149d9bf782e0baa82a2b ]
+
+Commit 406f42fa0d3c ("net-next: When a bond have a massive amount
+of VLANs...") introduced a rbtree for faster Ethernet address look
+up. To maintain netdev->dev_addr in this tree we need to make all
+the writes to it got through appropriate helpers.
+
+Convert net/usb from ether_addr_copy() to eth_hw_addr_set():
+
+ @@
+ expression dev, np;
+ @@
+ - ether_addr_copy(dev->dev_addr, np)
+ + eth_hw_addr_set(dev, np)
+
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/aqc111.c | 2 +-
+ drivers/net/usb/lan78xx.c | 4 ++--
+ drivers/net/usb/r8152.c | 2 +-
+ drivers/net/usb/rndis_host.c | 2 +-
+ drivers/net/usb/rtl8150.c | 2 +-
+ 5 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
+index 6be07557bc63d..00aba7e1d0b95 100644
+--- a/drivers/net/usb/aqc111.c
++++ b/drivers/net/usb/aqc111.c
+@@ -720,7 +720,7 @@ static int aqc111_bind(struct usbnet *dev, struct usb_interface *intf)
+ if (ret)
+ goto out;
+
+- ether_addr_copy(dev->net->dev_addr, dev->net->perm_addr);
++ eth_hw_addr_set(dev->net, dev->net->perm_addr);
+
+ /* Set Rx urb size */
+ dev->rx_urb_size = URB_SIZE;
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 2279a4b8cd4e3..4be15489a2c2a 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1819,7 +1819,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
+
+- ether_addr_copy(dev->net->dev_addr, addr);
++ eth_hw_addr_set(dev->net, addr);
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2394,7 +2394,7 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ if (!is_valid_ether_addr(addr->sa_data))
+ return -EADDRNOTAVAIL;
+
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
++ eth_hw_addr_set(netdev, addr->sa_data);
+
+ addr_lo = netdev->dev_addr[0] |
+ netdev->dev_addr[1] << 8 |
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 1dfa0091fa307..1bd18a6292803 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -1724,7 +1724,7 @@ static int set_ethernet_addr(struct r8152 *tp, bool in_resume)
+ return ret;
+
+ if (tp->version == RTL_VER_01)
+- ether_addr_copy(dev->dev_addr, sa.sa_data);
++ eth_hw_addr_set(dev, sa.sa_data);
+ else
+ ret = __rtl8152_set_mac_address(dev, &sa, in_resume);
+
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index e5f6614da5acc..f3e4a68b6c947 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -422,7 +422,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
+ if (bp[0] & 0x02)
+ eth_hw_addr_random(net);
+ else
+- ether_addr_copy(net->dev_addr, bp);
++ eth_hw_addr_set(net, bp);
+
+ /* set a nonzero filter to enable data transfers */
+ memset(u.set, 0, sizeof *u.set);
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 324bec0c22fb4..57f1056a27b14 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -270,7 +270,7 @@ static void set_ethernet_addr(rtl8150_t *dev)
+ ret = get_registers(dev, IDR, sizeof(node_id), node_id);
+
+ if (!ret) {
+- ether_addr_copy(dev->netdev->dev_addr, node_id);
++ eth_hw_addr_set(dev->netdev, node_id);
+ } else {
+ eth_hw_addr_random(dev->netdev);
+ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
+--
+2.51.0
+
--- /dev/null
+From fafb4f9c7a11e28dc00c7b91789588fd9f4bc476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 1ea30c9b8c07c..07dc9fdeea54c 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4962,8 +4962,9 @@ static int rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_runtime_resume(device);
+--
+2.51.0
+
--- /dev/null
+From 7bbc4c7faba8c72ead96d2989e37c2b185a39ed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:25:13 +0200
+Subject: riscv: kprobes: Fix probe address validation
+
+From: Fabian Vogt <fvogt@suse.de>
+
+[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
+
+When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
+arch_check_kprobe would start iterating all instructions starting from
+_text until the probed address. Not only is this very inefficient, but
+literal values in there (e.g. left by function patching) are
+misinterpreted in a way that causes a desync.
+
+Fix this by doing it like x86: start the iteration at the closest
+preceding symbol instead of the given starting point.
+
+Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
+Signed-off-by: Fabian Vogt <fvogt@suse.de>
+Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index 7548b1d62509c..5251f18278017 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
+-static bool __kprobes arch_check_kprobe(struct kprobe *p)
++static bool __kprobes arch_check_kprobe(unsigned long addr)
+ {
+- unsigned long tmp = (unsigned long)p->addr - p->offset;
+- unsigned long addr = (unsigned long)p->addr;
++ unsigned long tmp, offset;
++
++ /* start iterating at the closest preceding symbol */
++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
++ return false;
++
++ tmp = addr - offset;
+
+ while (tmp <= addr) {
+ if (tmp == addr)
+@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if ((unsigned long)insn & 0x1)
+ return -EILSEQ;
+
+- if (!arch_check_kprobe(p))
++ if (!arch_check_kprobe((unsigned long)p->addr))
+ return -EILSEQ;
+
+ /* copy instruction */
+--
+2.51.0
+
--- /dev/null
+From 45bbebefd25b0d0c54116a565b2785b2d0d21633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 12:18:16 +0100
+Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
+
+Standardize scheduler load-balancing function names on the
+sched_balance_() prefix.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index ea707ee9ddac1..03b809308712e 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3959,7 +3959,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf);
+
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+@@ -4291,7 +4291,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -7280,7 +7280,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+ if (rq->nr_running)
+ return 1;
+
+- return newidle_balance(rq, rf) != 0;
++ return sched_balance_newidle(rq, rf) != 0;
+ }
+ #endif /* CONFIG_SMP */
+
+@@ -7616,10 +7616,10 @@ done: __maybe_unused;
+ if (!rf)
+ return NULL;
+
+- new_tasks = newidle_balance(rq, rf);
++ new_tasks = sched_balance_newidle(rq, rf);
+
+ /*
+- * Because newidle_balance() releases (and re-acquires) rq->lock, it is
++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+ * possible for any higher priority task to appear. In that case we
+ * must re-start the pick_next_entity() loop.
+ */
+@@ -10427,7 +10427,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ ld_moved = 0;
+
+ /*
+- * newidle_balance() disregards balance intervals, so we could
++ * sched_balance_newidle() disregards balance intervals, so we could
+ * repeatedly reach this code, which would lead to balance_interval
+ * skyrocketing in a short amount of time. Skip the balance_interval
+ * increase logic to avoid that.
+@@ -11155,7 +11155,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * newidle_balance is called by schedule() if this_cpu is about to become
++ * sched_balance_newidle is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ *
+ * Returns:
+@@ -11163,7 +11163,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ * 0 - failed, no new tasks
+ * > 0 - success, new (fair) tasks present
+ */
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+--
+2.51.0
+
--- /dev/null
+From d17708aaf6d87d9e25338d1515dc0a36978e58f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 03b809308712e..87f32cf8aa029 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7613,21 +7613,21 @@ done: __maybe_unused;
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
crypto-rockchip-fix-dma_unmap_sg-nents-value.patch
cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch
hid-multitouch-fix-sticky-fingers.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+doc-fix-seg6_flowlabel-path.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+splice-net-add-a-splice_eof-op-to-file-ops-and-socke.patch
+net-tls-wait-for-async-completion-on-last-message.patch
+tls-wait-for-async-encrypt-in-case-of-error-during-l.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+net-usb-use-eth_hw_addr_set-instead-of-ether_addr_co.patch
+net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+riscv-kprobes-fix-probe-address-validation.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+sched-balancing-rename-newidle_balance-sched_balance.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
+alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch
--- /dev/null
+From 80062a0bb92b49fa486a08b38a6b64359b4c4470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 19:19:10 +0100
+Subject: splice, net: Add a splice_eof op to file-ops and socket-ops
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 2bfc66850952b6921b2033b09729ec59eabbc81d ]
+
+Add an optional method, ->splice_eof(), to allow splice to indicate the
+premature termination of a splice to struct file_operations and struct
+proto_ops.
+
+This is called if sendfile() or splice() encounters all of the following
+conditions inside splice_direct_to_actor():
+
+ (1) the user did not set SPLICE_F_MORE (splice only), and
+
+ (2) an EOF condition occurred (->splice_read() returned 0), and
+
+ (3) we haven't read enough to fulfill the request (ie. len > 0 still), and
+
+ (4) we have already spliced at least one byte.
+
+A further patch will modify the behaviour of SPLICE_F_MORE to always be
+passed to the actor if either the user set it or we haven't yet read
+sufficient data to fulfill the request.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/CAHk-=wh=V579PDYvkpnTobCLGczbgxpMgGmmhqiTyE34Cpi5Gg@mail.gmail.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Christoph Hellwig <hch@lst.de>
+cc: Al Viro <viro@zeniv.linux.org.uk>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: Jan Kara <jack@suse.cz>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: David Hildenbrand <david@redhat.com>
+cc: Christian Brauner <brauner@kernel.org>
+cc: Chuck Lever <chuck.lever@oracle.com>
+cc: Boris Pismenny <borisp@nvidia.com>
+cc: John Fastabend <john.fastabend@gmail.com>
+cc: linux-mm@kvack.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/splice.c | 31 ++++++++++++++++++++++++++++++-
+ include/linux/fs.h | 1 +
+ include/linux/net.h | 1 +
+ include/linux/splice.h | 1 +
+ include/net/sock.h | 1 +
+ net/socket.c | 10 ++++++++++
+ 6 files changed, 44 insertions(+), 1 deletion(-)
+
+diff --git a/fs/splice.c b/fs/splice.c
+index 5dbce4dcc1a7d..e8591211044a3 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -767,6 +767,17 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
+ return out->f_op->splice_write(pipe, out, ppos, len, flags);
+ }
+
++/*
++ * Indicate to the caller that there was a premature EOF when reading from the
++ * source and the caller didn't indicate they would be sending more data after
++ * this.
++ */
++static void do_splice_eof(struct splice_desc *sd)
++{
++ if (sd->splice_eof)
++ sd->splice_eof(sd);
++}
++
+ /*
+ * Attempt to initiate a splice from a file to a pipe.
+ */
+@@ -869,7 +880,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+
+ ret = do_splice_to(in, &pos, pipe, len, flags);
+ if (unlikely(ret <= 0))
+- goto out_release;
++ goto read_failure;
+
+ read_len = ret;
+ sd->total_len = read_len;
+@@ -909,6 +920,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ file_accessed(in);
+ return bytes;
+
++read_failure:
++ /*
++ * If the user did *not* set SPLICE_F_MORE *and* we didn't hit that
++ * "use all of len" case that cleared SPLICE_F_MORE, *and* we did a
++ * "->splice_in()" that returned EOF (ie zero) *and* we have sent at
++ * least 1 byte *then* we will also do the ->splice_eof() call.
++ */
++ if (ret == 0 && !more && len > 0 && bytes)
++ do_splice_eof(sd);
+ out_release:
+ /*
+ * If we did an incomplete transfer we must release
+@@ -937,6 +957,14 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
+ sd->flags);
+ }
+
++static void direct_file_splice_eof(struct splice_desc *sd)
++{
++ struct file *file = sd->u.file;
++
++ if (file->f_op->splice_eof)
++ file->f_op->splice_eof(file);
++}
++
+ /**
+ * do_splice_direct - splices data directly between two files
+ * @in: file to splice from
+@@ -962,6 +990,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
+ .flags = flags,
+ .pos = *ppos,
+ .u.file = out,
++ .splice_eof = direct_file_splice_eof,
+ .opos = opos,
+ };
+ long ret;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index a8d708fe08b30..72a956d243c2e 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2104,6 +2104,7 @@ struct file_operations {
+ int (*flock) (struct file *, int, struct file_lock *);
+ ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
+ ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
++ void (*splice_eof)(struct file *file);
+ int (*setlease)(struct file *, long, struct file_lock **, void **);
+ long (*fallocate)(struct file *file, int mode, loff_t offset,
+ loff_t len);
+diff --git a/include/linux/net.h b/include/linux/net.h
+index ba736b457a068..9054f17e4b631 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -187,6 +187,7 @@ struct proto_ops {
+ int offset, size_t size, int flags);
+ ssize_t (*splice_read)(struct socket *sock, loff_t *ppos,
+ struct pipe_inode_info *pipe, size_t len, unsigned int flags);
++ void (*splice_eof)(struct socket *sock);
+ int (*set_peek_off)(struct sock *sk, int val);
+ int (*peek_len)(struct socket *sock);
+
+diff --git a/include/linux/splice.h b/include/linux/splice.h
+index a55179fd60fc3..41a70687be853 100644
+--- a/include/linux/splice.h
++++ b/include/linux/splice.h
+@@ -38,6 +38,7 @@ struct splice_desc {
+ struct file *file; /* file to read/write */
+ void *data; /* cookie */
+ } u;
++ void (*splice_eof)(struct splice_desc *sd); /* Unexpected EOF handler */
+ loff_t pos; /* file position */
+ loff_t *opos; /* sendfile: output position */
+ size_t num_spliced; /* number of bytes already spliced */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 3158cf0269ac9..b987074f80965 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1229,6 +1229,7 @@ struct proto {
+ int *addr_len);
+ int (*sendpage)(struct sock *sk, struct page *page,
+ int offset, size_t size, int flags);
++ void (*splice_eof)(struct socket *sock);
+ int (*bind)(struct sock *sk,
+ struct sockaddr *addr, int addr_len);
+ int (*bind_add)(struct sock *sk,
+diff --git a/net/socket.c b/net/socket.c
+index bb2a209e3e28d..1d71fa44ace45 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -129,6 +129,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
+ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
+ struct pipe_inode_info *pipe, size_t len,
+ unsigned int flags);
++static void sock_splice_eof(struct file *file);
+
+ #ifdef CONFIG_PROC_FS
+ static void sock_show_fdinfo(struct seq_file *m, struct file *f)
+@@ -163,6 +164,7 @@ static const struct file_operations socket_file_ops = {
+ .sendpage = sock_sendpage,
+ .splice_write = generic_splice_sendpage,
+ .splice_read = sock_splice_read,
++ .splice_eof = sock_splice_eof,
+ .show_fdinfo = sock_show_fdinfo,
+ };
+
+@@ -1037,6 +1039,14 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
+ return sock->ops->splice_read(sock, ppos, pipe, len, flags);
+ }
+
++static void sock_splice_eof(struct file *file)
++{
++ struct socket *sock = file->private_data;
++
++ if (sock->ops->splice_eof)
++ sock->ops->splice_eof(sock);
++}
++
+ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ {
+ struct file *file = iocb->ki_filp;
+--
+2.51.0
+
--- /dev/null
+From 47c3d1544d743b92df4bc43e115d10d4dce0471a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 3a66d0c7d015c..dd63832c11fd7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2180,7 +2180,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2242,9 +2243,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From ed541e8bb62c87f44200569f369a0c36d8613014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 7c51b9b593afc..bd3b56c7aab8d 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5815,7 +5815,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5956,9 +5956,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From 0bfd361beff4011f26648b068e7e4791fd53c81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index ba170f1f38a4c..0352771295914 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -185,12 +185,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From a1830ac59041bbbf5d7cf3459ea65a6e8047c9f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index e08edfc639fd5..110859f7e5e3e 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1089,6 +1089,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1143,6 +1150,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From f9fd5adf6a854508bdeb988afd8fd4250db2390d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:57 +0200
+Subject: tls: wait for async encrypt in case of error during latter iterations
+ of sendmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
+
+If we hit an error during the main loop of tls_sw_sendmsg_locked (eg
+failed allocation), we jump to send_end and immediately
+return. Previous iterations may have queued async encryption requests
+that are still pending. We should wait for those before returning, as
+we could otherwise be reading from memory that userspace believes
+we're not using anymore, which would be a sort of use-after-free.
+
+This is similar to what tls_sw_recvmsg already does: failures during
+the main loop jump to the "wait for async" code, not straight to the
+unlock/return.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index d2cb19f5cb8bc..e08edfc639fd5 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1013,7 +1013,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ if (ret == -EINPROGRESS)
+ num_async++;
+ else if (ret != -EAGAIN)
+- goto send_end;
++ goto end;
+ }
+ }
+
+@@ -1162,8 +1162,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto alloc_encrypted;
+ }
+
++send_end:
+ if (!num_async) {
+- goto send_end;
++ goto end;
+ } else if (num_zc || eor) {
+ int err;
+
+@@ -1181,7 +1182,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ tls_tx_records(sk, msg->msg_flags);
+ }
+
+-send_end:
++end:
+ ret = sk_stream_error(sk, msg->msg_flags, ret);
+
+ release_sock(sk);
+--
+2.51.0
+
--- /dev/null
+From 6d3b6f0f07397c141274b4acbfd6310b9241dbe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index bbbca964b9b46..f1933f7b9f1bf 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ */
+--
+2.51.0
+
--- /dev/null
+From 683112be2ab02171a3cbd6ca551bcf5cacc5a8fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index de10e7e3a68d0..1fa7eb75d1a39 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1247,7 +1247,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 3819b23c927d5..6dd95e7d81e41 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1637,6 +1637,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From a578fd8dc79cdf79b79a31553163b1a1140cfd4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Sep 2020 08:14:17 +0200
+Subject: net: dl2k: switch from 'pci_' to 'dma_' API
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b49db89e9697ddfa7fbe7387e176072ee2feb2db ]
+
+The wrappers in include/linux/pci-dma-compat.h should go away.
+
+The patch has been generated with the coccinelle script below and has been
+hand modified to replace GFP_ with a correct flag.
+It has been compile tested.
+
+When memory is allocated in 'rio_probe1()' GFP_KERNEL can be used because
+it is a probe function and no lock is taken in the between.
+
+@@
+@@
+- PCI_DMA_BIDIRECTIONAL
++ DMA_BIDIRECTIONAL
+
+@@
+@@
+- PCI_DMA_TODEVICE
++ DMA_TO_DEVICE
+
+@@
+@@
+- PCI_DMA_FROMDEVICE
++ DMA_FROM_DEVICE
+
+@@
+@@
+- PCI_DMA_NONE
++ DMA_NONE
+
+@@
+expression e1, e2, e3;
+@@
+- pci_alloc_consistent(e1, e2, e3)
++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
+
+@@
+expression e1, e2, e3;
+@@
+- pci_zalloc_consistent(e1, e2, e3)
++ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_free_consistent(e1, e2, e3, e4)
++ dma_free_coherent(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_map_single(e1, e2, e3, e4)
++ dma_map_single(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_single(e1, e2, e3, e4)
++ dma_unmap_single(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4, e5;
+@@
+- pci_map_page(e1, e2, e3, e4, e5)
++ dma_map_page(&e1->dev, e2, e3, e4, e5)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_page(e1, e2, e3, e4)
++ dma_unmap_page(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_map_sg(e1, e2, e3, e4)
++ dma_map_sg(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_unmap_sg(e1, e2, e3, e4)
++ dma_unmap_sg(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
++ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_single_for_device(e1, e2, e3, e4)
++ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
++ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2, e3, e4;
+@@
+- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
++ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
+
+@@
+expression e1, e2;
+@@
+- pci_dma_mapping_error(e1, e2)
++ dma_mapping_error(&e1->dev, e2)
+
+@@
+expression e1, e2;
+@@
+- pci_set_dma_mask(e1, e2)
++ dma_set_mask(&e1->dev, e2)
+
+@@
+expression e1, e2;
+@@
+- pci_set_consistent_dma_mask(e1, e2)
++ dma_set_coherent_mask(&e1->dev, e2)
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 65946eac6d88 ("net: dlink: handle dma_map_single() failure properly")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 80 ++++++++++++++++---------------
+ 1 file changed, 41 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index b4a8d4f12087a..8597648156635 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -233,13 +233,15 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ pci_set_drvdata (pdev, dev);
+
+- ring_space = pci_alloc_consistent (pdev, TX_TOTAL_SIZE, &ring_dma);
++ ring_space = dma_alloc_coherent(&pdev->dev, TX_TOTAL_SIZE, &ring_dma,
++ GFP_KERNEL);
+ if (!ring_space)
+ goto err_out_iounmap;
+ np->tx_ring = ring_space;
+ np->tx_ring_dma = ring_dma;
+
+- ring_space = pci_alloc_consistent (pdev, RX_TOTAL_SIZE, &ring_dma);
++ ring_space = dma_alloc_coherent(&pdev->dev, RX_TOTAL_SIZE, &ring_dma,
++ GFP_KERNEL);
+ if (!ring_space)
+ goto err_out_unmap_tx;
+ np->rx_ring = ring_space;
+@@ -290,9 +292,11 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent)
+ return 0;
+
+ err_out_unmap_rx:
+- pci_free_consistent (pdev, RX_TOTAL_SIZE, np->rx_ring, np->rx_ring_dma);
++ dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
++ np->rx_ring_dma);
+ err_out_unmap_tx:
+- pci_free_consistent (pdev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma);
++ dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
++ np->tx_ring_dma);
+ err_out_iounmap:
+ #ifdef MEM_MAPPING
+ pci_iounmap(pdev, np->ioaddr);
+@@ -446,8 +450,9 @@ static void free_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ skb = np->rx_skbuff[i];
+ if (skb) {
+- pci_unmap_single(np->pdev, desc_to_dma(&np->rx_ring[i]),
+- skb->len, PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&np->pdev->dev,
++ desc_to_dma(&np->rx_ring[i]),
++ skb->len, DMA_FROM_DEVICE);
+ dev_kfree_skb(skb);
+ np->rx_skbuff[i] = NULL;
+ }
+@@ -457,8 +462,9 @@ static void free_list(struct net_device *dev)
+ for (i = 0; i < TX_RING_SIZE; i++) {
+ skb = np->tx_skbuff[i];
+ if (skb) {
+- pci_unmap_single(np->pdev, desc_to_dma(&np->tx_ring[i]),
+- skb->len, PCI_DMA_TODEVICE);
++ dma_unmap_single(&np->pdev->dev,
++ desc_to_dma(&np->tx_ring[i]),
++ skb->len, DMA_TO_DEVICE);
+ dev_kfree_skb(skb);
+ np->tx_skbuff[i] = NULL;
+ }
+@@ -515,9 +521,8 @@ static int alloc_list(struct net_device *dev)
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+ np->rx_ring[i].fraginfo =
+- cpu_to_le64(pci_map_single(
+- np->pdev, skb->data, np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE));
++ cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE));
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+@@ -683,9 +688,8 @@ rio_timer (struct timer_list *t)
+ }
+ np->rx_skbuff[entry] = skb;
+ np->rx_ring[entry].fraginfo =
+- cpu_to_le64 (pci_map_single
+- (np->pdev, skb->data, np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE));
++ cpu_to_le64 (dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE));
+ }
+ np->rx_ring[entry].fraginfo |=
+ cpu_to_le64((u64)np->rx_buf_sz << 48);
+@@ -739,9 +743,8 @@ start_xmit (struct sk_buff *skb, struct net_device *dev)
+ ((u64)np->vlan << 32) |
+ ((u64)skb->priority << 45);
+ }
+- txdesc->fraginfo = cpu_to_le64 (pci_map_single (np->pdev, skb->data,
+- skb->len,
+- PCI_DMA_TODEVICE));
++ txdesc->fraginfo = cpu_to_le64 (dma_map_single(&np->pdev->dev, skb->data,
++ skb->len, DMA_TO_DEVICE));
+ txdesc->fraginfo |= cpu_to_le64((u64)skb->len << 48);
+
+ /* DL2K bug: DMA fails to get next descriptor ptr in 10Mbps mode
+@@ -838,9 +841,9 @@ rio_free_tx (struct net_device *dev, int irq)
+ if (!(np->tx_ring[entry].status & cpu_to_le64(TFDDone)))
+ break;
+ skb = np->tx_skbuff[entry];
+- pci_unmap_single (np->pdev,
+- desc_to_dma(&np->tx_ring[entry]),
+- skb->len, PCI_DMA_TODEVICE);
++ dma_unmap_single(&np->pdev->dev,
++ desc_to_dma(&np->tx_ring[entry]), skb->len,
++ DMA_TO_DEVICE);
+ if (irq)
+ dev_consume_skb_irq(skb);
+ else
+@@ -965,25 +968,25 @@ receive_packet (struct net_device *dev)
+
+ /* Small skbuffs for short packets */
+ if (pkt_len > copy_thresh) {
+- pci_unmap_single (np->pdev,
+- desc_to_dma(desc),
+- np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&np->pdev->dev,
++ desc_to_dma(desc),
++ np->rx_buf_sz,
++ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+ } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
+- pci_dma_sync_single_for_cpu(np->pdev,
+- desc_to_dma(desc),
+- np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&np->pdev->dev,
++ desc_to_dma(desc),
++ np->rx_buf_sz,
++ DMA_FROM_DEVICE);
+ skb_copy_to_linear_data (skb,
+ np->rx_skbuff[entry]->data,
+ pkt_len);
+ skb_put (skb, pkt_len);
+- pci_dma_sync_single_for_device(np->pdev,
+- desc_to_dma(desc),
+- np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_device(&np->pdev->dev,
++ desc_to_dma(desc),
++ np->rx_buf_sz,
++ DMA_FROM_DEVICE);
+ }
+ skb->protocol = eth_type_trans (skb, dev);
+ #if 0
+@@ -1016,9 +1019,8 @@ receive_packet (struct net_device *dev)
+ }
+ np->rx_skbuff[entry] = skb;
+ np->rx_ring[entry].fraginfo =
+- cpu_to_le64 (pci_map_single
+- (np->pdev, skb->data, np->rx_buf_sz,
+- PCI_DMA_FROMDEVICE));
++ cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE));
+ }
+ np->rx_ring[entry].fraginfo |=
+ cpu_to_le64((u64)np->rx_buf_sz << 48);
+@@ -1818,10 +1820,10 @@ rio_remove1 (struct pci_dev *pdev)
+ struct netdev_private *np = netdev_priv(dev);
+
+ unregister_netdev (dev);
+- pci_free_consistent (pdev, RX_TOTAL_SIZE, np->rx_ring,
+- np->rx_ring_dma);
+- pci_free_consistent (pdev, TX_TOTAL_SIZE, np->tx_ring,
+- np->tx_ring_dma);
++ dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
++ np->rx_ring_dma);
++ dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
++ np->tx_ring_dma);
+ #ifdef MEM_MAPPING
+ pci_iounmap(pdev, np->ioaddr);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 86ba146507dce0881956d560dc7119268663a30b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 8597648156635..855328ae6ea57 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -508,25 +508,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 5978936965a6535b190469414bd61fd6702340f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 3a04e2ccfb393..d2945ec5aba21 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -454,6 +454,21 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
+ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ gfp_t flags);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 906c37c7f80d5..38cace81bfa2d 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -560,20 +560,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5319093d9aa62..c79e6c032b300 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1201,8 +1201,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 6131381137925dc64542a5498bcf91ad51f9c73a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 12:18:16 +0100
+Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
+
+Standardize scheduler load-balancing function names on the
+sched_balance_() prefix.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 1d82b9cc9eb77..62c0348ef556a 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3690,7 +3690,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf);
+
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+@@ -3851,7 +3851,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -6690,7 +6690,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+ if (rq->nr_running)
+ return 1;
+
+- return newidle_balance(rq, rf) != 0;
++ return sched_balance_newidle(rq, rf) != 0;
+ }
+ #endif /* CONFIG_SMP */
+
+@@ -6981,10 +6981,10 @@ done: __maybe_unused;
+ if (!rf)
+ return NULL;
+
+- new_tasks = newidle_balance(rq, rf);
++ new_tasks = sched_balance_newidle(rq, rf);
+
+ /*
+- * Because newidle_balance() releases (and re-acquires) rq->lock, it is
++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+ * possible for any higher priority task to appear. In that case we
+ * must re-start the pick_next_entity() loop.
+ */
+@@ -9182,7 +9182,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ ld_moved = 0;
+
+ /*
+- * newidle_balance() disregards balance intervals, so we could
++ * sched_balance_newidle() disregards balance intervals, so we could
+ * repeatedly reach this code, which would lead to balance_interval
+ * skyrocketting in a short amount of time. Skip the balance_interval
+ * increase logic to avoid that.
+@@ -9897,10 +9897,10 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * newidle_balance is called by schedule() if this_cpu is about to become
++ * sched_balance_newidle is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ */
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+--
+2.51.0
+
--- /dev/null
+From 05686279236c95809859e94d50c6216d5b1ea2f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 62c0348ef556a..5e8f2167d8caa 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -6978,21 +6978,21 @@ done: __maybe_unused;
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
--- /dev/null
+From bc8d436105b261ccccdce02ef038118ec93f96e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 11:06:41 +1300
+Subject: sched/fair: Trivial correction of the newidle_balance() comment
+
+From: Barry Song <song.bao.hua@hisilicon.com>
+
+[ Upstream commit 5b78f2dc315354c05300795064f587366a02c6ff ]
+
+idle_balance() has been renamed to newidle_balance(). To differentiate
+with nohz_idle_balance, it seems refining the comment will be helpful
+for the readers of the code.
+
+Signed-off-by: Barry Song <song.bao.hua@hisilicon.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20201202220641.22752-1-song.bao.hua@hisilicon.com
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index db4a1da522e42..1d82b9cc9eb77 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9897,7 +9897,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * idle_balance is called by schedule() if this_cpu is about to become
++ * newidle_balance is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ */
+ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
+--
+2.51.0
+
--- /dev/null
+From 73bf5432d99188c1372124e9d5a413ff9e1c3a89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Apr 2020 18:50:34 +0800
+Subject: sched: Make newidle_balance() static again
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit d91cecc156620ec75d94c55369509c807c3d07e6 ]
+
+After Commit 6e2df0581f56 ("sched: Fix pick_next_task() vs 'change'
+pattern race"), there is no need to expose newidle_balance() as it
+is only used within fair.c file. Change this function back to static again.
+
+No functional change.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/83cd3030b031ca5d646cd5e225be10e7a0fdd8f5.1587464698.git.yu.c.chen@intel.com
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 6 ++++--
+ kernel/sched/sched.h | 4 ----
+ 2 files changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 2680216234ff2..db4a1da522e42 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3690,6 +3690,8 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
++static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+ return READ_ONCE(p->se.avg.util_avg);
+@@ -3849,7 +3851,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int idle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -9898,7 +9900,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ * idle_balance is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ */
+-int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index b8a3db59e3267..46e6f4e905dd6 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1464,14 +1464,10 @@ static inline void unregister_sched_domain_sysctl(void)
+ }
+ #endif
+
+-extern int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
+-
+ #else
+
+ static inline void sched_ttwu_pending(void) { }
+
+-static inline int newidle_balance(struct rq *this_rq, struct rq_flags *rf) { return 0; }
+-
+ #endif /* CONFIG_SMP */
+
+ #include "stats.h"
+--
+2.51.0
+
xen-events-update-virq_to_irq-on-migration.patch
media-pci-ivtv-switch-from-pci_-to-dma_-api.patch
media-pci-ivtv-add-missing-check-after-dma-map.patch
+net-dl2k-switch-from-pci_-to-dma_-api.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+sched-make-newidle_balance-static-again.patch
+sched-fair-trivial-correction-of-the-newidle_balance.patch
+sched-balancing-rename-newidle_balance-sched_balance.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
--- /dev/null
+From 9a3a6801e4131fc47ce209324eb1880fb472149c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 4f203cbbc99b5..6492110e0c9b0 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1952,7 +1952,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2014,9 +2015,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From 7b3de864be175b878e68b2df69f347c55b500d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 55aa877713339..3ea966d85ea38 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5827,7 +5827,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5968,9 +5968,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From c45bd0ef8c66572f26e24425dd637a75b2b5dcf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index cb51a2f46b11d..5bf809b090342 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -181,12 +181,9 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 785b98b97f829018852014c5bf4148aa3ad1c8b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 8dabbbf521688..b175f0595a478 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1052,6 +1052,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1106,6 +1113,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From 77db58bbcdb74f658acd1feeab42bd083064df9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 011d0f0c39415..dc70256ca2203 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
+--
+2.51.0
+
--- /dev/null
+From 698aaeddebf4d8c0edfe1e3dec7861877a7448af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:16:45 +0800
+Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
+
+From: Jiaming Zhang <r772577952@gmail.com>
+
+[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
+
+In try_to_register_card(), the return value of usb_ifnum_to_if() is
+passed directly to usb_interface_claimed() without a NULL check, which
+will lead to a NULL pointer dereference when creating an invalid
+USB audio device. Fix this by adding a check to ensure the interface
+pointer is valid before passing it to usb_interface_claimed().
+
+Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration")
+Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/
+Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 5f539a1baef3d..d7fe1c22a48bb 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -753,10 +753,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)
+ */
+ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
+ {
++ struct usb_interface *iface;
++
+ if (check_delayed_register_option(chip) == ifnum ||
+- chip->last_iface == ifnum ||
+- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface)))
++ chip->last_iface == ifnum)
++ return snd_card_register(chip->card);
++
++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface);
++ if (iface && usb_interface_claimed(iface))
+ return snd_card_register(chip->card);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3d0e4225030ab4e7d2d31bb89fc86cbc9f5cf970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 34d45cebefb5d..b4d57da71de2a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 19fed56b6ee3f..ebb8b3e5b9a88 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1636,6 +1636,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From 1f98e30c3f928712976653ddf235a051ffa5c266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:26 +0300
+Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ]
+
+Stress testing the audio jack hotplug handling on a few Steam Deck units
+revealed that the debounce circuit is responsible for having a negative
+impact on the detection reliability, e.g. in some cases the ejection
+interrupt is not fired, while in other instances it goes into a kind of
+invalid state and generates a flood of misleading interrupts.
+
+Add new entries to the DMI table introduced via commit 1bc40efdaf4a
+("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect")
+and extend the quirk logic to allow bypassing the debounce circuit used
+for jack detection on Valve Steam Deck LCD and OLED models.
+
+While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to
+NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability
+by differentiating from similarly named register bits.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index 380ceac4d8700..66309eede0dbd 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -26,7 +26,8 @@
+ #include <sound/tlv.h>
+ #include "nau8821.h"
+
+-#define NAU8821_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1)
+
+ static int nau8821_quirk;
+ static int quirk_override = -1;
+@@ -1043,9 +1044,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2,
+ NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE);
+
+- /* Not bypass de-bounce circuit */
+- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+- NAU8821_JACK_DET_DB_BYPASS, 0);
++ /* Do not bypass de-bounce circuit */
++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS))
++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
++ NAU8821_JACK_DET_DB_BYPASS, 0);
+
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+ NAU8821_IRQ_EJECT_EN, 0);
+@@ -1718,7 +1720,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"),
+ },
+- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH),
++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Valve Steam Deck LCD */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
++ },
++ {
++ /* Valve Steam Deck OLED */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
+ },
+ {}
+ };
+@@ -1760,9 +1778,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)
+
+ nau8821_check_quirks();
+
+- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH)
++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH)
+ nau8821->jkdet_polarity = 0;
+
++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)
++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n");
++
+ nau8821_print_device_properties(nau8821);
+
+ nau8821_reset_chip(nau8821->regmap);
+--
+2.51.0
+
--- /dev/null
+From 2d7c74bf70faf630ade03d9d3f53704b126e60b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:23 +0300
+Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ]
+
+The microphone detection work scheduled by a prior jack insertion
+interrupt may still be in a pending state or under execution when a jack
+ejection interrupt has been fired.
+
+This might lead to a racing condition or nau8821_jdet_work() completing
+after nau8821_eject_jack(), which will override the currently
+disconnected state of the jack and incorrectly report the headphone or
+the headset as being connected.
+
+Cancel any pending jdet_work or wait for its execution to finish before
+attempting to handle the ejection interrupt.
+
+Proceed similarly before launching the eject handler as a consequence of
+detecting an invalid insert interrupt.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index efd92656a060d..ae2becb30beaa 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1063,6 +1063,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+
+ if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) ==
+ NAU8821_JACK_EJECT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+@@ -1077,11 +1078,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ clear_irq = NAU8821_KEY_RELEASE_IRQ;
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_EN);
+ if (nau8821_is_jack_inserted(regmap)) {
+ /* detect microphone and jack type */
+- cancel_work_sync(&nau8821->jdet_work);
+ schedule_work(&nau8821->jdet_work);
+ /* Turn off insertion interruption at manual mode */
+ regmap_update_bits(regmap,
+--
+2.51.0
+
--- /dev/null
+From ecd0cf3722278bb18a9f6b6b6356d4ad31f21540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:24 +0300
+Subject: ASoC: nau8821: Generalize helper to clear IRQ status
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ]
+
+Instead of adding yet another utility function for dealing with the
+interrupt clearing register, generalize nau8821_int_status_clear_all()
+by renaming it to nau8821_irq_status_clear(), whilst introducing a
+second parameter to allow restricting the operation scope to a single
+interrupt instead of the whole range of active IRQs.
+
+While at it, also fix a spelling typo in the comment block.
+
+Note this is mainly a prerequisite for subsequent patches aiming to
+address some deficiencies in the implementation of the interrupt
+handler. Thus the presence of the Fixes tag below is intentional, to
+facilitate backporting.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index ae2becb30beaa..380ceac4d8700 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -902,12 +902,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap)
+ return active_high == is_high;
+ }
+
+-static void nau8821_int_status_clear_all(struct regmap *regmap)
++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq)
+ {
+- int active_irq, clear_irq, i;
++ int clear_irq, i;
+
+- /* Reset the intrruption status from rightmost bit if the corres-
+- * ponding irq event occurs.
++ if (active_irq) {
++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq);
++ return;
++ }
++
++ /* Reset the interruption status from rightmost bit if the
++ * corresponding irq event occurs.
+ */
+ regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq);
+ for (i = 0; i < NAU8821_REG_DATA_LEN; i++) {
+@@ -934,7 +939,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ snd_soc_dapm_sync(dapm);
+
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable the insertion interruption, disable the ejection inter-
+ * ruption, and then bypass de-bounce circuit.
+@@ -1400,7 +1405,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821)
+ nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0);
+ if (nau8821->irq) {
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable both insertion and ejection interruptions, and then
+ * bypass de-bounce circuit.
+--
+2.51.0
+
--- /dev/null
+From a09b0c85e84722ad758221e2e82c32469ef25bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 17:46:32 +0200
+Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
+
+Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to
+m_can_platform") moved the PM runtime enable from the m_can core
+driver into the m_can_platform.
+
+That patch forgot to move the pm_runtime_disable() to
+m_can_plat_remove(), so that unloading the m_can_platform driver
+causes an "Unbalanced pm_runtime_enable!" error message.
+
+Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the
+problem.
+
+Cc: Patrik Flykt <patrik.flykt@linux.intel.com>
+Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index de6d8e01bf2e8..71cf3662128a1 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -170,7 +170,7 @@ static int m_can_plat_remove(struct platform_device *pdev)
+ struct m_can_classdev *mcan_class = &priv->cdev;
+
+ m_can_class_unregister(mcan_class);
+-
++ pm_runtime_disable(mcan_class->dev);
+ m_can_class_free_dev(mcan_class->net);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 14977b7f6bc47a0f7f758a093215e8c5d5ba05de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index ca7138bb1d545..2ebe70de35ec3 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1524,7 +1524,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5e67e1e90da09dd475fe9d3fce721ebee60695fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:18:59 +0200
+Subject: doc: fix seg6_flowlabel path
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
+
+This sysctl is not per interface; it's global per netns.
+
+Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst")
+Reported-by: Philippe Guibert <philippe.guibert@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/seg6-sysctl.rst | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst
+index 07c20e470bafe..1b6af4779be11 100644
+--- a/Documentation/networking/seg6-sysctl.rst
++++ b/Documentation/networking/seg6-sysctl.rst
+@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER
+
+ Default is 0.
+
++/proc/sys/net/ipv6/seg6_* variables:
++====================================
++
+ seg6_flowlabel - INTEGER
+ Controls the behaviour of computing the flowlabel of outer
+ IPv6 header in case of SR T.encaps
+--
+2.51.0
+
--- /dev/null
+From 52ec1c286319f128cae86dfe0e2c3be904e898a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 530888c475be1..d13ab986a5c20 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -5435,8 +5435,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ thermal_data->sw_ctf_threshold = thermal_data->max;
+
+--
+2.51.0
+
--- /dev/null
+From 44bc00f52af697966af1089e82802ef3dc7ea999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 12:59:53 +0200
+Subject: drm/bridge: lt9211: Drop check for last nibble of version register
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ]
+
+There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 .
+The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the
+driver checks for right now. Since there is a possibility there will be
+yet another revision of the LT9211 in the future, drop the last version
+nibble check to allow all future revisions of the chip to work with this
+driver.
+
+This fix makes LT9211 rev. U5 work with this driver.
