--- /dev/null
+From 46a5e069b8f422f9ad12c0231ec4d8e765bc037d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 08:39:51 -0700
+Subject: ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 4734c8b46b901cff2feda8b82abc710b65dc31c1 ]
+
+When a GHES (Generic Hardware Error Source) triggers a panic, add the
+TAINT_MACHINE_CHECK taint flag to the kernel. This explicitly marks the
+kernel as tainted due to a machine check event, improving diagnostics
+and post-mortem analysis. The taint is set with LOCKDEP_STILL_OK to
+indicate lockdep remains valid.
+
+At large scale deployment, this helps to quickly determine panics that
+are coming due to hardware failures.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Link: https://patch.msgid.link/20250702-add_tain-v1-1-9187b10914b9@debian.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index fe9bd27367ee..ce9b8e8a5d09 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1099,6 +1099,8 @@ static void __ghes_panic(struct ghes *ghes,
+
+ __ghes_print_estatus(KERN_EMERG, ghes->generic, estatus);
+
++ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK);
++
+ ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx);
+
+ if (!panic_timeout)
+--
+2.39.5
+
--- /dev/null
+From f713831394a4e78a66afe9c9dd1354162062999d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 19:42:11 +0800
+Subject: ACPI: APEI: send SIGBUS to current task if synchronous memory error
+ not recovered
+
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+
+[ Upstream commit 79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 ]
+
+If a synchronous error is detected as a result of user-space process
+triggering a 2-bit uncorrected error, the CPU will take a synchronous
+error exception such as Synchronous External Abort (SEA) on Arm64. The
+kernel will queue a memory_failure() work which poisons the related
+page, unmaps the page, and then sends a SIGBUS to the process, so that
+a system wide panic can be avoided.
+
+However, no memory_failure() work will be queued when abnormal
+synchronous errors occur. These errors can include situations like
+invalid PA, unexpected severity, no memory failure config support,
+invalid GUID section, etc. In such a case, the user-space process will
+trigger SEA again. This loop can potentially exceed the platform
+firmware threshold or even trigger a kernel hard lockup, leading to a
+system reboot.
+
+Fix it by performing a force kill if no memory_failure() work is queued
+for synchronous errors.
+
+Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Reviewed-by: Jane Chu <jane.chu@oracle.com>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://patch.msgid.link/20250714114212.31660-2-xueshuai@linux.alibaba.com
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 0f3c663c1b0a..fe9bd27367ee 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -902,6 +902,17 @@ static bool ghes_do_proc(struct ghes *ghes,
+ }
+ }
+
++ /*
++ * If no memory failure work is queued for abnormal synchronous
++ * errors, do a force kill.
++ */
++ if (sync && !queued) {
++ dev_err(ghes->dev,
++ HW_ERR GHES_PFX "%s:%d: synchronous unrecoverable error (SIGBUS)\n",
++ current->comm, task_pid_nr(current));
++ force_sig(SIGBUS);
++ }
++
+ return queued;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 8abd8d0e9761e26370fbff3c5f54c5066c90bca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 01:41:04 +0000
+Subject: ACPI: PRM: Reduce unnecessary printing to avoid user confusion
+
+From: Zhu Qiyu <qiyuzhu2@amd.com>
+
+[ Upstream commit 3db5648c4d608b5483470efc1da9780b081242dd ]
+
+Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM
+handler and context") introduced non-essential printing "Failed to find
+VA for GUID: xxxx, PA: 0x0" which may confuse users to think that
+something wrong is going on while it is not the case.
+
+According to the PRM Spec Section 4.1.2 [1], both static data buffer
+address and ACPI parameter buffer address may be NULL if they are not
+needed, so there is no need to print out the "Failed to find VA ... "
+in those cases.