+
+Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c
+index 933ca028d612d..fd581160d95e9 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9211.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c
+@@ -121,8 +121,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx)
+ }
+
+ /* Test for known Chip ID. */
+- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE ||
+- chipid[2] != REG_CHIPID2_VALUE) {
++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) {
+ dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n",
+ chipid[0], chipid[1], chipid[2]);
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 74004f901624725e4ae4770e653c9224cc13d3e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 07:20:01 -0700
+Subject: drm/rockchip: vop2: use correct destination rectangle height check
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ]
+
+The vop2_plane_atomic_check() function incorrectly checks
+drm_rect_width(dest) twice instead of verifying both width and height.
+Fix the second condition to use drm_rect_height(dest) so that invalid
+destination rectangles with height < 4 are correctly rejected.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 6efa0a51b7d65..e14557d80efc2 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -983,7 +983,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane,
+ return format;
+
+ if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 ||
+- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) {
++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) {
+ drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n",
+ drm_rect_width(src) >> 16, drm_rect_height(src) >> 16,
+ drm_rect_width(dest), drm_rect_height(dest));
+--
+2.51.0
+
--- /dev/null
+From a432faadb2024fcc8bc6c3385c424d63eec6dbea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 21:28:44 -0700
+Subject: HID: hid-input: only ignore 0 battery events for digitizers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ]
+
+Commit 581c4484769e ("HID: input: map digitizer battery usage") added
+handling of battery events for digitizers (typically for batteries
+presented in stylii). Digitizers typically report correct battery levels
+only when stylus is actively touching the surface, and in other cases
+they may report battery level of 0. To avoid confusing consumers of the
+battery information the code was added to filer out reports with 0
+battery levels.
+
+However there exist other kinds of devices that may legitimately report
+0 battery levels. Fix this by filtering out 0-level reports only for
+digitizer usages, and continue reporting them for other kinds of devices
+(Smart Batteries, etc).
+
+Reported-by: 卢国宏 <luguohong@xiaomi.com>
+Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index cd9d031858438..59ec205421753 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -636,7 +636,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
+ return;
+ }
+
+- if (value == 0 || value < dev->battery_min || value > dev->battery_max)
++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0)
++ return;
++
++ if (value < dev->battery_min || value > dev->battery_max)
+ return;
+
+ capacity = hidinput_scale_battery_capacity(dev, value);
+--
+2.51.0
+
--- /dev/null
+From 2693262b8543acdb947e2bb2778f6ff190655518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 09:40:33 -0300
+Subject: HID: multitouch: fix name of Stylus input devices
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ]
+
+HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by
+commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN").
+However, on multitouch devices, these suffixes may be overridden. Before
+that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after
+that, multitouch would override them to have an "UNKNOWN" suffix. Just add
+HID_DG_PEN to the list of non-overriden suffixes in multitouch.
+
+Before this fix:
+
+[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+ELAN9008:00 04F3:2E14 UNKNOWN
+
+After this fix:
+
+[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+
+ELAN9008:00 04F3:2E14 Stylus
+
+Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6f1e54ee8f05d..b9e67b408a4b9 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1658,6 +1658,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ case HID_CP_CONSUMER_CONTROL:
+ case HID_GD_WIRELESS_RADIO_CTLS:
+ case HID_GD_SYSTEM_MULTIAXIS:
++ case HID_DG_PEN:
+ /* already handled by hid core */
+ break;
+ case HID_DG_TOUCHSCREEN:
+--
+2.51.0
+
--- /dev/null
+From ed7c95bae9968c25b0b548d42c6ef8e690b7ac45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index bf58181589bf2..2221d5b7eeba9 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 82ef0e5fb71487d4db1b6ac6c4f5b5a01bab1d61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 84751313b8265..e93db837412b2 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -481,6 +481,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 90e55b9979e69..dcf9e9c52a22a 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 2a470c0c38aef..dfca22c6d345d 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1256,8 +1256,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 468d2a40d2b1bbc2e3f2685c6eddd7029eff77e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 14:17:41 +0200
+Subject: net: tls: wait for async completion on last message
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ]
+
+When asynchronous encryption is used KTLS sends out the final data at
+proto->close time. This becomes problematic when the task calling
+close() receives a signal. In this case it can happen that
+tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the
+final data is not sent.
+
+The described situation happens when KTLS is used in conjunction with
+io_uring, as io_uring uses task_work_add() to add work to the current
+userspace task. A discussion of the problem along with a reproducer can
+be found in [1] and [2]
+
+Fix this by waiting for the asynchronous encryption to be completed on
+the final message. With this there is no data left to be sent at close
+time.
+
+[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/
+[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index fe6514e964ba3..c67cf1a06c0e5 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1184,7 +1184,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+
+ if (!num_async) {
+ goto send_end;
+- } else if (num_zc) {
++ } else if (num_zc || eor) {
+ int err;
+
+ /* Wait for pending encryptions to get completed */
+--
+2.51.0
+
--- /dev/null
+From 4455b83d4da76c5ee11480c1d6a296623b9218d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:07:42 +0100
+Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
+
+Convert `lan78xx_init_mac_address` to return error codes and handle
+failures in register read and write operations. Update `lan78xx_reset`
+to check for errors during MAC address initialization and propagate them
+appropriately.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 0f1c9009d793e..08fb03bcf4952 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1940,13 +1940,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = {
+ .get_regs = lan78xx_get_regs,
+ };
+
+-static void lan78xx_init_mac_address(struct lan78xx_net *dev)
++static int lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+ u8 addr[6];
++ int ret;
++
++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ if (ret < 0)
++ return ret;
+
+- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ if (ret < 0)
++ return ret;
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1979,14 +1985,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ if (ret < 0)
++ return ret;
+ }
+
+- lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ if (ret < 0)
++ return ret;
+
+ eth_hw_addr_set(dev->net, addr);
++
++ return 0;
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2910,7 +2928,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- lan78xx_init_mac_address(dev);
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
+
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+--
+2.51.0
+
--- /dev/null
+From 463e3b2e3a49838d558a2cff4f4430a9e40c7a6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 08fb03bcf4952..42f8fc71baee8 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2928,10 +2928,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -2940,6 +2936,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 8e3ca393a9ce1c8944ccbb1a4f0b9ca6c272cafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 6346821d480bd..6879660e44fad 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4950,8 +4950,9 @@ static int rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_runtime_resume(device);
+--
+2.51.0
+
--- /dev/null
+From c323fc140bf9f7beca1081da382bd2246e4e260c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:25:13 +0200
+Subject: riscv: kprobes: Fix probe address validation
+
+From: Fabian Vogt <fvogt@suse.de>
+
+[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
+
+When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
+arch_check_kprobe would start iterating all instructions starting from
+_text until the probed address. Not only is this very inefficient, but
+literal values in there (e.g. left by function patching) are
+misinterpreted in a way that causes a desync.
+
+Fix this by doing it like x86: start the iteration at the closest
+preceding symbol instead of the given starting point.
+
+Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
+Signed-off-by: Fabian Vogt <fvogt@suse.de>
+Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index cca2b3a2135ad..f4836ef13e9bb 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
+-static bool __kprobes arch_check_kprobe(struct kprobe *p)
++static bool __kprobes arch_check_kprobe(unsigned long addr)
+ {
+- unsigned long tmp = (unsigned long)p->addr - p->offset;
+- unsigned long addr = (unsigned long)p->addr;
++ unsigned long tmp, offset;
++
++ /* start iterating at the closest preceding symbol */
++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
++ return false;
++
++ tmp = addr - offset;
+
+ while (tmp <= addr) {
+ if (tmp == addr)
+@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if ((unsigned long)insn & 0x1)
+ return -EILSEQ;
+
+- if (!arch_check_kprobe(p))
++ if (!arch_check_kprobe((unsigned long)p->addr))
+ return -EILSEQ;
+
+ /* copy instruction */
+--
+2.51.0
+
--- /dev/null
+From d6cce78b8fbe121245522c3191737620975a6df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 12:18:16 +0100
+Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
+
+Standardize scheduler load-balancing function names on the
+sched_balance_() prefix.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 2deb896883d38..cf889d1ed13d1 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4261,7 +4261,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf);
+
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+@@ -4590,7 +4590,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -7575,7 +7575,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+ if (rq->nr_running)
+ return 1;
+
+- return newidle_balance(rq, rf) != 0;
++ return sched_balance_newidle(rq, rf) != 0;
+ }
+ #endif /* CONFIG_SMP */
+
+@@ -7911,10 +7911,10 @@ done: __maybe_unused;
+ if (!rf)
+ return NULL;
+
+- new_tasks = newidle_balance(rq, rf);
++ new_tasks = sched_balance_newidle(rq, rf);
+
+ /*
+- * Because newidle_balance() releases (and re-acquires) rq->lock, it is
++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+ * possible for any higher priority task to appear. In that case we
+ * must re-start the pick_next_entity() loop.
+ */
+@@ -10786,7 +10786,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ ld_moved = 0;
+
+ /*
+- * newidle_balance() disregards balance intervals, so we could
++ * sched_balance_newidle() disregards balance intervals, so we could
+ * repeatedly reach this code, which would lead to balance_interval
+ * skyrocketing in a short amount of time. Skip the balance_interval
+ * increase logic to avoid that.
+@@ -11548,7 +11548,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * newidle_balance is called by schedule() if this_cpu is about to become
++ * sched_balance_newidle is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ *
+ * Returns:
+@@ -11556,7 +11556,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ * 0 - failed, no new tasks
+ * > 0 - success, new (fair) tasks present
+ */
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+--
+2.51.0
+
--- /dev/null
+From bae53a41cc6f5826e5e02def17bd57336ee1c5de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index cf889d1ed13d1..b6795bf15211c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7908,21 +7908,21 @@ done: __maybe_unused;
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
timers-update-the-documentation-to-reflect-on-the-new-timer_shutdown-api.patch
bluetooth-hci_qca-fix-the-teardown-problem-for-real.patch
hid-multitouch-fix-sticky-fingers.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+doc-fix-seg6_flowlabel-path.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+net-tls-wait-for-async-completion-on-last-message.patch
+tls-wait-for-async-encrypt-in-case-of-error-during-l.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+riscv-kprobes-fix-probe-address-validation.patch
+drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch
+asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch
+asoc-nau8821-generalize-helper-to-clear-irq-status.patch
+asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+drm-rockchip-vop2-use-correct-destination-rectangle-.patch
+sched-balancing-rename-newidle_balance-sched_balance.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
+alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch
+hid-hid-input-only-ignore-0-battery-events-for-digit.patch
+hid-multitouch-fix-name-of-stylus-input-devices.patch
--- /dev/null
+From c3817280e590183746596f2ae2ed82467831371b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 40568365cdb3b..a8d8e2f294ff2 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2184,7 +2184,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2246,9 +2247,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From 01906c0ad76f445d30ffbba472ecb8da3bfc9806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 95d460237835d..8e5236142aaca 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5814,7 +5814,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5955,9 +5955,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From aec93aa5f3960e0f55aa7b9b53fbc787055eea5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 14d01558311d2..4797f68b9ec80 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -208,12 +208,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From bf4305c45eae555faa247a384035578fb7ef92ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index baed07edc6395..e7f151c98eb93 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1109,6 +1109,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ } else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1163,6 +1170,12 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From b0c45ed11b2ad2fdc839e419891e61956f5c5189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:57 +0200
+Subject: tls: wait for async encrypt in case of error during latter iterations
+ of sendmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
+
+If we hit an error during the main loop of tls_sw_sendmsg_locked (eg
+failed allocation), we jump to send_end and immediately
+return. Previous iterations may have queued async encryption requests
+that are still pending. We should wait for those before returning, as
+we could otherwise be reading from memory that userspace believes
+we're not using anymore, which would be a sort of use-after-free.
+
+This is similar to what tls_sw_recvmsg already does: failures during
+the main loop jump to the "wait for async" code, not straight to the
+unlock/return.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index c67cf1a06c0e5..0e378d7cb6903 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1029,7 +1029,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ if (ret == -EINPROGRESS)
+ num_async++;
+ else if (ret != -EAGAIN)
+- goto send_end;
++ goto end;
+ }
+ }
+
+@@ -1182,8 +1182,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ goto alloc_encrypted;
+ }
+
++send_end:
+ if (!num_async) {
+- goto send_end;
++ goto end;
+ } else if (num_zc || eor) {
+ int err;
+
+@@ -1201,7 +1202,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ tls_tx_records(sk, msg->msg_flags);
+ }
+
+-send_end:
++end:
+ ret = sk_stream_error(sk, msg->msg_flags, ret);
+
+ release_sock(sk);
+--
+2.51.0
+
--- /dev/null
+From a1451677313f6b2de04041181757fe04b8b1fbc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:59 +0200
+Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ]
+
+Async decryption calls tls_strp_msg_hold to create a clone of the
+input skb to hold references to the memory it uses. If we fail to
+allocate that clone, proceeding with async decryption can lead to
+various issues (UAF on the skb, writing into userspace memory after
+the recv() call has returned).
+
+In this case, wait for all pending decryption requests.
+
+Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 0e378d7cb6903..baed07edc6395 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1724,8 +1724,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+
+ if (unlikely(darg->async)) {
+ err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold);
+- if (err)
+- __skb_queue_tail(&ctx->async_hold, darg->skb);
++ if (err) {
++ err = tls_decrypt_async_wait(ctx);
++ darg->async = false;
++ }
+ return err;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 12e65321ee51d001dfcb6f262c1aafb53eeb7767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 13:57:50 +0200
+Subject: accel/qaic: Fix bootlog initialization ordering
+
+From: Jeffrey Hugo <quic_jhugo@quicinc.com>
+
+[ Upstream commit fd6e385528d8f85993b7bfc6430576136bb14c65 ]
+
+As soon as we queue MHI buffers to receive the bootlog from the device,
+we could be receiving data. Therefore all the resources needed to
+process that data need to be setup prior to queuing the buffers.
+
+We currently initialize some of the resources after queuing the buffers
+which creates a race between the probe() and any data that comes back
+from the device. If the uninitialized resources are accessed, we could
+see page faults.
+
+Fix the init ordering to close the race.
+
+Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs")
+Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_debugfs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_debugfs.c b/drivers/accel/qaic/qaic_debugfs.c
+index 20b653d99e524..5ed49daaf541f 100644
+--- a/drivers/accel/qaic/qaic_debugfs.c
++++ b/drivers/accel/qaic/qaic_debugfs.c
+@@ -251,6 +251,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d
+ if (ret)
+ goto destroy_workqueue;
+
++ dev_set_drvdata(&mhi_dev->dev, qdev);
++ qdev->bootlog_ch = mhi_dev;
++
+ for (i = 0; i < BOOTLOG_POOL_SIZE; i++) {
+ msg = devm_kzalloc(&qdev->pdev->dev, sizeof(*msg), GFP_KERNEL);
+ if (!msg) {
+@@ -266,8 +269,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d
+ goto mhi_unprepare;
+ }
+
+- dev_set_drvdata(&mhi_dev->dev, qdev);
+- qdev->bootlog_ch = mhi_dev;
+ return 0;
+
+ mhi_unprepare:
+--
+2.51.0
+
--- /dev/null
+From 63cf520c34eef35c0e548c9c06c8d507be0468f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 08:18:37 +0200
+Subject: accel/qaic: Synchronize access to DBC request queue head & tail
+ pointer
+
+From: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
+
+[ Upstream commit 52e59f7740ba23bbb664914967df9a00208ca10c ]
+
+Two threads of the same process can potential read and write parallelly to
+head and tail pointers of the same DBC request queue. This could lead to a
+race condition and corrupt the DBC request queue.
+
+Fixes: ff13be830333 ("accel/qaic: Add datapath")
+Signed-off-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+[jhugo: Add fixes tag]
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic.h | 2 ++
+ drivers/accel/qaic/qaic_data.c | 12 ++++++++++--
+ drivers/accel/qaic/qaic_drv.c | 3 +++
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic.h b/drivers/accel/qaic/qaic.h
+index 02561b6cecc64..2d7b3af09e284 100644
+--- a/drivers/accel/qaic/qaic.h
++++ b/drivers/accel/qaic/qaic.h
+@@ -91,6 +91,8 @@ struct dma_bridge_chan {
+ * response queue's head and tail pointer of this DBC.
+ */
+ void __iomem *dbc_base;
++ /* Synchronizes access to Request queue's head and tail pointer */
++ struct mutex req_lock;
+ /* Head of list where each node is a memory handle queued in request queue */
+ struct list_head xfer_list;
+ /* Synchronizes DBC readers during cleanup */
+diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
+index 43aba57b48f05..265eeb4e156fc 100644
+--- a/drivers/accel/qaic/qaic_data.c
++++ b/drivers/accel/qaic/qaic_data.c
+@@ -1357,13 +1357,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ goto release_ch_rcu;
+ }
+
++ ret = mutex_lock_interruptible(&dbc->req_lock);
++ if (ret)
++ goto release_ch_rcu;
++
+ head = readl(dbc->dbc_base + REQHP_OFF);
+ tail = readl(dbc->dbc_base + REQTP_OFF);
+
+ if (head == U32_MAX || tail == U32_MAX) {
+ /* PCI link error */
+ ret = -ENODEV;
+- goto release_ch_rcu;
++ goto unlock_req_lock;
+ }
+
+ queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail);
+@@ -1371,11 +1375,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ ret = send_bo_list_to_device(qdev, file_priv, exec, args->hdr.count, is_partial, dbc,
+ head, &tail);
+ if (ret)
+- goto release_ch_rcu;
++ goto unlock_req_lock;
+
+ /* Finalize commit to hardware */
+ submit_ts = ktime_get_ns();
+ writel(tail, dbc->dbc_base + REQTP_OFF);
++ mutex_unlock(&dbc->req_lock);
+
+ update_profiling_data(file_priv, exec, args->hdr.count, is_partial, received_ts,
+ submit_ts, queue_level);
+@@ -1383,6 +1388,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ if (datapath_polling)
+ schedule_work(&dbc->poll_work);
+
++unlock_req_lock:
++ if (ret)
++ mutex_unlock(&dbc->req_lock);
+ release_ch_rcu:
+ srcu_read_unlock(&dbc->ch_lock, rcu_id);
+ unlock_dev_srcu:
+diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c
+index 10e711c96a670..cb606c4bb8511 100644
+--- a/drivers/accel/qaic/qaic_drv.c
++++ b/drivers/accel/qaic/qaic_drv.c
+@@ -422,6 +422,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, const struct pci_de
+ return NULL;
+ init_waitqueue_head(&qdev->dbc[i].dbc_release);
+ INIT_LIST_HEAD(&qdev->dbc[i].bo_lists);
++ ret = drmm_mutex_init(drm, &qdev->dbc[i].req_lock);
++ if (ret)
++ return NULL;
+ }
+
+ return qdev;
+--
+2.51.0
+
--- /dev/null
+From bc158f68bd3c060de4fae1d3c6bdf829c33a4d17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 14:23:20 +0200
+Subject: accel/qaic: Treat remaining == 0 as error in
+ find_and_map_user_pages()
+
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+
+[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ]
+
+Currently, if find_and_map_user_pages() takes a DMA xfer request from the
+user with a length field set to 0, or in a rare case, the host receives
+QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size
+is equal to the requested transaction size, the function will return 0
+before allocating an sgt or setting the fields of the dma_xfer struct.
+In that case, encode_addr_size_pairs() will try to access the sgt which
+will lead to a general protection fault.
+
+Return an EINVAL in case the user provides a zero-sized ALP, or the device
+requests continuation after all of the bytes have been transferred.
+
+Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()")
+Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index d8bdab69f8009..b86a8e48e731b 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
+ return -EINVAL;
+ remaining = in_trans->size - resources->xferred_dma_size;
+ if (remaining == 0)
+- return 0;
++ return -EINVAL;
+
+ if (check_add_overflow(xfer_start_addr, remaining, &end))
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 8ad8f18b198206038866fae11cdd048b293aa3c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 775db3fc4959f..ec10270c2cce3 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
+--
+2.51.0
+
--- /dev/null
+From f1f157481ff8e799e9ff614eac6e77d946c4943c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:16:45 +0800
+Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
+
+From: Jiaming Zhang <r772577952@gmail.com>
+
+[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
+
+In try_to_register_card(), the return value of usb_ifnum_to_if() is
+passed directly to usb_interface_claimed() without a NULL check, which
+will lead to a NULL pointer dereference when creating an invalid
+USB audio device. Fix this by adding a check to ensure the interface
+pointer is valid before passing it to usb_interface_claimed().
+
+Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration")
+Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/
+Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 9c411b82a218d..d0a42859208aa 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -760,10 +760,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)
+ */
+ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
+ {
++ struct usb_interface *iface;
++
+ if (check_delayed_register_option(chip) == ifnum ||
+- chip->last_iface == ifnum ||
+- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface)))
++ chip->last_iface == ifnum)
++ return snd_card_register(chip->card);
++
++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface);
++ if (iface && usb_interface_claimed(iface))
+ return snd_card_register(chip->card);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 05cdd6fa3d0c9bc6a2f83f284c726926115f720c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 8bc49259d71af..32a6d52614242 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index ed76a8df6ec6e..75e9cb3fc7aa6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1664,6 +1664,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From fd8bbcea9fd68ec535e5244922e21228364cdfba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:55:30 +0800
+Subject: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 5726b68473f7153a7f6294185e5998b7e2a230a2 ]
+
+devm_kasprintf() may return NULL on memory allocation failure,
+but the debug message prints cpus->dai_name before checking it.
+Move the dev_dbg() call after the NULL check to prevent potential
+NULL pointer dereference.
+
+Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver")
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c
+index 99a244f495bd3..876f0b7fcd3de 100644
+--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c
++++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c
+@@ -216,9 +216,9 @@ static int create_sdw_dailink(struct snd_soc_card *card,
+ cpus->dai_name = devm_kasprintf(dev, GFP_KERNEL,
+ "SDW%d Pin%d",
+ link_num, cpu_pin_id);
+- dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name);
+ if (!cpus->dai_name)
+ return -ENOMEM;
++ dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name);
+
+ codec_maps[j].cpu = 0;
+ codec_maps[j].codec = j;
+--
+2.51.0
+
--- /dev/null
+From 959f68a8985dd614219ca04a18e15730c5855f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 19:03:13 +0200
+Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ]
+
+The gain ranges specified in Renesas IDT821034 codec documentation
+are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the
+receive path (DAC). Allthough the registers allow programming values
+outside those ranges, the signal S/N and distorsion are only
+guaranteed in the specified ranges.
+
+Set ranges to the specified ones.
+
+Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/idt821034.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c
+index cb7a68c799f8f..401d0897b8ab4 100644
+--- a/sound/soc/codecs/idt821034.c
++++ b/sound/soc/codecs/idt821034.c
+@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol,
+ return ret;
+ }
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306);
+-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */
+-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300);
++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */
++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */
+ #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029);
+-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/
+-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300);
++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */
++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */
+ #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */
+
+ static const struct snd_kcontrol_new idt821034_controls[] = {
+--
+2.51.0
+
--- /dev/null
+From aaf4e9f1fe0bd3c0bd68bcd5b5f1cdd9f12bb392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:26 +0300
+Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ]
+
+Stress testing the audio jack hotplug handling on a few Steam Deck units
+revealed that the debounce circuit is responsible for having a negative
+impact on the detection reliability, e.g. in some cases the ejection
+interrupt is not fired, while in other instances it goes into a kind of
+invalid state and generates a flood of misleading interrupts.
+
+Add new entries to the DMI table introduced via commit 1bc40efdaf4a
+("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect")
+and extend the quirk logic to allow bypassing the debounce circuit used
+for jack detection on Valve Steam Deck LCD and OLED models.
+
+While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to
+NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability
+by differentiating from similarly named register bits.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index 56e769446eb30..bfb719ca4c2cf 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -26,7 +26,8 @@
+ #include <sound/tlv.h>
+ #include "nau8821.h"
+
+-#define NAU8821_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1)
+
+ static int nau8821_quirk;
+ static int quirk_override = -1;
+@@ -1166,9 +1167,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2,
+ NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE);
+
+- /* Not bypass de-bounce circuit */
+- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+- NAU8821_JACK_DET_DB_BYPASS, 0);
++ /* Do not bypass de-bounce circuit */
++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS))
++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
++ NAU8821_JACK_DET_DB_BYPASS, 0);
+
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+ NAU8821_IRQ_EJECT_EN, 0);
+@@ -1863,7 +1865,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"),
+ },
+- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH),
++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Valve Steam Deck LCD */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
++ },
++ {
++ /* Valve Steam Deck OLED */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
+ },
+ {}
+ };
+@@ -1905,9 +1923,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)
+
+ nau8821_check_quirks();
+
+- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH)
++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH)
+ nau8821->jkdet_polarity = 0;
+
++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)
++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n");
++
+ nau8821_print_device_properties(nau8821);
+
+ nau8821_reset_chip(nau8821->regmap);
+--
+2.51.0
+
--- /dev/null
+From 0f4b37925e53d1221c29a2a834cefb85ce4a92f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:23 +0300
+Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ]
+
+The microphone detection work scheduled by a prior jack insertion
+interrupt may still be in a pending state or under execution when a jack
+ejection interrupt has been fired.
+
+This might lead to a racing condition or nau8821_jdet_work() completing
+after nau8821_eject_jack(), which will override the currently
+disconnected state of the jack and incorrectly report the headphone or
+the headset as being connected.
+
+Cancel any pending jdet_work or wait for its execution to finish before
+attempting to handle the ejection interrupt.
+
+Proceed similarly before launching the eject handler as a consequence of
+detecting an invalid insert interrupt.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index de5c4db05c8f8..23ee515db9bdd 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1186,6 +1186,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+
+ if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) ==
+ NAU8821_JACK_EJECT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+@@ -1200,11 +1201,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ clear_irq = NAU8821_KEY_RELEASE_IRQ;
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_EN);
+ if (nau8821_is_jack_inserted(regmap)) {
+ /* detect microphone and jack type */
+- cancel_work_sync(&nau8821->jdet_work);
+ schedule_work(&nau8821->jdet_work);
+ /* Turn off insertion interruption at manual mode */
+ regmap_update_bits(regmap,
+--
+2.51.0
+
--- /dev/null
+From 495e6e7210eee1423f563110da1f680b1e4a63c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:24 +0300
+Subject: ASoC: nau8821: Generalize helper to clear IRQ status
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ]
+
+Instead of adding yet another utility function for dealing with the
+interrupt clearing register, generalize nau8821_int_status_clear_all()
+by renaming it to nau8821_irq_status_clear(), whilst introducing a
+second parameter to allow restricting the operation scope to a single
+interrupt instead of the whole range of active IRQs.
+
+While at it, also fix a spelling typo in the comment block.
+
+Note this is mainly a prerequisite for subsequent patches aiming to
+address some deficiencies in the implementation of the interrupt
+handler. Thus the presence of the Fixes tag below is intentional, to
+facilitate backporting.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index 23ee515db9bdd..56e769446eb30 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1022,12 +1022,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap)
+ return active_high == is_high;
+ }
+
+-static void nau8821_int_status_clear_all(struct regmap *regmap)
++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq)
+ {
+- int active_irq, clear_irq, i;
++ int clear_irq, i;
+
+- /* Reset the intrruption status from rightmost bit if the corres-
+- * ponding irq event occurs.
++ if (active_irq) {
++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq);
++ return;
++ }
++
++ /* Reset the interruption status from rightmost bit if the
++ * corresponding irq event occurs.
+ */
+ regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq);
+ for (i = 0; i < NAU8821_REG_DATA_LEN; i++) {
+@@ -1054,7 +1059,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ snd_soc_dapm_sync(dapm);
+
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable the insertion interruption, disable the ejection inter-
+ * ruption, and then bypass de-bounce circuit.
+@@ -1523,7 +1528,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821)
+ nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0);
+ if (nau8821->irq) {
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable both insertion and ejection interruptions, and then
+ * bypass de-bounce circuit.
+--
+2.51.0
+
--- /dev/null
+From 46d2e00e5f448bed2ac8275af969262b7200fcba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:52:22 +0100
+Subject: can: m_can: add deinit callback
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+[ Upstream commit baa8aaf79768b72eb7a181c476ca0291613f59e6 ]
+
+This is added in preparation for calling standby mode in the tcan4x5x
+driver or other users of m_can.
+For the tcan4x5x; If Vsup 12V, standby mode will save 7-8mA, when the
+interface is down.
+
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Link: https://patch.msgid.link/20241122-tcan-standby-v3-1-90bafaf5eccd@geanix.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Stable-dep-of: a9e30a22d6f2 ("can: m_can: fix CAN state in system PM")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 7 +++++++
+ drivers/net/can/m_can/m_can.h | 1 +
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index a7e326faca8ca..249263fca748d 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1796,6 +1796,13 @@ static void m_can_stop(struct net_device *dev)
+
+ /* set the state as STOPPED */
+ cdev->can.state = CAN_STATE_STOPPED;
++
++ if (cdev->ops->deinit) {
++ ret = cdev->ops->deinit(cdev);
++ if (ret)
++ netdev_err(dev, "failed to deinitialize: %pe\n",
++ ERR_PTR(ret));
++ }
+ }
+
+ static int m_can_close(struct net_device *dev)
+diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h
+index ef39e8e527ab6..bd4746c63af3f 100644
+--- a/drivers/net/can/m_can/m_can.h
++++ b/drivers/net/can/m_can/m_can.h
+@@ -68,6 +68,7 @@ struct m_can_ops {
+ int (*write_fifo)(struct m_can_classdev *cdev, int addr_offset,
+ const void *val, size_t val_count);
+ int (*init)(struct m_can_classdev *cdev);
++ int (*deinit)(struct m_can_classdev *cdev);
+ };
+
+ struct m_can_tx_op {
+--
+2.51.0
+
--- /dev/null
+From 1b50e99838906460c6ad4077528a90dc88e0c7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:52:24 +0100
+Subject: can: m_can: call deinit/init callback when going into suspend/resume
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+[ Upstream commit ad1ddb3bfb0c9193eb19d4788192904350c7e51a ]
+
+m_can user like the tcan4x5x device, can go into standby mode.
+Low power RX mode is enabled to allow wake on can.
+
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Link: https://patch.msgid.link/20241122-tcan-standby-v3-3-90bafaf5eccd@geanix.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Stable-dep-of: a9e30a22d6f2 ("can: m_can: fix CAN state in system PM")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 249263fca748d..bf7996c302426 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -2485,6 +2485,7 @@ int m_can_class_suspend(struct device *dev)
+ {
+ struct m_can_classdev *cdev = dev_get_drvdata(dev);
+ struct net_device *ndev = cdev->net;
++ int ret = 0;
+
+ if (netif_running(ndev)) {
+ netif_stop_queue(ndev);
+@@ -2497,6 +2498,9 @@ int m_can_class_suspend(struct device *dev)
+ if (cdev->pm_wake_source) {
+ hrtimer_cancel(&cdev->hrtimer);
+ m_can_write(cdev, M_CAN_IE, IR_RF0N);
++
++ if (cdev->ops->deinit)
++ ret = cdev->ops->deinit(cdev);
+ } else {
+ m_can_stop(ndev);
+ }
+@@ -2508,7 +2512,7 @@ int m_can_class_suspend(struct device *dev)
+
+ cdev->can.state = CAN_STATE_SLEEPING;
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_suspend);
+
+@@ -2516,14 +2520,13 @@ int m_can_class_resume(struct device *dev)
+ {
+ struct m_can_classdev *cdev = dev_get_drvdata(dev);
+ struct net_device *ndev = cdev->net;
++ int ret = 0;
+
+ pinctrl_pm_select_default_state(dev);
+
+ cdev->can.state = CAN_STATE_ERROR_ACTIVE;
+
+ if (netif_running(ndev)) {
+- int ret;
+-
+ ret = m_can_clk_start(cdev);
+ if (ret)
+ return ret;
+@@ -2536,6 +2539,10 @@ int m_can_class_resume(struct device *dev)
+ * again.
+ */
+ cdev->active_interrupts |= IR_RF0N | IR_TEFN;
++
++ if (cdev->ops->init)
++ ret = cdev->ops->init(cdev);
++
+ m_can_write(cdev, M_CAN_IE, cdev->active_interrupts);
+ } else {
+ ret = m_can_start(ndev);
+@@ -2549,7 +2556,7 @@ int m_can_class_resume(struct device *dev)
+ netif_start_queue(ndev);
+ }
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_resume);
+
+--
+2.51.0
+
--- /dev/null
+From 0f730d87a32f6a48b8f2659491fb1800e2df0768 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:58:31 +0200
+Subject: can: m_can: fix CAN state in system PM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a9e30a22d6f23a2684c248871cad4c3061181639 ]
+
+A suspend/resume cycle on a down interface results in the interface
+coming up in Error Active state. A suspend/resume cycle on an Up
+interface will always result in Error Active state, regardless of the
+actual CAN state.
+
+During suspend, only set running interfaces to CAN_STATE_SLEEPING.
+During resume only touch the CAN state of running interfaces. For
+wakeup sources, set the CAN state depending on the Protocol Status
+Regitser (PSR), for non wakeup source interfaces m_can_start() will do
+the same.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index bf7996c302426..f31a91ec7a6d0 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -2506,12 +2506,11 @@ int m_can_class_suspend(struct device *dev)
+ }
+
+ m_can_clk_stop(cdev);
++ cdev->can.state = CAN_STATE_SLEEPING;
+ }
+
+ pinctrl_pm_select_sleep_state(dev);
+
+- cdev->can.state = CAN_STATE_SLEEPING;
+-
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_suspend);
+@@ -2524,8 +2523,6 @@ int m_can_class_resume(struct device *dev)
+
+ pinctrl_pm_select_default_state(dev);
+
+- cdev->can.state = CAN_STATE_ERROR_ACTIVE;
+-
+ if (netif_running(ndev)) {
+ ret = m_can_clk_start(cdev);
+ if (ret)
+@@ -2543,6 +2540,8 @@ int m_can_class_resume(struct device *dev)
+ if (cdev->ops->init)
+ ret = cdev->ops->init(cdev);
+
++ cdev->can.state = m_can_state_get_by_psr(cdev);
++
+ m_can_write(cdev, M_CAN_IE, cdev->active_interrupts);
+ } else {
+ ret = m_can_start(ndev);
+--
+2.51.0
+
--- /dev/null
+From 50b2322a89d7c27e525c2e33c7ed755848debf92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 18:24:12 +0200
+Subject: can: m_can: m_can_chip_config(): bring up interface in correct state
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 ]
+
+In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the
+CAN state and CAN error counters over an internal reset cycle. An
+external reset is not always possible, due to the shared reset with
+the other CAN core. This caused the core not always be in Error Active
+state when bringing up the controller.
+
+Instead of always setting the CAN state to Error Active in
+m_can_chip_config(), fix this by reading and decoding the Protocol
+Status Regitser (PSR) and set the CAN state accordingly.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 8f663db386948..a7e326faca8ca 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1617,7 +1617,7 @@ static int m_can_start(struct net_device *dev)
+ netdev_queue_set_dql_min_limit(netdev_get_tx_queue(cdev->net, 0),
+ cdev->tx_max_coalesced_frames);
+
+- cdev->can.state = CAN_STATE_ERROR_ACTIVE;
++ cdev->can.state = m_can_state_get_by_psr(cdev);
+
+ m_can_enable_all_interrupts(cdev);
+
+--
+2.51.0
+
--- /dev/null
+From add77cc37b26cc74d6448cb2671a17d9e1127156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:56:15 +0200
+Subject: can: m_can: m_can_handle_state_errors(): fix CAN state transition to
+ Error Active
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 3d9db29b45f970d81acf61cf91a65442efbeb997 ]
+
+The CAN Error State is determined by the receive and transmit error
+counters. The CAN error counters decrease when reception/transmission
+is successful, so that a status transition back to the Error Active
+status is possible. This transition is not handled by
+m_can_handle_state_errors().
+
+Add the missing detection of the Error Active state to
+m_can_handle_state_errors() and extend the handling of this state in
+m_can_handle_state_change().
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Stable-dep-of: 4942c42fe184 ("can: m_can: m_can_chip_config(): bring up interface in correct state")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 53 +++++++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index dbcf17fb3ef25..8f663db386948 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -812,6 +812,9 @@ static int m_can_handle_state_change(struct net_device *dev,
+ u32 timestamp = 0;
+
+ switch (new_state) {
++ case CAN_STATE_ERROR_ACTIVE:
++ cdev->can.state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cdev->can.can_stats.error_warning++;
+@@ -841,6 +844,12 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ cf->data[6] = bec.txerr;
++ cf->data[7] = bec.rxerr;
++ break;
+ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT;
+@@ -877,30 +886,33 @@ static int m_can_handle_state_change(struct net_device *dev,
+ return 1;
+ }
+
+-static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
++static enum can_state
++m_can_state_get_by_psr(struct m_can_classdev *cdev)
+ {
+- struct m_can_classdev *cdev = netdev_priv(dev);
+- int work_done = 0;
++ u32 reg_psr;
+
+- if (psr & PSR_EW && cdev->can.state != CAN_STATE_ERROR_WARNING) {
+- netdev_dbg(dev, "entered error warning state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_ERROR_WARNING);
+- }
++ reg_psr = m_can_read(cdev, M_CAN_PSR);
+
+- if (psr & PSR_EP && cdev->can.state != CAN_STATE_ERROR_PASSIVE) {
+- netdev_dbg(dev, "entered error passive state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_ERROR_PASSIVE);
+- }
++ if (reg_psr & PSR_BO)
++ return CAN_STATE_BUS_OFF;
++ if (reg_psr & PSR_EP)
++ return CAN_STATE_ERROR_PASSIVE;
++ if (reg_psr & PSR_EW)
++ return CAN_STATE_ERROR_WARNING;
+
+- if (psr & PSR_BO && cdev->can.state != CAN_STATE_BUS_OFF) {
+- netdev_dbg(dev, "entered error bus off state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_BUS_OFF);
+- }
++ return CAN_STATE_ERROR_ACTIVE;
++}
+
+- return work_done;
++static int m_can_handle_state_errors(struct net_device *dev)
++{
++ struct m_can_classdev *cdev = netdev_priv(dev);
++ enum can_state new_state;
++
++ new_state = m_can_state_get_by_psr(cdev);
++ if (new_state == cdev->can.state)
++ return 0;
++
++ return m_can_handle_state_change(dev, new_state);
+ }
+
+ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
+@@ -1031,8 +1043,7 @@ static int m_can_rx_handler(struct net_device *dev, int quota, u32 irqstatus)
+ }
+
+ if (irqstatus & IR_ERR_STATE)
+- work_done += m_can_handle_state_errors(dev,
+- m_can_read(cdev, M_CAN_PSR));
++ work_done += m_can_handle_state_errors(dev);
+
+ if (irqstatus & IR_ERR_BUS_30X)
+ work_done += m_can_handle_bus_errors(dev, irqstatus,
+--
+2.51.0
+
--- /dev/null
+From 006893a7f0b275255c34e9d80701f24236c7133b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 17:46:32 +0200
+Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
+
+Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to
+m_can_platform") moved the PM runtime enable from the m_can core
+driver into the m_can_platform.
+
+That patch forgot to move the pm_runtime_disable() to
+m_can_plat_remove(), so that unloading the m_can_platform driver
+causes an "Unbalanced pm_runtime_enable!" error message.
+
+Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the
+problem.
+
+Cc: Patrik Flykt <patrik.flykt@linux.intel.com>
+Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index b832566efda04..057eaa7b8b4b2 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -180,7 +180,7 @@ static void m_can_plat_remove(struct platform_device *pdev)
+ struct m_can_classdev *mcan_class = &priv->cdev;
+
+ m_can_class_unregister(mcan_class);
+-
++ pm_runtime_disable(mcan_class->dev);
+ m_can_class_free_dev(mcan_class->net);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f2ba0f3ed98b42484ee9b5360ebc297eded6f398 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 21b47402b3dca..756400f2a6257 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1578,7 +1578,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8d29f50816956b539bb63f8c9f2b2aa0359ce5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:18:59 +0200
+Subject: doc: fix seg6_flowlabel path
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
+
+This sysctl is not per interface; it's global per netns.
+
+Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst")
+Reported-by: Philippe Guibert <philippe.guibert@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/seg6-sysctl.rst | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst
+index 07c20e470bafe..1b6af4779be11 100644
+--- a/Documentation/networking/seg6-sysctl.rst
++++ b/Documentation/networking/seg6-sysctl.rst
+@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER
+
+ Default is 0.
+
++/proc/sys/net/ipv6/seg6_* variables:
++====================================
++
+ seg6_flowlabel - INTEGER
+ Controls the behaviour of computing the flowlabel of outer
+ IPv6 header in case of SR T.encaps
+--
+2.51.0
+
--- /dev/null
+From c4cf6e0286a2a6019b488ae844cb5bba8719eec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 632a25957477e..3018e294673a5 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -5444,8 +5444,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ thermal_data->sw_ctf_threshold = thermal_data->max;
+
+--
+2.51.0
+
--- /dev/null
+From 1d76411a7a97265ebe1355f084eac969fbb0061c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:12:36 -0400
+Subject: drm/amdgpu: add ip offset support for cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c ]
+
+For chips that don't have IP discovery tables.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/Makefile | 3 +-
+ .../drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/nv.h | 1 +
+ 3 files changed, 59 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile b/drivers/gpu/drm/amd/amdgpu/Makefile
+index c7b18c52825d6..784651269ec55 100644
+--- a/drivers/gpu/drm/amd/amdgpu/Makefile
++++ b/drivers/gpu/drm/amd/amdgpu/Makefile
+@@ -83,7 +83,8 @@ amdgpu-y += \
+ vega20_reg_init.o nbio_v7_4.o nbio_v2_3.o nv.o arct_reg_init.o mxgpu_nv.o \
+ nbio_v7_2.o hdp_v4_0.o hdp_v5_0.o aldebaran_reg_init.o aldebaran.o soc21.o soc24.o \
+ sienna_cichlid.o smu_v13_0_10.o nbio_v4_3.o hdp_v6_0.o nbio_v7_7.o hdp_v5_2.o lsdma_v6_0.o \
+- nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o
++ nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o \
++ cyan_skillfish_reg_init.o
+
+ # add DF block
+ amdgpu-y += \
+diff --git a/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+new file mode 100644
+index 0000000000000..96616a865aac7
+--- /dev/null
++++ b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+@@ -0,0 +1,56 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright 2018 Advanced Micro Devices, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
++#include "amdgpu.h"
++#include "nv.h"
++
++#include "soc15_common.h"
++#include "soc15_hw_ip.h"
++#include "cyan_skillfish_ip_offset.h"
++
++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev)
++{
++ /* HW has more IP blocks, only initialized the blocke needed by driver */
++ uint32_t i;
++
++ adev->gfx.xcc_mask = 1;
++ for (i = 0 ; i < MAX_INSTANCE ; ++i) {
++ adev->reg_offset[GC_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[HDP_HWIP][i] = (uint32_t *)(&(HDP_BASE.instance[i]));
++ adev->reg_offset[MMHUB_HWIP][i] = (uint32_t *)(&(MMHUB_BASE.instance[i]));
++ adev->reg_offset[ATHUB_HWIP][i] = (uint32_t *)(&(ATHUB_BASE.instance[i]));
++ adev->reg_offset[NBIO_HWIP][i] = (uint32_t *)(&(NBIO_BASE.instance[i]));
++ adev->reg_offset[MP0_HWIP][i] = (uint32_t *)(&(MP0_BASE.instance[i]));
++ adev->reg_offset[MP1_HWIP][i] = (uint32_t *)(&(MP1_BASE.instance[i]));
++ adev->reg_offset[VCN_HWIP][i] = (uint32_t *)(&(UVD0_BASE.instance[i]));
++ adev->reg_offset[DF_HWIP][i] = (uint32_t *)(&(DF_BASE.instance[i]));
++ adev->reg_offset[DCE_HWIP][i] = (uint32_t *)(&(DMU_BASE.instance[i]));
++ adev->reg_offset[OSSSYS_HWIP][i] = (uint32_t *)(&(OSSSYS_BASE.instance[i]));
++ adev->reg_offset[SDMA0_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[SDMA1_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[SMUIO_HWIP][i] = (uint32_t *)(&(SMUIO_BASE.instance[i]));
++ adev->reg_offset[THM_HWIP][i] = (uint32_t *)(&(THM_BASE.instance[i]));
++ adev->reg_offset[CLK_HWIP][i] = (uint32_t *)(&(CLK_BASE.instance[i]));
++ }
++ return 0;
++}
+diff --git a/drivers/gpu/drm/amd/amdgpu/nv.h b/drivers/gpu/drm/amd/amdgpu/nv.h
+index 83e9782aef39d..8f4817404f10d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nv.h
++++ b/drivers/gpu/drm/amd/amdgpu/nv.h
+@@ -31,5 +31,6 @@ extern const struct amdgpu_ip_block_version nv_common_ip_block;
+ void nv_grbm_select(struct amdgpu_device *adev,
+ u32 me, u32 pipe, u32 queue, u32 vmid);
+ void nv_set_virt_ops(struct amdgpu_device *adev);
++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev);
+
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 8452b48bd71ff21eb676636673a453af721b0bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:18:46 -0400
+Subject: drm/amdgpu: add support for cyan skillfish without IP discovery
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 ]
+
+For platforms without an IP discovery table.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 30 +++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index 6042956cd5c3c..0f427314b2b48 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2644,6 +2644,36 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 6, 0);
+ adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0);
+ break;
++ case CHIP_CYAN_SKILLFISH:
++ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2) {
++ r = amdgpu_discovery_reg_base_init(adev);
++ if (r)
++ return -EINVAL;
++
++ amdgpu_discovery_harvest_ip(adev);
++ amdgpu_discovery_get_gfx_info(adev);
++ amdgpu_discovery_get_mall_info(adev);
++ amdgpu_discovery_get_vcn_info(adev);
++ } else {
++ cyan_skillfish_reg_base_init(adev);
++ adev->sdma.num_instances = 2;
++ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3);
++ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3);
++ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[HDP_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[SDMA0_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[SDMA1_HWIP][1] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[DF_HWIP][0] = IP_VERSION(3, 5, 0);
++ adev->ip_versions[NBIO_HWIP][0] = IP_VERSION(2, 1, 1);
++ adev->ip_versions[UMC_HWIP][0] = IP_VERSION(8, 1, 1);
++ adev->ip_versions[MP0_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[MP1_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[THM_HWIP][0] = IP_VERSION(11, 0, 1);
++ adev->ip_versions[SMUIO_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[GC_HWIP][0] = IP_VERSION(10, 1, 3);
++ adev->ip_versions[UVD_HWIP][0] = IP_VERSION(2, 0, 3);
++ }
++ break;
+ default:
+ r = amdgpu_discovery_reg_base_init(adev);
+ if (r) {
+--
+2.51.0
+
--- /dev/null
+From a584fbb11c965a65863fb4d5dfded8ddf70af03a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 17:31:32 -0400
+Subject: drm/amdgpu: fix handling of harvesting for ip_discovery firmware
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 ]
+
+Chips which use the IP discovery firmware loaded by the driver
+reported incorrect harvesting information in the ip discovery
+table in sysfs because the driver only uses the ip discovery
+firmware for populating sysfs and not for direct parsing for the
+driver itself as such, the fields that are used to print the
+harvesting info in sysfs report incorrect data for some IPs. Populate
+the relevant fields for this case as well.
+
+Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery")
+Acked-by: Tom St Denis <tom.stdenis@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index 0f427314b2b48..e00b5e4542347 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -1016,7 +1016,9 @@ static uint8_t amdgpu_discovery_get_harvest_info(struct amdgpu_device *adev,
+ /* Until a uniform way is figured, get mask based on hwid */
+ switch (hw_id) {
+ case VCN_HWID:
+- harvest = ((1 << inst) & adev->vcn.inst_mask) == 0;
++ /* VCN vs UVD+VCE */
++ if (!amdgpu_ip_version(adev, VCE_HWIP, 0))
++ harvest = ((1 << inst) & adev->vcn.inst_mask) == 0;
+ break;
+ case DMU_HWID:
+ if (adev->harvest_ip_mask & AMD_HARVEST_IP_DMU_MASK)
+@@ -2462,7 +2464,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 0, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 0, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 0);
+@@ -2489,7 +2493,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 3, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 3, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 1);
+@@ -2516,8 +2522,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 1;
++ adev->sdma.sdma_mask = 1;
+ adev->vcn.num_vcn_inst = 1;
+ adev->gmc.num_umc = 2;
++ adev->gfx.xcc_mask = 1;
+ if (adev->apu_flags & AMD_APU_IS_RAVEN2) {
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 2, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 2, 0);
+@@ -2560,7 +2568,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega20_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 8;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 0);
+@@ -2588,8 +2598,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ arct_reg_base_init(adev);
+ adev->sdma.num_instances = 8;
++ adev->sdma.sdma_mask = 0xff;
+ adev->vcn.num_vcn_inst = 2;
+ adev->gmc.num_umc = 8;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 1);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 1);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 1);
+@@ -2621,8 +2633,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ aldebaran_reg_base_init(adev);
+ adev->sdma.num_instances = 5;
++ adev->sdma.sdma_mask = 0x1f;
+ adev->vcn.num_vcn_inst = 2;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 2);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 2);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 4, 0);
+@@ -2657,6 +2671,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ } else {
+ cyan_skillfish_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1);
+--
+2.51.0
+
--- /dev/null
+From 9c4c8117d903410d6a7d97d4c55802dda65e8988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 12:59:53 +0200
+Subject: drm/bridge: lt9211: Drop check for last nibble of version register
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ]
+
+There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 .
+The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the
+driver checks for right now. Since there is a possibility there will be
+yet another revision of the LT9211 in the future, drop the last version
+nibble check to allow all future revisions of the chip to work with this
+driver.
+
+This fix makes LT9211 rev. U5 work with this driver.
+
+Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c
+index c8881796fba4c..4014375f06ea1 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9211.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c
+@@ -120,8 +120,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx)
+ }
+
+ /* Test for known Chip ID. */
+- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE ||
+- chipid[2] != REG_CHIPID2_VALUE) {
++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) {
+ dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n",
+ chipid[0], chipid[1], chipid[2]);
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 56a46444629be7e09a8bc284891e330811008dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 12:33:03 +0200
+Subject: drm/draw: fix color truncation in drm_draw_fill24
+
+From: Francesco Valla <francesco@valla.it>
+
+[ Upstream commit 095232711f23179053ca26bcf046ca121a91a465 ]
+
+The color parameter passed to drm_draw_fill24() was truncated to 16
+bits, leading to an incorrect color drawn to the target iosys_map.
+Fix this behavior, widening the parameter to 32 bits.
+
+Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw")
+
+Signed-off-by: Francesco Valla <francesco@valla.it>
+Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
+Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_draw.c | 2 +-
+ drivers/gpu/drm/drm_draw_internal.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_draw.c b/drivers/gpu/drm/drm_draw.c
+index d41f8ae1c1483..b61ebc5bdd5ce 100644
+--- a/drivers/gpu/drm/drm_draw.c
++++ b/drivers/gpu/drm/drm_draw.c
+@@ -125,7 +125,7 @@ EXPORT_SYMBOL(drm_draw_fill16);
+
+ void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+- u16 color)
++ u32 color)
+ {
+ unsigned int y, x;
+
+diff --git a/drivers/gpu/drm/drm_draw_internal.h b/drivers/gpu/drm/drm_draw_internal.h
+index f121ee7339dc1..20cb404e23ea6 100644
+--- a/drivers/gpu/drm/drm_draw_internal.h
++++ b/drivers/gpu/drm/drm_draw_internal.h
+@@ -47,7 +47,7 @@ void drm_draw_fill16(struct iosys_map *dmap, unsigned int dpitch,
+
+ void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+- u16 color);
++ u32 color);
+
+ void drm_draw_fill32(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+--
+2.51.0
+
--- /dev/null
+From 37664506784e92921a6a6034555015fb7437e158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:29:04 -0400
+Subject: drm/i915/guc: Skip communication warning on reset in progress
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ]
+
+GuC IRQ and tasklet handler receive just single G2H message, and let other
+messages to be received from next tasklet. During this chained tasklet
+process, if reset process started, communication will be disabled.
+Skip warning for this condition.
+
+Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com
+(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+index 0d5197c0824a9..5cf3a516ccfb3 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+@@ -1324,9 +1324,16 @@ static int ct_receive(struct intel_guc_ct *ct)
+
+ static void ct_try_receive_message(struct intel_guc_ct *ct)
+ {
++ struct intel_guc *guc = ct_to_guc(ct);
+ int ret;
+
+- if (GEM_WARN_ON(!ct->enabled))
++ if (!ct->enabled) {
++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress);
++ return;
++ }
++
++ /* When interrupt disabled, message handling is not expected */
++ if (!guc->interrupts.enabled)
+ return;
+
+ ret = ct_receive(ct);
+--
+2.51.0
+
--- /dev/null
+From 10ae5615b0e01eb8e075f38c841d77f38a1d861e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 12:51:11 +0200
+Subject: drm/panthor: Ensure MCU is disabled on suspend
+
+From: Ketil Johnsen <ketil.johnsen@arm.com>
+
+[ Upstream commit e07e10ae83bdf429f59c8c149173a8c4f29c481e ]
+
+Currently the Panthor driver needs the GPU to be powered down
+between suspend and resume. If this is not done, then the
+MCU_CONTROL register will be preserved as AUTO, which again will
+cause a premature FW boot on resume. The FW will go directly into
+fatal state in this case.
+
+This case needs to be handled as there is no guarantee that the
+GPU will be powered down after the suspend callback on all platforms.
+
+The fix is to call panthor_fw_stop() in "pre-reset" path to ensure
+the MCU_CONTROL register is cleared (set DISABLE). This matches
+well with the already existing call to panthor_fw_start() from the
+"post-reset" path.
+
+Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
+Acked-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_fw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
+index 4e2d3a02ea068..cdd6e1c08cebd 100644
+--- a/drivers/gpu/drm/panthor/panthor_fw.c
++++ b/drivers/gpu/drm/panthor/panthor_fw.c
+@@ -1057,6 +1057,7 @@ void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang)
+ }
+
+ panthor_job_irq_suspend(&ptdev->fw->irq);
++ panthor_fw_stop(ptdev);
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From ed3563cdb0eebd62d5236ffc1e676b9e5c7ca3e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 07:20:01 -0700
+Subject: drm/rockchip: vop2: use correct destination rectangle height check
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ]
+
+The vop2_plane_atomic_check() function incorrectly checks
+drm_rect_width(dest) twice instead of verifying both width and height.
+Fix the second condition to use drm_rect_height(dest) so that invalid
+destination rectangles with height < 4 are correctly rejected.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 5d7df4c3b08c4..a551458ad4340 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1118,7 +1118,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane,
+ return format;
+
+ if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 ||
+- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) {
++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) {
+ drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n",
+ drm_rect_width(src) >> 16, drm_rect_height(src) >> 16,
+ drm_rect_width(dest), drm_rect_height(dest));
+--
+2.51.0
+
--- /dev/null
+From 20dd4eb3dbfa72a76ff11ab0c6c832b1e200ccc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 21:28:44 -0700
+Subject: HID: hid-input: only ignore 0 battery events for digitizers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ]
+
+Commit 581c4484769e ("HID: input: map digitizer battery usage") added
+handling of battery events for digitizers (typically for batteries
+presented in stylii). Digitizers typically report correct battery levels
+only when stylus is actively touching the surface, and in other cases
+they may report battery level of 0. To avoid confusing consumers of the
+battery information the code was added to filer out reports with 0
+battery levels.
+
+However there exist other kinds of devices that may legitimately report
+0 battery levels. Fix this by filtering out 0-level reports only for
+digitizer usages, and continue reporting them for other kinds of devices
+(Smart Batteries, etc).
+
+Reported-by: 卢国宏 <luguohong@xiaomi.com>
+Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f5c217ac4bfaa..f073d5621050a 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
+ return;
+ }
+
+- if (value == 0 || value < dev->battery_min || value > dev->battery_max)
++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0)
++ return;
++
++ if (value < dev->battery_min || value > dev->battery_max)
+ return;
+
+ capacity = hidinput_scale_battery_capacity(dev, value);
+--
+2.51.0
+
--- /dev/null
+From eec78243e3fbbb1c67bf7b54c667d662e8049091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 09:40:33 -0300
+Subject: HID: multitouch: fix name of Stylus input devices
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ]
+
+HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by
+commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN").
+However, on multitouch devices, these suffixes may be overridden. Before
+that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after
+that, multitouch would override them to have an "UNKNOWN" suffix. Just add
+HID_DG_PEN to the list of non-overriden suffixes in multitouch.
+
+Before this fix:
+
+[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+ELAN9008:00 04F3:2E14 UNKNOWN
+
+After this fix:
+
+[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+
+ELAN9008:00 04F3:2E14 Stylus
+
+Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 0667a24576fc4..0e4cb0e668eb5 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1663,6 +1663,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ case HID_CP_CONSUMER_CONTROL:
+ case HID_GD_WIRELESS_RADIO_CTLS:
+ case HID_GD_SYSTEM_MULTIAXIS:
++ case HID_DG_PEN:
+ /* already handled by hid core */
+ break;
+ case HID_DG_TOUCHSCREEN:
+--
+2.51.0
+
--- /dev/null
+From 8020bdb6b1da711ffb970d89123500d7f66d6672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 09:25:46 +0200
+Subject: ksmbd: fix recursive locking in RPC handle list access
+
+From: Marios Makassikis <mmakassikis@freebox.fr>
+
+[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ]
+
+Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list
+access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
+
+This causes hung connections / tasks when a client attempts to open
+a named pipe. Using Samba's rpcclient tool:
+
+ $ rpcclient //192.168.1.254 -U user%password
+ $ rpcclient $> srvinfo
+ <connection hung here>
+
+Kernel side:
+ "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
+ Workqueue: ksmbd-io handle_ksmbd_work
+ Call trace:
+ __schedule from schedule+0x3c/0x58
+ schedule from schedule_preempt_disabled+0xc/0x10
+ schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8
+ rwsem_down_read_slowpath from down_read+0x28/0x30
+ down_read from ksmbd_session_rpc_method+0x18/0x3c
+ ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68
+ ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228
+ ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8
+ create_smb2_pipe from smb2_open+0x10c/0x27ac
+ smb2_open from handle_ksmbd_work+0x238/0x3dc
+ handle_ksmbd_work from process_scheduled_works+0x160/0x25c
+ process_scheduled_works from worker_thread+0x16c/0x1e8
+ worker_thread from kthread+0xa8/0xb8
+ kthread from ret_from_fork+0x14/0x38
+ Exception stack(0x8529ffb0 to 0x8529fff8)
+
+The task deadlocks because the lock is already held:
+ ksmbd_session_rpc_open
+ down_write(&sess->rpc_lock)
+ ksmbd_rpc_open
+ ksmbd_session_rpc_method
+ down_read(&sess->rpc_lock) <-- deadlock
+
+Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
+
+Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access")
+Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/mgmt/user_session.c | 7 ++-----
+ fs/smb/server/smb2pdu.c | 9 ++++++++-
+ fs/smb/server/transport_ipc.c | 12 ++++++++++++
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
+index b36d0676dbe58..00805aed0b07d 100644
+--- a/fs/smb/server/mgmt/user_session.c
++++ b/fs/smb/server/mgmt/user_session.c
+@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
+ int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
+ {
+ struct ksmbd_session_rpc *entry;
+- int method;
+
+- down_read(&sess->rpc_lock);
++ lockdep_assert_held(&sess->rpc_lock);
+ entry = xa_load(&sess->rpc_handle_list, id);
+- method = entry ? entry->method : 0;
+- up_read(&sess->rpc_lock);
+
+- return method;
++ return entry ? entry->method : 0;
+ }
+
+ void ksmbd_session_destroy(struct ksmbd_session *sess)
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index d2182477566a6..796235cb95677 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -4623,8 +4623,15 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess,
+ * pipe without opening it, checking error condition here
+ */
+ id = req->VolatileFileId;
+- if (!ksmbd_session_rpc_method(sess, id))
++
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
++ if (!ksmbd_session_rpc_method(sess, id)) {
++ up_read(&sess->rpc_lock);
+ return -ENOENT;
++ }
++ up_read(&sess->rpc_lock);
+
+ ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n",
+ req->FileInfoClass, req->VolatileFileId);
+diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
+index 4454bbe3c7107..816f136ce5c4e 100644
+--- a/fs/smb/server/transport_ipc.c
++++ b/fs/smb/server/transport_ipc.c
+@@ -825,6 +825,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -833,6 +836,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle
+ req->flags |= KSMBD_RPC_WRITE_METHOD;
+ req->payload_sz = payload_sz;
+ memcpy(req->payload, payload, payload_sz);
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+@@ -849,6 +853,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -856,6 +863,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)
+ req->flags |= rpc_context_flags(sess);
+ req->flags |= KSMBD_RPC_READ_METHOD;
+ req->payload_sz = 0;
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+@@ -876,6 +884,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -884,6 +895,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle
+ req->flags |= KSMBD_RPC_IOCTL_METHOD;
+ req->payload_sz = payload_sz;
+ memcpy(req->payload, payload, payload_sz);
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+--
+2.51.0
+
--- /dev/null
+From dd2ecdf112a2c340754c6e56843acfa737daae46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 92856cf387c76..7c9658a4ec4b5 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 07869f710a3550eec323b04d7aeebfc6e23112ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index ae83a969ae64b..01fcf952b05de 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -605,6 +605,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 09b73acf037ae..7c77d06372d19 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5350c9bb2319b..b72ca10349068 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1257,8 +1257,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 3cf994139ffdf6df0877147f542d05d2b6791e47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:07:42 +0100
+Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
+
+Convert `lan78xx_init_mac_address` to return error codes and handle
+failures in register read and write operations. Update `lan78xx_reset`
+to check for errors during MAC address initialization and propagate them
+appropriately.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 2f8637224b69e..6babe909036cf 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1920,13 +1920,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = {
+ .get_regs = lan78xx_get_regs,
+ };
+
+-static void lan78xx_init_mac_address(struct lan78xx_net *dev)
++static int lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+ u8 addr[6];
++ int ret;
++
++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ if (ret < 0)
++ return ret;
+
+- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ if (ret < 0)
++ return ret;
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1959,14 +1965,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ if (ret < 0)
++ return ret;
+ }
+
+- lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ if (ret < 0)
++ return ret;
+
+ eth_hw_addr_set(dev->net, addr);
++
++ return 0;
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2905,7 +2923,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- lan78xx_init_mac_address(dev);
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
+
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+--
+2.51.0
+
--- /dev/null
+From 322d1a879b1ed5bcb5df97ded52906fd8eb7fd7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 6babe909036cf..2da67814556f9 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2923,10 +2923,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -2935,6 +2931,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 32779bc11f31137d25c87a0de961c6a73a7b69ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 02:17:25 -0700
+Subject: netdevsim: set the carrier when the device goes up
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 ]
+
+Bringing a linked netdevsim device down and then up causes communication
+failure because both interfaces lack carrier. Basically a ifdown/ifup on
+the interface make the link broken.
+
+Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported
+for NAPI, calling netif_carrier_off() in nsim_stop(). This patch
+re-enables the carrier symmetrically on nsim_open(), in case the device
+is linked and the peer is up.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/netdev.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index ee2a7b2f6268d..e2d92295ad33b 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -433,6 +433,7 @@ static void nsim_enable_napi(struct netdevsim *ns)
+ static int nsim_open(struct net_device *dev)
+ {
+ struct netdevsim *ns = netdev_priv(dev);
++ struct netdevsim *peer;
+ int err;
+
+ err = nsim_init_napi(ns);
+@@ -441,6 +442,12 @@ static int nsim_open(struct net_device *dev)
+
+ nsim_enable_napi(ns);
+
++ peer = rtnl_dereference(ns->peer);
++ if (peer && netif_running(peer->netdev)) {
++ netif_carrier_on(dev);
++ netif_carrier_on(peer->netdev);
++ }
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e34627c43800a48ca53f986bfaafe68ae90f349e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 12:08:22 -0700
+Subject: nvme-multipath: Skip nr_active increments in RETRY disposition
+
+From: Amit Chaudhary <achaudhary@purestorage.com>
+
+[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ]
+
+For queue-depth I/O policy, this patch fixes unbalanced I/Os across
+nvme multipaths.
+
+Issue Description:
+
+The RETRY disposition incorrectly increments ns->ctrl->nr_active
+counter and reinitializes iostat start-time. In such cases nr_active
+counter never goes back to zero until that path disconnects and
+reconnects.
+
+Such a path is not chosen for new I/Os if multiple RETRY cases on a given
+a path cause its queue-depth counter to be artificially higher compared
+to other paths. This leads to unbalanced I/Os across paths.
+
+The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already
+set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set.
+
+base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a
+Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device")
+Signed-off-by: Amit Chaudhary <achaudhary@purestorage.com>
+Reviewed-by: Randy Jennings <randyj@purestorage.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 561dd08022c06..24cff8b044923 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -131,12 +131,14 @@ void nvme_mpath_start_request(struct request *rq)
+ struct nvme_ns *ns = rq->q->queuedata;
+ struct gendisk *disk = ns->head->disk;
+
+- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) {
++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) &&
++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) {
+ atomic_inc(&ns->ctrl->nr_active);
+ nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE;
+ }
+
+- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq))
++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) ||
++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS))
+ return;
+
+ nvme_req(rq)->flags |= NVME_MPATH_IO_STATS;
+--
+2.51.0
+
--- /dev/null
+From ca6e4d6da5510218e9de9b200dfe977eeb1804d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 17:19:42 +1000
+Subject: nvme/tcp: handle tls partially sent records in write_space()
+
+From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+
+[ Upstream commit 5a869d017793399fd1d2609ff27e900534173eb3 ]
+
+With TLS enabled, records that are encrypted and appended to TLS TX
+list can fail to see a retry if the underlying TCP socket is busy, for
+example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known
+to the NVMe TCP driver, as the TLS layer successfully generated a record.
+
+Typically, the TLS write_space() callback would ensure such records are
+retried, but in the NVMe TCP Host driver, write_space() invokes
+nvme_tcp_write_space(). This causes a partially sent record in the TLS TX
+list to timeout after not being retried.
+
+This patch fixes the above by calling queue->write_space(), which calls
+into the TLS layer to retry any pending records.
+
+Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
+Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 83a6b18b01ada..77df3432dfb78 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1075,6 +1075,9 @@ static void nvme_tcp_write_space(struct sock *sk)
+ queue = sk->sk_user_data;
+ if (likely(queue && sk_stream_is_writeable(sk))) {
+ clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
++ /* Ensure pending TLS partial records are retried */
++ if (nvme_tcp_queue_tls(queue))
++ queue->write_space(sk);
+ queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
+ }
+ read_unlock_bh(&sk->sk_callback_lock);
+--
+2.51.0
+
--- /dev/null
+From cec5dfdbc8bec669d1ea0a64795bffe77b81a770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 7b82779e4cd5d..80b5262d0d572 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5060,8 +5060,9 @@ static int rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_runtime_resume(device);
+--
+2.51.0
+
--- /dev/null
+From 0e15f27e79d41d84bbfbb24c6ec6c3df4d6fa7a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:25:13 +0200
+Subject: riscv: kprobes: Fix probe address validation
+
+From: Fabian Vogt <fvogt@suse.de>
+
+[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
+
+When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
+arch_check_kprobe would start iterating all instructions starting from
+_text until the probed address. Not only is this very inefficient, but
+literal values in there (e.g. left by function patching) are
+misinterpreted in a way that causes a desync.
+
+Fix this by doing it like x86: start the iteration at the closest
+preceding symbol instead of the given starting point.
+
+Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
+Signed-off-by: Fabian Vogt <fvogt@suse.de>
+Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index d2dacea1aedd9..0daba93c1a81e 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
+-static bool __kprobes arch_check_kprobe(struct kprobe *p)
++static bool __kprobes arch_check_kprobe(unsigned long addr)
+ {
+- unsigned long tmp = (unsigned long)p->addr - p->offset;
+- unsigned long addr = (unsigned long)p->addr;
++ unsigned long tmp, offset;
++
++ /* start iterating at the closest preceding symbol */
++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
++ return false;
++
++ tmp = addr - offset;
+
+ while (tmp <= addr) {
+ if (tmp == addr)
+@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if ((unsigned long)insn & 0x1)
+ return -EILSEQ;
+
+- if (!arch_check_kprobe(p))
++ if (!arch_check_kprobe((unsigned long)p->addr))
+ return -EILSEQ;
+
+ /* copy instruction */
+--
+2.51.0
+
--- /dev/null
+From 432a19c4e757b6b8428f76f32ea04da42ea8e4c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index b3d9826e25b03..8bdcb5df0d461 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9059,21 +9059,21 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
--- /dev/null
+From 1f71000255b310347817a9861fa098151ea6617e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 11:53:30 +0800
+Subject: selftests: arg_parsing: Ensure data is flushed to disk before
+ reading.
+
+From: Xing Guo <higuoxing@gmail.com>
+
+[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ]
+
+test_parse_test_list_file writes some data to
+/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read
+the data back. However, after writing data to that file, we forget to
+call fsync() and it's causing testing failure in my laptop. This patch
+helps fix it by adding the missing fsync() call.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Xing Guo <higuoxing@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index fbf0d9c2f58b3..e27d66b75fb1f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void)
+ if (!ASSERT_OK(ferror(fp), "prepare tmp"))
+ goto out_fclose;
+
++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp"))
++ goto out_fclose;
++
+ init_test_filter_set(&set);
+
+ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
+--
+2.51.0
+
--- /dev/null
+From 451dc090085d7198ca013ed78d9391fd41024bb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 13:20:37 -0700
+Subject: selftests/bpf: make arg_parsing.c more robust to crashes
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ]
+
+We started getting a crash in BPF CI, which seems to originate from
+test_parse_test_list_file() test and is happening at this line:
+
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+
+One way we can crash there is if set.cnt zero, which is checked for with
+ASSERT_EQ() above, but we proceed after this regardless of the outcome.
+Instead of crashing, we should bail out with test failure early.
+
+Similarly, if parse_test_list_file() fails, we shouldn't be even looking
+at set, so bail even earlier if ASSERT_OK() fails.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index bb143de68875c..fbf0d9c2f58b3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)
+
+ init_test_filter_set(&set);
+
+- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file");
++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
++ goto out_fclose;
++
++ if (!ASSERT_EQ(set.cnt, 4, "test count"))
++ goto out_free_set;
+
+- ASSERT_EQ(set.cnt, 4, "test count");
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+ ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count");
+ ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name");
+@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)
+ ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name");
+ ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name");
+
++out_free_set:
+ free_test_filter_set(&set);
+-
+ out_fclose:
+ fclose(fp);
+ out_remove:
+--
+2.51.0
+
cpufreq-cppc-avoid-using-cpufreq_eternal-as-transition-delay.patch
revert-io_uring-rw-drop-eopnotsupp-check-in-__io_complete_rw_common.patch
hid-multitouch-fix-sticky-fingers.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch
+can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch
+can-m_can-m_can_chip_config-bring-up-interface-in-co.patch
+can-m_can-add-deinit-callback.patch
+can-m_can-call-deinit-init-callback-when-going-into-.patch
+can-m_can-fix-can-state-in-system-pm.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+doc-fix-seg6_flowlabel-path.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+tls-trim-encrypted-message-to-match-the-plaintext-on.patch
+tls-wait-for-async-encrypt-in-case-of-error-during-l.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+netdevsim-set-the-carrier-when-the-device-goes-up.patch
+net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+drm-panthor-ensure-mcu-is-disabled-on-suspend.patch
+nvme-multipath-skip-nr_active-increments-in-retry-di.patch
+riscv-kprobes-fix-probe-address-validation.patch
+drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch
+asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch
+asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch
+asoc-nau8821-generalize-helper-to-clear-irq-status.patch
+asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch
+drm-i915-guc-skip-communication-warning-on-reset-in-.patch
+drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch
+drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+drm-draw-fix-color-truncation-in-drm_draw_fill24.patch
+drm-rockchip-vop2-use-correct-destination-rectangle-.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
+accel-qaic-fix-bootlog-initialization-ordering.patch
+accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch
+accel-qaic-synchronize-access-to-dbc-request-queue-h.patch
+selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch
+alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch
+hid-hid-input-only-ignore-0-battery-events-for-digit.patch
+hid-multitouch-fix-name-of-stylus-input-devices.patch
+asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch
+selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch
+nvme-tcp-handle-tls-partially-sent-records-in-write_.patch
--- /dev/null
+From a8615a02b55567cf1db5835cba66835215e19773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 6d5387811c32a..5e37dc45639db 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2217,7 +2217,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2279,9 +2280,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From 16da245e4d8918e661d627b4846ff9ae37472e3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 717e110d23c91..dc170feee8ad7 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5803,7 +5803,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5944,9 +5944,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From 3218034da74ceb86716c4b13b33de6f88b14cd00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 0acf313deb01f..e52e4c91c9091 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -255,12 +255,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From f7168d5e8f8d22ce1660d38b007015200aba2ba9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index bebf0dd3b95fa..1ff0d01bdadf0 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ } else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From 3fe70866e40d6169c0f4278f872d4b2305b056f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:56 +0200
+Subject: tls: trim encrypted message to match the plaintext on short splice
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ]
+
+During tls_sw_sendmsg_locked, we pre-allocate the encrypted message
+for the size we're expecting to send during the current iteration, but
+we may end up sending less, for example when splicing: if we're
+getting the data from small fragments of memory, we may fill up all
+the slots in the skmsg with less data than expected.
+
+In this case, we need to trim the encrypted message to only the length
+we actually need, to avoid pushing uninitialized bytes down the
+underlying TCP socket.
+
+Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index f46550b96061e..aac685daf66c4 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ tls_ctx->pending_open_record_frags = true;
+
+- if (sk_msg_full(msg_pl))
++ if (sk_msg_full(msg_pl)) {
+ full_record = true;
++ sk_msg_trim(sk, msg_en,
++ msg_pl->sg.size + prot->overhead_size);
++ }
+
+ if (full_record || eor)
+ goto copied;
+--
+2.51.0
+
--- /dev/null
+From db0f8a603774c0eccd3aca9c46913099b35d602f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:57 +0200
+Subject: tls: wait for async encrypt in case of error during latter iterations
+ of sendmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
+
+If we hit an error during the main loop of tls_sw_sendmsg_locked (eg
+failed allocation), we jump to send_end and immediately
+return. Previous iterations may have queued async encryption requests
+that are still pending. We should wait for those before returning, as
+we could otherwise be reading from memory that userspace believes
+we're not using anymore, which would be a sort of use-after-free.
+
+This is similar to what tls_sw_recvmsg already does: failures during
+the main loop jump to the "wait for async" code, not straight to the
+unlock/return.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index aac685daf66c4..dc5a7e24d7b77 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ if (ret == -EINPROGRESS)
+ num_async++;
+ else if (ret != -EAGAIN)
+- goto send_end;
++ goto end;
+ }
+ }
+
+@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto alloc_encrypted;
+ }
+
++send_end:
+ if (!num_async) {
+- goto send_end;
++ goto end;
+ } else if (num_zc || eor) {
+ int err;
+
+@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ tls_tx_records(sk, msg->msg_flags);
+ }
+
+-send_end:
++end:
+ ret = sk_stream_error(sk, msg->msg_flags, ret);
+ return copied > 0 ? copied : ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 13cb8203b3290fc84074f251f8b8c5bb14c6bccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:59 +0200
+Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ]
+
+Async decryption calls tls_strp_msg_hold to create a clone of the
+input skb to hold references to the memory it uses. If we fail to
+allocate that clone, proceeding with async decryption can lead to
+various issues (UAF on the skb, writing into userspace memory after
+the recv() call has returned).
+
+In this case, wait for all pending decryption requests.
+
+Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index dc5a7e24d7b77..bebf0dd3b95fa 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1637,8 +1637,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+
+ if (unlikely(darg->async)) {
+ err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold);
+- if (err)
+- __skb_queue_tail(&ctx->async_hold, darg->skb);
++ if (err) {
++ err = tls_decrypt_async_wait(ctx);
++ darg->async = false;
++ }
+ return err;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 84ae5da84ae8bac647092dc7f5b84374032ad9fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 13:57:50 +0200
+Subject: accel/qaic: Fix bootlog initialization ordering
+
+From: Jeffrey Hugo <quic_jhugo@quicinc.com>
+
+[ Upstream commit fd6e385528d8f85993b7bfc6430576136bb14c65 ]
+
+As soon as we queue MHI buffers to receive the bootlog from the device,
+we could be receiving data. Therefore all the resources needed to
+process that data need to be setup prior to queuing the buffers.
+
+We currently initialize some of the resources after queuing the buffers
+which creates a race between the probe() and any data that comes back
+from the device. If the uninitialized resources are accessed, we could
+see page faults.
+
+Fix the init ordering to close the race.
+
+Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs")
+Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_debugfs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_debugfs.c b/drivers/accel/qaic/qaic_debugfs.c
+index a991b8198dc40..8dc4fe5bb560e 100644
+--- a/drivers/accel/qaic/qaic_debugfs.c
++++ b/drivers/accel/qaic/qaic_debugfs.c
+@@ -218,6 +218,9 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d
+ if (ret)
+ goto destroy_workqueue;
+
++ dev_set_drvdata(&mhi_dev->dev, qdev);
++ qdev->bootlog_ch = mhi_dev;
++
+ for (i = 0; i < BOOTLOG_POOL_SIZE; i++) {
+ msg = devm_kzalloc(&qdev->pdev->dev, sizeof(*msg), GFP_KERNEL);
+ if (!msg) {
+@@ -233,8 +236,6 @@ static int qaic_bootlog_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_d
+ goto mhi_unprepare;
+ }
+
+- dev_set_drvdata(&mhi_dev->dev, qdev);
+- qdev->bootlog_ch = mhi_dev;
+ return 0;
+
+ mhi_unprepare:
+--
+2.51.0
+
--- /dev/null
+From f6b621feb11a95f4f0e8ba9659f4b0459767cb21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 08:18:37 +0200
+Subject: accel/qaic: Synchronize access to DBC request queue head & tail
+ pointer
+
+From: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
+
+[ Upstream commit 52e59f7740ba23bbb664914967df9a00208ca10c ]
+
+Two threads of the same process can potential read and write parallelly to
+head and tail pointers of the same DBC request queue. This could lead to a
+race condition and corrupt the DBC request queue.
+
+Fixes: ff13be830333 ("accel/qaic: Add datapath")
+Signed-off-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+[jhugo: Add fixes tag]
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic.h | 2 ++
+ drivers/accel/qaic/qaic_data.c | 12 ++++++++++--
+ drivers/accel/qaic/qaic_drv.c | 3 +++
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic.h b/drivers/accel/qaic/qaic.h
+index c31081e42cee0..820d133236dd1 100644
+--- a/drivers/accel/qaic/qaic.h
++++ b/drivers/accel/qaic/qaic.h
+@@ -97,6 +97,8 @@ struct dma_bridge_chan {
+ * response queue's head and tail pointer of this DBC.
+ */
+ void __iomem *dbc_base;
++ /* Synchronizes access to Request queue's head and tail pointer */
++ struct mutex req_lock;
+ /* Head of list where each node is a memory handle queued in request queue */
+ struct list_head xfer_list;
+ /* Synchronizes DBC readers during cleanup */
+diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
+index 797289e9d7806..c4f117edb266e 100644
+--- a/drivers/accel/qaic/qaic_data.c
++++ b/drivers/accel/qaic/qaic_data.c
+@@ -1356,13 +1356,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ goto release_ch_rcu;
+ }
+
++ ret = mutex_lock_interruptible(&dbc->req_lock);
++ if (ret)
++ goto release_ch_rcu;
++
+ head = readl(dbc->dbc_base + REQHP_OFF);
+ tail = readl(dbc->dbc_base + REQTP_OFF);
+
+ if (head == U32_MAX || tail == U32_MAX) {
+ /* PCI link error */
+ ret = -ENODEV;
+- goto release_ch_rcu;
++ goto unlock_req_lock;
+ }
+
+ queue_level = head <= tail ? tail - head : dbc->nelem - (head - tail);
+@@ -1370,11 +1374,12 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ ret = send_bo_list_to_device(qdev, file_priv, exec, args->hdr.count, is_partial, dbc,
+ head, &tail);
+ if (ret)
+- goto release_ch_rcu;
++ goto unlock_req_lock;
+
+ /* Finalize commit to hardware */
+ submit_ts = ktime_get_ns();
+ writel(tail, dbc->dbc_base + REQTP_OFF);
++ mutex_unlock(&dbc->req_lock);
+
+ update_profiling_data(file_priv, exec, args->hdr.count, is_partial, received_ts,
+ submit_ts, queue_level);
+@@ -1382,6 +1387,9 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
+ if (datapath_polling)
+ schedule_work(&dbc->poll_work);
+
++unlock_req_lock:
++ if (ret)
++ mutex_unlock(&dbc->req_lock);
+ release_ch_rcu:
+ srcu_read_unlock(&dbc->ch_lock, rcu_id);
+ unlock_dev_srcu:
+diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c
+index e31bcb0ecfc94..e162f4b8a262a 100644
+--- a/drivers/accel/qaic/qaic_drv.c
++++ b/drivers/accel/qaic/qaic_drv.c
+@@ -454,6 +454,9 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev,
+ return NULL;
+ init_waitqueue_head(&qdev->dbc[i].dbc_release);
+ INIT_LIST_HEAD(&qdev->dbc[i].bo_lists);
++ ret = drmm_mutex_init(drm, &qdev->dbc[i].req_lock);
++ if (ret)
++ return NULL;
+ }
+
+ return qdev;
+--
+2.51.0
+
--- /dev/null
+From cf44a5e1749552dc47d100d4caa74a773b83215b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 14:23:20 +0200
+Subject: accel/qaic: Treat remaining == 0 as error in
+ find_and_map_user_pages()
+
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+
+[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ]
+
+Currently, if find_and_map_user_pages() takes a DMA xfer request from the
+user with a length field set to 0, or in a rare case, the host receives
+QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size
+is equal to the requested transaction size, the function will return 0
+before allocating an sgt or setting the fields of the dma_xfer struct.