+
+Link: https://uefi.org/sites/default/files/resources/Platform%20Runtime%20Mechanism%20-%20with%20legal%20notice.pdf # [1]
+Signed-off-by: Zhu Qiyu <qiyuzhu2@amd.com>
+Link: https://patch.msgid.link/20250704014104.82524-1-qiyuzhu2@amd.com
+[ rjw: Edits in new comments, subject and changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/prmt.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/prmt.c b/drivers/acpi/prmt.c
+index e549914a636c..be033bbb126a 100644
+--- a/drivers/acpi/prmt.c
++++ b/drivers/acpi/prmt.c
+@@ -85,8 +85,6 @@ static u64 efi_pa_va_lookup(efi_guid_t *guid, u64 pa)
+ }
+ }
+
+- pr_warn("Failed to find VA for GUID: %pUL, PA: 0x%llx", guid, pa);
+-
+ return 0;
+ }
+
+@@ -154,13 +152,37 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
+ guid_copy(&th->guid, (guid_t *)handler_info->handler_guid);
+ th->handler_addr =
+ (void *)efi_pa_va_lookup(&th->guid, handler_info->handler_address);
++ /*
++ * Print a warning message if handler_addr is zero which is not expected to
++ * ever happen.
++ */
++ if (unlikely(!th->handler_addr))
++ pr_warn("Failed to find VA of handler for GUID: %pUL, PA: 0x%llx",
++ &th->guid, handler_info->handler_address);
+
+ th->static_data_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->static_data_buffer_address);
++ /*
++ * According to the PRM specification, static_data_buffer_address can be zero,
++ * so avoid printing a warning message in that case. Otherwise, if the
++ * return value of efi_pa_va_lookup() is zero, print the message.
++ */
++ if (unlikely(!th->static_data_buffer_addr && handler_info->static_data_buffer_address))
++ pr_warn("Failed to find VA of static data buffer for GUID: %pUL, PA: 0x%llx",
++ &th->guid, handler_info->static_data_buffer_address);
+
+ th->acpi_param_buffer_addr =
+ efi_pa_va_lookup(&th->guid, handler_info->acpi_param_buffer_address);
+
++ /*
++ * According to the PRM specification, acpi_param_buffer_address can be zero,
++ * so avoid printing a warning message in that case. Otherwise, if the
++ * return value of efi_pa_va_lookup() is zero, print the message.
++ */
++ if (unlikely(!th->acpi_param_buffer_addr && handler_info->acpi_param_buffer_address))
++ pr_warn("Failed to find VA of acpi param buffer for GUID: %pUL, PA: 0x%llx",
++ &th->guid, handler_info->acpi_param_buffer_address);
++
+ } while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info)));
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 7d7d47bee8dfaa0098bc27400d51b940ec99129b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 14:42:15 +0200
+Subject: ACPI: processor: fix acpi_object initialization
+
+From: Sebastian Ott <sebott@redhat.com>
+
+[ Upstream commit 13edf7539211d8f7d0068ce3ed143005f1da3547 ]
+
+Initialization of the local acpi_object in acpi_processor_get_info()
+only sets the first 4 bytes to zero and is thus incomplete. This is
+indicated by messages like:
+ acpi ACPI0007:be: Invalid PBLK length [166288104]
+
+Fix this by initializing all 16 bytes of the processor member of that
+union.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+Link: https://patch.msgid.link/20250703124215.12522-1-sebott@redhat.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 7cf6101cb4c7..2a99f5eb6962 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -275,7 +275,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr,
+
+ static int acpi_processor_get_info(struct acpi_device *device)
+ {
+- union acpi_object object = { 0 };
++ union acpi_object object = { .processor = { 0 } };
+ struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
+ struct acpi_processor *pr = acpi_driver_data(device);
+ int device_declaration = 0;
+--
+2.39.5
+
--- /dev/null
+From 683dc651df75030be270d51f8c97d0f4cce4c973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 21:13:08 +0800
+Subject: ACPI: Suppress misleading SPCR console message when SPCR table is
+ absent
+
+From: Li Chen <chenl311@chinatelecom.cn>
+
+[ Upstream commit bad3fa2fb9206f4dcec6ddef094ec2fbf6e8dcb2 ]
+
+The kernel currently alway prints:
+"Use ACPI SPCR as default console: No/Yes "
+
+even on systems that lack an SPCR table. This can
+mislead users into thinking the SPCR table exists
+on the machines without SPCR.
+
+With this change, the "Yes" is only printed if
+the SPCR table is present, parsed and !param_acpi_nospcr.