+In that case, encode_addr_size_pairs() will try to access the sgt which
+will lead to a general protection fault.
+
+Return an EINVAL in case the user provides a zero-sized ALP, or the device
+requests continuation after all of the bytes have been transferred.
+
+Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()")
+Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index d8bdab69f8009..b86a8e48e731b 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
+ return -EINVAL;
+ remaining = in_trans->size - resources->xferred_dma_size;
+ if (remaining == 0)
+- return 0;
++ return -EINVAL;
+
+ if (check_add_overflow(xfer_start_addr, remaining, &end))
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 5b7075c724d3bf0b41aeaa8402e9594a7a1bd1fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 775db3fc4959f..ec10270c2cce3 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
+--
+2.51.0
+
--- /dev/null
+From 33be0aa225e94ee72cf2dd80bef871d7c8ae0424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:16:45 +0800
+Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
+
+From: Jiaming Zhang <r772577952@gmail.com>
+
+[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
+
+In try_to_register_card(), the return value of usb_ifnum_to_if() is
+passed directly to usb_interface_claimed() without a NULL check, which
+will lead to a NULL pointer dereference when creating an invalid
+USB audio device. Fix this by adding a check to ensure the interface
+pointer is valid before passing it to usb_interface_claimed().
+
+Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration")
+Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/
+Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 10d9b72855970..557f53d10ecfb 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -850,10 +850,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)
+ */
+ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
+ {
++ struct usb_interface *iface;
++
+ if (check_delayed_register_option(chip) == ifnum ||
+- chip->last_iface == ifnum ||
+- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface)))
++ chip->last_iface == ifnum)
++ return snd_card_register(chip->card);
++
++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface);
++ if (iface && usb_interface_claimed(iface))
+ return snd_card_register(chip->card);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f54dfeae6e4b0f19c65313398416cc3dc1440c7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 2e9b95a94f89f..2ad672c17eec6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1065,7 +1065,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 1a37ec45e6502..7675bb98f0295 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1555,6 +1555,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From 055feb87ff350335bdd2b2b73fd7ede02c372010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 15:55:30 +0800
+Subject: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 5726b68473f7153a7f6294185e5998b7e2a230a2 ]
+
+devm_kasprintf() may return NULL on memory allocation failure,
+but the debug message prints cpus->dai_name before checking it.
+Move the dev_dbg() call after the NULL check to prevent potential
+NULL pointer dereference.
+
+Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver")
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-sdw-sof-mach.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/acp-sdw-sof-mach.c b/sound/soc/amd/acp/acp-sdw-sof-mach.c
+index 91d72d4bb9a26..d055582a3bf1a 100644
+--- a/sound/soc/amd/acp/acp-sdw-sof-mach.c
++++ b/sound/soc/amd/acp/acp-sdw-sof-mach.c
+@@ -176,9 +176,9 @@ static int create_sdw_dailink(struct snd_soc_card *card,
+ cpus->dai_name = devm_kasprintf(dev, GFP_KERNEL,
+ "SDW%d Pin%d",
+ link_num, cpu_pin_id);
+- dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name);
+ if (!cpus->dai_name)
+ return -ENOMEM;
++ dev_dbg(dev, "cpu->dai_name:%s\n", cpus->dai_name);
+
+ codec_maps[j].cpu = 0;
+ codec_maps[j].codec = j;
+--
+2.51.0
+
--- /dev/null
+From fcd4fa721f2cc00993dd4d1a48c5f8e3bd5ef449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 19:03:13 +0200
+Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ]
+
+The gain ranges specified in Renesas IDT821034 codec documentation
+are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the
+receive path (DAC). Allthough the registers allow programming values
+outside those ranges, the signal S/N and distorsion are only
+guaranteed in the specified ranges.
+
+Set ranges to the specified ones.
+
+Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/idt821034.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c
+index a03d4e5e7d144..cab2f2eecdfba 100644
+--- a/sound/soc/codecs/idt821034.c
++++ b/sound/soc/codecs/idt821034.c
+@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol,
+ return ret;
+ }
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306);
+-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */
+-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300);
++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */
++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */
+ #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029);
+-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/
+-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300);
++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */
++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */
+ #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */
+
+ static const struct snd_kcontrol_new idt821034_controls[] = {
+--
+2.51.0
+
--- /dev/null
+From ad1b4d0a957556a3a99984f75e495b0937064623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:26 +0300
+Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ]
+
+Stress testing the audio jack hotplug handling on a few Steam Deck units
+revealed that the debounce circuit is responsible for having a negative
+impact on the detection reliability, e.g. in some cases the ejection
+interrupt is not fired, while in other instances it goes into a kind of
+invalid state and generates a flood of misleading interrupts.
+
+Add new entries to the DMI table introduced via commit 1bc40efdaf4a
+("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect")
+and extend the quirk logic to allow bypassing the debounce circuit used
+for jack detection on Valve Steam Deck LCD and OLED models.
+
+While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to
+NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability
+by differentiating from similarly named register bits.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index 56e5a0d80782b..a8ff2ce70be9a 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -26,7 +26,8 @@
+ #include <sound/tlv.h>
+ #include "nau8821.h"
+
+-#define NAU8821_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1)
+
+ static int nau8821_quirk;
+ static int quirk_override = -1;
+@@ -1177,9 +1178,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2,
+ NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE);
+
+- /* Not bypass de-bounce circuit */
+- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+- NAU8821_JACK_DET_DB_BYPASS, 0);
++ /* Do not bypass de-bounce circuit */
++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS))
++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
++ NAU8821_JACK_DET_DB_BYPASS, 0);
+
+ /* Unmask & enable the ejection IRQs */
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+@@ -1864,7 +1866,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"),
+ },
+- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH),
++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Valve Steam Deck LCD */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
++ },
++ {
++ /* Valve Steam Deck OLED */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
+ },
+ {}
+ };
+@@ -1906,9 +1924,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)
+
+ nau8821_check_quirks();
+
+- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH)
++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH)
+ nau8821->jkdet_polarity = 0;
+
++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)
++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n");
++
+ nau8821_print_device_properties(nau8821);
+
+ nau8821_reset_chip(nau8821->regmap);
+--
+2.51.0
+
--- /dev/null
+From b043bc6cf8e21630bf5ed0753135422842aca81f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:23 +0300
+Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ]
+
+The microphone detection work scheduled by a prior jack insertion
+interrupt may still be in a pending state or under execution when a jack
+ejection interrupt has been fired.
+
+This might lead to a racing condition or nau8821_jdet_work() completing
+after nau8821_eject_jack(), which will override the currently
+disconnected state of the jack and incorrectly report the headphone or
+the headset as being connected.
+
+Cancel any pending jdet_work or wait for its execution to finish before
+attempting to handle the ejection interrupt.
+
+Proceed similarly before launching the eject handler as a consequence of
+detecting an invalid insert interrupt.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index edb95f869a4a6..fed5d51fa5c3b 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1185,6 +1185,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+
+ if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) ==
+ NAU8821_JACK_EJECT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+@@ -1199,11 +1200,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ clear_irq = NAU8821_KEY_RELEASE_IRQ;
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_EN);
+ if (nau8821_is_jack_inserted(regmap)) {
+ /* detect microphone and jack type */
+- cancel_work_sync(&nau8821->jdet_work);
+ schedule_work(&nau8821->jdet_work);
+ /* Turn off insertion interruption at manual mode */
+ regmap_update_bits(regmap,
+--
+2.51.0
+
--- /dev/null
+From b5a00ad10fd5ea3ce0db07cb5ceee7e934cdceef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:25 +0300
+Subject: ASoC: nau8821: Consistently clear interrupts before unmasking
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit a698679fe8b0fec41d1fb9547a53127a85c1be92 ]
+
+The interrupt handler attempts to perform some IRQ status clear
+operations *after* rather than *before* unmasking and enabling
+interrupts. This is a rather fragile approach since it may generally
+lead to missing IRQ requests or causing spurious interrupts.
+
+Make use of the nau8821_irq_status_clear() helper instead of
+manipulating the related register directly and ensure any interrupt
+clearing is performed *after* the target interrupts are disabled/masked
+and *before* proceeding with additional interrupt unmasking/enablement
+operations.
+
+This also implicitly drops the redundant clear operation of the ejection
+IRQ in the interrupt handler, since nau8821_eject_jack() has been
+already responsible for clearing all active interrupts.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Fixes: 2551b6e89936 ("ASoC: nau8821: Add headset button detection")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-3-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 58 ++++++++++++++++++++------------------
+ 1 file changed, 30 insertions(+), 28 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index cefce97893123..56e5a0d80782b 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1057,20 +1057,24 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ snd_soc_component_disable_pin(component, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
++ /* Disable & mask both insertion & ejection IRQs */
++ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL,
++ NAU8821_IRQ_INSERT_DIS | NAU8821_IRQ_EJECT_DIS,
++ NAU8821_IRQ_INSERT_DIS | NAU8821_IRQ_EJECT_DIS);
++ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
++ NAU8821_IRQ_INSERT_EN | NAU8821_IRQ_EJECT_EN,
++ NAU8821_IRQ_INSERT_EN | NAU8821_IRQ_EJECT_EN);
++
+ /* Clear all interruption status */
+ nau8821_irq_status_clear(regmap, 0);
+
+- /* Enable the insertion interruption, disable the ejection inter-
+- * ruption, and then bypass de-bounce circuit.
+- */
++ /* Enable & unmask the insertion IRQ */
+ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL,
+- NAU8821_IRQ_EJECT_DIS | NAU8821_IRQ_INSERT_DIS,
+- NAU8821_IRQ_EJECT_DIS);
+- /* Mask unneeded IRQs: 1 - disable, 0 - enable */
++ NAU8821_IRQ_INSERT_DIS, 0);
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+- NAU8821_IRQ_EJECT_EN | NAU8821_IRQ_INSERT_EN,
+- NAU8821_IRQ_EJECT_EN);
++ NAU8821_IRQ_INSERT_EN, 0);
+
++ /* Bypass de-bounce circuit */
+ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+ NAU8821_JACK_DET_DB_BYPASS, NAU8821_JACK_DET_DB_BYPASS);
+
+@@ -1094,7 +1098,6 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ NAU8821_IRQ_KEY_RELEASE_DIS |
+ NAU8821_IRQ_KEY_PRESS_DIS);
+ }
+-
+ }
+
+ static void nau8821_jdet_work(struct work_struct *work)
+@@ -1151,6 +1154,15 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ {
+ struct regmap *regmap = nau8821->regmap;
+
++ /* Disable & mask insertion IRQ */
++ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL,
++ NAU8821_IRQ_INSERT_DIS, NAU8821_IRQ_INSERT_DIS);
++ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
++ NAU8821_IRQ_INSERT_EN, NAU8821_IRQ_INSERT_EN);
++
++ /* Clear insert IRQ status */
++ nau8821_irq_status_clear(regmap, NAU8821_JACK_INSERT_DETECTED);
++
+ /* Enable internal VCO needed for interruptions */
+ if (nau8821->dapm->bias_level < SND_SOC_BIAS_PREPARE)
+ nau8821_configure_sysclk(nau8821, NAU8821_CLK_INTERNAL, 0);
+@@ -1169,17 +1181,18 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+ NAU8821_JACK_DET_DB_BYPASS, 0);
+
++ /* Unmask & enable the ejection IRQs */
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+- NAU8821_IRQ_EJECT_EN, 0);
++ NAU8821_IRQ_EJECT_EN, 0);
+ regmap_update_bits(regmap, NAU8821_R12_INTERRUPT_DIS_CTRL,
+- NAU8821_IRQ_EJECT_DIS, 0);
++ NAU8821_IRQ_EJECT_DIS, 0);
+ }
+
+ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ {
+ struct nau8821 *nau8821 = (struct nau8821 *)data;
+ struct regmap *regmap = nau8821->regmap;
+- int active_irq, clear_irq = 0, event = 0, event_mask = 0;
++ int active_irq, event = 0, event_mask = 0;
+
+ if (regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq)) {
+ dev_err(nau8821->dev, "failed to read irq status\n");
+@@ -1195,14 +1208,13 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+ event_mask |= SND_JACK_HEADSET;
+- clear_irq = NAU8821_JACK_EJECT_IRQ_MASK;
+ } else if (active_irq & NAU8821_KEY_SHORT_PRESS_IRQ) {
+ event |= NAU8821_BUTTON;
+ event_mask |= NAU8821_BUTTON;
+- clear_irq = NAU8821_KEY_SHORT_PRESS_IRQ;
++ nau8821_irq_status_clear(regmap, NAU8821_KEY_SHORT_PRESS_IRQ);
+ } else if (active_irq & NAU8821_KEY_RELEASE_IRQ) {
+ event_mask = NAU8821_BUTTON;
+- clear_irq = NAU8821_KEY_RELEASE_IRQ;
++ nau8821_irq_status_clear(regmap, NAU8821_KEY_RELEASE_IRQ);
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
+ cancel_work_sync(&nau8821->jdet_work);
+@@ -1212,27 +1224,17 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ /* detect microphone and jack type */
+ schedule_work(&nau8821->jdet_work);
+ /* Turn off insertion interruption at manual mode */
+- regmap_update_bits(regmap,
+- NAU8821_R12_INTERRUPT_DIS_CTRL,
+- NAU8821_IRQ_INSERT_DIS,
+- NAU8821_IRQ_INSERT_DIS);
+- regmap_update_bits(regmap,
+- NAU8821_R0F_INTERRUPT_MASK,
+- NAU8821_IRQ_INSERT_EN,
+- NAU8821_IRQ_INSERT_EN);
+ nau8821_setup_inserted_irq(nau8821);
+ } else {
+ dev_warn(nau8821->dev,
+ "Inserted IRQ fired but not connected\n");
+ nau8821_eject_jack(nau8821);
+ }
++ } else {
++ /* Clear the rightmost interrupt */
++ nau8821_irq_status_clear(regmap, active_irq);
+ }
+
+- if (!clear_irq)
+- clear_irq = active_irq;
+- /* clears the rightmost interruption */
+- regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, clear_irq);
+-
+ if (event_mask)
+ snd_soc_jack_report(nau8821->jack, event, event_mask);
+
+--
+2.51.0
+
--- /dev/null
+From c9a6e722d65669044b6bab930fd371db58015456 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:24 +0300
+Subject: ASoC: nau8821: Generalize helper to clear IRQ status
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ]
+
+Instead of adding yet another utility function for dealing with the
+interrupt clearing register, generalize nau8821_int_status_clear_all()
+by renaming it to nau8821_irq_status_clear(), whilst introducing a
+second parameter to allow restricting the operation scope to a single
+interrupt instead of the whole range of active IRQs.
+
+While at it, also fix a spelling typo in the comment block.
+
+Note this is mainly a prerequisite for subsequent patches aiming to
+address some deficiencies in the implementation of the interrupt
+handler. Thus the presence of the Fixes tag below is intentional, to
+facilitate backporting.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index fed5d51fa5c3b..cefce97893123 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1021,12 +1021,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap)
+ return active_high == is_high;
+ }
+
+-static void nau8821_int_status_clear_all(struct regmap *regmap)
++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq)
+ {
+- int active_irq, clear_irq, i;
++ int clear_irq, i;
+
+- /* Reset the intrruption status from rightmost bit if the corres-
+- * ponding irq event occurs.
++ if (active_irq) {
++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq);
++ return;
++ }
++
++ /* Reset the interruption status from rightmost bit if the
++ * corresponding irq event occurs.
+ */
+ regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq);
+ for (i = 0; i < NAU8821_REG_DATA_LEN; i++) {
+@@ -1053,7 +1058,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ snd_soc_dapm_sync(dapm);
+
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable the insertion interruption, disable the ejection inter-
+ * ruption, and then bypass de-bounce circuit.
+@@ -1522,7 +1527,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821)
+ nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0);
+ if (nau8821->irq) {
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable both insertion and ejection interruptions, and then
+ * bypass de-bounce circuit.
+--
+2.51.0
+
--- /dev/null
+From d876c5f1c159cde8dc165572ebeae10c2266b1a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 09:48:27 +0800
+Subject: blk-mq: fix stale tag depth for shared sched tags in
+ blk_mq_update_nr_requests()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit dc96cefef0d3032c69e46a21b345c60e56b18934 ]
+
+Commit 7f2799c546db ("blk-mq: cleanup shared tags case in
+blk_mq_update_nr_requests()") moves blk_mq_tag_update_sched_shared_tags()
+before q->nr_requests is updated, however, it's still using the old
+q->nr_requests to resize tag depth.
+
+Fix this problem by passing in expected new tag depth.
+
+Fixes: 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reported-by: Chris Mason <clm@meta.com>
+Link: https://lore.kernel.org/linux-block/20251014130507.4187235-2-clm@meta.com/
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sched.c | 2 +-
+ block/blk-mq-tag.c | 5 +++--
+ block/blk-mq.c | 2 +-
+ block/blk-mq.h | 3 ++-
+ 4 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index d06bb137a7437..e0bed16485c34 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -557,7 +557,7 @@ int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e,
+ if (blk_mq_is_shared_tags(flags)) {
+ /* Shared tags are stored at index 0 in @et->tags. */
+ q->sched_shared_tags = et->tags[0];
+- blk_mq_tag_update_sched_shared_tags(q);
++ blk_mq_tag_update_sched_shared_tags(q, et->nr_requests);
+ }
+
+ queue_for_each_hw_ctx(q, hctx, i) {
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index aed84c5d5c2b2..12f48e7a0f774 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -622,10 +622,11 @@ void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, unsigned int size
+ sbitmap_queue_resize(&tags->bitmap_tags, size - set->reserved_tags);
+ }
+
+-void blk_mq_tag_update_sched_shared_tags(struct request_queue *q)
++void blk_mq_tag_update_sched_shared_tags(struct request_queue *q,
++ unsigned int nr)
+ {
+ sbitmap_queue_resize(&q->sched_shared_tags->bitmap_tags,
+- q->nr_requests - q->tag_set->reserved_tags);
++ nr - q->tag_set->reserved_tags);
+ }
+
+ /**
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index f8a8a23b90402..19f62b070ca9d 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4942,7 +4942,7 @@ struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,
+ * tags can't grow, see blk_mq_alloc_sched_tags().
+ */
+ if (q->elevator)
+- blk_mq_tag_update_sched_shared_tags(q);
++ blk_mq_tag_update_sched_shared_tags(q, nr);
+ else
+ blk_mq_tag_resize_shared_tags(set, nr);
+ } else if (!q->elevator) {
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 6c9d03625ba12..2fdc8eeb40040 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -188,7 +188,8 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
+ struct blk_mq_tags **tags, unsigned int depth);
+ void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set,
+ unsigned int size);
+-void blk_mq_tag_update_sched_shared_tags(struct request_queue *q);
++void blk_mq_tag_update_sched_shared_tags(struct request_queue *q,
++ unsigned int nr);
+
+ void blk_mq_tag_wakeup_all(struct blk_mq_tags *tags, bool);
+ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_tag_iter_fn *fn,
+--
+2.51.0
+
--- /dev/null
+From 03d679d784a116012e4b8df3590511be2d0170c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 18:30:39 +0800
+Subject: block: Remove elevator_lock usage from blkg_conf frozen operations
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 08823e89e3e269bf4c4a20b4c24a8119920cc7a4 ]
+
+Remove the acquisition and release of q->elevator_lock in the
+blkg_conf_open_bdev_frozen() and blkg_conf_exit_frozen() functions. The
+elevator lock is no longer needed in these code paths since commit
+78c271344b6f ("block: move wbt_enable_default() out of queue freezing
+from sched ->exit()") which introduces `disk->rqos_state_mutex` for
+protecting wbt state change, and not necessary to abuse elevator_lock
+for this purpose.
+
+This change helps to solve the lockdep warning reported from Yu Kuai[1].
+
+Pass blktests/throtl with lockdep enabled.
+
+Links: https://lore.kernel.org/linux-block/e5e7ac3f-2063-473a-aafb-4d8d43e5576e@yukuai.org.cn/ [1]
+Fixes: commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 7246fc2563152..091e9623bc294 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -812,8 +812,7 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx)
+ }
+ /*
+ * Similar to blkg_conf_open_bdev, but additionally freezes the queue,
+- * acquires q->elevator_lock, and ensures the correct locking order
+- * between q->elevator_lock and q->rq_qos_mutex.
++ * ensures the correct locking order between freeze queue and q->rq_qos_mutex.
+ *
+ * This function returns negative error on failure. On success it returns
+ * memflags which must be saved and later passed to blkg_conf_exit_frozen
+@@ -834,13 +833,11 @@ unsigned long __must_check blkg_conf_open_bdev_frozen(struct blkg_conf_ctx *ctx)
+ * At this point, we haven’t started protecting anything related to QoS,
+ * so we release q->rq_qos_mutex here, which was first acquired in blkg_
+ * conf_open_bdev. Later, we re-acquire q->rq_qos_mutex after freezing
+- * the queue and acquiring q->elevator_lock to maintain the correct
+- * locking order.
++ * the queue to maintain the correct locking order.
+ */
+ mutex_unlock(&ctx->bdev->bd_queue->rq_qos_mutex);
+
+ memflags = blk_mq_freeze_queue(ctx->bdev->bd_queue);
+- mutex_lock(&ctx->bdev->bd_queue->elevator_lock);
+ mutex_lock(&ctx->bdev->bd_queue->rq_qos_mutex);
+
+ return memflags;
+@@ -1002,9 +999,8 @@ void blkg_conf_exit(struct blkg_conf_ctx *ctx)
+ EXPORT_SYMBOL_GPL(blkg_conf_exit);
+
+ /*
+- * Similar to blkg_conf_exit, but also unfreezes the queue and releases
+- * q->elevator_lock. Should be used when blkg_conf_open_bdev_frozen
+- * is used to open the bdev.
++ * Similar to blkg_conf_exit, but also unfreezes the queue. Should be used
++ * when blkg_conf_open_bdev_frozen is used to open the bdev.
+ */
+ void blkg_conf_exit_frozen(struct blkg_conf_ctx *ctx, unsigned long memflags)
+ {
+@@ -1012,7 +1008,6 @@ void blkg_conf_exit_frozen(struct blkg_conf_ctx *ctx, unsigned long memflags)
+ struct request_queue *q = ctx->bdev->bd_queue;
+
+ blkg_conf_exit(ctx);
+- mutex_unlock(&q->elevator_lock);
+ blk_mq_unfreeze_queue(q, memflags);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From d8613170af5bce5e9bfc2d9856792c48dc330ba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 21:11:16 +0900
+Subject: can: j1939: add missing calls in NETDEV_UNREGISTER notification
+ handler
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 93a27b5891b8194a8c083c9a80d2141d4bf47ba8 ]
+
+Currently NETDEV_UNREGISTER event handler is not calling
+j1939_cancel_active_session() and j1939_sk_queue_drop_all().
+This will result in these calls being skipped when j1939_sk_release() is
+called. And I guess that the reason syzbot is still reporting
+
+ unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
+
+is caused by lack of these calls.
+
+Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can
+be covered by calling j1939_cancel_active_session(priv, NULL) from
+j1939_netdev_notify().
+
+Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered
+by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify().
+
+Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and
+j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler.
+
+Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/3ad3c7f8-5a74-4b07-a193-cb0725823558@I-love.SAKURA.ne.jp
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/j1939/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
+index 3706a872ecafd..a93af55df5fd5 100644
+--- a/net/can/j1939/main.c
++++ b/net/can/j1939/main.c
+@@ -378,6 +378,8 @@ static int j1939_netdev_notify(struct notifier_block *nb,
+ j1939_ecu_unmap_all(priv);
+ break;
+ case NETDEV_UNREGISTER:
++ j1939_cancel_active_session(priv, NULL);
++ j1939_sk_netdev_event_netdown(priv);
+ j1939_sk_netdev_event_unregister(priv);
+ break;
+ }
+--
+2.51.0
+
--- /dev/null
+From aade88b12113b6a01bf3a2a596ad570076ea352c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:58:31 +0200
+Subject: can: m_can: fix CAN state in system PM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a9e30a22d6f23a2684c248871cad4c3061181639 ]
+
+A suspend/resume cycle on a down interface results in the interface
+coming up in Error Active state. A suspend/resume cycle on an Up
+interface will always result in Error Active state, regardless of the
+actual CAN state.
+
+During suspend, only set running interfaces to CAN_STATE_SLEEPING.
+During resume only touch the CAN state of running interfaces. For
+wakeup sources, set the CAN state depending on the Protocol Status
+Regitser (PSR), for non wakeup source interfaces m_can_start() will do
+the same.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 9eafd135fcb43..c82ea6043d408 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -2505,12 +2505,11 @@ int m_can_class_suspend(struct device *dev)
+ }
+
+ m_can_clk_stop(cdev);
++ cdev->can.state = CAN_STATE_SLEEPING;
+ }
+
+ pinctrl_pm_select_sleep_state(dev);
+
+- cdev->can.state = CAN_STATE_SLEEPING;
+-
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_suspend);
+@@ -2523,8 +2522,6 @@ int m_can_class_resume(struct device *dev)
+
+ pinctrl_pm_select_default_state(dev);
+
+- cdev->can.state = CAN_STATE_ERROR_ACTIVE;
+-
+ if (netif_running(ndev)) {
+ ret = m_can_clk_start(cdev);
+ if (ret)
+@@ -2542,6 +2539,8 @@ int m_can_class_resume(struct device *dev)
+ if (cdev->ops->init)
+ ret = cdev->ops->init(cdev);
+
++ cdev->can.state = m_can_state_get_by_psr(cdev);
++
+ m_can_write(cdev, M_CAN_IE, cdev->active_interrupts);
+ } else {
+ ret = m_can_start(ndev);
+--
+2.51.0
+
--- /dev/null
+From 33c07d78928d664bab3601214fc965301f1eeace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 18:24:12 +0200
+Subject: can: m_can: m_can_chip_config(): bring up interface in correct state
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 ]
+
+In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the
+CAN state and CAN error counters over an internal reset cycle. An
+external reset is not always possible, due to the shared reset with
+the other CAN core. This caused the core not always be in Error Active
+state when bringing up the controller.
+
+Instead of always setting the CAN state to Error Active in
+m_can_chip_config(), fix this by reading and decoding the Protocol
+Status Regitser (PSR) and set the CAN state accordingly.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 4826b8dcad0f7..9eafd135fcb43 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1617,7 +1617,7 @@ static int m_can_start(struct net_device *dev)
+ netdev_queue_set_dql_min_limit(netdev_get_tx_queue(cdev->net, 0),
+ cdev->tx_max_coalesced_frames);
+
+- cdev->can.state = CAN_STATE_ERROR_ACTIVE;
++ cdev->can.state = m_can_state_get_by_psr(cdev);
+
+ m_can_enable_all_interrupts(cdev);
+
+--
+2.51.0
+
--- /dev/null
+From 6e1e453c1bc3d8541ad46f8b9c9da3d52a2b71f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:56:15 +0200
+Subject: can: m_can: m_can_handle_state_errors(): fix CAN state transition to
+ Error Active
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 3d9db29b45f970d81acf61cf91a65442efbeb997 ]
+
+The CAN Error State is determined by the receive and transmit error
+counters. The CAN error counters decrease when reception/transmission
+is successful, so that a status transition back to the Error Active
+status is possible. This transition is not handled by
+m_can_handle_state_errors().
+
+Add the missing detection of the Error Active state to
+m_can_handle_state_errors() and extend the handling of this state in
+m_can_handle_state_change().
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 53 +++++++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index fe74dbd2c9663..4826b8dcad0f7 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -812,6 +812,9 @@ static int m_can_handle_state_change(struct net_device *dev,
+ u32 timestamp = 0;
+
+ switch (new_state) {
++ case CAN_STATE_ERROR_ACTIVE:
++ cdev->can.state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cdev->can.can_stats.error_warning++;
+@@ -841,6 +844,12 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ cf->data[6] = bec.txerr;
++ cf->data[7] = bec.rxerr;
++ break;
+ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL | CAN_ERR_CNT;
+@@ -877,30 +886,33 @@ static int m_can_handle_state_change(struct net_device *dev,
+ return 1;
+ }
+
+-static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
++static enum can_state
++m_can_state_get_by_psr(struct m_can_classdev *cdev)
+ {
+- struct m_can_classdev *cdev = netdev_priv(dev);
+- int work_done = 0;
++ u32 reg_psr;
+
+- if (psr & PSR_EW && cdev->can.state != CAN_STATE_ERROR_WARNING) {
+- netdev_dbg(dev, "entered error warning state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_ERROR_WARNING);
+- }
++ reg_psr = m_can_read(cdev, M_CAN_PSR);
+
+- if (psr & PSR_EP && cdev->can.state != CAN_STATE_ERROR_PASSIVE) {
+- netdev_dbg(dev, "entered error passive state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_ERROR_PASSIVE);
+- }
++ if (reg_psr & PSR_BO)
++ return CAN_STATE_BUS_OFF;
++ if (reg_psr & PSR_EP)
++ return CAN_STATE_ERROR_PASSIVE;
++ if (reg_psr & PSR_EW)
++ return CAN_STATE_ERROR_WARNING;
+
+- if (psr & PSR_BO && cdev->can.state != CAN_STATE_BUS_OFF) {
+- netdev_dbg(dev, "entered error bus off state\n");
+- work_done += m_can_handle_state_change(dev,
+- CAN_STATE_BUS_OFF);
+- }
++ return CAN_STATE_ERROR_ACTIVE;
++}
+
+- return work_done;
++static int m_can_handle_state_errors(struct net_device *dev)
++{
++ struct m_can_classdev *cdev = netdev_priv(dev);
++ enum can_state new_state;
++
++ new_state = m_can_state_get_by_psr(cdev);
++ if (new_state == cdev->can.state)
++ return 0;
++
++ return m_can_handle_state_change(dev, new_state);
+ }
+
+ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
+@@ -1031,8 +1043,7 @@ static int m_can_rx_handler(struct net_device *dev, int quota, u32 irqstatus)
+ }
+
+ if (irqstatus & IR_ERR_STATE)
+- work_done += m_can_handle_state_errors(dev,
+- m_can_read(cdev, M_CAN_PSR));
++ work_done += m_can_handle_state_errors(dev);
+
+ if (irqstatus & IR_ERR_BUS_30X)
+ work_done += m_can_handle_bus_errors(dev, irqstatus,
+--
+2.51.0
+
--- /dev/null
+From 7e9eb893d8e44518730890281110a34ac6baa659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 17:46:32 +0200
+Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
+
+Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to
+m_can_platform") moved the PM runtime enable from the m_can core
+driver into the m_can_platform.
+
+That patch forgot to move the pm_runtime_disable() to
+m_can_plat_remove(), so that unloading the m_can_platform driver
+causes an "Unbalanced pm_runtime_enable!" error message.
+
+Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the
+problem.
+
+Cc: Patrik Flykt <patrik.flykt@linux.intel.com>
+Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index b832566efda04..057eaa7b8b4b2 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -180,7 +180,7 @@ static void m_can_plat_remove(struct platform_device *pdev)
+ struct m_can_classdev *mcan_class = &priv->cdev;
+
+ m_can_class_unregister(mcan_class);
+-
++ pm_runtime_disable(mcan_class->dev);
+ m_can_class_free_dev(mcan_class->net);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2e85077725a435c635caaa2b93ad65c73b3d64c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 11:32:42 +0200
+Subject: coredump: fix core_pattern input validation
+
+From: Christian Brauner <brauner@kernel.org>
+
+[ Upstream commit a779e27f24aeb679969ddd1fdd7f636e22ddbc1e ]
+
+In be1e0283021e ("coredump: don't pointlessly check and spew warnings")
+we tried to fix input validation so it only happens during a write to
+core_pattern. This would avoid needlessly logging a lot of warnings
+during a read operation. However the logic accidently got inverted in
+this commit. Fix it so the input validation only happens on write and is
+skipped on read.
+
+Fixes: be1e0283021e ("coredump: don't pointlessly check and spew warnings")
+Fixes: 16195d2c7dd2 ("coredump: validate socket name as it is written")
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: Yu Watanabe <watanabe.yu@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/coredump.c | 2 +-
+ fs/exec.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 60bc9685e1498..c5e9a855502dd 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -1466,7 +1466,7 @@ static int proc_dostring_coredump(const struct ctl_table *table, int write,
+ ssize_t retval;
+ char old_core_pattern[CORENAME_MAX_SIZE];
+
+- if (write)
++ if (!write)
+ return proc_dostring(table, write, buffer, lenp, ppos);
+
+ retval = strscpy(old_core_pattern, core_pattern, CORENAME_MAX_SIZE);
+diff --git a/fs/exec.c b/fs/exec.c
+index e861a4b7ffda9..a69a2673f6311 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -2048,7 +2048,7 @@ static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int writ
+ {
+ int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+
+- if (!error && !write)
++ if (!error && write)
+ validate_coredump_safety();
+ return error;
+ }
+--
+2.51.0
+
--- /dev/null
+From 22af17f6041330546776e23b0ec9feb3b85ce7bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 08:40:01 -0700
+Subject: cxl/features: Add check for no entries in cxl_feature_info
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e ]
+
+cxl EDAC calls cxl_feature_info() to get the feature information and
+if the hardware has no Features support, cxlfs may be passed in as
+NULL.
+
+[ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008
+[ 51.965571] #PF: supervisor read access in kernel mode
+[ 51.971559] #PF: error_code(0x0000) - not-present page
+[ 51.977542] PGD 17e4f6067 P4D 0
+[ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI
+[ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj
+test+ #64 PREEMPT(voluntary)
+[ 51.997355] Hardware name: <removed>
+[ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]
+
+Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if
+there is no cxlfs created due to no hardware support.
+
+Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature")
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/features.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
+index 7c750599ea690..4bc484b46f439 100644
+--- a/drivers/cxl/core/features.c
++++ b/drivers/cxl/core/features.c
+@@ -371,6 +371,9 @@ cxl_feature_info(struct cxl_features_state *cxlfs,
+ {
+ struct cxl_feat_entry *feat;
+
++ if (!cxlfs || !cxlfs->entries)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ for (int i = 0; i < cxlfs->entries->num_features; i++) {
+ feat = &cxlfs->entries->ent[i];
+ if (uuid_equal(uuid, &feat->uuid))
+--
+2.51.0
+
--- /dev/null
+From af695e4787e74b1e14855828b8e3c4a5b11276d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 14:38:49 -0700
+Subject: cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+[ Upstream commit a4bbb493a3247ef32f6191fd8b2a0657139f8e08 ]
+
+Traces of cxl_poison events include an hpa_alias0 field if the poison
+address is in a region configured with an ELC, Extended Linear Cache.
+
+Since the ELC always comes first in the region, the calculation needs
+to subtract the ELC size from the calculated HPA address.
+
+Fixes: 8c520c5f1e76 ("cxl: Add extended linear cache address alias emission for cxl events")
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h
+index a53ec4798b12f..a972e4ef19368 100644
+--- a/drivers/cxl/core/trace.h
++++ b/drivers/cxl/core/trace.h
+@@ -1068,7 +1068,7 @@ TRACE_EVENT(cxl_poison,
+ __entry->hpa = cxl_dpa_to_hpa(cxlr, cxlmd,
+ __entry->dpa);
+ if (__entry->hpa != ULLONG_MAX && cxlr->params.cache_size)
+- __entry->hpa_alias0 = __entry->hpa +
++ __entry->hpa_alias0 = __entry->hpa -
+ cxlr->params.cache_size;
+ else
+ __entry->hpa_alias0 = ULLONG_MAX;
+--
+2.51.0
+
--- /dev/null
+From d4738c7d4eb54d0083b11b40968f82fd00188a80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 20ecf652c129d..260e063e3bc2d 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1752,7 +1752,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e15706936fd76d66e2be260f39590fba1a671ed9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:18:59 +0200
+Subject: doc: fix seg6_flowlabel path
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
+
+This sysctl is not per interface; it's global per netns.
+
+Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst")
+Reported-by: Philippe Guibert <philippe.guibert@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/seg6-sysctl.rst | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst
+index 07c20e470bafe..1b6af4779be11 100644
+--- a/Documentation/networking/seg6-sysctl.rst
++++ b/Documentation/networking/seg6-sysctl.rst
+@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER
+
+ Default is 0.
+
++/proc/sys/net/ipv6/seg6_* variables:
++====================================
++
+ seg6_flowlabel - INTEGER
+ Controls the behaviour of computing the flowlabel of outer
+ IPv6 header in case of SR T.encaps
+--
+2.51.0
+
--- /dev/null
+From b64e18706404f7181e804092bf8ce473b0e13f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 16:14:45 +0200
+Subject: dpll: zl3073x: Handle missing or corrupted flash configuration
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+[ Upstream commit fcb8b32a68fd40b0440cb9468cf6f6ab9de9f3c5 ]
+
+If the internal flash contains missing or corrupted configuration,
+basic communication over the bus still functions, but the device
+is not capable of normal operation (for example, using mailboxes).
+
+This condition is indicated in the info register by the ready bit.
+If this bit is cleared, the probe procedure times out while fetching
+the device state.
+
+Handle this case by checking the ready bit value in zl3073x_dev_start()
+and skipping DPLL device and pin registration if it is cleared.
+Do not report this condition as an error, allowing the devlink device
+to be registered and enabling the user to flash the correct configuration.
+
+Prior this patch:
+[ 31.112299] zl3073x-i2c 1-0070: Failed to fetch input state: -ETIMEDOUT
+[ 31.116332] zl3073x-i2c 1-0070: error -ETIMEDOUT: Failed to start device
+[ 31.136881] zl3073x-i2c 1-0070: probe with driver zl3073x-i2c failed with error -110
+
+After this patch:
+[ 41.011438] zl3073x-i2c 1-0070: FW not fully ready - missing or corrupted config
+
+Fixes: 75a71ecc24125 ("dpll: zl3073x: Register DPLL devices and pins")
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20251008141445.841113-1-ivecera@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dpll/zl3073x/core.c | 21 +++++++++++++++++++++
+ drivers/dpll/zl3073x/regs.h | 3 +++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c
+index 0df210cec08da..59c75b470efbf 100644
+--- a/drivers/dpll/zl3073x/core.c
++++ b/drivers/dpll/zl3073x/core.c
+@@ -864,8 +864,29 @@ zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev)
+ int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full)
+ {
+ struct zl3073x_dpll *zldpll;
++ u8 info;
+ int rc;
+
++ rc = zl3073x_read_u8(zldev, ZL_REG_INFO, &info);
++ if (rc) {
++ dev_err(zldev->dev, "Failed to read device status info\n");
++ return rc;
++ }
++
++ if (!FIELD_GET(ZL_INFO_READY, info)) {
++ /* The ready bit indicates that the firmware was successfully
++ * configured and is ready for normal operation. If it is
++ * cleared then the configuration stored in flash is wrong
++ * or missing. In this situation the driver will expose
++ * only devlink interface to give an opportunity to flash
++ * the correct config.
++ */
++ dev_info(zldev->dev,
++ "FW not fully ready - missing or corrupted config\n");
++
++ return 0;
++ }
++
+ if (full) {
+ /* Fetch device state */
+ rc = zl3073x_dev_state_fetch(zldev);
+diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h
+index 614e33128a5c9..bb9965b8e8c75 100644
+--- a/drivers/dpll/zl3073x/regs.h
++++ b/drivers/dpll/zl3073x/regs.h
+@@ -67,6 +67,9 @@
+ * Register Page 0, General
+ **************************/
+
++#define ZL_REG_INFO ZL_REG(0, 0x00, 1)
++#define ZL_INFO_READY BIT(7)
++
+ #define ZL_REG_ID ZL_REG(0, 0x01, 2)
+ #define ZL_REG_REVISION ZL_REG(0, 0x03, 2)
+ #define ZL_REG_FW_VER ZL_REG(0, 0x05, 2)
+--
+2.51.0
+
--- /dev/null
+From 9ae1b53123cf537f0bac74e70cc55905dcde7995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:15:31 +0200
+Subject: dpll: zl3073x: Refactor DPLL initialization
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+[ Upstream commit ebb1031c51377829b21e1c58e8eccc479e4921b7 ]
+
+Refactor DPLL initialization and move DPLL (de)registration, monitoring
+control, fetching device invariant parameters and phase offset
+measurement block setup to separate functions.
+
+Use these new functions during device probe and teardown functions and
+during changes to the clock_id devlink parameter.
+
+These functions will also be used in the next patch implementing devlink
+flash, where this functionality is likewise required.
+
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Link: https://patch.msgid.link/20250909091532.11790-5-ivecera@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: fcb8b32a68fd ("dpll: zl3073x: Handle missing or corrupted flash configuration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dpll/zl3073x/core.c | 207 +++++++++++++++++++++------------
+ drivers/dpll/zl3073x/core.h | 3 +
+ drivers/dpll/zl3073x/devlink.c | 18 +--
+ 3 files changed, 142 insertions(+), 86 deletions(-)
+
+diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c
+index 7ebcfc5ec1f09..0df210cec08da 100644
+--- a/drivers/dpll/zl3073x/core.c
++++ b/drivers/dpll/zl3073x/core.c
+@@ -809,21 +809,142 @@ zl3073x_dev_periodic_work(struct kthread_work *work)
+ msecs_to_jiffies(500));
+ }
+
++/**
++ * zl3073x_dev_phase_meas_setup - setup phase offset measurement
++ * @zldev: pointer to zl3073x_dev structure
++ *
++ * Enable phase offset measurement block, set measurement averaging factor
++ * and enable DPLL-to-its-ref phase measurement for all DPLLs.
++ *
++ * Returns: 0 on success, <0 on error
++ */
++static int
++zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev)
++{
++ struct zl3073x_dpll *zldpll;
++ u8 dpll_meas_ctrl, mask = 0;
++ int rc;
++
++ /* Read DPLL phase measurement control register */
++ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, &dpll_meas_ctrl);
++ if (rc)
++ return rc;
++
++ /* Setup phase measurement averaging factor */
++ dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR;
++ dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, 3);
++
++ /* Enable DPLL measurement block */
++ dpll_meas_ctrl |= ZL_DPLL_MEAS_CTRL_EN;
++
++ /* Update phase measurement control register */
++ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl);
++ if (rc)
++ return rc;
++
++ /* Enable DPLL-to-connected-ref measurement for each channel */
++ list_for_each_entry(zldpll, &zldev->dplls, list)
++ mask |= BIT(zldpll->id);
++
++ return zl3073x_write_u8(zldev, ZL_REG_DPLL_PHASE_ERR_READ_MASK, mask);
++}
++
++/**
++ * zl3073x_dev_start - Start normal operation
++ * @zldev: zl3073x device pointer
++ * @full: perform full initialization
++ *
++ * The function starts normal operation, which means registering all DPLLs and
++ * their pins, and starting monitoring. If full initialization is requested,
++ * the function additionally initializes the phase offset measurement block and
++ * fetches hardware-invariant parameters.
++ *
++ * Return: 0 on success, <0 on error
++ */
++int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full)
++{
++ struct zl3073x_dpll *zldpll;
++ int rc;
++
++ if (full) {
++ /* Fetch device state */
++ rc = zl3073x_dev_state_fetch(zldev);
++ if (rc)
++ return rc;
++
++ /* Setup phase offset measurement block */
++ rc = zl3073x_dev_phase_meas_setup(zldev);
++ if (rc) {
++ dev_err(zldev->dev,
++ "Failed to setup phase measurement\n");
++ return rc;
++ }
++ }
++
++ /* Register all DPLLs */
++ list_for_each_entry(zldpll, &zldev->dplls, list) {
++ rc = zl3073x_dpll_register(zldpll);
++ if (rc) {
++ dev_err_probe(zldev->dev, rc,
++ "Failed to register DPLL%u\n",
++ zldpll->id);
++ return rc;
++ }
++ }
++
++ /* Perform initial firmware fine phase correction */
++ rc = zl3073x_dpll_init_fine_phase_adjust(zldev);
++ if (rc) {
++ dev_err_probe(zldev->dev, rc,
++ "Failed to init fine phase correction\n");
++ return rc;
++ }
++
++ /* Start monitoring */
++ kthread_queue_delayed_work(zldev->kworker, &zldev->work, 0);
++
++ return 0;
++}
++
++/**
++ * zl3073x_dev_stop - Stop normal operation
++ * @zldev: zl3073x device pointer
++ *
++ * The function stops the normal operation that mean deregistration of all
++ * DPLLs and their pins and stop monitoring.
++ *
++ * Return: 0 on success, <0 on error
++ */
++void zl3073x_dev_stop(struct zl3073x_dev *zldev)
++{
++ struct zl3073x_dpll *zldpll;
++
++ /* Stop monitoring */
++ kthread_cancel_delayed_work_sync(&zldev->work);
++
++ /* Unregister all DPLLs */
++ list_for_each_entry(zldpll, &zldev->dplls, list) {
++ if (zldpll->dpll_dev)
++ zl3073x_dpll_unregister(zldpll);
++ }
++}
++
+ static void zl3073x_dev_dpll_fini(void *ptr)
+ {
+ struct zl3073x_dpll *zldpll, *next;
+ struct zl3073x_dev *zldev = ptr;
+
+- /* Stop monitoring thread */
++ /* Stop monitoring and unregister DPLLs */
++ zl3073x_dev_stop(zldev);
++
++ /* Destroy monitoring thread */
+ if (zldev->kworker) {
+- kthread_cancel_delayed_work_sync(&zldev->work);
+ kthread_destroy_worker(zldev->kworker);
+ zldev->kworker = NULL;
+ }
+
+- /* Release DPLLs */
++ /* Free all DPLLs */
+ list_for_each_entry_safe(zldpll, next, &zldev->dplls, list) {
+- zl3073x_dpll_unregister(zldpll);
+ list_del(&zldpll->list);
+ zl3073x_dpll_free(zldpll);
+ }
+@@ -839,7 +960,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)
+
+ INIT_LIST_HEAD(&zldev->dplls);
+
+- /* Initialize all DPLLs */
++ /* Allocate all DPLLs */
+ for (i = 0; i < num_dplls; i++) {
+ zldpll = zl3073x_dpll_alloc(zldev, i);
+ if (IS_ERR(zldpll)) {
+@@ -849,25 +970,9 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)
+ goto error;
+ }
+
+- rc = zl3073x_dpll_register(zldpll);
+- if (rc) {
+- dev_err_probe(zldev->dev, rc,
+- "Failed to register DPLL%u\n", i);
+- zl3073x_dpll_free(zldpll);
+- goto error;
+- }
+-
+ list_add_tail(&zldpll->list, &zldev->dplls);
+ }
+
+- /* Perform initial firmware fine phase correction */
+- rc = zl3073x_dpll_init_fine_phase_adjust(zldev);
+- if (rc) {
+- dev_err_probe(zldev->dev, rc,
+- "Failed to init fine phase correction\n");
+- goto error;
+- }
+-
+ /* Initialize monitoring thread */
+ kthread_init_delayed_work(&zldev->work, zl3073x_dev_periodic_work);
+ kworker = kthread_run_worker(0, "zl3073x-%s", dev_name(zldev->dev));
+@@ -875,9 +980,14 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)
+ rc = PTR_ERR(kworker);
+ goto error;
+ }
+-
+ zldev->kworker = kworker;
+- kthread_queue_delayed_work(zldev->kworker, &zldev->work, 0);
++
++ /* Start normal operation */
++ rc = zl3073x_dev_start(zldev, true);
++ if (rc) {
++ dev_err_probe(zldev->dev, rc, "Failed to start device\n");
++ goto error;
++ }
+
+ /* Add devres action to release DPLL related resources */
+ rc = devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev);
+@@ -892,46 +1002,6 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)
+ return rc;
+ }
+
+-/**
+- * zl3073x_dev_phase_meas_setup - setup phase offset measurement
+- * @zldev: pointer to zl3073x_dev structure
+- * @num_channels: number of DPLL channels
+- *
+- * Enable phase offset measurement block, set measurement averaging factor
+- * and enable DPLL-to-its-ref phase measurement for all DPLLs.
+- *
+- * Returns: 0 on success, <0 on error
+- */
+-static int
+-zl3073x_dev_phase_meas_setup(struct zl3073x_dev *zldev, int num_channels)
+-{
+- u8 dpll_meas_ctrl, mask;
+- int i, rc;
+-
+- /* Read DPLL phase measurement control register */
+- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, &dpll_meas_ctrl);
+- if (rc)
+- return rc;
+-
+- /* Setup phase measurement averaging factor */
+- dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR;
+- dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, 3);
+-
+- /* Enable DPLL measurement block */
+- dpll_meas_ctrl |= ZL_DPLL_MEAS_CTRL_EN;
+-
+- /* Update phase measurement control register */
+- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl);
+- if (rc)
+- return rc;
+-
+- /* Enable DPLL-to-connected-ref measurement for each channel */
+- for (i = 0, mask = 0; i < num_channels; i++)
+- mask |= BIT(i);
+-
+- return zl3073x_write_u8(zldev, ZL_REG_DPLL_PHASE_ERR_READ_MASK, mask);
+-}
+-
+ /**
+ * zl3073x_dev_probe - initialize zl3073x device
+ * @zldev: pointer to zl3073x device
+@@ -999,17 +1069,6 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev,
+ return dev_err_probe(zldev->dev, rc,
+ "Failed to initialize mutex\n");
+
+- /* Fetch device state */
+- rc = zl3073x_dev_state_fetch(zldev);
+- if (rc)
+- return rc;
+-
+- /* Setup phase offset measurement block */
+- rc = zl3073x_dev_phase_meas_setup(zldev, chip_info->num_channels);
+- if (rc)
+- return dev_err_probe(zldev->dev, rc,
+- "Failed to setup phase measurement\n");
+-
+ /* Register DPLL channels */
+ rc = zl3073x_devm_dpll_init(zldev, chip_info->num_channels);
+ if (rc)
+diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h
+index 71af2c8001109..84e52d5521a34 100644
+--- a/drivers/dpll/zl3073x/core.h
++++ b/drivers/dpll/zl3073x/core.h
+@@ -111,6 +111,9 @@ struct zl3073x_dev *zl3073x_devm_alloc(struct device *dev);
+ int zl3073x_dev_probe(struct zl3073x_dev *zldev,
+ const struct zl3073x_chip_info *chip_info);
+
++int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full);
++void zl3073x_dev_stop(struct zl3073x_dev *zldev);
++
+ /**********************
+ * Registers operations
+ **********************/
+diff --git a/drivers/dpll/zl3073x/devlink.c b/drivers/dpll/zl3073x/devlink.c
+index 7e7fe726ee37a..c2e9f7aca3c84 100644
+--- a/drivers/dpll/zl3073x/devlink.c
++++ b/drivers/dpll/zl3073x/devlink.c
+@@ -86,14 +86,12 @@ zl3073x_devlink_reload_down(struct devlink *devlink, bool netns_change,
+ struct netlink_ext_ack *extack)
+ {
+ struct zl3073x_dev *zldev = devlink_priv(devlink);
+- struct zl3073x_dpll *zldpll;
+
+ if (action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT)
+ return -EOPNOTSUPP;
+
+- /* Unregister all DPLLs */
+- list_for_each_entry(zldpll, &zldev->dplls, list)
+- zl3073x_dpll_unregister(zldpll);
++ /* Stop normal operation */
++ zl3073x_dev_stop(zldev);
+
+ return 0;
+ }
+@@ -107,7 +105,6 @@ zl3073x_devlink_reload_up(struct devlink *devlink,
+ {
+ struct zl3073x_dev *zldev = devlink_priv(devlink);
+ union devlink_param_value val;
+- struct zl3073x_dpll *zldpll;
+ int rc;
+
+ if (action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT)
+@@ -125,13 +122,10 @@ zl3073x_devlink_reload_up(struct devlink *devlink,
+ zldev->clock_id = val.vu64;
+ }
+
+- /* Re-register all DPLLs */
+- list_for_each_entry(zldpll, &zldev->dplls, list) {
+- rc = zl3073x_dpll_register(zldpll);
+- if (rc)
+- dev_warn(zldev->dev,
+- "Failed to re-register DPLL%u\n", zldpll->id);
+- }
++ /* Restart normal operation */
++ rc = zl3073x_dev_start(zldev, false);
++ if (rc)
++ dev_warn(zldev->dev, "Failed to re-start normal operation\n");
+
+ *actions_performed = BIT(DEVLINK_RELOAD_ACTION_DRIVER_REINIT);
+
+--
+2.51.0
+
--- /dev/null
+From b20d0d39b0e22b238e99f1989775ff4cba82ca06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 8da882c518565..9b28c07282699 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -5444,8 +5444,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ thermal_data->sw_ctf_threshold = thermal_data->max;
+
+--
+2.51.0
+
--- /dev/null
+From 76352502791e415f02947b986f7d8ff2d9ee4920 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:12:36 -0400
+Subject: drm/amdgpu: add ip offset support for cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit e8529dbc75cab56fc3c57830d0fd48cbd8911e6c ]
+
+For chips that don't have IP discovery tables.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/Makefile | 3 +-
+ .../drm/amd/amdgpu/cyan_skillfish_reg_init.c | 56 +++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/nv.h | 1 +
+ 3 files changed, 59 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile b/drivers/gpu/drm/amd/amdgpu/Makefile
+index 930de203d533c..2d0fea87af79f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/Makefile
++++ b/drivers/gpu/drm/amd/amdgpu/Makefile
+@@ -84,7 +84,8 @@ amdgpu-y += \
+ vega20_reg_init.o nbio_v7_4.o nbio_v2_3.o nv.o arct_reg_init.o mxgpu_nv.o \
+ nbio_v7_2.o hdp_v4_0.o hdp_v5_0.o aldebaran_reg_init.o aldebaran.o soc21.o soc24.o \
+ sienna_cichlid.o smu_v13_0_10.o nbio_v4_3.o hdp_v6_0.o nbio_v7_7.o hdp_v5_2.o lsdma_v6_0.o \
+- nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o
++ nbio_v7_9.o aqua_vanjaram.o nbio_v7_11.o lsdma_v7_0.o hdp_v7_0.o nbif_v6_3_1.o \
++ cyan_skillfish_reg_init.o
+
+ # add DF block
+ amdgpu-y += \
+diff --git a/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+new file mode 100644
+index 0000000000000..96616a865aac7
+--- /dev/null
++++ b/drivers/gpu/drm/amd/amdgpu/cyan_skillfish_reg_init.c
+@@ -0,0 +1,56 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright 2018 Advanced Micro Devices, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
++#include "amdgpu.h"
++#include "nv.h"
++
++#include "soc15_common.h"
++#include "soc15_hw_ip.h"
++#include "cyan_skillfish_ip_offset.h"
++
++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev)
++{
++ /* HW has more IP blocks, only initialized the blocke needed by driver */
++ uint32_t i;
++
++ adev->gfx.xcc_mask = 1;
++ for (i = 0 ; i < MAX_INSTANCE ; ++i) {
++ adev->reg_offset[GC_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[HDP_HWIP][i] = (uint32_t *)(&(HDP_BASE.instance[i]));
++ adev->reg_offset[MMHUB_HWIP][i] = (uint32_t *)(&(MMHUB_BASE.instance[i]));
++ adev->reg_offset[ATHUB_HWIP][i] = (uint32_t *)(&(ATHUB_BASE.instance[i]));
++ adev->reg_offset[NBIO_HWIP][i] = (uint32_t *)(&(NBIO_BASE.instance[i]));
++ adev->reg_offset[MP0_HWIP][i] = (uint32_t *)(&(MP0_BASE.instance[i]));
++ adev->reg_offset[MP1_HWIP][i] = (uint32_t *)(&(MP1_BASE.instance[i]));
++ adev->reg_offset[VCN_HWIP][i] = (uint32_t *)(&(UVD0_BASE.instance[i]));
++ adev->reg_offset[DF_HWIP][i] = (uint32_t *)(&(DF_BASE.instance[i]));
++ adev->reg_offset[DCE_HWIP][i] = (uint32_t *)(&(DMU_BASE.instance[i]));
++ adev->reg_offset[OSSSYS_HWIP][i] = (uint32_t *)(&(OSSSYS_BASE.instance[i]));
++ adev->reg_offset[SDMA0_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[SDMA1_HWIP][i] = (uint32_t *)(&(GC_BASE.instance[i]));
++ adev->reg_offset[SMUIO_HWIP][i] = (uint32_t *)(&(SMUIO_BASE.instance[i]));
++ adev->reg_offset[THM_HWIP][i] = (uint32_t *)(&(THM_BASE.instance[i]));
++ adev->reg_offset[CLK_HWIP][i] = (uint32_t *)(&(CLK_BASE.instance[i]));
++ }
++ return 0;
++}
+diff --git a/drivers/gpu/drm/amd/amdgpu/nv.h b/drivers/gpu/drm/amd/amdgpu/nv.h
+index 83e9782aef39d..8f4817404f10d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nv.h
++++ b/drivers/gpu/drm/amd/amdgpu/nv.h
+@@ -31,5 +31,6 @@ extern const struct amdgpu_ip_block_version nv_common_ip_block;
+ void nv_grbm_select(struct amdgpu_device *adev,
+ u32 me, u32 pipe, u32 queue, u32 vmid);
+ void nv_set_virt_ops(struct amdgpu_device *adev);
++int cyan_skillfish_reg_base_init(struct amdgpu_device *adev);
+
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 2d7557b7689ccc9adb449189fb343b0dc9eb3c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:18:46 -0400
+Subject: drm/amdgpu: add support for cyan skillfish without IP discovery
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 9e6a5cf1a23bf575e93544ae05585659063b1c18 ]
+
+For platforms without an IP discovery table.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 357d90be2c7a ("drm/amdgpu: fix handling of harvesting for ip_discovery firmware")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 30 +++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index efe0058b48ca8..38c4ebc063db2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2746,6 +2746,36 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ adev->ip_versions[UVD_HWIP][1] = IP_VERSION(2, 6, 0);
+ adev->ip_versions[XGMI_HWIP][0] = IP_VERSION(6, 1, 0);
+ break;
++ case CHIP_CYAN_SKILLFISH:
++ if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2) {
++ r = amdgpu_discovery_reg_base_init(adev);
++ if (r)
++ return -EINVAL;
++
++ amdgpu_discovery_harvest_ip(adev);
++ amdgpu_discovery_get_gfx_info(adev);
++ amdgpu_discovery_get_mall_info(adev);
++ amdgpu_discovery_get_vcn_info(adev);
++ } else {
++ cyan_skillfish_reg_base_init(adev);
++ adev->sdma.num_instances = 2;
++ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3);
++ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3);
++ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[HDP_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[SDMA0_HWIP][0] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[SDMA1_HWIP][1] = IP_VERSION(5, 0, 1);
++ adev->ip_versions[DF_HWIP][0] = IP_VERSION(3, 5, 0);
++ adev->ip_versions[NBIO_HWIP][0] = IP_VERSION(2, 1, 1);
++ adev->ip_versions[UMC_HWIP][0] = IP_VERSION(8, 1, 1);
++ adev->ip_versions[MP0_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[MP1_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[THM_HWIP][0] = IP_VERSION(11, 0, 1);
++ adev->ip_versions[SMUIO_HWIP][0] = IP_VERSION(11, 0, 8);
++ adev->ip_versions[GC_HWIP][0] = IP_VERSION(10, 1, 3);
++ adev->ip_versions[UVD_HWIP][0] = IP_VERSION(2, 0, 3);
++ }
++ break;
+ default:
+ r = amdgpu_discovery_reg_base_init(adev);
+ if (r) {
+--
+2.51.0
+
--- /dev/null
+From d6d229e32c73b1c60187c95434bfe0ef3d6a29b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:40:57 -0400
+Subject: drm/amdgpu: drop unused structures in amdgpu_drm.h
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit ef38b4eab146715bc68d45029257f5e69ea3f2cd ]
+
+These were never used and are duplicated with the
+interface that is used. Maybe leftovers from a previous
+revision of the patch that added them.
+
+Fixes: 90c448fef312 ("drm/amdgpu: add new AMDGPU_INFO subquery for userq objects")
+Reviewed-by: Prike Liang <Prike.Liang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/drm/amdgpu_drm.h | 21 ---------------------
+ 1 file changed, 21 deletions(-)
+
+diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
+index bdedbaccf776d..0b3827cd6f4a3 100644
+--- a/include/uapi/drm/amdgpu_drm.h
++++ b/include/uapi/drm/amdgpu_drm.h
+@@ -1497,27 +1497,6 @@ struct drm_amdgpu_info_hw_ip {
+ __u32 userq_num_slots;
+ };
+
+-/* GFX metadata BO sizes and alignment info (in bytes) */
+-struct drm_amdgpu_info_uq_fw_areas_gfx {
+- /* shadow area size */
+- __u32 shadow_size;
+- /* shadow area base virtual mem alignment */
+- __u32 shadow_alignment;
+- /* context save area size */
+- __u32 csa_size;
+- /* context save area base virtual mem alignment */
+- __u32 csa_alignment;
+-};
+-
+-/* IP specific fw related information used in the
+- * subquery AMDGPU_INFO_UQ_FW_AREAS
+- */
+-struct drm_amdgpu_info_uq_fw_areas {
+- union {
+- struct drm_amdgpu_info_uq_fw_areas_gfx gfx;
+- };
+-};
+-
+ struct drm_amdgpu_info_num_handles {
+ /** Max handles as supported by firmware for UVD */
+ __u32 uvd_max_handles;
+--
+2.51.0
+
--- /dev/null
+From a148d9916d97e12cd10d1e36db7098f0f17f3484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 17:31:32 -0400
+Subject: drm/amdgpu: fix handling of harvesting for ip_discovery firmware
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 ]
+
+Chips which use the IP discovery firmware loaded by the driver
+reported incorrect harvesting information in the ip discovery
+table in sysfs because the driver only uses the ip discovery
+firmware for populating sysfs and not for direct parsing for the
+driver itself as such, the fields that are used to print the
+harvesting info in sysfs report incorrect data for some IPs. Populate
+the relevant fields for this case as well.
+
+Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery")
+Acked-by: Tom St Denis <tom.stdenis@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index 38c4ebc063db2..e814da2b14225 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -1033,7 +1033,9 @@ static uint8_t amdgpu_discovery_get_harvest_info(struct amdgpu_device *adev,
+ /* Until a uniform way is figured, get mask based on hwid */
+ switch (hw_id) {
+ case VCN_HWID:
+- harvest = ((1 << inst) & adev->vcn.inst_mask) == 0;
++ /* VCN vs UVD+VCE */
++ if (!amdgpu_ip_version(adev, VCE_HWIP, 0))
++ harvest = ((1 << inst) & adev->vcn.inst_mask) == 0;
+ break;
+ case DMU_HWID:
+ if (adev->harvest_ip_mask & AMD_HARVEST_IP_DMU_MASK)
+@@ -2562,7 +2564,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 0, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 0, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 0);
+@@ -2589,7 +2593,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 3, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 3, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 0, 1);
+@@ -2616,8 +2622,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega10_reg_base_init(adev);
+ adev->sdma.num_instances = 1;
++ adev->sdma.sdma_mask = 1;
+ adev->vcn.num_vcn_inst = 1;
+ adev->gmc.num_umc = 2;
++ adev->gfx.xcc_mask = 1;
+ if (adev->apu_flags & AMD_APU_IS_RAVEN2) {
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 2, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 2, 0);
+@@ -2662,7 +2670,9 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ vega20_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
+ adev->gmc.num_umc = 8;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 0);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 0);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 0);
+@@ -2690,8 +2700,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ arct_reg_base_init(adev);
+ adev->sdma.num_instances = 8;
++ adev->sdma.sdma_mask = 0xff;
+ adev->vcn.num_vcn_inst = 2;
+ adev->gmc.num_umc = 8;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 1);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 1);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 2, 1);
+@@ -2723,8 +2735,10 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ amdgpu_discovery_init(adev);
+ aldebaran_reg_base_init(adev);
+ adev->sdma.num_instances = 5;
++ adev->sdma.sdma_mask = 0x1f;
+ adev->vcn.num_vcn_inst = 2;
+ adev->gmc.num_umc = 4;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(9, 4, 2);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(9, 4, 2);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(4, 4, 0);
+@@ -2759,6 +2773,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
+ } else {
+ cyan_skillfish_reg_base_init(adev);
+ adev->sdma.num_instances = 2;
++ adev->sdma.sdma_mask = 3;
++ adev->gfx.xcc_mask = 1;
+ adev->ip_versions[MMHUB_HWIP][0] = IP_VERSION(2, 0, 3);
+ adev->ip_versions[ATHUB_HWIP][0] = IP_VERSION(2, 0, 3);
+ adev->ip_versions[OSSSYS_HWIP][0] = IP_VERSION(5, 0, 1);
+--
+2.51.0
+
--- /dev/null
+From 7729492571a4fb27da7663df270df132b9e169d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 12:37:32 -0400
+Subject: drm/amdgpu: handle wrap around in reemit handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1f22fcb88bfef26a966e9eb242c692c6bf253d47 ]
+
+Compare the sequence numbers directly.
+
+Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 9e7506965cab2..bb17af79c24a6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -791,14 +791,19 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring,
+ struct dma_fence *unprocessed;
+ struct dma_fence __rcu **ptr;
+ struct amdgpu_fence *fence;
+- u64 wptr, i, seqno;
++ u64 wptr;
++ u32 seq, last_seq;
+
+- seqno = amdgpu_fence_read(ring);
++ last_seq = amdgpu_fence_read(ring) & ring->fence_drv.num_fences_mask;
++ seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask;
+ wptr = ring->fence_drv.signalled_wptr;
+ ring->ring_backup_entries_to_copy = 0;
+
+- for (i = seqno + 1; i <= ring->fence_drv.sync_seq; ++i) {
+- ptr = &ring->fence_drv.fences[i & ring->fence_drv.num_fences_mask];
++ do {
++ last_seq++;
++ last_seq &= ring->fence_drv.num_fences_mask;
++
++ ptr = &ring->fence_drv.fences[last_seq];
+ rcu_read_lock();
+ unprocessed = rcu_dereference(*ptr);
+
+@@ -814,7 +819,7 @@ void amdgpu_ring_backup_unprocessed_commands(struct amdgpu_ring *ring,
+ wptr = fence->wptr;
+ }
+ rcu_read_unlock();
+- }
++ } while (last_seq != seq);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 0a9ddb5368c1c21aff72143c1ee8329f822f9971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:48:23 -0400
+Subject: drm/amdgpu: set an error on all fences from a bad context
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit ff780f4f80323148d43198f2052c14160c8428d3 ]
+
+When we backup ring contents to reemit after a queue reset,
+we don't backup ring contents from the bad context. When
+we signal the fences, we should set an error on those
+fences as well.
+
+v2: misc cleanups
+v3: add locking for fence error, fix comment (Christian)
+v4: fix wrap around, locking (Christian)
+
+Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 39 ++++++++++++++++++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 2 +-
+ 3 files changed, 37 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index bb17af79c24a6..9f79f0cc5ff83 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -759,11 +759,42 @@ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring)
+ * @fence: fence of the ring to signal
+ *
+ */
+-void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *fence)
++void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af)
+ {
+- dma_fence_set_error(&fence->base, -ETIME);
+- amdgpu_fence_write(fence->ring, fence->seq);
+- amdgpu_fence_process(fence->ring);
++ struct dma_fence *unprocessed;
++ struct dma_fence __rcu **ptr;
++ struct amdgpu_fence *fence;
++ struct amdgpu_ring *ring = af->ring;
++ unsigned long flags;
++ u32 seq, last_seq;
++
++ last_seq = amdgpu_fence_read(ring) & ring->fence_drv.num_fences_mask;
++ seq = ring->fence_drv.sync_seq & ring->fence_drv.num_fences_mask;
++
++ /* mark all fences from the guilty context with an error */
++ spin_lock_irqsave(&ring->fence_drv.lock, flags);
++ do {
++ last_seq++;
++ last_seq &= ring->fence_drv.num_fences_mask;
++
++ ptr = &ring->fence_drv.fences[last_seq];
++ rcu_read_lock();
++ unprocessed = rcu_dereference(*ptr);
++
++ if (unprocessed && !dma_fence_is_signaled_locked(unprocessed)) {
++ fence = container_of(unprocessed, struct amdgpu_fence, base);
++
++ if (fence == af)
++ dma_fence_set_error(&fence->base, -ETIME);
++ else if (fence->context == af->context)
++ dma_fence_set_error(&fence->base, -ECANCELED);
++ }
++ rcu_read_unlock();
++ } while (last_seq != seq);
++ spin_unlock_irqrestore(&ring->fence_drv.lock, flags);
++ /* signal the guilty fence */
++ amdgpu_fence_write(ring, af->seq);
++ amdgpu_fence_process(ring);
+ }
+
+ void amdgpu_fence_save_wptr(struct dma_fence *fence)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+index 8f6ce948c6841..5ec5c3ff22bb0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -811,7 +811,7 @@ int amdgpu_ring_reset_helper_end(struct amdgpu_ring *ring,
+ if (r)
+ return r;
+
+- /* signal the fence of the bad job */
++ /* signal the guilty fence and set an error on all fences from the context */
+ if (guilty_fence)
+ amdgpu_fence_driver_guilty_force_completion(guilty_fence);
+ /* Re-emit the non-guilty commands */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+index 12783ea3ba0f1..869b486168f3e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+@@ -155,7 +155,7 @@ extern const struct drm_sched_backend_ops amdgpu_sched_ops;
+ void amdgpu_fence_driver_clear_job_fences(struct amdgpu_ring *ring);
+ void amdgpu_fence_driver_set_error(struct amdgpu_ring *ring, int error);
+ void amdgpu_fence_driver_force_completion(struct amdgpu_ring *ring);
+-void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *fence);
++void amdgpu_fence_driver_guilty_force_completion(struct amdgpu_fence *af);
+ void amdgpu_fence_save_wptr(struct dma_fence *fence);
+
+ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring);
+--
+2.51.0
+
--- /dev/null
+From 747de3eb7db28c802dce609cf22807d5fb22b7d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 12:59:53 +0200
+Subject: drm/bridge: lt9211: Drop check for last nibble of version register
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ]
+
+There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 .
+The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the
+driver checks for right now. Since there is a possibility there will be
+yet another revision of the LT9211 in the future, drop the last version
+nibble check to allow all future revisions of the chip to work with this
+driver.
+
+This fix makes LT9211 rev. U5 work with this driver.
+
+Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c
+index 399fa7eebd49c..03fc8fd10f20a 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9211.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c
+@@ -121,8 +121,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx)
+ }
+
+ /* Test for known Chip ID. */
+- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE ||
+- chipid[2] != REG_CHIPID2_VALUE) {
++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) {
+ dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n",
+ chipid[0], chipid[1], chipid[2]);
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 32b03fee8e393ab24baafb2bd3b891a96d495dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 12:33:03 +0200
+Subject: drm/draw: fix color truncation in drm_draw_fill24
+
+From: Francesco Valla <francesco@valla.it>
+
+[ Upstream commit 095232711f23179053ca26bcf046ca121a91a465 ]
+
+The color parameter passed to drm_draw_fill24() was truncated to 16
+bits, leading to an incorrect color drawn to the target iosys_map.
+Fix this behavior, widening the parameter to 32 bits.
+
+Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw")
+
+Signed-off-by: Francesco Valla <francesco@valla.it>
+Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
+Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_draw.c | 2 +-
+ drivers/gpu/drm/drm_draw_internal.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_draw.c b/drivers/gpu/drm/drm_draw.c
+index 9dc0408fbbead..5b956229c82fb 100644
+--- a/drivers/gpu/drm/drm_draw.c
++++ b/drivers/gpu/drm/drm_draw.c
+@@ -127,7 +127,7 @@ EXPORT_SYMBOL(drm_draw_fill16);
+
+ void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+- u16 color)
++ u32 color)
+ {
+ unsigned int y, x;
+
+diff --git a/drivers/gpu/drm/drm_draw_internal.h b/drivers/gpu/drm/drm_draw_internal.h
+index f121ee7339dc1..20cb404e23ea6 100644
+--- a/drivers/gpu/drm/drm_draw_internal.h
++++ b/drivers/gpu/drm/drm_draw_internal.h
+@@ -47,7 +47,7 @@ void drm_draw_fill16(struct iosys_map *dmap, unsigned int dpitch,
+
+ void drm_draw_fill24(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+- u16 color);
++ u32 color);
+
+ void drm_draw_fill32(struct iosys_map *dmap, unsigned int dpitch,
+ unsigned int height, unsigned int width,
+--
+2.51.0
+
--- /dev/null
+From 8495e8cd8a1e4f841cc2bb93eea77cd76b5f7af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 17:57:31 +0300
+Subject: drm/i915/fb: Fix the set_tiling vs. addfb race, again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 86af6b90e0556fcefbc6e98eb78bdce90327ee76 ]
+
+intel_frontbuffer_get() is what locks out subsequent set_tiling
+changes to the bo. Thus the fence vs. modifier check must be done
+after intel_frontbuffer_get(), or else a concurrent set_tiling ioctl
+might sneak in and change the fence after the check has been done.
+
+Close the race again. See commit dd689287b977 ("drm/i915: Prevent
+concurrent tiling/framebuffer modifications") for the previous
+instance.
+
+v2: Reorder intel_user_framebuffer_destroy() to match the unwind (Jani)
+
+Cc: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-3-ville.syrjala@linux.intel.com
+(cherry picked from commit 1d1e4ded216017f8febd91332ee337f0e0e79285)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_fb.c | 38 +++++++++++++------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c
+index 0da842bd2f2f1..974e5b547d886 100644
+--- a/drivers/gpu/drm/i915/display/intel_fb.c
++++ b/drivers/gpu/drm/i915/display/intel_fb.c
+@@ -2111,10 +2111,10 @@ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)
+ if (intel_fb_uses_dpt(fb))
+ intel_dpt_destroy(intel_fb->dpt_vm);
+
+- intel_frontbuffer_put(intel_fb->frontbuffer);
+-
+ intel_fb_bo_framebuffer_fini(intel_fb_bo(fb));
+
++ intel_frontbuffer_put(intel_fb->frontbuffer);
++
+ kfree(intel_fb);
+ }
+
+@@ -2216,15 +2216,17 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ int ret = -EINVAL;
+ int i;
+
++ /*
++ * intel_frontbuffer_get() must be done before
++ * intel_fb_bo_framebuffer_init() to avoid set_tiling vs. addfb race.
++ */
++ intel_fb->frontbuffer = intel_frontbuffer_get(obj);
++ if (!intel_fb->frontbuffer)
++ return -ENOMEM;
++
+ ret = intel_fb_bo_framebuffer_init(fb, obj, mode_cmd);
+ if (ret)
+- return ret;
+-
+- intel_fb->frontbuffer = intel_frontbuffer_get(obj);
+- if (!intel_fb->frontbuffer) {
+- ret = -ENOMEM;
+- goto err;
+- }
++ goto err_frontbuffer_put;
+
+ ret = -EINVAL;
+ if (!drm_any_plane_has_format(display->drm,
+@@ -2233,7 +2235,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ drm_dbg_kms(display->drm,
+ "unsupported pixel format %p4cc / modifier 0x%llx\n",
+ &mode_cmd->pixel_format, mode_cmd->modifier[0]);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+
+ max_stride = intel_fb_max_stride(display, mode_cmd->pixel_format,
+@@ -2244,7 +2246,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ mode_cmd->modifier[0] != DRM_FORMAT_MOD_LINEAR ?
+ "tiled" : "linear",
+ mode_cmd->pitches[0], max_stride);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+
+ /* FIXME need to adjust LINOFF/TILEOFF accordingly. */
+@@ -2252,7 +2254,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ drm_dbg_kms(display->drm,
+ "plane 0 offset (0x%08x) must be 0\n",
+ mode_cmd->offsets[0]);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+
+ drm_helper_mode_fill_fb_struct(display->drm, fb, info, mode_cmd);
+@@ -2262,7 +2264,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+
+ if (mode_cmd->handles[i] != mode_cmd->handles[0]) {
+ drm_dbg_kms(display->drm, "bad plane %d handle\n", i);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+
+ stride_alignment = intel_fb_stride_alignment(fb, i);
+@@ -2270,7 +2272,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ drm_dbg_kms(display->drm,
+ "plane %d pitch (%d) must be at least %u byte aligned\n",
+ i, fb->pitches[i], stride_alignment);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+
+ if (intel_fb_is_gen12_ccs_aux_plane(fb, i)) {
+@@ -2280,7 +2282,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ drm_dbg_kms(display->drm,
+ "ccs aux plane %d pitch (%d) must be %d\n",
+ i, fb->pitches[i], ccs_aux_stride);
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+ }
+ }
+
+@@ -2289,7 +2291,7 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+
+ ret = intel_fill_fb_info(display, intel_fb);
+ if (ret)
+- goto err_frontbuffer_put;
++ goto err_bo_framebuffer_fini;
+
+ if (intel_fb_uses_dpt(fb)) {
+ struct i915_address_space *vm;
+@@ -2315,10 +2317,10 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ err_free_dpt:
+ if (intel_fb_uses_dpt(fb))
+ intel_dpt_destroy(intel_fb->dpt_vm);
++err_bo_framebuffer_fini:
++ intel_fb_bo_framebuffer_fini(obj);
+ err_frontbuffer_put:
+ intel_frontbuffer_put(intel_fb->frontbuffer);
+-err:
+- intel_fb_bo_framebuffer_fini(obj);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5a937ed6189ca94457e3597f791b9b059b8d35f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 17:57:30 +0300
+Subject: drm/i915/frontbuffer: Move bo refcounting
+ intel_frontbuffer_{get,release}()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 760039c95c78490c5c66ef584fcd536797ed6a2f ]
+
+Currently xe's intel_frontbuffer implementation forgets to
+hold a reference on the bo. This makes the entire thing
+extremely fragile as the cleanup order now depends on bo
+references held by other things
+(namely intel_fb_bo_framebuffer_fini()).
+
+Move the bo refcounting to intel_frontbuffer_{get,release}()
+so that both i915 and xe do this the same way.
+
+I first tried to fix this by having xe do the refcounting
+from its intel_bo_set_frontbuffer() implementation
+(which is what i915 does currently), but turns out xe's
+drm_gem_object_free() can sleep and thus drm_gem_object_put()
+isn't safe to call while we hold fb_tracking.lock.
+
+Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-2-ville.syrjala@linux.intel.com
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit eb4d490729a5fd8dc5a76d334f8d01fec7c14bbe)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_frontbuffer.c | 10 +++++++++-
+ drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 2 --
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_frontbuffer.c b/drivers/gpu/drm/i915/display/intel_frontbuffer.c
+index 43be5377ddc1a..73ed28ac95734 100644
+--- a/drivers/gpu/drm/i915/display/intel_frontbuffer.c
++++ b/drivers/gpu/drm/i915/display/intel_frontbuffer.c
+@@ -270,6 +270,8 @@ static void frontbuffer_release(struct kref *ref)
+ spin_unlock(&display->fb_tracking.lock);
+
+ i915_active_fini(&front->write);
++
++ drm_gem_object_put(obj);
+ kfree_rcu(front, rcu);
+ }
+
+@@ -287,6 +289,8 @@ intel_frontbuffer_get(struct drm_gem_object *obj)
+ if (!front)
+ return NULL;
+
++ drm_gem_object_get(obj);
++
+ front->obj = obj;
+ kref_init(&front->ref);
+ atomic_set(&front->bits, 0);
+@@ -299,8 +303,12 @@ intel_frontbuffer_get(struct drm_gem_object *obj)
+ spin_lock(&display->fb_tracking.lock);
+ cur = intel_bo_set_frontbuffer(obj, front);
+ spin_unlock(&display->fb_tracking.lock);
+- if (cur != front)
++
++ if (cur != front) {
++ drm_gem_object_put(obj);
+ kfree(front);
++ }
++
+ return cur;
+ }
+
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
+index b6dc3d1b9bb13..b682969e3a293 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
+@@ -89,12 +89,10 @@ i915_gem_object_set_frontbuffer(struct drm_i915_gem_object *obj,
+
+ if (!front) {
+ RCU_INIT_POINTER(obj->frontbuffer, NULL);
+- drm_gem_object_put(intel_bo_to_drm_bo(obj));
+ } else if (rcu_access_pointer(obj->frontbuffer)) {
+ cur = rcu_dereference_protected(obj->frontbuffer, true);
+ kref_get(&cur->ref);
+ } else {
+- drm_gem_object_get(intel_bo_to_drm_bo(obj));
+ rcu_assign_pointer(obj->frontbuffer, front);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9d3e6431110fb0aeadd78749c3c050b30d753678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:29:04 -0400
+Subject: drm/i915/guc: Skip communication warning on reset in progress
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ]
+
+GuC IRQ and tasklet handler receive just single G2H message, and let other
+messages to be received from next tasklet. During this chained tasklet
+process, if reset process started, communication will be disabled.
+Skip warning for this condition.