+This avoids user confusion on SPCR-less systems.
+
+Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
+Acked-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/20250620131309.126555-3-me@linux.beauty
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/acpi.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
+index b9a66fc146c9..4d529ff7ba51 100644
+--- a/arch/arm64/kernel/acpi.c
++++ b/arch/arm64/kernel/acpi.c
+@@ -197,6 +197,8 @@ static int __init acpi_fadt_sanity_check(void)
+ */
+ void __init acpi_boot_table_init(void)
+ {
++ int ret;
++
+ /*
+ * Enable ACPI instead of device tree unless
+ * - ACPI has been disabled explicitly (acpi=off), or
+@@ -250,10 +252,12 @@ void __init acpi_boot_table_init(void)
+ * behaviour, use acpi=nospcr to disable console in ACPI SPCR
+ * table as default serial console.
+ */
+- acpi_parse_spcr(earlycon_acpi_spcr_enable,
++ ret = acpi_parse_spcr(earlycon_acpi_spcr_enable,
+ !param_acpi_nospcr);
+- pr_info("Use ACPI SPCR as default console: %s\n",
+- param_acpi_nospcr ? "No" : "Yes");
++ if (!ret || param_acpi_nospcr || !IS_ENABLED(CONFIG_ACPI_SPCR_TABLE))
++ pr_info("Use ACPI SPCR as default console: No\n");
++ else
++ pr_info("Use ACPI SPCR as default console: Yes\n");
+
+ if (IS_ENABLED(CONFIG_ACPI_BGRT))
+ acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);
+--
+2.39.5
+
--- /dev/null
+From 574dbfa9a05a1529c1f59e6a551f0e8baadea050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 18:17:17 +0800
+Subject: ALSA: hda: add MODULE_FIRMWARE for cs35l41/cs35l56
+
+From: GalaxySnail <me@glxys.nl>
+
+[ Upstream commit 6eda9429501508196001845998bb8c73307d311a ]
+
+add firmware information in the .modinfo section, so that userspace
+tools can find out firmware required by cs35l41/cs35l56 kernel module
+
+Signed-off-by: GalaxySnail <me@glxys.nl>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250624101716.2365302-2-me@glxys.nl
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda.c | 2 ++
+ sound/pci/hda/cs35l56_hda.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/sound/pci/hda/cs35l41_hda.c b/sound/pci/hda/cs35l41_hda.c
+index 5dc021976c79..4397630496fd 100644
+--- a/sound/pci/hda/cs35l41_hda.c
++++ b/sound/pci/hda/cs35l41_hda.c
+@@ -2060,3 +2060,5 @@ MODULE_IMPORT_NS("SND_SOC_CS_AMP_LIB");
+ MODULE_AUTHOR("Lucas Tanure, Cirrus Logic Inc, <tanureal@opensource.cirrus.com>");
+ MODULE_LICENSE("GPL");
+ MODULE_IMPORT_NS("FW_CS_DSP");
++MODULE_FIRMWARE("cirrus/cs35l41-*.wmfw");
++MODULE_FIRMWARE("cirrus/cs35l41-*.bin");
+diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c
+index c9c8ec8d2474..7e92ad955e78 100644
+--- a/sound/pci/hda/cs35l56_hda.c
++++ b/sound/pci/hda/cs35l56_hda.c
+@@ -1178,3 +1178,7 @@ MODULE_IMPORT_NS("SND_SOC_CS_AMP_LIB");
+ MODULE_AUTHOR("Richard Fitzgerald <rf@opensource.cirrus.com>");
+ MODULE_AUTHOR("Simon Trimmer <simont@opensource.cirrus.com>");
+ MODULE_LICENSE("GPL");
++MODULE_FIRMWARE("cirrus/cs35l54-*.wmfw");
++MODULE_FIRMWARE("cirrus/cs35l54-*.bin");
++MODULE_FIRMWARE("cirrus/cs35l56-*.wmfw");
++MODULE_FIRMWARE("cirrus/cs35l56-*.bin");
+--
+2.39.5
+
--- /dev/null
+From 83a7e2b3e5d6fda803a67600ccd25807784c68da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 19:50:12 +0200
+Subject: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
+
+From: Lucy Thrun <lucy.thrun@digital-rabbithole.de>
+
+[ Upstream commit a409c60111e6bb98fcabab2aeaa069daa9434ca0 ]
+
+The 'sprintf' call in 'add_tuning_control' may exceed the 44-byte
+buffer if either string argument is too long. This triggers a compiler
+warning.
+Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent
+overflow.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506100642.95jpuMY1-lkp@intel.com/
+Signed-off-by: Lucy Thrun <lucy.thrun@digital-rabbithole.de>
+Link: https://patch.msgid.link/20250610175012.918-3-lucy.thrun@digital-rabbithole.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 77432e06f3e3..a2f57d7424bb 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -4410,7 +4410,7 @@ static int add_tuning_control(struct hda_codec *codec,
+ }
+ knew.private_value =
+ HDA_COMPOSE_AMP_VAL(nid, 1, 0, type);
+- sprintf(namestr, "%s %s Volume", name, dirstr[dir]);
++ snprintf(namestr, sizeof(namestr), "%s %s Volume", name, dirstr[dir]);
+ return snd_hda_ctl_add(codec, nid, snd_ctl_new1(&knew, codec));
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 516a9c17e59c7daa17b39842d7cea8507b16a8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 15:14:30 +0200
+Subject: ALSA: hda: Disable jack polling at shutdown
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1adcbdf54f76e1004bdf71df4eb1888c26e7ad06 ]
+
+Although the jack polling is canceled at shutdown in
+snd_hda_codec_shutdown(), it might be still re-triggered when the work
+is being processed at cancel_delayed_work_sync() call. This may
+result in the unexpected hardware access that should have been already
+disabled.
+
+For assuring to stop the jack polling, clear codec->jackpoll_interval
+at shutdown.
+
+Reported-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Closes: https://lore.kernel.org/20250619020844.2974160-4-joakim.zhang@cixtech.com
+Tested-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250623131437.10670-2-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index ca7c3517c341..7b090c953974 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3037,6 +3037,7 @@ void snd_hda_codec_shutdown(struct hda_codec *codec)
+ if (!codec->core.registered)
+ return;
+
++ codec->jackpoll_interval = 0; /* don't poll any longer */
+ cancel_delayed_work_sync(&codec->jackpoll_work);
+ list_for_each_entry(cpcm, &codec->pcm_list_head, list)
+ snd_pcm_suspend_all(cpcm->pcm);
+--
+2.39.5
+
--- /dev/null
+From bf2e538e1578d1d2c1ae0f614adaeeb4ca9abe8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 15:14:32 +0200
+Subject: ALSA: hda: Handle the jack polling always via a work
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5f7e54b23e4d253eff3b10b12d6fa92d28d7dddc ]
+
+We used to call directly hda_jackpoll_work() from a couple of places
+for updating the jack and notify to user-space, but this makes rather
+the code flow fragile. Namely, because of those direct calls,
+hda_jackpoll_work() uses snd_hda_power_up_pm() and *_down_pm() calls
+instead of the standard snd_hda_power_up() and *_down() calls. The
+latter pair assures the runtime PM resume sync, so it can avoid the
+race against the PM callbacks gracefully, while the former pair may
+continue if called concurrently, hence it may race (by design).
+
+In this patch, we change the call pattern of hda_jackpoll_work(); now
+all callers are replaced with the standard snd_hda_jack_report_sync()
+and the additional schedule_delayed_work().
+
+Since hda_jackpoll_work() is called only from the associated work,
+it's always outside the PM code path, and we can safely use
+snd_hda_power_up() and *_down() there instead. This allows us to
+remove the racy check of power-state in hda_jackpoll_work(), as well
+as the tricky cancel_delayed_work() and rescheduling at
+hda_codec_runtime_suspend().
+
+Reported-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Closes: https://lore.kernel.org/20250619020844.2974160-1-joakim.zhang@cixtech.com
+Tested-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250623131437.10670-4-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 41 +++++++++++++--------------------------
+ 1 file changed, 14 insertions(+), 27 deletions(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index b436d436831b..ca7c3517c341 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -639,24 +639,16 @@ static void hda_jackpoll_work(struct work_struct *work)
+ struct hda_codec *codec =
+ container_of(work, struct hda_codec, jackpoll_work.work);
+
+- /* for non-polling trigger: we need nothing if already powered on */
+- if (!codec->jackpoll_interval && snd_hdac_is_power_on(&codec->core))
++ if (!codec->jackpoll_interval)
+ return;
+
+ /* the power-up/down sequence triggers the runtime resume */
+- snd_hda_power_up_pm(codec);
++ snd_hda_power_up(codec);
+ /* update jacks manually if polling is required, too */
+- if (codec->jackpoll_interval) {
+- snd_hda_jack_set_dirty_all(codec);
+- snd_hda_jack_poll_all(codec);
+- }
+- snd_hda_power_down_pm(codec);
+-
+- if (!codec->jackpoll_interval)
+- return;
+-
+- schedule_delayed_work(&codec->jackpoll_work,
+- codec->jackpoll_interval);
++ snd_hda_jack_set_dirty_all(codec);
++ snd_hda_jack_poll_all(codec);
++ schedule_delayed_work(&codec->jackpoll_work, codec->jackpoll_interval);
++ snd_hda_power_down(codec);
+ }
+
+ /* release all pincfg lists */
+@@ -2926,12 +2918,12 @@ static void hda_call_codec_resume(struct hda_codec *codec)
+ snd_hda_regmap_sync(codec);
+ }
+
+- if (codec->jackpoll_interval)
+- hda_jackpoll_work(&codec->jackpoll_work.work);
+- else
+- snd_hda_jack_report_sync(codec);
++ snd_hda_jack_report_sync(codec);
+ codec->core.dev.power.power_state = PMSG_ON;
+ snd_hdac_leave_pm(&codec->core);
++ if (codec->jackpoll_interval)
++ schedule_delayed_work(&codec->jackpoll_work,
++ codec->jackpoll_interval);
+ }
+
+ static int hda_codec_runtime_suspend(struct device *dev)
+@@ -2943,8 +2935,6 @@ static int hda_codec_runtime_suspend(struct device *dev)
+ if (!codec->card)
+ return 0;
+
+- cancel_delayed_work_sync(&codec->jackpoll_work);
+-
+ state = hda_call_codec_suspend(codec);
+ if (codec->link_down_at_suspend ||
+ (codec_has_clkstop(codec) && codec_has_epss(codec) &&
+@@ -2952,10 +2942,6 @@ static int hda_codec_runtime_suspend(struct device *dev)
+ snd_hdac_codec_link_down(&codec->core);
+ snd_hda_codec_display_power(codec, false);
+
+- if (codec->bus->jackpoll_in_suspend &&
+- (dev->power.power_state.event != PM_EVENT_SUSPEND))
+- schedule_delayed_work(&codec->jackpoll_work,
+- codec->jackpoll_interval);
+ return 0;
+ }
+
+@@ -3117,10 +3103,11 @@ int snd_hda_codec_build_controls(struct hda_codec *codec)
+ if (err < 0)
+ return err;
+
++ snd_hda_jack_report_sync(codec); /* call at the last init point */
+ if (codec->jackpoll_interval)
+- hda_jackpoll_work(&codec->jackpoll_work.work);
+- else
+- snd_hda_jack_report_sync(codec); /* call at the last init point */
++ schedule_delayed_work(&codec->jackpoll_work,
++ codec->jackpoll_interval);
++
+ sync_power_up_states(codec);
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From bfe7902e575c86186872bf19804e16663e6839d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 09:12:07 -0600
+Subject: ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
+
+From: Thomas Croft <thomasmcft@gmail.com>
+
+[ Upstream commit dbe05428c4e54068a86e7e02405f3b30b1d2b3dd ]
+
+Several months ago, Joshua Grisham submitted a patch [1]
+for several ALC298 based sound cards.
+
+The entry for the LG gram 16 in the alc269_fixup_tbl only matches the
+Subsystem ID for the 16Z90R-Q and 16Z90R-K models [2]. My 16Z90R-A has a
+different Subsystem ID [3]. I'm not sure why these IDs differ, but I
+speculate it's due to the NVIDIA GPU included in the 16Z90R-A model that
+isn't present in the other models.