+
+Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com
+(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+index 0d5197c0824a9..5cf3a516ccfb3 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+@@ -1324,9 +1324,16 @@ static int ct_receive(struct intel_guc_ct *ct)
+
+ static void ct_try_receive_message(struct intel_guc_ct *ct)
+ {
++ struct intel_guc *guc = ct_to_guc(ct);
+ int ret;
+
+- if (GEM_WARN_ON(!ct->enabled))
++ if (!ct->enabled) {
++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress);
++ return;
++ }
++
++ /* When interrupt disabled, message handling is not expected */
++ if (!guc->interrupts.enabled)
+ return;
+
+ ret = ct_receive(ct);
+--
+2.51.0
+
--- /dev/null
+From 5acbf0c634d4ad2aa8839ae94a0e3e47a54e77ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 12:51:11 +0200
+Subject: drm/panthor: Ensure MCU is disabled on suspend
+
+From: Ketil Johnsen <ketil.johnsen@arm.com>
+
+[ Upstream commit e07e10ae83bdf429f59c8c149173a8c4f29c481e ]
+
+Currently the Panthor driver needs the GPU to be powered down
+between suspend and resume. If this is not done, then the
+MCU_CONTROL register will be preserved as AUTO, which again will
+cause a premature FW boot on resume. The FW will go directly into
+fatal state in this case.
+
+This case needs to be handled as there is no guarantee that the
+GPU will be powered down after the suspend callback on all platforms.
+
+The fix is to call panthor_fw_stop() in "pre-reset" path to ensure
+the MCU_CONTROL register is cleared (set DISABLE). This matches
+well with the already existing call to panthor_fw_start() from the
+"post-reset" path.
+
+Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
+Acked-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_fw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
+index 36f1034839c27..44a9958351889 100644
+--- a/drivers/gpu/drm/panthor/panthor_fw.c
++++ b/drivers/gpu/drm/panthor/panthor_fw.c
+@@ -1099,6 +1099,7 @@ void panthor_fw_pre_reset(struct panthor_device *ptdev, bool on_hang)
+ }
+
+ panthor_job_irq_suspend(&ptdev->fw->irq);
++ panthor_fw_stop(ptdev);
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 656c1b8462024bfde8592f120ee3ba9e4a540c9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 07:20:01 -0700
+Subject: drm/rockchip: vop2: use correct destination rectangle height check
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ]
+
+The vop2_plane_atomic_check() function incorrectly checks
+drm_rect_width(dest) twice instead of verifying both width and height.
+Fix the second condition to use drm_rect_height(dest) so that invalid
+destination rectangles with height < 4 are correctly rejected.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index b50927a824b40..7ec7bea5e38e6 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1031,7 +1031,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane,
+ return format;
+
+ if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 ||
+- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) {
++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) {
+ drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n",
+ drm_rect_width(src) >> 16, drm_rect_height(src) >> 16,
+ drm_rect_width(dest), drm_rect_height(dest));
+--
+2.51.0
+
--- /dev/null
+From 17e8a732b018fdd0e66107caaa8e6d932f31194f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 18:10:47 -0700
+Subject: drm/xe: Enable media sampler power gating
+
+From: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+
+[ Upstream commit 1852d27aa998272696680607b65a2ceac966104e ]
+
+Where applicable, enable media sampler power gating. Also, add
+it to the powergate_info debugfs.
+
+v2: Remove the sampler powergate status since it is cleared quickly anyway.
+v3: Use vcs mask (Rodrigo) and fix the version check for media
+v4: Remove extra spaces
+v5: Media samplers are independent of vcs mask,
+ use Media version 1255 (Matt Roper)
+
+Fixes: 38e8c4184ea0 ("drm/xe: Enable Coarse Power Gating")
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Link: https://lore.kernel.org/r/20251010011047.2047584-1-vinay.belgaumkar@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 4cbc08649a54c3d533df9832342d52d409dfbbf0)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 +
+ drivers/gpu/drm/xe/xe_gt_idle.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/regs/xe_gt_regs.h b/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+index 5cd5ab8529c5c..9994887fc73f9 100644
+--- a/drivers/gpu/drm/xe/regs/xe_gt_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+@@ -342,6 +342,7 @@
+ #define POWERGATE_ENABLE XE_REG(0xa210)
+ #define RENDER_POWERGATE_ENABLE REG_BIT(0)
+ #define MEDIA_POWERGATE_ENABLE REG_BIT(1)
++#define MEDIA_SAMPLERS_POWERGATE_ENABLE REG_BIT(2)
+ #define VDN_HCP_POWERGATE_ENABLE(n) REG_BIT(3 + 2 * (n))
+ #define VDN_MFXVDENC_POWERGATE_ENABLE(n) REG_BIT(4 + 2 * (n))
+
+diff --git a/drivers/gpu/drm/xe/xe_gt_idle.c b/drivers/gpu/drm/xe/xe_gt_idle.c
+index ffb210216aa99..9bd197da60279 100644
+--- a/drivers/gpu/drm/xe/xe_gt_idle.c
++++ b/drivers/gpu/drm/xe/xe_gt_idle.c
+@@ -124,6 +124,9 @@ void xe_gt_idle_enable_pg(struct xe_gt *gt)
+ if (xe_gt_is_main_type(gt))
+ gtidle->powergate_enable |= RENDER_POWERGATE_ENABLE;
+
++ if (MEDIA_VERx100(xe) >= 1100 && MEDIA_VERx100(xe) < 1255)
++ gtidle->powergate_enable |= MEDIA_SAMPLERS_POWERGATE_ENABLE;
++
+ if (xe->info.platform != XE_DG1) {
+ for (i = XE_HW_ENGINE_VCS0, j = 0; i <= XE_HW_ENGINE_VCS7; ++i, ++j) {
+ if ((gt->info.engine_mask & BIT(i)))
+@@ -246,6 +249,11 @@ int xe_gt_idle_pg_print(struct xe_gt *gt, struct drm_printer *p)
+ drm_printf(p, "Media Slice%d Power Gate Status: %s\n", n,
+ str_up_down(pg_status & media_slices[n].status_bit));
+ }
++
++ if (MEDIA_VERx100(xe) >= 1100 && MEDIA_VERx100(xe) < 1255)
++ drm_printf(p, "Media Samplers Power Gating Enabled: %s\n",
++ str_yes_no(pg_enabled & MEDIA_SAMPLERS_POWERGATE_ENABLE));
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 27fab65ad9a317e83a084a38121dec2bcf2f9296 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:24:58 +0100
+Subject: drm/xe/evict: drop bogus assert
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 225bc03d85427e7e3821d6f99f4f2d4a09350dda ]
+
+This assert can trigger here with non pin_map users that select
+LATE_RESTORE, since the vmap is allowed to be NULL given that
+save/restore can now use the blitter instead. The check here doesn't
+seem to have much value anymore given that we no longer move pinned
+memory, so any existing vmap is left well alone, and doesn't need to be
+recreated upon restore, so just drop the assert here.
+
+Fixes: 86f69c26113c ("drm/xe: use backup object for pinned save/restore")
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6213
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://lore.kernel.org/r/20251010152457.177884-2-matthew.auld@intel.com
+(cherry picked from commit a10b4a69c7f8f596d2c5218fbe84430734fab3b2)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo_evict.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c
+index d5dbc51e8612d..bc5b4c5fab812 100644
+--- a/drivers/gpu/drm/xe/xe_bo_evict.c
++++ b/drivers/gpu/drm/xe/xe_bo_evict.c
+@@ -182,7 +182,6 @@ int xe_bo_evict_all(struct xe_device *xe)
+
+ static int xe_bo_restore_and_map_ggtt(struct xe_bo *bo)
+ {
+- struct xe_device *xe = xe_bo_device(bo);
+ int ret;
+
+ ret = xe_bo_restore_pinned(bo);
+@@ -201,13 +200,6 @@ static int xe_bo_restore_and_map_ggtt(struct xe_bo *bo)
+ }
+ }
+
+- /*
+- * We expect validate to trigger a move VRAM and our move code
+- * should setup the iosys map.
+- */
+- xe_assert(xe, !(bo->flags & XE_BO_FLAG_PINNED_LATE_RESTORE) ||
+- !iosys_map_is_null(&bo->vmap));
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ca91d6619f068b851ea160213f9825fb59bf27b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 21:28:44 -0700
+Subject: HID: hid-input: only ignore 0 battery events for digitizers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ]
+
+Commit 581c4484769e ("HID: input: map digitizer battery usage") added
+handling of battery events for digitizers (typically for batteries
+presented in stylii). Digitizers typically report correct battery levels
+only when stylus is actively touching the surface, and in other cases
+they may report battery level of 0. To avoid confusing consumers of the
+battery information the code was added to filer out reports with 0
+battery levels.
+
+However there exist other kinds of devices that may legitimately report
+0 battery levels. Fix this by filtering out 0-level reports only for
+digitizer usages, and continue reporting them for other kinds of devices
+(Smart Batteries, etc).
+
+Reported-by: 卢国宏 <luguohong@xiaomi.com>
+Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f45f856a127fe..2c743e35c1d33 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
+ return;
+ }
+
+- if (value == 0 || value < dev->battery_min || value > dev->battery_max)
++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0)
++ return;
++
++ if (value < dev->battery_min || value > dev->battery_max)
+ return;
+
+ capacity = hidinput_scale_battery_capacity(dev, value);
+--
+2.51.0
+
--- /dev/null
+From 57c902699cc3e7cd08ef6e05dfcc8e8f3906b081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:09:39 +0800
+Subject: HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level
+ to edge detection
+
+From: Even Xu <even.xu@intel.com>
+
+[ Upstream commit 8fe2cd8ec84b3592b57f40b080f9d5aeebd553af ]
+
+The original implementation used level detection for the first interrupt
+after device reset to avoid potential interrupt line noise and missed
+interrupts during the initialization phase. However, this approach
+introduced unintended side effects when tested with certain touch panels,
+including:
+ - Delayed hardware interrupt response
+ - Multiple spurious interrupt triggers
+
+Switching back to edge detection for the first interrupt resolves these
+issues while maintaining reliable interrupt handling.
+
+Extensive testing across multiple platforms with touch panels from
+various vendors confirms this change introduces no regressions.
+
+[jkosina@suse.com: properly capitalize shortlog]
+Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation")
+Tested-by: Rui Zhang <rui1.zhang@intel.com>
+Signed-off-by: Even Xu <even.xu@intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+index e6ba2ddcc9cbc..16f780bc879b1 100644
+--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
++++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+@@ -280,8 +280,7 @@ int reset_tic(struct quickspi_device *qsdev)
+
+ qsdev->reset_ack = false;
+
+- /* First interrupt uses level trigger to avoid missing interrupt */
+- thc_int_trigger_type_select(qsdev->thc_hw, false);
++ thc_int_trigger_type_select(qsdev->thc_hw, true);
+
+ ret = acpi_tic_reset(qsdev);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 2d105452cdc0fd2694a021533d27b3127fbb8bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 09:40:33 -0300
+Subject: HID: multitouch: fix name of Stylus input devices
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ]
+
+HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by
+commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN").
+However, on multitouch devices, these suffixes may be overridden. Before
+that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after
+that, multitouch would override them to have an "UNKNOWN" suffix. Just add
+HID_DG_PEN to the list of non-overriden suffixes in multitouch.
+
+Before this fix:
+
+[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+ELAN9008:00 04F3:2E14 UNKNOWN
+
+After this fix:
+
+[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+
+ELAN9008:00 04F3:2E14 Stylus
+
+Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 7587a7748a82d..a9ff84f0bd9bb 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1711,6 +1711,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ case HID_CP_CONSUMER_CONTROL:
+ case HID_GD_WIRELESS_RADIO_CTLS:
+ case HID_GD_SYSTEM_MULTIAXIS:
++ case HID_DG_PEN:
+ /* already handled by hid core */
+ break;
+ case HID_DG_TOUCHSCREEN:
+--
+2.51.0
+
--- /dev/null
+From 2ba7fd6f17b849b99cdf2e2093d95b259e24f10d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 17:03:46 -0700
+Subject: idpf: cleanup remaining SKBs in PTP flows
+
+From: Milena Olech <milena.olech@intel.com>
+
+[ Upstream commit a3f8c0a273120fd2638f03403e786c3de2382e72 ]
+
+When the driver requests Tx timestamp value, one of the first steps is
+to clone SKB using skb_get. It increases the reference counter for that
+SKB to prevent unexpected freeing by another component.
+However, there may be a case where the index is requested, SKB is
+assigned and never consumed by PTP flows - for example due to reset during
+running PTP apps.
+
+Add a check in release timestamping function to verify if the SKB
+assigned to Tx timestamp latch was freed, and release remaining SKBs.
+
+Fixes: 4901e83a94ef ("idpf: add Tx timestamp capabilities negotiation")
+Signed-off-by: Milena Olech <milena.olech@intel.com>
+Signed-off-by: Anton Nadezhdin <anton.nadezhdin@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-1-ef32a425b92a@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_ptp.c | 3 +++
+ drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_ptp.c
+index ee21f2ff0cad9..63a41e688733b 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ptp.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ptp.c
+@@ -855,6 +855,9 @@ static void idpf_ptp_release_vport_tstamp(struct idpf_vport *vport)
+ head = &vport->tx_tstamp_caps->latches_in_use;
+ list_for_each_entry_safe(ptp_tx_tstamp, tmp, head, list_member) {
+ list_del(&ptp_tx_tstamp->list_member);
++ if (ptp_tx_tstamp->skb)
++ consume_skb(ptp_tx_tstamp->skb);
++
+ kfree(ptp_tx_tstamp);
+ }
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
+index 4f1fb0cefe516..688a6f4e0acc8 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
+@@ -517,6 +517,7 @@ idpf_ptp_get_tstamp_value(struct idpf_vport *vport,
+ shhwtstamps.hwtstamp = ns_to_ktime(tstamp);
+ skb_tstamp_tx(ptp_tx_tstamp->skb, &shhwtstamps);
+ consume_skb(ptp_tx_tstamp->skb);
++ ptp_tx_tstamp->skb = NULL;
+
+ list_add(&ptp_tx_tstamp->list_member,
+ &tx_tstamp_caps->latches_free);
+--
+2.51.0
+
--- /dev/null
+From fb942643fc1d063b5868760f377b586d0d427493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 17:03:51 -0700
+Subject: ixgbe: fix too early devlink_free() in ixgbe_remove()
+
+From: Koichiro Den <den@valinux.co.jp>
+
+[ Upstream commit 5feef67b646d8f5064bac288e22204ffba2b9a4a ]
+
+Since ixgbe_adapter is embedded in devlink, calling devlink_free()
+prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
+to the end.
+
+KASAN report:
+
+ BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
+ Read of size 8 at addr ffff0000adf813e0 by task bash/2095
+ CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
+ [...]
+ Call trace:
+ show_stack+0x30/0x90 (C)
+ dump_stack_lvl+0x9c/0xd0
+ print_address_description.constprop.0+0x90/0x310
+ print_report+0x104/0x1f0
+ kasan_report+0x88/0x180
+ __asan_report_load8_noabort+0x20/0x30
+ ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
+ ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
+ ixgbe_remove+0x2d0/0x8c0 [ixgbe]
+ pci_device_remove+0xa0/0x220
+ device_remove+0xb8/0x170
+ device_release_driver_internal+0x318/0x490
+ device_driver_detach+0x40/0x68
+ unbind_store+0xec/0x118
+ drv_attr_store+0x64/0xb8
+ sysfs_kf_write+0xcc/0x138
+ kernfs_fop_write_iter+0x294/0x440
+ new_sync_write+0x1fc/0x588
+ vfs_write+0x480/0x6a0
+ ksys_write+0xf0/0x1e0
+ __arm64_sys_write+0x70/0xc0
+ invoke_syscall.constprop.0+0xcc/0x280
+ el0_svc_common.constprop.0+0xa8/0x248
+ do_el0_svc+0x44/0x68
+ el0_svc+0x54/0x160
+ el0t_64_sync_handler+0xa0/0xe8
+ el0t_64_sync+0x1b0/0x1b8
+
+Fixes: a0285236ab93 ("ixgbe: add initial devlink support")
+Signed-off-by: Koichiro Den <den@valinux.co.jp>
+Tested-by: Rinitha S <sx.rinitha@intel.com>
+Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-6-ef32a425b92a@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 6218bdb7f941f..86b9caece1042 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -12091,7 +12091,6 @@ static void ixgbe_remove(struct pci_dev *pdev)
+
+ devl_port_unregister(&adapter->devlink_port);
+ devl_unlock(adapter->devlink);
+- devlink_free(adapter->devlink);
+
+ ixgbe_stop_ipsec_offload(adapter);
+ ixgbe_clear_interrupt_scheme(adapter);
+@@ -12127,6 +12126,8 @@ static void ixgbe_remove(struct pci_dev *pdev)
+
+ if (disable_dev)
+ pci_disable_device(pdev);
++
++ devlink_free(adapter->devlink);
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 3718a923a04fbfa98eb12729fed6be4bb7ae3c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 09:25:46 +0200
+Subject: ksmbd: fix recursive locking in RPC handle list access
+
+From: Marios Makassikis <mmakassikis@freebox.fr>
+
+[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ]
+
+Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list
+access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
+
+This causes hung connections / tasks when a client attempts to open
+a named pipe. Using Samba's rpcclient tool:
+
+ $ rpcclient //192.168.1.254 -U user%password
+ $ rpcclient $> srvinfo
+ <connection hung here>
+
+Kernel side:
+ "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
+ Workqueue: ksmbd-io handle_ksmbd_work
+ Call trace:
+ __schedule from schedule+0x3c/0x58
+ schedule from schedule_preempt_disabled+0xc/0x10
+ schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8
+ rwsem_down_read_slowpath from down_read+0x28/0x30
+ down_read from ksmbd_session_rpc_method+0x18/0x3c
+ ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68
+ ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228
+ ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8
+ create_smb2_pipe from smb2_open+0x10c/0x27ac
+ smb2_open from handle_ksmbd_work+0x238/0x3dc
+ handle_ksmbd_work from process_scheduled_works+0x160/0x25c
+ process_scheduled_works from worker_thread+0x16c/0x1e8
+ worker_thread from kthread+0xa8/0xb8
+ kthread from ret_from_fork+0x14/0x38
+ Exception stack(0x8529ffb0 to 0x8529fff8)
+
+The task deadlocks because the lock is already held:
+ ksmbd_session_rpc_open
+ down_write(&sess->rpc_lock)
+ ksmbd_rpc_open
+ ksmbd_session_rpc_method
+ down_read(&sess->rpc_lock) <-- deadlock
+
+Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
+
+Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access")
+Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/mgmt/user_session.c | 7 ++-----
+ fs/smb/server/smb2pdu.c | 9 ++++++++-
+ fs/smb/server/transport_ipc.c | 12 ++++++++++++
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
+index b36d0676dbe58..00805aed0b07d 100644
+--- a/fs/smb/server/mgmt/user_session.c
++++ b/fs/smb/server/mgmt/user_session.c
+@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
+ int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
+ {
+ struct ksmbd_session_rpc *entry;
+- int method;
+
+- down_read(&sess->rpc_lock);
++ lockdep_assert_held(&sess->rpc_lock);
+ entry = xa_load(&sess->rpc_handle_list, id);
+- method = entry ? entry->method : 0;
+- up_read(&sess->rpc_lock);
+
+- return method;
++ return entry ? entry->method : 0;
+ }
+
+ void ksmbd_session_destroy(struct ksmbd_session *sess)
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index a1db006ab6e92..287200d7c0764 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -4624,8 +4624,15 @@ static int smb2_get_info_file_pipe(struct ksmbd_session *sess,
+ * pipe without opening it, checking error condition here
+ */
+ id = req->VolatileFileId;
+- if (!ksmbd_session_rpc_method(sess, id))
++
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
++ if (!ksmbd_session_rpc_method(sess, id)) {
++ up_read(&sess->rpc_lock);
+ return -ENOENT;
++ }
++ up_read(&sess->rpc_lock);
+
+ ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n",
+ req->FileInfoClass, req->VolatileFileId);
+diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c
+index 2aa1b29bea080..46f87fd1ce1cd 100644
+--- a/fs/smb/server/transport_ipc.c
++++ b/fs/smb/server/transport_ipc.c
+@@ -825,6 +825,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -833,6 +836,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle
+ req->flags |= KSMBD_RPC_WRITE_METHOD;
+ req->payload_sz = payload_sz;
+ memcpy(req->payload, payload, payload_sz);
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+@@ -849,6 +853,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -856,6 +863,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)
+ req->flags |= rpc_context_flags(sess);
+ req->flags |= KSMBD_RPC_READ_METHOD;
+ req->payload_sz = 0;
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+@@ -876,6 +884,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle
+ if (!msg)
+ return NULL;
+
++ lockdep_assert_not_held(&sess->rpc_lock);
++
++ down_read(&sess->rpc_lock);
+ msg->type = KSMBD_EVENT_RPC_REQUEST;
+ req = (struct ksmbd_rpc_command *)msg->payload;
+ req->handle = handle;
+@@ -884,6 +895,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle
+ req->flags |= KSMBD_RPC_IOCTL_METHOD;
+ req->payload_sz = payload_sz;
+ memcpy(req->payload, payload, payload_sz);
++ up_read(&sess->rpc_lock);
+
+ resp = ipc_msg_send_request(msg, req->handle);
+ ipc_msg_free(msg);
+--
+2.51.0
+
--- /dev/null
+From 63d39e190520694ad6db64da322862f13781542a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 11:19:44 +0200
+Subject: net: airoha: Take into account out-of-order tx completions in
+ airoha_dev_xmit()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit bd5afca115f181c85f992d42a57cd497bc823ccb ]
+
+Completion napi can free out-of-order tx descriptors if hw QoS is
+enabled and packets with different priority are queued to same DMA ring.
+Take into account possible out-of-order reports checking if the tx queue
+is full using circular buffer head/tail pointer instead of the number of
+queued packets.
+
+Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC")
+Suggested-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20251012-airoha-tx-busy-queue-v2-1-a600b08bab2d@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
+index 6d23c5c049b9a..ffb10c758c293 100644
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -1872,6 +1872,20 @@ static u32 airoha_get_dsa_tag(struct sk_buff *skb, struct net_device *dev)
+ #endif
+ }
+
++static bool airoha_dev_tx_queue_busy(struct airoha_queue *q, u32 nr_frags)
++{
++ u32 tail = q->tail <= q->head ? q->tail + q->ndesc : q->tail;
++ u32 index = q->head + nr_frags;
++
++ /* completion napi can free out-of-order tx descriptors if hw QoS is
++ * enabled and packets with different priorities are queued to the same
++ * DMA ring. Take into account possible out-of-order reports checking
++ * if the tx queue is full using circular buffer head/tail pointers
++ * instead of the number of queued packets.
++ */
++ return index >= tail;
++}
++
+ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
+@@ -1925,7 +1939,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+ txq = netdev_get_tx_queue(dev, qid);
+ nr_frags = 1 + skb_shinfo(skb)->nr_frags;
+
+- if (q->queued + nr_frags > q->ndesc) {
++ if (airoha_dev_tx_queue_busy(q, nr_frags)) {
+ /* not enough space in the queue */
+ netif_tx_stop_queue(txq);
+ spin_unlock_bh(&q->lock);
+--
+2.51.0
+
--- /dev/null
+From 368b2d237925ffeaedb437a19506e9865d8fd748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:50:52 +0200
+Subject: net: core: fix lockdep splat on device unregister
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 7f0fddd817ba6daebea1445ae9fab4b6d2294fa8 ]
+
+Since blamed commit, unregister_netdevice_many_notify() takes the netdev
+mutex if the device needs it.
+
+If the device list is too long, this will lock more device mutexes than
+lockdep can handle:
+
+unshare -n \
+ bash -c 'for i in $(seq 1 100);do ip link add foo$i type dummy;done'
+
+BUG: MAX_LOCK_DEPTH too low!
+turning off the locking correctness validator.
+depth: 48 max: 48!
+48 locks held by kworker/u16:1/69:
+ #0: ..148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work
+ #1: ..d40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work
+ #2: ..bd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net
+ #3: ..aa8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch
+ #4: ..cb0 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify
+[..]
+
+Add a helper to close and then unlock a list of net_devices.
+Devices that are not up have to be skipped - netif_close_many always
+removes them from the list without any other actions taken, so they'd
+remain in locked state.
+
+Close devices whenever we've used up half of the tracking slots or we
+processed entire list without hitting the limit.
+
+Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Link: https://patch.msgid.link/20251013185052.14021-1-fw@strlen.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 40 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 35 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 8d49b2198d072..5194b70769cc5 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -12088,6 +12088,35 @@ static void dev_memory_provider_uninstall(struct net_device *dev)
+ }
+ }
+
++/* devices must be UP and netdev_lock()'d */
++static void netif_close_many_and_unlock(struct list_head *close_head)
++{
++ struct net_device *dev, *tmp;
++
++ netif_close_many(close_head, false);
++
++ /* ... now unlock them */
++ list_for_each_entry_safe(dev, tmp, close_head, close_list) {
++ netdev_unlock(dev);
++ list_del_init(&dev->close_list);
++ }
++}
++
++static void netif_close_many_and_unlock_cond(struct list_head *close_head)
++{
++#ifdef CONFIG_LOCKDEP
++ /* We can only track up to MAX_LOCK_DEPTH locks per task.
++ *
++ * Reserve half the available slots for additional locks possibly
++ * taken by notifiers and (soft)irqs.
++ */
++ unsigned int limit = MAX_LOCK_DEPTH / 2;
++
++ if (lockdep_depth(current) > limit)
++ netif_close_many_and_unlock(close_head);
++#endif
++}
++
+ void unregister_netdevice_many_notify(struct list_head *head,
+ u32 portid, const struct nlmsghdr *nlh)
+ {
+@@ -12120,17 +12149,18 @@ void unregister_netdevice_many_notify(struct list_head *head,
+
+ /* If device is running, close it first. Start with ops locked... */
+ list_for_each_entry(dev, head, unreg_list) {
++ if (!(dev->flags & IFF_UP))
++ continue;
+ if (netdev_need_ops_lock(dev)) {
+ list_add_tail(&dev->close_list, &close_head);
+ netdev_lock(dev);
+ }
++ netif_close_many_and_unlock_cond(&close_head);
+ }
+- netif_close_many(&close_head, true);
+- /* ... now unlock them and go over the rest. */
++ netif_close_many_and_unlock(&close_head);
++ /* ... now go over the rest. */
+ list_for_each_entry(dev, head, unreg_list) {
+- if (netdev_need_ops_lock(dev))
+- netdev_unlock(dev);
+- else
++ if (!netdev_need_ops_lock(dev))
+ list_add_tail(&dev->close_list, &close_head);
+ }
+ netif_close_many(&close_head, true);
+--
+2.51.0
+
--- /dev/null
+From f1672549e01700b9d081b0d896f902fb6b42f3e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 1996d2e4e3e2c..7077d705e471f 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -508,25 +508,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 3c4e7a01e8363344ae172ac0626d0a53f192f7e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 8cf1380f36562..63154c8faecc3 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -609,6 +609,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index aaeb5d16f0c9a..158a30ae7c5f2 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -568,20 +568,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 3262e81223dfc..6405072050e0e 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1257,8 +1257,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 938f6172ae5f6d40068433fec7a49dbfc5f479ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 08:29:34 +0200
+Subject: net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with
+ more than 4GB DRAM
+
+From: Rex Lu <rex.lu@mediatek.com>
+
+[ Upstream commit 3abc0e55ea1fa2250e52bc860e8f24b2b9a2093a ]
+
+Limit tx/rx buffer address to 32-bit address space for board with more
+than 4GB DRAM.
+
+Fixes: 804775dfc2885 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Fixes: 6757d345dd7db ("net: ethernet: mtk_wed: introduce hw_rro support for MT7988")
+Tested-by: Daniel Pawlik <pawlik.dan@gmail.com>
+Tested-by: Matteo Croce <teknoraver@meta.com>
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_wed.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
+index 0a80d8f8cff7f..16aa7e4138d36 100644
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -670,7 +670,7 @@ mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev)
+ void *buf;
+ int s;
+
+- page = __dev_alloc_page(GFP_KERNEL);
++ page = __dev_alloc_page(GFP_KERNEL | GFP_DMA32);
+ if (!page)
+ return -ENOMEM;
+
+@@ -793,7 +793,7 @@ mtk_wed_hwrro_buffer_alloc(struct mtk_wed_device *dev)
+ struct page *page;
+ int s;
+
+- page = __dev_alloc_page(GFP_KERNEL);
++ page = __dev_alloc_page(GFP_KERNEL | GFP_DMA32);
+ if (!page)
+ return -ENOMEM;
+
+@@ -2405,6 +2405,10 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+ dev->version = hw->version;
+ dev->hw->pcie_base = mtk_wed_get_pcie_base(dev);
+
++ ret = dma_set_mask_and_coherent(hw->dev, DMA_BIT_MASK(32));
++ if (ret)
++ goto out;
++
+ if (hw->eth->dma_dev == hw->eth->dev &&
+ of_dma_is_coherent(hw->eth->dev->of_node))
+ mtk_eth_set_dma_device(hw->eth, hw->dev);
+--
+2.51.0
+
--- /dev/null
+From ed7bc017784014b34c965e1b655bea7d847ebe92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 15:06:56 +0200
+Subject: net: phy: bcm54811: Fix GMII/MII/MII-Lite selection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kamil Horák - 2N <kamilh@axis.com>
+
+[ Upstream commit e4d0c909bf8328d986bf3aadba0c33a72b5ae30d ]
+
+The Broadcom bcm54811 is hardware-strapped to select among RGMII and
+GMII/MII/MII-Lite modes. However, the corresponding bit, RGMII Enable
+in Miscellaneous Control Register must be also set to select desired
+RGMII or MII(-lite)/GMII mode.
+
+Fixes: 3117a11fff5af9e7 ("net: phy: bcm54811: PHY initialization")
+Signed-off-by: Kamil Horák - 2N <kamilh@axis.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20251009130656.1308237-2-kamilh@axis.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 20 +++++++++++++++++++-
+ include/linux/brcmphy.h | 1 +
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index a60e58ef90c4e..6884eaccc3e1d 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -407,7 +407,7 @@ static int bcm5481x_set_brrmode(struct phy_device *phydev, bool on)
+ static int bcm54811_config_init(struct phy_device *phydev)
+ {
+ struct bcm54xx_phy_priv *priv = phydev->priv;
+- int err, reg, exp_sync_ethernet;
++ int err, reg, exp_sync_ethernet, aux_rgmii_en;
+
+ /* Enable CLK125 MUX on LED4 if ref clock is enabled. */
+ if (!(phydev->dev_flags & PHY_BRCM_RX_REFCLK_UNUSED)) {
+@@ -436,6 +436,24 @@ static int bcm54811_config_init(struct phy_device *phydev)
+ if (err < 0)
+ return err;
+
++ /* Enable RGMII if configured */
++ if (phy_interface_is_rgmii(phydev))
++ aux_rgmii_en = MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN |
++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
++ else
++ aux_rgmii_en = 0;
++
++ /* Also writing Reserved bits 6:5 because the documentation requires
++ * them to be written to 0b11
++ */
++ err = bcm54xx_auxctl_write(phydev,
++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC,
++ MII_BCM54XX_AUXCTL_MISC_WREN |
++ aux_rgmii_en |
++ MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD);
++ if (err < 0)
++ return err;
++
+ return bcm5481x_set_brrmode(phydev, priv->brr_mode);
+ }
+
+diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
+index 15c35655f4826..115a964f30069 100644
+--- a/include/linux/brcmphy.h
++++ b/include/linux/brcmphy.h
+@@ -137,6 +137,7 @@
+
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC 0x07
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN 0x0010
++#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RSVD 0x0060
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN 0x0080
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN 0x0100
+ #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX 0x0200
+--
+2.51.0
+
--- /dev/null
+From 0c7ddfda82bf28bc46fe58421ab6179b2b836b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 13:02:49 +0200
+Subject: net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit 2c67301584f2671e320236df6bbe75ae09feb4d0 ]
+
+The driver is currently checking for PHYCR2 register presence in
+rtl8211f_config_init(), but it does so after accessing PHYCR2 to
+disable EEE. This was introduced in commit bfc17c165835 ("net:
+phy: realtek: disable PHY-mode EEE"). Move the PHYCR2 presence
+test before the EEE disablement and simplify the code.
+
+Fixes: bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/20251011110309.12664-1-marek.vasut@mailbox.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c
+index dd0d675149ad7..64af3b96f0288 100644
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -589,26 +589,25 @@ static int rtl8211f_config_init(struct phy_device *phydev)
+ str_enabled_disabled(val_rxdly));
+ }
+
++ if (!priv->has_phycr2)
++ return 0;
++
+ /* Disable PHY-mode EEE so LPI is passed to the MAC */
+ ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR2,
+ RTL8211F_PHYCR2_PHY_EEE_ENABLE, 0);
+ if (ret)
+ return ret;
+
+- if (priv->has_phycr2) {
+- ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE,
+- RTL8211F_PHYCR2, RTL8211F_CLKOUT_EN,
+- priv->phycr2);
+- if (ret < 0) {
+- dev_err(dev, "clkout configuration failed: %pe\n",
+- ERR_PTR(ret));
+- return ret;
+- }
+-
+- return genphy_soft_reset(phydev);
++ ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE,
++ RTL8211F_PHYCR2, RTL8211F_CLKOUT_EN,
++ priv->phycr2);
++ if (ret < 0) {
++ dev_err(dev, "clkout configuration failed: %pe\n",
++ ERR_PTR(ret));
++ return ret;
+ }
+
+- return 0;
++ return genphy_soft_reset(phydev);
+ }
+
+ static int rtl821x_suspend(struct phy_device *phydev)
+--
+2.51.0
+
--- /dev/null
+From ef3c2ce81f743068d5ca502a7155a6715008ec37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 5ccbe6ae2ebe9..e0c425779e67f 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3244,10 +3244,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -3256,6 +3252,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 3f488fbd80a5304be97c57689f12bb208ba7242a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 02:17:25 -0700
+Subject: netdevsim: set the carrier when the device goes up
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 ]
+
+Bringing a linked netdevsim device down and then up causes communication
+failure because both interfaces lack carrier. Basically a ifdown/ifup on
+the interface make the link broken.
+
+Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported
+for NAPI, calling netif_carrier_off() in nsim_stop(). This patch
+re-enables the carrier symmetrically on nsim_open(), in case the device
+is linked and the peer is up.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/netdev.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index 0178219f0db53..d7938e11f24de 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -528,6 +528,7 @@ static void nsim_enable_napi(struct netdevsim *ns)
+ static int nsim_open(struct net_device *dev)
+ {
+ struct netdevsim *ns = netdev_priv(dev);
++ struct netdevsim *peer;
+ int err;
+
+ netdev_assert_locked(dev);
+@@ -538,6 +539,12 @@ static int nsim_open(struct net_device *dev)
+
+ nsim_enable_napi(ns);
+
++ peer = rtnl_dereference(ns->peer);
++ if (peer && netif_running(peer->netdev)) {
++ netif_carrier_on(dev);
++ netif_carrier_on(peer->netdev);
++ }
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8a354e57b4c1627b325fae79c322cd9bdfe51164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 22:54:57 +0530
+Subject: nvme-auth: update sc_c in host response
+
+From: Martin George <martinus.gpy@gmail.com>
+
+[ Upstream commit 7e091add9c433bab6912228799bf508e2414acc3 ]
+
+The sc_c field is currently not updated in the host response to the
+controller challenge leading to failures while attempting secure
+channel concatenation. Fix this by adding a new sc_c variable to the
+dhchap queue context structure which is appropriately set during
+negotiate and then used in the host response.
+
+Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
+Signed-off-by: Martin George <marting@netapp.com>
+Signed-off-by: Prashanth Adurthi <prashana@netapp.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index 012fcfc79a73b..a01178caf15bb 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -36,6 +36,7 @@ struct nvme_dhchap_queue_context {
+ u8 status;
+ u8 dhgroup_id;
+ u8 hash_id;
++ u8 sc_c;
+ size_t hash_len;
+ u8 c1[64];
+ u8 c2[64];
+@@ -154,6 +155,8 @@ static int nvme_auth_set_dhchap_negotiate_data(struct nvme_ctrl *ctrl,
+ data->auth_protocol[0].dhchap.idlist[34] = NVME_AUTH_DHGROUP_6144;
+ data->auth_protocol[0].dhchap.idlist[35] = NVME_AUTH_DHGROUP_8192;
+
++ chap->sc_c = data->sc_c;
++
+ return size;
+ }
+
+@@ -489,7 +492,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl,
+ ret = crypto_shash_update(shash, buf, 2);
+ if (ret)
+ goto out;
+- memset(buf, 0, sizeof(buf));
++ *buf = chap->sc_c;
+ ret = crypto_shash_update(shash, buf, 1);
+ if (ret)
+ goto out;
+@@ -500,6 +503,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl,
+ strlen(ctrl->opts->host->nqn));
+ if (ret)
+ goto out;
++ memset(buf, 0, sizeof(buf));
+ ret = crypto_shash_update(shash, buf, 1);
+ if (ret)
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 2ab7548de49e3f799abeaaf9a59fc8390167bc84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 12:08:22 -0700
+Subject: nvme-multipath: Skip nr_active increments in RETRY disposition
+
+From: Amit Chaudhary <achaudhary@purestorage.com>
+
+[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ]
+
+For queue-depth I/O policy, this patch fixes unbalanced I/Os across
+nvme multipaths.
+
+Issue Description:
+
+The RETRY disposition incorrectly increments ns->ctrl->nr_active
+counter and reinitializes iostat start-time. In such cases nr_active
+counter never goes back to zero until that path disconnects and
+reconnects.
+
+Such a path is not chosen for new I/Os if multiple RETRY cases on a given
+a path cause its queue-depth counter to be artificially higher compared
+to other paths. This leads to unbalanced I/Os across paths.
+
+The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already
+set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set.
+
+base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a
+Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device")
+Signed-off-by: Amit Chaudhary <achaudhary@purestorage.com>
+Reviewed-by: Randy Jennings <randyj@purestorage.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 3da980dc60d91..543e17aead12b 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -182,12 +182,14 @@ void nvme_mpath_start_request(struct request *rq)
+ struct nvme_ns *ns = rq->q->queuedata;
+ struct gendisk *disk = ns->head->disk;
+
+- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) {
++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) &&
++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) {
+ atomic_inc(&ns->ctrl->nr_active);
+ nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE;
+ }
+
+- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq))
++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) ||
++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS))
+ return;
+
+ nvme_req(rq)->flags |= NVME_MPATH_IO_STATS;
+--
+2.51.0
+
--- /dev/null
+From e130b2ae1d5e87e7c128da28473e4f59b5f70e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 17:19:42 +1000
+Subject: nvme/tcp: handle tls partially sent records in write_space()
+
+From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+
+[ Upstream commit 5a869d017793399fd1d2609ff27e900534173eb3 ]
+
+With TLS enabled, records that are encrypted and appended to TLS TX
+list can fail to see a retry if the underlying TCP socket is busy, for
+example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known
+to the NVMe TCP driver, as the TLS layer successfully generated a record.
+
+Typically, the TLS write_space() callback would ensure such records are
+retried, but in the NVMe TCP Host driver, write_space() invokes
+nvme_tcp_write_space(). This causes a partially sent record in the TLS TX
+list to timeout after not being retried.
+
+This patch fixes the above by calling queue->write_space(), which calls
+into the TLS layer to retry any pending records.
+
+Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
+Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 1413788ca7d52..9a96df1a511c0 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1081,6 +1081,9 @@ static void nvme_tcp_write_space(struct sock *sk)
+ queue = sk->sk_user_data;
+ if (likely(queue && sk_stream_is_writeable(sk))) {
+ clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
++ /* Ensure pending TLS partial records are retried */
++ if (nvme_tcp_queue_tls(queue))
++ queue->write_space(sk);
+ queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
+ }
+ read_unlock_bh(&sk->sk_callback_lock);
+--
+2.51.0
+
--- /dev/null
+From e8cfb28b872db448db23f2c84cb3c4985e9db4db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 13:42:39 -0700
+Subject: Octeontx2-af: Fix missing error code in cgx_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit c5705a2a4aa35350e504b72a94b5c71c3754833c ]
+
+When CGX fails mapping to NIX, set the error code to -ENODEV, currently
+err is zero and that is treated as success path.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/aLAdlCg2_Yv7Y-3h@stanley.mountain/
+Fixes: d280233fc866 ("Octeontx2-af: Fix NIX X2P calibration failures")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20251010204239.94237-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 69324ae093973..31310018c3cac 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -1981,6 +1981,7 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ !is_cgx_mapped_to_nix(pdev->subsystem_device, cgx->cgx_id)) {
+ dev_notice(dev, "CGX %d not mapped to NIX, skipping probe\n",
+ cgx->cgx_id);
++ err = -ENODEV;
+ goto err_release_regions;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d1e75c3d344a5e787554984dfcdd22098726d445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 08:59:34 +0530
+Subject: powerpc/fadump: skip parameter area allocation when fadump is
+ disabled
+
+From: Sourabh Jain <sourabhjain@linux.ibm.com>
+
+[ Upstream commit 0843ba458439f38efdc14aa359c14ad0127edb01 ]
+
+Fadump allocates memory to pass additional kernel command-line argument
+to the fadump kernel. However, this allocation is not needed when fadump
+is disabled. So avoid allocating memory for the additional parameter
+area in such cases.