+
+I applied the patch to the latest Arch Linux kernel and the card was
+initialized as expected.
+
+[1]: https://lore.kernel.org/linux-sound/20240909193000.838815-1-josh@joshuagrisham.com/
+[2]: https://linux-hardware.org/?id=pci:8086-51ca-1854-0488
+[3]: https://linux-hardware.org/?id=pci:8086-51ca-1854-0489
+
+Signed-off-by: Thomas Croft <thomasmcft@gmail.com>
+Link: https://patch.msgid.link/20250804151457.134761-2-thomasmcft@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 71632790ca1d..1c421518570e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11376,6 +11376,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1854, 0x0440, "LG CQ6", ALC256_FIXUP_HEADPHONE_AMP_VOL),
+ SND_PCI_QUIRK(0x1854, 0x0441, "LG CQ6 AIO", ALC256_FIXUP_HEADPHONE_AMP_VOL),
+ SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
++ SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
+ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+--
+2.39.5
+
--- /dev/null
+From be669cc9fd084bb27747800021d8b7ef7ca0d8fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jun 2025 11:52:24 -0700
+Subject: ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 87aafc8580acf87fcaf1a7e30ed858d8c8d37d81 ]
+
+code mistakenly used a hardcoded index (codec[1]) instead of
+iterating, over the codec array using the loop variable i.
+Use codec[i] instead of codec[1] to match the loop iteration.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250621185233.4081094-1-alok.a.tiwari@oracle.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/intel8x0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
+index e4bb99f71c2c..95f0bd2e1532 100644
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2249,7 +2249,7 @@ static int snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
+ tmp |= chip->ac97_sdin[0] << ICH_DI1L_SHIFT;
+ for (i = 1; i < 4; i++) {
+ if (pcm->r[0].codec[i]) {
+- tmp |= chip->ac97_sdin[pcm->r[0].codec[1]->num] << ICH_DI2L_SHIFT;
++ tmp |= chip->ac97_sdin[pcm->r[0].codec[i]->num] << ICH_DI2L_SHIFT;
+ break;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From a1f24de76a156a42e40cc236ae221451b90e6fc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 11:44:02 +0200
+Subject: ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 92f59aeb13252265c20e7aef1379a8080c57e0a2 ]
+
+At the time being recalculate_boundary() is implemented with a
+loop which shows up as costly in a perf profile, as depicted by
+the annotate below:
+
+ 0.00 : c057e934: 3d 40 7f ff lis r10,32767
+ 0.03 : c057e938: 61 4a ff ff ori r10,r10,65535
+ 0.21 : c057e93c: 7d 49 50 50 subf r10,r9,r10
+ 5.39 : c057e940: 7d 3c 4b 78 mr r28,r9
+ 2.11 : c057e944: 55 29 08 3c slwi r9,r9,1
+ 3.04 : c057e948: 7c 09 50 40 cmplw r9,r10
+ 2.47 : c057e94c: 40 81 ff f4 ble c057e940 <snd_pcm_ioctl+0xee0>
+
+Total: 13.2% on that simple loop.
+
+But what the loop does is to multiply the boundary by 2 until it is
+over the wanted border. This can be avoided by using fls() to get the
+boundary value order and shift it by the appropriate number of bits at
+once.