+
+Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early")
+Reviewed-by: Hari Bathini <hbathini@linux.ibm.com>
+Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
+Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early")
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20251008032934.262683-1-sourabhjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/fadump.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 5782e743fd270..4ebc333dd786f 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -1747,6 +1747,9 @@ void __init fadump_setup_param_area(void)
+ {
+ phys_addr_t range_start, range_end;
+
++ if (!fw_dump.fadump_enabled)
++ return;
++
+ if (!fw_dump.param_area_supported || fw_dump.dump_active)
+ return;
+
+--
+2.51.0
+
--- /dev/null
+From 3a7f3387ed1b37dac430660246f876be65b138fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 9c601f271c02b..4b0ac73565ea9 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4994,8 +4994,9 @@ static int rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_runtime_resume(device);
+--
+2.51.0
+
--- /dev/null
+From ef55ae3703d35b1fe0419e4f5b0901149208369d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:25:13 +0200
+Subject: riscv: kprobes: Fix probe address validation
+
+From: Fabian Vogt <fvogt@suse.de>
+
+[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
+
+When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
+arch_check_kprobe would start iterating all instructions starting from
+_text until the probed address. Not only is this very inefficient, but
+literal values in there (e.g. left by function patching) are
+misinterpreted in a way that causes a desync.
+
+Fix this by doing it like x86: start the iteration at the closest
+preceding symbol instead of the given starting point.
+
+Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
+Signed-off-by: Fabian Vogt <fvogt@suse.de>
+Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index c0738d6c6498a..8723390c7cad5 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
+-static bool __kprobes arch_check_kprobe(struct kprobe *p)
++static bool __kprobes arch_check_kprobe(unsigned long addr)
+ {
+- unsigned long tmp = (unsigned long)p->addr - p->offset;
+- unsigned long addr = (unsigned long)p->addr;
++ unsigned long tmp, offset;
++
++ /* start iterating at the closest preceding symbol */
++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
++ return false;
++
++ tmp = addr - offset;
+
+ while (tmp <= addr) {
+ if (tmp == addr)
+@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if ((unsigned long)insn & 0x1)
+ return -EILSEQ;
+
+- if (!arch_check_kprobe(p))
++ if (!arch_check_kprobe((unsigned long)p->addr))
+ return -EILSEQ;
+
+ /* copy instruction */
+--
+2.51.0
+
--- /dev/null
+From b8384fcf947f8db716c1773faaa727c291918164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 19:43:51 +0200
+Subject: rust: cpufreq: fix formatting
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 32f072d9eaf9c31c2b0527a4a3370570a731e3cc ]
+
+We do our best to keep the repository `rustfmt`-clean, thus run the tool
+to fix the formatting issue.
+
+Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting
+Link: https://rust-for-linux.com/contributing#submit-checklist-addendum
+Fixes: f97aef092e19 ("cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency")
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Benno Lossin <lossin@kernel.org>
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/cpufreq.rs | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs
+index b762ecdc22b00..cb15f612028ed 100644
+--- a/rust/kernel/cpufreq.rs
++++ b/rust/kernel/cpufreq.rs
+@@ -39,8 +39,7 @@ use macros::vtable;
+ const CPUFREQ_NAME_LEN: usize = bindings::CPUFREQ_NAME_LEN as usize;
+
+ /// Default transition latency value in nanoseconds.
+-pub const DEFAULT_TRANSITION_LATENCY_NS: u32 =
+- bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS;
++pub const DEFAULT_TRANSITION_LATENCY_NS: u32 = bindings::CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS;
+
+ /// CPU frequency driver flags.
+ pub mod flags {
+--
+2.51.0
+
--- /dev/null
+From 95e227b36fa658b2a631b5fe2fa53359a152ce04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:17:27 +0530
+Subject: sched/deadline: Stop dl_server before CPU goes offline
+
+From: Peter Zijlstra (Intel) <peterz@infradead.org>
+
+[ Upstream commit ee6e44dfe6e50b4a5df853d933a96bdff5309e6e ]
+
+IBM CI tool reported kernel warning[1] when running a CPU removal
+operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1"
+
+WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170
+NIP [c0000000002b6ed8] cpudl_set+0x58/0x170
+LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0
+Call Trace:
+[c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable)
+[c0000000002b7cb8] dl_server_timer+0x168/0x2a0
+[c00000000034df84] __hrtimer_run_queues+0x1a4/0x390
+[c00000000034f624] hrtimer_interrupt+0x124/0x300
+[c00000000002a230] timer_interrupt+0x140/0x320
+
+Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck")
+
+This happens since:
+- dl_server hrtimer gets enqueued close to cpu offline, when
+ kthread_park enqueues a fair task.
+- CPU goes offline and drmgr removes it from cpu_present_mask.
+- hrtimer fires and warning is hit.
+
+Fix it by stopping the dl_server before CPU is marked dead.
+
+[1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/
+[2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr
+
+[sshegde: wrote the changelog and tested it]
+Fixes: 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck")
+Closes: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
+Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 2 ++
+ kernel/sched/deadline.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ccba6fc3c3fed..8575d67cbf738 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -8603,10 +8603,12 @@ int sched_cpu_dying(unsigned int cpu)
+ sched_tick_stop(cpu);
+
+ rq_lock_irqsave(rq, &rf);
++ update_rq_clock(rq);
+ if (rq->nr_running != 1 || rq_has_pinned_tasks(rq)) {
+ WARN(true, "Dying CPU not properly vacated!");
+ dump_rq_tasks(rq, KERN_WARNING);
+ }
++ dl_server_stop(&rq->fair_server);
+ rq_unlock_irqrestore(rq, &rf);
+
+ calc_load_migrate(rq);
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 615411a0a8813..7b7671060bf9e 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -1582,6 +1582,9 @@ void dl_server_start(struct sched_dl_entity *dl_se)
+ if (!dl_server(dl_se) || dl_se->dl_server_active)
+ return;
+
++ if (WARN_ON_ONCE(!cpu_online(cpu_of(rq))))
++ return;
++
+ dl_se->dl_server_active = 1;
+ enqueue_dl_entity(dl_se, ENQUEUE_WAKEUP);
+ if (!dl_task(dl_se->rq->curr) || dl_entity_preempt(dl_se, &rq->curr->dl))
+--
+2.51.0
+
--- /dev/null
+From 633327d761ca853ac6c2d2296167f74d1e8149d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 8ce56a8d507f9..8f0b1acace0ad 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8829,21 +8829,21 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
--- /dev/null
+From 7b582140c19e64142cb7c9e2f199f7b4cabd58c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 11:53:30 +0800
+Subject: selftests: arg_parsing: Ensure data is flushed to disk before
+ reading.
+
+From: Xing Guo <higuoxing@gmail.com>
+
+[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ]
+
+test_parse_test_list_file writes some data to
+/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read
+the data back. However, after writing data to that file, we forget to
+call fsync() and it's causing testing failure in my laptop. This patch
+helps fix it by adding the missing fsync() call.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Xing Guo <higuoxing@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index fbf0d9c2f58b3..e27d66b75fb1f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void)
+ if (!ASSERT_OK(ferror(fp), "prepare tmp"))
+ goto out_fclose;
+
++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp"))
++ goto out_fclose;
++
+ init_test_filter_set(&set);
+
+ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
+--
+2.51.0
+
--- /dev/null
+From 72eadd505de917e389f0120fee665e8a0fdd153b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 13:20:37 -0700
+Subject: selftests/bpf: make arg_parsing.c more robust to crashes
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ]
+
+We started getting a crash in BPF CI, which seems to originate from
+test_parse_test_list_file() test and is happening at this line:
+
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+
+One way we can crash there is if set.cnt zero, which is checked for with
+ASSERT_EQ() above, but we proceed after this regardless of the outcome.
+Instead of crashing, we should bail out with test failure early.
+
+Similarly, if parse_test_list_file() fails, we shouldn't be even looking
+at set, so bail even earlier if ASSERT_OK() fails.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index bb143de68875c..fbf0d9c2f58b3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)
+
+ init_test_filter_set(&set);
+
+- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file");
++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
++ goto out_fclose;
++
++ if (!ASSERT_EQ(set.cnt, 4, "test count"))
++ goto out_free_set;
+
+- ASSERT_EQ(set.cnt, 4, "test count");
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+ ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count");
+ ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name");
+@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)
+ ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name");
+ ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name");
+
++out_free_set:
+ free_test_filter_set(&set);
+-
+ out_fclose:
+ fclose(fp);
+ out_remove:
+--
+2.51.0
+
--- /dev/null
+From 5d0494c5ab69c8ebe73b063f3edf09792a4fe2f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 16:00:39 +0800
+Subject: selftests: net: check jq command is supported
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit 4f86eb0a38bc719ba966f155071a6f0594327f34 ]
+
+The jq command is used in vlan_bridge_binding.sh, if it is not supported,
+the test will spam the following log.
+
+ # ./vlan_bridge_binding.sh: line 51: jq: command not found
+ # ./vlan_bridge_binding.sh: line 51: jq: command not found
+ # ./vlan_bridge_binding.sh: line 51: jq: command not found
+ # ./vlan_bridge_binding.sh: line 51: jq: command not found
+ # ./vlan_bridge_binding.sh: line 51: jq: command not found
+ # TEST: Test bridge_binding on->off when lower down [FAIL]
+ # Got operstate of , expected 0
+
+The rtnetlink.sh has the same problem. It makes sense to check if jq is
+installed before running these tests. After this patch, the
+vlan_bridge_binding.sh skipped if jq is not supported:
+
+ # timeout set to 3600
+ # selftests: net: vlan_bridge_binding.sh
+ # TEST: jq not installed [SKIP]
+
+Fixes: dca12e9ab760 ("selftests: net: Add a VLAN bridge binding selftest")
+Fixes: 6a414fd77f61 ("selftests: rtnetlink: Add an address proto test")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20251013080039.3035898-1-wangliang74@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/rtnetlink.sh | 2 ++
+ tools/testing/selftests/net/vlan_bridge_binding.sh | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
+index d6c00efeb6642..281758e407888 100755
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -1453,6 +1453,8 @@ usage: ${0##*/} OPTS
+ EOF
+ }
+
++require_command jq
++
+ #check for needed privileges
+ if [ "$(id -u)" -ne 0 ];then
+ end_test "SKIP: Need root privileges"
+diff --git a/tools/testing/selftests/net/vlan_bridge_binding.sh b/tools/testing/selftests/net/vlan_bridge_binding.sh
+index e7cb8c678bdee..fe5472d844243 100755
+--- a/tools/testing/selftests/net/vlan_bridge_binding.sh
++++ b/tools/testing/selftests/net/vlan_bridge_binding.sh
+@@ -249,6 +249,8 @@ test_binding_toggle_off_when_upper_down()
+ do_test_binding_off : "on->off when upper down"
+ }
+
++require_command jq
++
+ trap defer_scopes_cleanup EXIT
+ setup_prepare
+ tests_run
+--
+2.51.0
+
usb-gadget-f_ecm-refactor-bind-path-to-use-__free.patch
usb-gadget-f_ncm-refactor-bind-path-to-use-__free.patch
hid-multitouch-fix-sticky-fingers.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+coredump-fix-core_pattern-input-validation.patch
+can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch
+can-m_can-m_can_handle_state_errors-fix-can-state-tr.patch
+can-m_can-m_can_chip_config-bring-up-interface-in-co.patch
+can-m_can-fix-can-state-in-system-pm.patch
+net-mtk-wed-add-dma-mask-limitation-and-gfp_dma32-fo.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+doc-fix-seg6_flowlabel-path.patch
+can-j1939-add-missing-calls-in-netdev_unregister-not.patch
+dpll-zl3073x-refactor-dpll-initialization.patch
+dpll-zl3073x-handle-missing-or-corrupted-flash-confi.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-phy-bcm54811-fix-gmii-mii-mii-lite-selection.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+idpf-cleanup-remaining-skbs-in-ptp-flows.patch
+ixgbe-fix-too-early-devlink_free-in-ixgbe_remove.patch
+net-phy-realtek-avoid-phycr2-access-if-phycr2-not-pr.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+octeontx2-af-fix-missing-error-code-in-cgx_probe.patch
+usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+net-airoha-take-into-account-out-of-order-tx-complet.patch
+selftests-net-check-jq-command-is-supported.patch
+net-core-fix-lockdep-splat-on-device-unregister.patch
+ksmbd-fix-recursive-locking-in-rpc-handle-list-acces.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+tls-trim-encrypted-message-to-match-the-plaintext-on.patch
+tls-wait-for-async-encrypt-in-case-of-error-during-l.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+netdevsim-set-the-carrier-when-the-device-goes-up.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+drm-panthor-ensure-mcu-is-disabled-on-suspend.patch
+nvme-multipath-skip-nr_active-increments-in-retry-di.patch
+riscv-kprobes-fix-probe-address-validation.patch
+drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch
+powerpc-fadump-skip-parameter-area-allocation-when-f.patch
+asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch
+asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch
+asoc-nau8821-generalize-helper-to-clear-irq-status.patch
+asoc-nau8821-consistently-clear-interrupts-before-un.patch
+asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch
+drm-i915-guc-skip-communication-warning-on-reset-in-.patch
+drm-i915-frontbuffer-move-bo-refcounting-intel_front.patch
+drm-i915-fb-fix-the-set_tiling-vs.-addfb-race-again.patch
+drm-amdgpu-add-ip-offset-support-for-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-without-ip.patch
+drm-amdgpu-fix-handling-of-harvesting-for-ip_discove.patch
+drm-amdgpu-handle-wrap-around-in-reemit-handling.patch
+drm-amdgpu-set-an-error-on-all-fences-from-a-bad-con.patch
+drm-amdgpu-drop-unused-structures-in-amdgpu_drm.h.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+drm-xe-enable-media-sampler-power-gating.patch
+cxl-features-add-check-for-no-entries-in-cxl_feature.patch
+x86-mm-fix-smp-ordering-in-switch_mm_irqs_off.patch
+drm-draw-fix-color-truncation-in-drm_draw_fill24.patch
+drm-rockchip-vop2-use-correct-destination-rectangle-.patch
+hid-intel-thc-hid-intel-quickspi-switch-first-interr.patch
+sched-deadline-stop-dl_server-before-cpu-goes-offlin.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
+accel-qaic-fix-bootlog-initialization-ordering.patch
+accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch
+accel-qaic-synchronize-access-to-dbc-request-queue-h.patch
+nvme-auth-update-sc_c-in-host-response.patch
+cxl-trace-subtract-to-find-an-hpa_alias0-in-cxl_pois.patch
+selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch
+alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch
+blk-mq-fix-stale-tag-depth-for-shared-sched-tags-in-.patch
+block-remove-elevator_lock-usage-from-blkg_conf-froz.patch
+hid-hid-input-only-ignore-0-battery-events-for-digit.patch
+hid-multitouch-fix-name-of-stylus-input-devices.patch
+asoc-amd-sdw_utils-avoid-null-deref-when-devm_kaspri.patch
+drm-xe-evict-drop-bogus-assert.patch
+selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch
+nvme-tcp-handle-tls-partially-sent-records-in-write_.patch
+rust-cpufreq-fix-formatting.patch
--- /dev/null
+From 0527c3c699fd55467205ed12bafbdee015c4b86b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index caf11920a8786..16251d8e1b592 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2219,7 +2219,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2281,9 +2282,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From b4417266fa4342d4a8c827421519bdb6ac757a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index b4dc93a487184..8b64e4667c21c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5803,7 +5803,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5944,9 +5944,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From 159388788f0787e45486246a0e059dc98ad78d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index a3ccb3135e51a..39a2ab47fe720 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -255,12 +255,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From e86eb295b45d4714922b907f857ab1a51d6ab016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index e3d852091e7a4..d171353699800 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ } else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From 5aea4d29d081c4512445b7e01d6bcb2062a329eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:56 +0200
+Subject: tls: trim encrypted message to match the plaintext on short splice
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ]
+
+During tls_sw_sendmsg_locked, we pre-allocate the encrypted message
+for the size we're expecting to send during the current iteration, but
+we may end up sending less, for example when splicing: if we're
+getting the data from small fragments of memory, we may fill up all
+the slots in the skmsg with less data than expected.
+
+In this case, we need to trim the encrypted message to only the length
+we actually need, to avoid pushing uninitialized bytes down the
+underlying TCP socket.
+
+Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index daac9fd4be7eb..36ca3011ab876 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ tls_ctx->pending_open_record_frags = true;
+
+- if (sk_msg_full(msg_pl))
++ if (sk_msg_full(msg_pl)) {
+ full_record = true;
++ sk_msg_trim(sk, msg_en,
++ msg_pl->sg.size + prot->overhead_size);
++ }
+
+ if (full_record || eor)
+ goto copied;
+--
+2.51.0
+
--- /dev/null
+From 3bfb4c7b18cd944f834b9a417f20da87b07a8092 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:57 +0200
+Subject: tls: wait for async encrypt in case of error during latter iterations
+ of sendmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
+
+If we hit an error during the main loop of tls_sw_sendmsg_locked (eg
+failed allocation), we jump to send_end and immediately
+return. Previous iterations may have queued async encryption requests
+that are still pending. We should wait for those before returning, as
+we could otherwise be reading from memory that userspace believes
+we're not using anymore, which would be a sort of use-after-free.
+
+This is similar to what tls_sw_recvmsg already does: failures during
+the main loop jump to the "wait for async" code, not straight to the
+unlock/return.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 36ca3011ab876..1478d515badc8 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ if (ret == -EINPROGRESS)
+ num_async++;
+ else if (ret != -EAGAIN)
+- goto send_end;
++ goto end;
+ }
+ }
+
+@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto alloc_encrypted;
+ }
+
++send_end:
+ if (!num_async) {
+- goto send_end;
++ goto end;
+ } else if (num_zc || eor) {
+ int err;
+
+@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ tls_tx_records(sk, msg->msg_flags);
+ }
+
+-send_end:
++end:
+ ret = sk_stream_error(sk, msg->msg_flags, ret);
+ return copied > 0 ? copied : ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From a241f9ebd35414cf2a96fe585f68d52107470f15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:59 +0200
+Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ]
+
+Async decryption calls tls_strp_msg_hold to create a clone of the
+input skb to hold references to the memory it uses. If we fail to
+allocate that clone, proceeding with async decryption can lead to
+various issues (UAF on the skb, writing into userspace memory after
+the recv() call has returned).
+
+In this case, wait for all pending decryption requests.
+
+Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 1478d515badc8..e3d852091e7a4 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1641,8 +1641,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+
+ if (unlikely(darg->async)) {
+ err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold);
+- if (err)
+- __skb_queue_tail(&ctx->async_hold, darg->skb);
++ if (err) {
++ err = tls_decrypt_async_wait(ctx);
++ darg->async = false;
++ }
+ return err;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ce83f147a89e4dd8d12b50908ffdf9cc2418805e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 15:05:18 +0800
+Subject: usbnet: Fix using smp_processor_id() in preemptible code warnings
+
+From: Zqiang <qiang.zhang@linux.dev>
+
+[ Upstream commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 ]
+
+Syzbot reported the following warning:
+
+BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879
+caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
+CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary)
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
+ check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49
+ usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
+ usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708
+ usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417
+ __dev_set_mtu net/core/dev.c:9443 [inline]
+ netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496
+ netif_set_mtu+0xb0/0x160 net/core/dev.c:9520
+ dev_set_mtu+0xae/0x170 net/core/dev_api.c:247
+ dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572
+ dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821
+ sock_do_ioctl+0x19d/0x280 net/socket.c:1204
+ sock_ioctl+0x42f/0x6a0 net/socket.c:1311
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:906 [inline]
+ __se_sys_ioctl fs/ioctl.c:892 [inline]
+ __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+For historical and portability reasons, the netif_rx() is usually
+run in the softirq or interrupt context, this commit therefore add
+local_bh_disable/enable() protection in the usbnet_resume_rx().
+
+Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
+Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1e1
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Zqiang <qiang.zhang@linux.dev>
+Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/usbnet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 511c4154cf742..bf01f27285318 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -702,6 +702,7 @@ void usbnet_resume_rx(struct usbnet *dev)
+ struct sk_buff *skb;
+ int num = 0;
+
++ local_bh_disable();
+ clear_bit(EVENT_RX_PAUSED, &dev->flags);
+
+ while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) {
+@@ -710,6 +711,7 @@ void usbnet_resume_rx(struct usbnet *dev)
+ }
+
+ queue_work(system_bh_wq, &dev->bh_work);
++ local_bh_enable();
+
+ netif_dbg(dev, rx_status, dev->net,
+ "paused rx queue disabled, %d skbs requeued\n", num);
+--
+2.51.0
+
--- /dev/null
+From 0244c8d122992b5a47cc3d1b1514c5a2882683d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 15:43:04 +0200
+Subject: x86/mm: Fix SMP ordering in switch_mm_irqs_off()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 ]
+
+Stephen noted that it is possible to not have an smp_mb() between
+the loaded_mm store and the tlb_gen load in switch_mm(), meaning the
+ordering against flush_tlb_mm_range() goes out the window, and it
+becomes possible for switch_mm() to not observe a recent tlb_gen
+update and fail to flush the TLBs.
+
+[ dhansen: merge conflict fixed by Ingo ]
+
+Fixes: 209954cbc7d0 ("x86/mm/tlb: Update mm_cpumask lazily")
+Reported-by: Stephen Dolan <sdolan@janestreet.com>
+Closes: https://lore.kernel.org/all/CAHDw0oGd0B4=uuv8NGqbUQ_ZVmSheU2bN70e4QhFXWvuAZdt2w@mail.gmail.com/
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/tlb.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 39f80111e6f17..5d221709353e0 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -911,11 +911,31 @@ void switch_mm_irqs_off(struct mm_struct *unused, struct mm_struct *next,
+ * CR3 and cpu_tlbstate.loaded_mm are not all in sync.
+ */
+ this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING);
+- barrier();
+
+- /* Start receiving IPIs and then read tlb_gen (and LAM below) */
++ /*
++ * Make sure this CPU is set in mm_cpumask() such that we'll
++ * receive invalidation IPIs.
++ *
++ * Rely on the smp_mb() implied by cpumask_set_cpu()'s atomic
++ * operation, or explicitly provide one. Such that:
++ *
++ * switch_mm_irqs_off() flush_tlb_mm_range()
++ * smp_store_release(loaded_mm, SWITCHING); atomic64_inc_return(tlb_gen)
++ * smp_mb(); // here // smp_mb() implied
++ * atomic64_read(tlb_gen); this_cpu_read(loaded_mm);
++ *
++ * we properly order against flush_tlb_mm_range(), where the
++ * loaded_mm load can happen in mative_flush_tlb_multi() ->
++ * should_flush_tlb().
++ *
++ * This way switch_mm() must see the new tlb_gen or
++ * flush_tlb_mm_range() must see the new loaded_mm, or both.
++ */
+ if (next != &init_mm && !cpumask_test_cpu(cpu, mm_cpumask(next)))
+ cpumask_set_cpu(cpu, mm_cpumask(next));
++ else
++ smp_mb();
++
+ next_tlb_gen = atomic64_read(&next->context.tlb_gen);
+
+ ns = choose_new_asid(next, next_tlb_gen);
+--
+2.51.0
+
--- /dev/null
+From 76fcec5867489726b4a2d62d856d555877a41aef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 14:23:20 +0200
+Subject: accel/qaic: Treat remaining == 0 as error in
+ find_and_map_user_pages()
+
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+
+[ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ]
+
+Currently, if find_and_map_user_pages() takes a DMA xfer request from the
+user with a length field set to 0, or in a rare case, the host receives
+QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size
+is equal to the requested transaction size, the function will return 0
+before allocating an sgt or setting the fields of the dma_xfer struct.
+In that case, encode_addr_size_pairs() will try to access the sgt which
+will lead to a general protection fault.
+
+Return an EINVAL in case the user provides a zero-sized ALP, or the device
+requests continuation after all of the bytes have been transferred.
+
+Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()")
+Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index f3db3fa91dd52..08b78f5678532 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
+ return -EINVAL;
+ remaining = in_trans->size - resources->xferred_dma_size;
+ if (remaining == 0)
+- return 0;
++ return -EINVAL;
+
+ if (check_add_overflow(xfer_start_addr, remaining, &end))
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 64ac609e8703199470096d3540bec51928d6395d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 20:05:52 -0700
+Subject: ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit d41f68dff783d181a8fd462e612bda0fbab7f735 ]
+
+Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning.
+
+Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags'
+Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags'
+
+Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h
+index 775db3fc4959f..ec10270c2cce3 100644
+--- a/sound/firewire/amdtp-stream.h
++++ b/sound/firewire/amdtp-stream.h
+@@ -32,7 +32,7 @@
+ * allows 5 times as large as IEC 61883-6 defines.
+ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include
+ * valid EOH.
+- * @CIP_NO_HEADERS: a lack of headers in packets
++ * @CIP_NO_HEADER: a lack of headers in packets
+ * @CIP_UNALIGHED_DBC: Only for in-stream. The value of dbc is not alighed to
+ * the value of current SYT_INTERVAL; e.g. initial value is not zero.
+ * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff.
+--
+2.51.0
+
--- /dev/null
+From 919edb8699e182037458d566370fe985149bcbfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 13:16:45 +0800
+Subject: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
+
+From: Jiaming Zhang <r772577952@gmail.com>
+
+[ Upstream commit 28412b489b088fb88dff488305fd4e56bd47f6e4 ]
+
+In try_to_register_card(), the return value of usb_ifnum_to_if() is
+passed directly to usb_interface_claimed() without a NULL check, which
+will lead to a NULL pointer dereference when creating an invalid
+USB audio device. Fix this by adding a check to ensure the interface
+pointer is valid before passing it to usb_interface_claimed().
+
+Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration")
+Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/
+Signed-off-by: Jiaming Zhang <r772577952@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 7743ea983b1a8..9335bc20c56df 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -754,10 +754,16 @@ get_alias_quirk(struct usb_device *dev, unsigned int id)
+ */
+ static int try_to_register_card(struct snd_usb_audio *chip, int ifnum)
+ {
++ struct usb_interface *iface;
++
+ if (check_delayed_register_option(chip) == ifnum ||
+- chip->last_iface == ifnum ||
+- usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface)))
++ chip->last_iface == ifnum)
++ return snd_card_register(chip->card);
++
++ iface = usb_ifnum_to_if(chip->dev, chip->last_iface);
++ if (iface && usb_interface_claimed(iface))
+ return snd_card_register(chip->card);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8bd76c534410eab5cbe0b4ca434f84e44dbb9225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 12:21:42 +0530
+Subject: amd-xgbe: Avoid spurious link down messages during interface toggle
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 ]
+
+During interface toggle operations (ifdown/ifup), the driver currently
+resets the local helper variable 'phy_link' to -1. This causes the link
+state machine to incorrectly interpret the state as a link change event,
+resulting in spurious "Link is down" messages being logged when the
+interface is brought back up.
+
+Preserve the phy_link state across interface toggles to avoid treating
+the -1 sentinel value as a legitimate link state transition.
+
+Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop")
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 -
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 34d45cebefb5d..b4d57da71de2a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1172,7 +1172,6 @@ static void xgbe_free_rx_data(struct xgbe_prv_data *pdata)
+
+ static int xgbe_phy_reset(struct xgbe_prv_data *pdata)
+ {
+- pdata->phy_link = -1;
+ pdata->phy_speed = SPEED_UNKNOWN;
+
+ return pdata->phy_if.phy_reset(pdata);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 8345d439184eb..63012119f2c8e 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1664,6 +1664,7 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ pdata->phy.duplex = DUPLEX_FULL;
+ }
+
++ pdata->phy_link = 0;
+ pdata->phy.link = 0;
+
+ pdata->phy.pause_autoneg = pdata->pause_autoneg;
+--
+2.51.0
+
--- /dev/null
+From 3ec991bd6f0a6a78d31c457a1fef016cef122c14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 19:03:13 +0200
+Subject: ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 6370a996f308ea3276030769b7482b346e7cc7c1 ]
+
+The gain ranges specified in Renesas IDT821034 codec documentation
+are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the
+receive path (DAC). Allthough the registers allow programming values
+outside those ranges, the signal S/N and distorsion are only
+guaranteed in the specified ranges.
+
+Set ranges to the specified ones.
+
+Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/idt821034.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/idt821034.c b/sound/soc/codecs/idt821034.c
+index 2cc7b9166e695..068a5448e273e 100644
+--- a/sound/soc/codecs/idt821034.c
++++ b/sound/soc/codecs/idt821034.c
+@@ -548,14 +548,14 @@ static int idt821034_kctrl_mute_put(struct snd_kcontrol *kcontrol,
+ return ret;
+ }
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -6520, 1306);
+-#define IDT821034_GAIN_IN_MIN_RAW 1 /* -65.20 dB -> 10^(-65.2/20.0) * 1820 = 1 */
+-#define IDT821034_GAIN_IN_MAX_RAW 8191 /* 13.06 dB -> 10^(13.06/20.0) * 1820 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_in, -300, 1300);
++#define IDT821034_GAIN_IN_MIN_RAW 1288 /* -3.0 dB -> 10^(-3.0/20.0) * 1820 = 1288 */
++#define IDT821034_GAIN_IN_MAX_RAW 8130 /* 13.0 dB -> 10^(13.0/20.0) * 1820 = 8130 */
+ #define IDT821034_GAIN_IN_INIT_RAW 1820 /* 0dB -> 10^(0/20) * 1820 = 1820 */
+
+-static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -6798, 1029);
+-#define IDT821034_GAIN_OUT_MIN_RAW 1 /* -67.98 dB -> 10^(-67.98/20.0) * 2506 = 1*/
+-#define IDT821034_GAIN_OUT_MAX_RAW 8191 /* 10.29 dB -> 10^(10.29/20.0) * 2506 = 8191 */
++static const DECLARE_TLV_DB_LINEAR(idt821034_gain_out, -1300, 300);
++#define IDT821034_GAIN_OUT_MIN_RAW 561 /* -13.0 dB -> 10^(-13.0/20.0) * 2506 = 561 */
++#define IDT821034_GAIN_OUT_MAX_RAW 3540 /* 3.0 dB -> 10^(3.0/20.0) * 2506 = 3540 */
+ #define IDT821034_GAIN_OUT_INIT_RAW 2506 /* 0dB -> 10^(0/20) * 2506 = 2506 */
+
+ static const struct snd_kcontrol_new idt821034_controls[] = {
+--
+2.51.0
+
--- /dev/null
+From a0c2268c8be79db09489618842fe8bb02ffc7928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:26 +0300
+Subject: ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 ]
+
+Stress testing the audio jack hotplug handling on a few Steam Deck units
+revealed that the debounce circuit is responsible for having a negative
+impact on the detection reliability, e.g. in some cases the ejection
+interrupt is not fired, while in other instances it goes into a kind of
+invalid state and generates a flood of misleading interrupts.
+
+Add new entries to the DMI table introduced via commit 1bc40efdaf4a
+("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect")
+and extend the quirk logic to allow bypassing the debounce circuit used
+for jack detection on Valve Steam Deck LCD and OLED models.
+
+While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to
+NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability
+by differentiating from similarly named register bits.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 33 +++++++++++++++++++++++++++------
+ 1 file changed, 27 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index 432b47340dbc7..48ed75c3a7db2 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -26,7 +26,8 @@
+ #include <sound/tlv.h>
+ #include "nau8821.h"
+
+-#define NAU8821_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_ACTIVE_HIGH BIT(0)
++#define NAU8821_QUIRK_JD_DB_BYPASS BIT(1)
+
+ static int nau8821_quirk;
+ static int quirk_override = -1;
+@@ -1171,9 +1172,10 @@ static void nau8821_setup_inserted_irq(struct nau8821 *nau8821)
+ regmap_update_bits(regmap, NAU8821_R1D_I2S_PCM_CTRL2,
+ NAU8821_I2S_MS_MASK, NAU8821_I2S_MS_SLAVE);
+
+- /* Not bypass de-bounce circuit */
+- regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
+- NAU8821_JACK_DET_DB_BYPASS, 0);
++ /* Do not bypass de-bounce circuit */
++ if (!(nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS))
++ regmap_update_bits(regmap, NAU8821_R0D_JACK_DET_CTRL,
++ NAU8821_JACK_DET_DB_BYPASS, 0);
+
+ regmap_update_bits(regmap, NAU8821_R0F_INTERRUPT_MASK,
+ NAU8821_IRQ_EJECT_EN, 0);
+@@ -1854,7 +1856,23 @@ static const struct dmi_system_id nau8821_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"),
+ },
+- .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH),
++ .driver_data = (void *)(NAU8821_QUIRK_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Valve Steam Deck LCD */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
++ },
++ {
++ /* Valve Steam Deck OLED */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
++ },
++ .driver_data = (void *)(NAU8821_QUIRK_JD_DB_BYPASS),
+ },
+ {}
+ };
+@@ -1896,9 +1914,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)
+
+ nau8821_check_quirks();
+
+- if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH)
++ if (nau8821_quirk & NAU8821_QUIRK_JD_ACTIVE_HIGH)
+ nau8821->jkdet_polarity = 0;
+
++ if (nau8821_quirk & NAU8821_QUIRK_JD_DB_BYPASS)
++ dev_dbg(dev, "Force bypassing jack detection debounce circuit\n");
++
+ nau8821_print_device_properties(nau8821);
+
+ nau8821_reset_chip(nau8821->regmap);
+--
+2.51.0
+
--- /dev/null
+From 3889e1389fb3916a5a134f7b059afef0912dbefe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:23 +0300
+Subject: ASoC: nau8821: Cancel jdet_work before handling jack ejection
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff ]
+
+The microphone detection work scheduled by a prior jack insertion
+interrupt may still be in a pending state or under execution when a jack
+ejection interrupt has been fired.
+
+This might lead to a racing condition or nau8821_jdet_work() completing
+after nau8821_eject_jack(), which will override the currently
+disconnected state of the jack and incorrectly report the headphone or
+the headset as being connected.
+
+Cancel any pending jdet_work or wait for its execution to finish before
+attempting to handle the ejection interrupt.
+
+Proceed similarly before launching the eject handler as a consequence of
+detecting an invalid insert interrupt.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index f307374834b55..ee65707a7827e 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1191,6 +1191,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+
+ if ((active_irq & NAU8821_JACK_EJECT_IRQ_MASK) ==
+ NAU8821_JACK_EJECT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_DIS);
+ nau8821_eject_jack(nau8821);
+@@ -1205,11 +1206,11 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)
+ clear_irq = NAU8821_KEY_RELEASE_IRQ;
+ } else if ((active_irq & NAU8821_JACK_INSERT_IRQ_MASK) ==
+ NAU8821_JACK_INSERT_DETECTED) {
++ cancel_work_sync(&nau8821->jdet_work);
+ regmap_update_bits(regmap, NAU8821_R71_ANALOG_ADC_1,
+ NAU8821_MICDET_MASK, NAU8821_MICDET_EN);
+ if (nau8821_is_jack_inserted(regmap)) {
+ /* detect microphone and jack type */
+- cancel_work_sync(&nau8821->jdet_work);
+ schedule_work(&nau8821->jdet_work);
+ /* Turn off insertion interruption at manual mode */
+ regmap_update_bits(regmap,
+--
+2.51.0
+
--- /dev/null
+From 46f16c52eae74515efe8fc8aa617995f95258aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 21:03:24 +0300
+Subject: ASoC: nau8821: Generalize helper to clear IRQ status
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e ]
+
+Instead of adding yet another utility function for dealing with the
+interrupt clearing register, generalize nau8821_int_status_clear_all()
+by renaming it to nau8821_irq_status_clear(), whilst introducing a
+second parameter to allow restricting the operation scope to a single
+interrupt instead of the whole range of active IRQs.
+
+While at it, also fix a spelling typo in the comment block.
+
+Note this is mainly a prerequisite for subsequent patches aiming to
+address some deficiencies in the implementation of the interrupt
+handler. Thus the presence of the Fixes tag below is intentional, to
+facilitate backporting.
+
+Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index ee65707a7827e..432b47340dbc7 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1030,12 +1030,17 @@ static bool nau8821_is_jack_inserted(struct regmap *regmap)
+ return active_high == is_high;
+ }
+
+-static void nau8821_int_status_clear_all(struct regmap *regmap)
++static void nau8821_irq_status_clear(struct regmap *regmap, int active_irq)
+ {
+- int active_irq, clear_irq, i;
++ int clear_irq, i;
+
+- /* Reset the intrruption status from rightmost bit if the corres-
+- * ponding irq event occurs.
++ if (active_irq) {
++ regmap_write(regmap, NAU8821_R11_INT_CLR_KEY_STATUS, active_irq);
++ return;
++ }
++
++ /* Reset the interruption status from rightmost bit if the
++ * corresponding irq event occurs.
+ */
+ regmap_read(regmap, NAU8821_R10_IRQ_STATUS, &active_irq);
+ for (i = 0; i < NAU8821_REG_DATA_LEN; i++) {
+@@ -1062,7 +1067,7 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)
+ snd_soc_dapm_sync(dapm);
+
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable the insertion interruption, disable the ejection inter-
+ * ruption, and then bypass de-bounce circuit.
+@@ -1528,7 +1533,7 @@ static int nau8821_resume_setup(struct nau8821 *nau8821)
+ nau8821_configure_sysclk(nau8821, NAU8821_CLK_DIS, 0);
+ if (nau8821->irq) {
+ /* Clear all interruption status */
+- nau8821_int_status_clear_all(regmap);
++ nau8821_irq_status_clear(regmap, 0);
+
+ /* Enable both insertion and ejection interruptions, and then
+ * bypass de-bounce circuit.
+--
+2.51.0
+
--- /dev/null
+From 22232807739339d4373ec1c9fd97e4d3e84f7c2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 17:46:32 +0200
+Subject: can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 ]
+
+Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to
+m_can_platform") moved the PM runtime enable from the m_can core
+driver into the m_can_platform.
+
+That patch forgot to move the pm_runtime_disable() to
+m_can_plat_remove(), so that unloading the m_can_platform driver
+causes an "Unbalanced pm_runtime_enable!" error message.
+
+Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the
+problem.
+
+Cc: Patrik Flykt <patrik.flykt@linux.intel.com>
+Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform")
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index cdb28d6a092c6..e5477775992e6 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -183,7 +183,7 @@ static void m_can_plat_remove(struct platform_device *pdev)
+ struct m_can_classdev *mcan_class = &priv->cdev;
+
+ m_can_class_unregister(mcan_class);
+-
++ pm_runtime_disable(mcan_class->dev);
+ m_can_class_free_dev(mcan_class->net);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6ee84cf411dcd99ff719481f1ca35d1c87844595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 13:42:57 +0800
+Subject: dax: skip read lock assertion for read-only filesystems
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d ]
+
+The commit 168316db3583("dax: assert that i_rwsem is held
+exclusive for writes") added lock assertions to ensure proper
+locking in DAX operations. However, these assertions trigger
+false-positive lockdep warnings since read lock is unnecessary
+on read-only filesystems(e.g., erofs).
+
+This patch skips the read lock assertion for read-only filesystems,
+eliminating the spurious warnings while maintaining the integrity
+checks for writable filesystems.
+
+Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Friendy Su <friendy.su@sony.com>
+Reviewed-by: Daniel Palmer <daniel.palmer@sony.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dax.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 8c09578fa0357..e1451efaab140 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1578,7 +1578,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (iov_iter_rw(iter) == WRITE) {
+ lockdep_assert_held_write(&iomi.inode->i_rwsem);
+ iomi.flags |= IOMAP_WRITE;
+- } else {
++ } else if (!sb_rdonly(iomi.inode->i_sb)) {
+ lockdep_assert_held(&iomi.inode->i_rwsem);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0aa0147256be2354566a0f22a5e7d2b4fcdc2c20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 16:18:59 +0200
+Subject: doc: fix seg6_flowlabel path
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 ]
+
+This sysctl is not per interface; it's global per netns.
+
+Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst")
+Reported-by: Philippe Guibert <philippe.guibert@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/seg6-sysctl.rst | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Documentation/networking/seg6-sysctl.rst b/Documentation/networking/seg6-sysctl.rst
+index 07c20e470bafe..1b6af4779be11 100644
+--- a/Documentation/networking/seg6-sysctl.rst
++++ b/Documentation/networking/seg6-sysctl.rst
+@@ -25,6 +25,9 @@ seg6_require_hmac - INTEGER
+
+ Default is 0.
+
++/proc/sys/net/ipv6/seg6_* variables:
++====================================
++
+ seg6_flowlabel - INTEGER
+ Controls the behaviour of computing the flowlabel of outer
+ IPv6 header in case of SR T.encaps
+--
+2.51.0
+
--- /dev/null
+From 18e28e973a803cb1746daf5108f5955297ebb7e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 08:06:42 +0200
+Subject: drm/amd/powerplay: Fix CIK shutdown temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf ]
+
+Remove extra multiplication.
+
+CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case
+the shutdown temperature is hardcoded in smu7_init_dpm_defaults
+and is already multiplied by 1000. The value was mistakenly
+multiplied another time by smu7_get_thermal_temperature_range.
+
+Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 53849fd3615f6..965ffcac17f86 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -5437,8 +5437,7 @@ static int smu7_get_thermal_temperature_range(struct pp_hwmgr *hwmgr,
+ thermal_data->max = table_info->cac_dtp_table->usSoftwareShutdownTemp *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+ else if (hwmgr->pp_table_version == PP_TABLE_V0)
+- thermal_data->max = data->thermal_temp_setting.temperature_shutdown *
+- PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
++ thermal_data->max = data->thermal_temp_setting.temperature_shutdown;
+
+ thermal_data->sw_ctf_threshold = thermal_data->max;
+
+--
+2.51.0
+
--- /dev/null
+From 286da28eca56d5d9c0feadbec2132591939fb8aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 12:59:53 +0200
+Subject: drm/bridge: lt9211: Drop check for last nibble of version register
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 ]
+
+There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 .
+The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the
+driver checks for right now. Since there is a possibility there will be
+yet another revision of the LT9211 in the future, drop the last version
+nibble check to allow all future revisions of the chip to work with this
+driver.
+
+This fix makes LT9211 rev. U5 work with this driver.
+
+Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt9211.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt9211.c b/drivers/gpu/drm/bridge/lontium-lt9211.c
+index 4d404f5ef87eb..ea192c90b543e 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt9211.c
++++ b/drivers/gpu/drm/bridge/lontium-lt9211.c
+@@ -120,8 +120,7 @@ static int lt9211_read_chipid(struct lt9211 *ctx)
+ }
+
+ /* Test for known Chip ID. */
+- if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE ||
+- chipid[2] != REG_CHIPID2_VALUE) {
++ if (chipid[0] != REG_CHIPID0_VALUE || chipid[1] != REG_CHIPID1_VALUE) {
+ dev_err(ctx->dev, "Unknown Chip ID: 0x%02x 0x%02x 0x%02x\n",
+ chipid[0], chipid[1], chipid[2]);
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 7d8bb8abdc6c5e9a9b1beeb7f4b2bebdf2389955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:29:04 -0400
+Subject: drm/i915/guc: Skip communication warning on reset in progress
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 ]
+
+GuC IRQ and tasklet handler receive just single G2H message, and let other
+messages to be received from next tasklet. During this chained tasklet
+process, if reset process started, communication will be disabled.
+Skip warning for this condition.
+
+Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler")
+Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com
+(cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+index 97eadd08181d6..38fad14ffd435 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c
+@@ -1281,9 +1281,16 @@ static int ct_receive(struct intel_guc_ct *ct)
+
+ static void ct_try_receive_message(struct intel_guc_ct *ct)
+ {
++ struct intel_guc *guc = ct_to_guc(ct);
+ int ret;
+
+- if (GEM_WARN_ON(!ct->enabled))
++ if (!ct->enabled) {
++ GEM_WARN_ON(!guc_to_gt(guc)->uc.reset_in_progress);
++ return;
++ }
++
++ /* When interrupt disabled, message handling is not expected */
++ if (!guc->interrupts.enabled)
+ return;
+
+ ret = ct_receive(ct);
+--
+2.51.0
+
--- /dev/null
+From fcd0f4105bf1417f1dcff85f92e91e0afecff39c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Oct 2025 07:20:01 -0700
+Subject: drm/rockchip: vop2: use correct destination rectangle height check
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e ]
+
+The vop2_plane_atomic_check() function incorrectly checks
+drm_rect_width(dest) twice instead of verifying both width and height.
+Fix the second condition to use drm_rect_height(dest) so that invalid
+destination rectangles with height < 4 are correctly rejected.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 0193d10867dd2..97486eba01b7b 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -984,7 +984,7 @@ static int vop2_plane_atomic_check(struct drm_plane *plane,
+ return format;
+
+ if (drm_rect_width(src) >> 16 < 4 || drm_rect_height(src) >> 16 < 4 ||
+- drm_rect_width(dest) < 4 || drm_rect_width(dest) < 4) {
++ drm_rect_width(dest) < 4 || drm_rect_height(dest) < 4) {
+ drm_err(vop2->drm, "Invalid size: %dx%d->%dx%d, min size is 4x4\n",
+ drm_rect_width(src) >> 16, drm_rect_height(src) >> 16,
+ drm_rect_width(dest), drm_rect_height(dest));
+--
+2.51.0
+
--- /dev/null
+From 208de4e7281d4ec04244e431b73212d72656427e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 21:28:44 -0700
+Subject: HID: hid-input: only ignore 0 battery events for digitizers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 ]
+
+Commit 581c4484769e ("HID: input: map digitizer battery usage") added
+handling of battery events for digitizers (typically for batteries
+presented in stylii). Digitizers typically report correct battery levels
+only when stylus is actively touching the surface, and in other cases
+they may report battery level of 0. To avoid confusing consumers of the
+battery information the code was added to filer out reports with 0
+battery levels.
+
+However there exist other kinds of devices that may legitimately report
+0 battery levels. Fix this by filtering out 0-level reports only for
+digitizer usages, and continue reporting them for other kinds of devices
+(Smart Batteries, etc).
+
+Reported-by: 卢国宏 <luguohong@xiaomi.com>
+Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f5c217ac4bfaa..f073d5621050a 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -622,7 +622,10 @@ static void hidinput_update_battery(struct hid_device *dev, unsigned int usage,
+ return;
+ }
+
+- if (value == 0 || value < dev->battery_min || value > dev->battery_max)
++ if ((usage & HID_USAGE_PAGE) == HID_UP_DIGITIZER && value == 0)
++ return;
++
++ if (value < dev->battery_min || value > dev->battery_max)
+ return;
+
+ capacity = hidinput_scale_battery_capacity(dev, value);
+--
+2.51.0
+
--- /dev/null
+From d48f4cd119da911aec61a346c61e6772efa8844c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 09:40:33 -0300
+Subject: HID: multitouch: fix name of Stylus input devices
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit aa4daea418ee4215dca5c8636090660c545cb233 ]
+
+HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by
+commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN").
+However, on multitouch devices, these suffixes may be overridden. Before
+that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after
+that, multitouch would override them to have an "UNKNOWN" suffix. Just add
+HID_DG_PEN to the list of non-overriden suffixes in multitouch.
+
+Before this fix:
+
+[ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+ELAN9008:00 04F3:2E14 UNKNOWN
+
+After this fix:
+
+[ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8
+
+ELAN9008:00 04F3:2E14 Stylus
+
+Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6f1e54ee8f05d..b9e67b408a4b9 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1658,6 +1658,7 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ case HID_CP_CONSUMER_CONTROL:
+ case HID_GD_WIRELESS_RADIO_CTLS:
+ case HID_GD_SYSTEM_MULTIAXIS:
++ case HID_DG_PEN:
+ /* already handled by hid core */
+ break;
+ case HID_DG_TOUCHSCREEN:
+--
+2.51.0
+
--- /dev/null
+From e9d82c33be38fef2de799e060bbbe21fda20e95f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Oct 2025 00:57:16 +0900
+Subject: net: dlink: handle dma_map_single() failure properly
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 ]
+
+There is no error handling for `dma_map_single()` failures.
+
+Add error handling by checking `dma_mapping_error()` and freeing
+the `skb` using `dev_kfree_skb()` (process context) when it fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Tested-on: D-Link DGE-550T Rev-A3
+Suggested-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 1c3a5cf379cd0..72c97dcd0fee0 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -498,25 +498,34 @@ static int alloc_list(struct net_device *dev)
+ for (i = 0; i < RX_RING_SIZE; i++) {
+ /* Allocated fixed size of skbuff */
+ struct sk_buff *skb;
++ dma_addr_t addr;
+
+ skb = netdev_alloc_skb_ip_align(dev, np->rx_buf_sz);
+ np->rx_skbuff[i] = skb;
+- if (!skb) {
+- free_list(dev);
+- return -ENOMEM;
+- }
++ if (!skb)
++ goto err_free_list;
++
++ addr = dma_map_single(&np->pdev->dev, skb->data,
++ np->rx_buf_sz, DMA_FROM_DEVICE);
++ if (dma_mapping_error(&np->pdev->dev, addr))
++ goto err_kfree_skb;
+
+ np->rx_ring[i].next_desc = cpu_to_le64(np->rx_ring_dma +
+ ((i + 1) % RX_RING_SIZE) *
+ sizeof(struct netdev_desc));
+ /* Rubicon now supports 40 bits of addressing space. */
+- np->rx_ring[i].fraginfo =
+- cpu_to_le64(dma_map_single(&np->pdev->dev, skb->data,
+- np->rx_buf_sz, DMA_FROM_DEVICE));
++ np->rx_ring[i].fraginfo = cpu_to_le64(addr);
+ np->rx_ring[i].fraginfo |= cpu_to_le64((u64)np->rx_buf_sz << 48);
+ }
+
+ return 0;
++
++err_kfree_skb:
++ dev_kfree_skb(np->rx_skbuff[i]);
++ np->rx_skbuff[i] = NULL;
++err_free_list:
++ free_list(dev);
++ return -ENOMEM;
+ }
+
+ static void rio_hw_init(struct net_device *dev)
+--
+2.51.0
+
--- /dev/null
+From 177b9596da1c144402d39aff2c007c98df14a86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 16:02:19 +0100
+Subject: net/ip6_tunnel: Prevent perpetual tunnel growth
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 ]
+
+Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too.
+While ipv4 tunnel headroom adjustment growth was limited in
+commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"),
+ipv6 tunnel yet increases the headroom without any ceiling.
+
+Reflect ipv4 tunnel headroom adjustment limit on ipv6 version.
+
+Credits to Francesco Ruggeri, who was originally debugging this issue
+and wrote local Arista-specific patch and a reproducer.
+
+Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit")
+Cc: Florian Westphal <fw@strlen.de>
+Cc: Francesco Ruggeri <fruggeri05@gmail.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_tunnels.h | 15 +++++++++++++++
+ net/ipv4/ip_tunnel.c | 14 --------------
+ net/ipv6/ip6_tunnel.c | 3 +--
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 006a61ddd36fa..3d36794cb1899 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -489,6 +489,21 @@ struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ int headroom, bool reply);
+
++static inline void ip_tunnel_adj_headroom(struct net_device *dev,
++ unsigned int headroom)
++{
++ /* we must cap headroom to some upperlimit, else pskb_expand_head
++ * will overflow header offsets in skb_headers_offset_update().
++ */
++ const unsigned int max_allowed = 512;
++
++ if (headroom > max_allowed)
++ headroom = max_allowed;
++
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
++}
++
+ int iptunnel_handle_offloads(struct sk_buff *skb, int gso_type_mask);
+
+ static inline int iptunnel_pull_offloads(struct sk_buff *skb)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index b5d64cd3ab0a2..090403c8cc6c3 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -567,20 +567,6 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ return 0;
+ }
+
+-static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom)
+-{
+- /* we must cap headroom to some upperlimit, else pskb_expand_head
+- * will overflow header offsets in skb_headers_offset_update().
+- */
+- static const unsigned int max_allowed = 512;
+-
+- if (headroom > max_allowed)
+- headroom = max_allowed;
+-
+- if (headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, headroom);
+-}
+-
+ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ u8 proto, int tunnel_hlen)
+ {
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index d645d022ce774..e635ddd41aba6 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1255,8 +1255,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > READ_ONCE(dev->needed_headroom))
+- WRITE_ONCE(dev->needed_headroom, max_headroom);
++ ip_tunnel_adj_headroom(dev, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 85bbbe5387408bf3b75a443b2f8ae3ead2aa5f18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 14:17:41 +0200
+Subject: net: tls: wait for async completion on last message
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 54001d0f2fdbc7852136a00f3e6fc395a9547ae5 ]
+
+When asynchronous encryption is used KTLS sends out the final data at
+proto->close time. This becomes problematic when the task calling
+close() receives a signal. In this case it can happen that
+tcp_sendmsg_locked() called at close time returns -ERESTARTSYS and the
+final data is not sent.
+
+The described situation happens when KTLS is used in conjunction with
+io_uring, as io_uring uses task_work_add() to add work to the current
+userspace task. A discussion of the problem along with a reproducer can
+be found in [1] and [2]
+
+Fix this by waiting for the asynchronous encryption to be completed on
+the final message. With this there is no data left to be sent at close
+time.
+
+[1] https://lore.kernel.org/all/20231010141932.GD3114228@pengutronix.de/
+[2] https://lore.kernel.org/all/20240315100159.3898944-1-s.hauer@pengutronix.de/
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Link: https://patch.msgid.link/20240904-ktls-wait-async-v1-1-a62892833110@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b014a4e066c5 ("tls: wait for async encrypt in case of error during latter iterations of sendmsg")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 21276ac1f81dc..1f22c7adf3e56 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1228,7 +1228,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+
+ if (!num_async) {
+ goto send_end;
+- } else if (num_zc) {
++ } else if (num_zc || eor) {
+ int err;
+
+ /* Wait for pending encryptions to get completed */
+--
+2.51.0
+
--- /dev/null
+From 7820a5ec4727ced7ad70957aab1a9d31e48416de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:07:42 +0100
+Subject: net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 6f31135894ec96481e2bda93a1da70712f5e57c1 ]
+
+Convert `lan78xx_init_mac_address` to return error codes and handle
+failures in register read and write operations. Update `lan78xx_reset`
+to check for errors during MAC address initialization and propagate them
+appropriately.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241209130751.703182-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 8d93ff40d49d ("net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index ec5689cd240aa..712530d6738fa 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1940,13 +1940,19 @@ static const struct ethtool_ops lan78xx_ethtool_ops = {
+ .get_regs = lan78xx_get_regs,
+ };
+
+-static void lan78xx_init_mac_address(struct lan78xx_net *dev)
++static int lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+ u8 addr[6];
++ int ret;
++
++ ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ if (ret < 0)
++ return ret;
+
+- lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ if (ret < 0)
++ return ret;
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1979,14 +1985,26 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ if (ret < 0)
++ return ret;
+ }
+
+- lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ if (ret < 0)
++ return ret;
++
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ if (ret < 0)
++ return ret;
+
+ eth_hw_addr_set(dev->net, addr);
++
++ return 0;
+ }
+
+ /* MDIO read and write wrappers for phylib */
+@@ -2910,7 +2928,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- lan78xx_init_mac_address(dev);
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
+
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+--
+2.51.0
+
--- /dev/null
+From 9f8d03a4d5f6ab2aa77b434f5ac64ee26d16d152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Oct 2025 23:46:48 +0530
+Subject: net: usb: lan78xx: fix use of improperly initialized dev->chipid in
+ lan78xx_reset
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 ]
+
+dev->chipid is used in lan78xx_init_mac_address before it's initialized:
+
+lan78xx_reset() {
+ lan78xx_init_mac_address()
+ lan78xx_read_eeprom()
+ lan78xx_read_raw_eeprom() <- dev->chipid is used here
+
+ dev->chipid = ... <- dev->chipid is initialized correctly here
+}
+
+Reorder initialization so that dev->chipid is set before calling
+lan78xx_init_mac_address().
+
+Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Khalid Aziz <khalid@kernel.org>
+Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 712530d6738fa..121f1c15c6793 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2928,10 +2928,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ }
+ } while (buf & HW_CFG_LRST_);
+
+- ret = lan78xx_init_mac_address(dev);
+- if (ret < 0)
+- return ret;
+-
+ /* save DEVID for later usage */
+ ret = lan78xx_read_reg(dev, ID_REV, &buf);
+ if (ret < 0)
+@@ -2940,6 +2936,10 @@ static int lan78xx_reset(struct lan78xx_net *dev)
+ dev->chipid = (buf & ID_REV_CHIP_ID_MASK_) >> 16;
+ dev->chiprev = buf & ID_REV_CHIP_REV_MASK_;
+
++ ret = lan78xx_init_mac_address(dev);
++ if (ret < 0)
++ return ret;
++
+ /* Respond to the IN token with a NAK */
+ ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 5f4285f9090d5141c4da7cbcbebd9c54ec0b027c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 12:08:22 -0700
+Subject: nvme-multipath: Skip nr_active increments in RETRY disposition
+
+From: Amit Chaudhary <achaudhary@purestorage.com>
+
+[ Upstream commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 ]
+
+For queue-depth I/O policy, this patch fixes unbalanced I/Os across
+nvme multipaths.
+
+Issue Description:
+
+The RETRY disposition incorrectly increments ns->ctrl->nr_active
+counter and reinitializes iostat start-time. In such cases nr_active
+counter never goes back to zero until that path disconnects and
+reconnects.
+
+Such a path is not chosen for new I/Os if multiple RETRY cases on a given
+a path cause its queue-depth counter to be artificially higher compared
+to other paths. This leads to unbalanced I/Os across paths.
+
+The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already
+set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set.
+
+base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a
+Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device")
+Signed-off-by: Amit Chaudhary <achaudhary@purestorage.com>
+Reviewed-by: Randy Jennings <randyj@purestorage.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 119afdfe4b91e..57416bbf9344f 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -131,12 +131,14 @@ void nvme_mpath_start_request(struct request *rq)
+ struct nvme_ns *ns = rq->q->queuedata;
+ struct gendisk *disk = ns->head->disk;
+
+- if (READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) {
++ if ((READ_ONCE(ns->head->subsys->iopolicy) == NVME_IOPOLICY_QD) &&
++ !(nvme_req(rq)->flags & NVME_MPATH_CNT_ACTIVE)) {
+ atomic_inc(&ns->ctrl->nr_active);
+ nvme_req(rq)->flags |= NVME_MPATH_CNT_ACTIVE;
+ }
+
+- if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq))
++ if (!blk_queue_io_stat(disk->queue) || blk_rq_is_passthrough(rq) ||
++ (nvme_req(rq)->flags & NVME_MPATH_IO_STATS))
+ return;
+
+ nvme_req(rq)->flags |= NVME_MPATH_IO_STATS;
+--
+2.51.0
+
--- /dev/null
+From 1f3d83fb4531f0384313e08a07572c62f9a53fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Oct 2025 20:25:49 +0800
+Subject: r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
+
+From: Linmao Li <lilinmao@kylinos.cn>
+
+[ Upstream commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 ]
+
+After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming
+packets. Packet captures show messages like "IP truncated-ip - 146 bytes
+missing!".
+
+The issue is caused by RxConfig not being properly re-initialized after
+resume. Re-initializing the RxConfig register before the chip
+re-initialization sequence avoids the truncation and restores correct
+packet reception.
+
+This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data
+corruption issue on RTL8402").
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 5af932a5e70c4..3b90f257e94f8 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4919,8 +4919,9 @@ static int rtl8169_resume(struct device *device)
+ if (!device_may_wakeup(tp_to_dev(tp)))
+ clk_prepare_enable(tp->clk);
+
+- /* Reportedly at least Asus X453MA truncates packets otherwise */
+- if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ /* Some chip versions may truncate packets without this initialization */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37 ||
++ tp->mac_version == RTL_GIGA_MAC_VER_46)
+ rtl_init_rxcfg(tp);
+
+ return rtl8169_runtime_resume(device);
+--
+2.51.0
+
--- /dev/null
+From cf0f97a958da546e74181ea2174a15ede71f7788 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:25:13 +0200
+Subject: riscv: kprobes: Fix probe address validation
+
+From: Fabian Vogt <fvogt@suse.de>
+
+[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]
+
+When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
+arch_check_kprobe would start iterating all instructions starting from
+_text until the probed address. Not only is this very inefficient, but
+literal values in there (e.g. left by function patching) are
+misinterpreted in a way that causes a desync.
+
+Fix this by doing it like x86: start the iteration at the closest
+preceding symbol instead of the given starting point.
+
+Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
+Signed-off-by: Fabian Vogt <fvogt@suse.de>
+Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index 297427ffc4e04..8a6ea7d270188 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
+-static bool __kprobes arch_check_kprobe(struct kprobe *p)
++static bool __kprobes arch_check_kprobe(unsigned long addr)
+ {
+- unsigned long tmp = (unsigned long)p->addr - p->offset;
+- unsigned long addr = (unsigned long)p->addr;
++ unsigned long tmp, offset;
++
++ /* start iterating at the closest preceding symbol */
++ if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
++ return false;
++
++ tmp = addr - offset;
+
+ while (tmp <= addr) {
+ if (tmp == addr)
+@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if ((unsigned long)insn & 0x1)
+ return -EILSEQ;
+
+- if (!arch_check_kprobe(p))
++ if (!arch_check_kprobe((unsigned long)p->addr))
+ return -EILSEQ;
+
+ /* copy instruction */
+--
+2.51.0
+
--- /dev/null
+From 9fe0b1ccb788a857cb642b5c60989bda4b823761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 12:18:16 +0100
+Subject: sched/balancing: Rename newidle_balance() => sched_balance_newidle()
+
+From: Ingo Molnar <mingo@kernel.org>
+
+[ Upstream commit 7d058285cd77cc1411c91efd1b1673530bb1bee8 ]
+
+Standardize scheduler load-balancing function names on the
+sched_balance_() prefix.
+
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240308111819.1101550-11-mingo@kernel.org
+Stable-dep-of: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 1cf43e91ae9de..84d5caf6230f6 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4829,7 +4829,7 @@ static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq)
+ return cfs_rq->avg.load_avg;
+ }
+
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf);
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf);
+
+ static inline unsigned long task_util(struct task_struct *p)
+ {
+@@ -5158,7 +5158,7 @@ attach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+ static inline void
+ detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) {}
+
+-static inline int newidle_balance(struct rq *rq, struct rq_flags *rf)
++static inline int sched_balance_newidle(struct rq *rq, struct rq_flags *rf)
+ {
+ return 0;
+ }
+@@ -8281,7 +8281,7 @@ balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+ if (rq->nr_running)
+ return 1;
+
+- return newidle_balance(rq, rf) != 0;
++ return sched_balance_newidle(rq, rf) != 0;
+ }
+ #endif /* CONFIG_SMP */
+
+@@ -8531,10 +8531,10 @@ done: __maybe_unused;
+ if (!rf)
+ return NULL;
+
+- new_tasks = newidle_balance(rq, rf);
++ new_tasks = sched_balance_newidle(rq, rf);
+
+ /*
+- * Because newidle_balance() releases (and re-acquires) rq->lock, it is
++ * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+ * possible for any higher priority task to appear. In that case we
+ * must re-start the pick_next_entity() loop.
+ */
+@@ -11542,7 +11542,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ ld_moved = 0;
+
+ /*
+- * newidle_balance() disregards balance intervals, so we could
++ * sched_balance_newidle() disregards balance intervals, so we could
+ * repeatedly reach this code, which would lead to balance_interval
+ * skyrocketing in a short amount of time. Skip the balance_interval
+ * increase logic to avoid that.
+@@ -12308,7 +12308,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ #endif /* CONFIG_NO_HZ_COMMON */
+
+ /*
+- * newidle_balance is called by schedule() if this_cpu is about to become
++ * sched_balance_newidle is called by schedule() if this_cpu is about to become
+ * idle. Attempts to pull tasks from other CPUs.
+ *
+ * Returns:
+@@ -12316,7 +12316,7 @@ static inline void nohz_newidle_balance(struct rq *this_rq) { }
+ * 0 - failed, no new tasks
+ * > 0 - success, new (fair) tasks present
+ */
+-static int newidle_balance(struct rq *this_rq, struct rq_flags *rf)
++static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+ {
+ unsigned long next_balance = jiffies + HZ;
+ int this_cpu = this_rq->cpu;
+--
+2.51.0
+
--- /dev/null
+From f72348b7890fd38dcb6ed9c93147918c78e7b08d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:12:14 +0200
+Subject: sched/fair: Fix pelt lost idle time detection
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 ]
+
+The check for some lost idle pelt time should be always done when
+pick_next_task_fair() fails to pick a task and not only when we call it
+from the fair fast-path.
+
+The case happens when the last running task on rq is a RT or DL task. When
+the latter goes to sleep and the /Sum of util_sum of the rq is at the max
+value, we don't account the lost of idle time whereas we should.
+
+Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path")
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 84d5caf6230f6..58231999d929e 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8528,21 +8528,21 @@ done: __maybe_unused;
+ return p;
+
+ idle:
+- if (!rf)
+- return NULL;
+-
+- new_tasks = sched_balance_newidle(rq, rf);
++ if (rf) {
++ new_tasks = sched_balance_newidle(rq, rf);
+
+- /*
+- * Because sched_balance_newidle() releases (and re-acquires) rq->lock, it is
+- * possible for any higher priority task to appear. In that case we
+- * must re-start the pick_next_entity() loop.
+- */
+- if (new_tasks < 0)
+- return RETRY_TASK;
++ /*
++ * Because sched_balance_newidle() releases (and re-acquires)
++ * rq->lock, it is possible for any higher priority task to
++ * appear. In that case we must re-start the pick_next_entity()
++ * loop.
++ */
++ if (new_tasks < 0)
++ return RETRY_TASK;
+
+- if (new_tasks > 0)
+- goto again;
++ if (new_tasks > 0)
++ goto again;
++ }
+
+ /*
+ * rq is about to be idle, check if we need to update the
+--
+2.51.0
+
--- /dev/null
+From bff5eba5560571ebea9699d6eae0b27f994fcd34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 11:53:30 +0800
+Subject: selftests: arg_parsing: Ensure data is flushed to disk before
+ reading.
+
+From: Xing Guo <higuoxing@gmail.com>
+
+[ Upstream commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a ]
+
+test_parse_test_list_file writes some data to
+/tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read
+the data back. However, after writing data to that file, we forget to
+call fsync() and it's causing testing failure in my laptop. This patch
+helps fix it by adding the missing fsync() call.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Xing Guo <higuoxing@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index fbf0d9c2f58b3..e27d66b75fb1f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -144,6 +144,9 @@ static void test_parse_test_list_file(void)
+ if (!ASSERT_OK(ferror(fp), "prepare tmp"))
+ goto out_fclose;
+
++ if (!ASSERT_OK(fsync(fileno(fp)), "fsync tmp"))
++ goto out_fclose;
++
+ init_test_filter_set(&set);
+
+ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
+--
+2.51.0
+
--- /dev/null
+From b2db42f1b2a7b2816cd73390a66ce6ba22529cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 13:20:37 -0700
+Subject: selftests/bpf: make arg_parsing.c more robust to crashes
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 ]
+
+We started getting a crash in BPF CI, which seems to originate from
+test_parse_test_list_file() test and is happening at this line:
+
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+
+One way we can crash there is if set.cnt zero, which is checked for with
+ASSERT_EQ() above, but we proceed after this regardless of the outcome.
+Instead of crashing, we should bail out with test failure early.
+
+Similarly, if parse_test_list_file() fails, we shouldn't be even looking
+at set, so bail even earlier if ASSERT_OK() fails.
+
+Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/arg_parsing.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+index bb143de68875c..fbf0d9c2f58b3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
++++ b/tools/testing/selftests/bpf/prog_tests/arg_parsing.c
+@@ -146,9 +146,12 @@ static void test_parse_test_list_file(void)
+
+ init_test_filter_set(&set);
+
+- ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file");
++ if (!ASSERT_OK(parse_test_list_file(tmpfile, &set, true), "parse file"))
++ goto out_fclose;
++
++ if (!ASSERT_EQ(set.cnt, 4, "test count"))
++ goto out_free_set;
+
+- ASSERT_EQ(set.cnt, 4, "test count");
+ ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name");
+ ASSERT_EQ(set.tests[0].subtest_cnt, 0, "test 0 subtest count");
+ ASSERT_OK(strcmp("testA", set.tests[1].name), "test 1 name");
+@@ -158,8 +161,8 @@ static void test_parse_test_list_file(void)
+ ASSERT_OK(strcmp("testB", set.tests[2].name), "test 2 name");
+ ASSERT_OK(strcmp("testC_no_eof_newline", set.tests[3].name), "test 3 name");
+
++out_free_set:
+ free_test_filter_set(&set);
+-
+ out_fclose:
+ fclose(fp);
+ out_remove:
+--
+2.51.0
+
usb-gadget-f_ncm-refactor-bind-path-to-use-__free.patch
usb-gadget-f_rndis-refactor-bind-path-to-use-__free.patch
hid-multitouch-fix-sticky-fingers.patch
+dax-skip-read-lock-assertion-for-read-only-filesyste.patch
+can-m_can-m_can_plat_remove-add-missing-pm_runtime_d.patch
+net-dlink-handle-dma_map_single-failure-properly.patch
+doc-fix-seg6_flowlabel-path.patch
+r8169-fix-packet-truncation-after-s4-resume-on-rtl81.patch
+net-ip6_tunnel-prevent-perpetual-tunnel-growth.patch
+amd-xgbe-avoid-spurious-link-down-messages-during-in.patch
+tcp-fix-tcp_tso_should_defer-vs-large-rtt.patch
+tg3-prevent-use-of-uninitialized-remote_adv-and-loca.patch
+tls-trim-encrypted-message-to-match-the-plaintext-on.patch
+net-tls-wait-for-async-completion-on-last-message.patch
+tls-wait-for-async-encrypt-in-case-of-error-during-l.patch
+tls-always-set-record_type-in-tls_process_cmsg.patch
+tls-wait-for-pending-async-decryptions-if-tls_strp_m.patch
+tls-don-t-rely-on-tx_work-during-send.patch
+net-usb-lan78xx-add-error-handling-to-lan78xx_init_m.patch
+net-usb-lan78xx-fix-use-of-improperly-initialized-de.patch
+nvme-multipath-skip-nr_active-increments-in-retry-di.patch
+riscv-kprobes-fix-probe-address-validation.patch
+drm-bridge-lt9211-drop-check-for-last-nibble-of-vers.patch
+asoc-codecs-fix-gain-setting-ranges-for-renesas-idt8.patch
+asoc-nau8821-cancel-jdet_work-before-handling-jack-e.patch
+asoc-nau8821-generalize-helper-to-clear-irq-status.patch
+asoc-nau8821-add-dmi-quirk-to-bypass-jack-debounce-c.patch
+drm-i915-guc-skip-communication-warning-on-reset-in-.patch
+drm-amd-powerplay-fix-cik-shutdown-temperature.patch
+drm-rockchip-vop2-use-correct-destination-rectangle-.patch
+sched-balancing-rename-newidle_balance-sched_balance.patch
+sched-fair-fix-pelt-lost-idle-time-detection.patch
+alsa-firewire-amdtp-stream-fix-enum-kernel-doc-warni.patch
+accel-qaic-treat-remaining-0-as-error-in-find_and_ma.patch
+selftests-bpf-make-arg_parsing.c-more-robust-to-cras.patch
+alsa-usb-audio-fix-null-pointer-deference-in-try_to_.patch
+hid-hid-input-only-ignore-0-battery-events-for-digit.patch
+hid-multitouch-fix-name-of-stylus-input-devices.patch
+selftests-arg_parsing-ensure-data-is-flushed-to-disk.patch
--- /dev/null
+From 1b0d34d6bc6a5cfb5b2cc36289a9ceaedb0f9fc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Oct 2025 11:57:42 +0000
+Subject: tcp: fix tcp_tso_should_defer() vs large RTT
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 295ce1eb36ae47dc862d6c8a1012618a25516208 ]
+
+Neal reported that using neper tcp_stream with TCP_TX_DELAY
+set to 50ms would often lead to flows stuck in a small cwnd mode,
+regardless of the congestion control.
+
+While tcp_stream sets TCP_TX_DELAY too late after the connect(),
+it highlighted two kernel bugs.
+
+The following heuristic in tcp_tso_should_defer() seems wrong
+for large RTT:
+
+delta = tp->tcp_clock_cache - head->tstamp;
+/* If next ACK is likely to come too late (half srtt), do not defer */
+if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
+ goto send_now;
+
+If next ACK is expected to come in more than 1 ms, we should
+not defer because we prefer a smooth ACK clocking.
+
+While blamed commit was a step in the good direction, it was not
+generic enough.
+
+Another patch fixing TCP_TX_DELAY for established flows
+will be proposed when net-next reopens.
+
+Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing")
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com
+[pabeni@redhat.com: fixed whitespace issue]
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 560273e7f7736..88551db62ca29 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2189,7 +2189,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+- u32 send_win, cong_win, limit, in_flight;
++ u32 send_win, cong_win, limit, in_flight, threshold;
++ u64 srtt_in_ns, expected_ack, how_far_is_the_ack;
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *head;
+ int win_divisor;
+@@ -2251,9 +2252,19 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ head = tcp_rtx_queue_head(sk);
+ if (!head)
+ goto send_now;
+- delta = tp->tcp_clock_cache - head->tstamp;
+- /* If next ACK is likely to come too late (half srtt), do not defer */
+- if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0)
++
++ srtt_in_ns = (u64)(NSEC_PER_USEC >> 3) * tp->srtt_us;
++ /* When is the ACK expected ? */
++ expected_ack = head->tstamp + srtt_in_ns;
++ /* How far from now is the ACK expected ? */
++ how_far_is_the_ack = expected_ack - tp->tcp_clock_cache;
++
++ /* If next ACK is likely to come too late,
++ * ie in more than min(1ms, half srtt), do not defer.
++ */
++ threshold = min(srtt_in_ns >> 1, NSEC_PER_MSEC);
++
++ if ((s64)(how_far_is_the_ack - threshold) > 0)
+ goto send_now;
+
+ /* Ok, it looks like it is advisable to defer.
+--
+2.51.0
+
--- /dev/null
+From 15c3eab1c55760985b65f147d5053cdf77e5a4f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 19:47:38 +0300
+Subject: tg3: prevent use of uninitialized remote_adv and local_adv variables
+
+From: Alexey Simakov <bigalex934@gmail.com>
+
+[ Upstream commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 ]
+
+Some execution paths that jump to the fiber_setup_done label
+could leave the remote_adv and local_adv variables uninitialized
+and then use it.
+
+Initialize this variables at the point of definition to avoid this.
+
+Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes")
+Co-developed-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index b3878975bd9c0..ea4973096aa28 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5814,7 +5814,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ u32 current_speed = SPEED_UNKNOWN;
+ u8 current_duplex = DUPLEX_UNKNOWN;
+ bool current_link_up = false;
+- u32 local_adv, remote_adv, sgsr;
++ u32 local_adv = 0, remote_adv = 0, sgsr;
+
+ if ((tg3_asic_rev(tp) == ASIC_REV_5719 ||
+ tg3_asic_rev(tp) == ASIC_REV_5720) &&
+@@ -5955,9 +5955,6 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
+ else
+ current_duplex = DUPLEX_HALF;
+
+- local_adv = 0;
+- remote_adv = 0;
+-
+ if (bmcr & BMCR_ANENABLE) {
+ u32 common;
+
+--
+2.51.0
+
--- /dev/null
+From 07f3687885eb6984d404d5a43232bc647b44d91f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:58 +0200
+Subject: tls: always set record_type in tls_process_cmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ]
+
+When userspace wants to send a non-DATA record (via the
+TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a
+previous MSG_MORE send() as a separate DATA record. If that DATA record
+is encrypted asynchronously, tls_handle_open_record will return
+-EINPROGRESS. This is currently treated as an error by
+tls_process_cmsg, and it will skip setting record_type to the correct
+value, but the caller (tls_sw_sendmsg_locked) handles that return
+value correctly and proceeds with sending the new message with an
+incorrect record_type (DATA instead of whatever was requested in the
+cmsg).
+
+Always set record_type before handling the open record. If
+tls_handle_open_record returns an error, record_type will be
+ignored. If it succeeds, whether with synchronous crypto (returning 0)
+or asynchronous (returning -EINPROGRESS), the caller will proceed
+correctly.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index d7dea82bcf565..c7ee44bd32064 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -254,12 +254,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg,
+ if (msg->msg_flags & MSG_MORE)
+ return -EINVAL;
+
+- rc = tls_handle_open_record(sk, msg->msg_flags);
+- if (rc)
+- return rc;
+-
+ *record_type = *(unsigned char *)CMSG_DATA(cmsg);
+- rc = 0;
++
++ rc = tls_handle_open_record(sk, msg->msg_flags);
+ break;
+ default:
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 994d5344e75ccea809a9d882458a1dbde57a5b74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:17:00 +0200
+Subject: tls: don't rely on tx_work during send()
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 7f846c65ca11e63d2409868ff039081f80e42ae4 ]
+
+With async crypto, we rely on tx_work to actually transmit records
+once encryption completes. But while send() is running, both the
+tx_lock and socket lock are held, so tx_work_handler cannot process
+the queue of encrypted records, and simply reschedules itself. During
+a large send(), this could last a long time, and use a lot of memory.
+
+Transmit any pending encrypted records before restarting the main
+loop of tls_sw_sendmsg_locked.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 6ea557ebab171..410e39e4b79fd 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1152,6 +1152,13 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ } else if (ret != -EAGAIN)
+ goto send_end;
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
++
+ continue;
+ rollback_iter:
+ copied -= try_to_copy;
+@@ -1207,6 +1214,12 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ }
+ }
++
++ /* Transmit if any encryptions have completed */
++ if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) {
++ cancel_delayed_work(&ctx->tx_work.work);
++ tls_tx_records(sk, msg->msg_flags);
++ }
+ }
+
+ continue;
+--
+2.51.0
+
--- /dev/null
+From fdc1477b7759d32ec8ae29fcb5b282d6ec9cc903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:56 +0200
+Subject: tls: trim encrypted message to match the plaintext on short splice
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit ce5af41e3234425a40974696682163edfd21128c ]
+
+During tls_sw_sendmsg_locked, we pre-allocate the encrypted message
+for the size we're expecting to send during the current iteration, but
+we may end up sending less, for example when splicing: if we're
+getting the data from small fragments of memory, we may fill up all
+the slots in the skmsg with less data than expected.
+
+In this case, we need to trim the encrypted message to only the length
+we actually need, to avoid pushing uninitialized bytes down the
+underlying TCP socket.
+
+Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 435235a351e2f..21276ac1f81dc 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1112,8 +1112,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto send_end;
+ tls_ctx->pending_open_record_frags = true;
+
+- if (sk_msg_full(msg_pl))
++ if (sk_msg_full(msg_pl)) {
+ full_record = true;
++ sk_msg_trim(sk, msg_en,
++ msg_pl->sg.size + prot->overhead_size);
++ }
+
+ if (full_record || eor)
+ goto copied;
+--
+2.51.0
+
--- /dev/null
+From 9dc92d56650ed44f2bc752d221c025b2c82bfa66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:57 +0200
+Subject: tls: wait for async encrypt in case of error during latter iterations
+ of sendmsg
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b014a4e066c555185b7c367efacdc33f16695495 ]
+
+If we hit an error during the main loop of tls_sw_sendmsg_locked (eg
+failed allocation), we jump to send_end and immediately
+return. Previous iterations may have queued async encryption requests
+that are still pending. We should wait for those before returning, as
+we could otherwise be reading from memory that userspace believes
+we're not using anymore, which would be a sort of use-after-free.
+
+This is similar to what tls_sw_recvmsg already does: failures during
+the main loop jump to the "wait for async" code, not straight to the
+unlock/return.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 1f22c7adf3e56..d3bf2dbc297ae 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1054,7 +1054,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ if (ret == -EINPROGRESS)
+ num_async++;
+ else if (ret != -EAGAIN)
+- goto send_end;
++ goto end;
+ }
+ }
+
+@@ -1226,8 +1226,9 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ goto alloc_encrypted;
+ }
+
++send_end:
+ if (!num_async) {
+- goto send_end;
++ goto end;
+ } else if (num_zc || eor) {
+ int err;
+
+@@ -1245,7 +1246,7 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ tls_tx_records(sk, msg->msg_flags);
+ }
+
+-send_end:
++end:
+ ret = sk_stream_error(sk, msg->msg_flags, ret);
+ return copied > 0 ? copied : ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From b8b877ae72c846ec53a49b5ff7b0852ae2d0a45c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 11:16:59 +0200
+Subject: tls: wait for pending async decryptions if tls_strp_msg_hold fails
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit b8a6ff84abbcbbc445463de58704686011edc8e1 ]
+
+Async decryption calls tls_strp_msg_hold to create a clone of the
+input skb to hold references to the memory it uses. If we fail to
+allocate that clone, proceeding with async decryption can lead to
+various issues (UAF on the skb, writing into userspace memory after
+the recv() call has returned).
+
+In this case, wait for all pending decryption requests.
+
+Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index d3bf2dbc297ae..6ea557ebab171 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1637,8 +1637,10 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
+
+ if (unlikely(darg->async)) {
+ err = tls_strp_msg_hold(&ctx->strp, &ctx->async_hold);
+- if (err)
+- __skb_queue_tail(&ctx->async_hold, darg->skb);
++ if (err) {
++ err = tls_decrypt_async_wait(ctx);
++ darg->async = false;
++ }
+ return err;
+ }
+
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