+
+This change provides the following profile:
+
+ 0.04 : c057f6e8: 3d 20 7f ff lis r9,32767
+ 0.02 : c057f6ec: 61 29 ff ff ori r9,r9,65535
+ 0.34 : c057f6f0: 7d 5a 48 50 subf r10,r26,r9
+ 0.23 : c057f6f4: 7c 1a 50 40 cmplw r26,r10
+ 0.02 : c057f6f8: 41 81 00 20 bgt c057f718 <snd_pcm_ioctl+0xf08>
+ 0.26 : c057f6fc: 7f 47 00 34 cntlzw r7,r26
+ 0.09 : c057f700: 7d 48 00 34 cntlzw r8,r10
+ 0.22 : c057f704: 7d 08 38 50 subf r8,r8,r7
+ 0.04 : c057f708: 7f 5a 40 30 slw r26,r26,r8
+ 0.35 : c057f70c: 7c 0a d0 40 cmplw r10,r26
+ 0.13 : c057f710: 40 80 05 f8 bge c057fd08 <snd_pcm_ioctl+0x14f8>
+ 0.00 : c057f714: 57 5a f8 7e srwi r26,r26,1
+
+Total: 1.7% with that loopless alternative.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://patch.msgid.link/4836e2cde653eebaf2709ebe30eec736bb8c67fd.1749202237.git.christophe.leroy@csgroup.eu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_native.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 853ac5bb33ff..ecb71bf1859d 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -24,6 +24,7 @@
+ #include <sound/minors.h>
+ #include <linux/uio.h>
+ #include <linux/delay.h>
++#include <linux/bitops.h>
+
+ #include "pcm_local.h"
+
+@@ -3130,13 +3131,23 @@ struct snd_pcm_sync_ptr32 {
+ static snd_pcm_uframes_t recalculate_boundary(struct snd_pcm_runtime *runtime)
+ {
+ snd_pcm_uframes_t boundary;
++ snd_pcm_uframes_t border;
++ int order;
+
+ if (! runtime->buffer_size)
+ return 0;
+- boundary = runtime->buffer_size;
+- while (boundary * 2 <= 0x7fffffffUL - runtime->buffer_size)
+- boundary *= 2;
+- return boundary;
++
++ border = 0x7fffffffUL - runtime->buffer_size;
++ if (runtime->buffer_size > border)
++ return runtime->buffer_size;
++
++ order = __fls(border) - __fls(runtime->buffer_size);
++ boundary = runtime->buffer_size << order;
++
++ if (boundary <= border)
++ return boundary;
++ else
++ return boundary / 2;
+ }
+
+ static int snd_pcm_ioctl_sync_ptr_compat(struct snd_pcm_substream *substream,
+--
+2.39.5
+
--- /dev/null
+From cb5734deb9dd18c23aaf93c5107b6e2803b2f122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 May 2025 17:07:42 +0300
+Subject: ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit fd3ab72e42e9871a9902b945a2bf8bb87b49c718 ]
+
+Fix all macro related issues identified by checkpatch.pl:
+
+ CHECK: Macro argument 'x' may be better as '(x)' to avoid precedence issues
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-3-1a821463b632@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_quirks.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index a90673d43822..8435ca833a42 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -2153,15 +2153,15 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer)
+ #define SND_RME_CLK_FREQMUL_SHIFT 18
+ #define SND_RME_CLK_FREQMUL_MASK 0x7
+ #define SND_RME_CLK_SYSTEM(x) \
+- ((x >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK)
++ (((x) >> SND_RME_CLK_SYSTEM_SHIFT) & SND_RME_CLK_SYSTEM_MASK)
+ #define SND_RME_CLK_AES(x) \
+- ((x >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)
++ (((x) >> SND_RME_CLK_AES_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)
+ #define SND_RME_CLK_SPDIF(x) \
+- ((x >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)
++ (((x) >> SND_RME_CLK_SPDIF_SHIFT) & SND_RME_CLK_AES_SPDIF_MASK)
+ #define SND_RME_CLK_SYNC(x) \
+- ((x >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK)
++ (((x) >> SND_RME_CLK_SYNC_SHIFT) & SND_RME_CLK_SYNC_MASK)
+ #define SND_RME_CLK_FREQMUL(x) \
+- ((x >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK)
++ (((x) >> SND_RME_CLK_FREQMUL_SHIFT) & SND_RME_CLK_FREQMUL_MASK)
+ #define SND_RME_CLK_AES_LOCK 0x1
+ #define SND_RME_CLK_AES_SYNC 0x4
+ #define SND_RME_CLK_SPDIF_LOCK 0x2
+@@ -2170,9 +2170,9 @@ static int dell_dock_mixer_init(struct usb_mixer_interface *mixer)
+ #define SND_RME_SPDIF_FORMAT_SHIFT 5
+ #define SND_RME_BINARY_MASK 0x1
+ #define SND_RME_SPDIF_IF(x) \
+- ((x >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK)
++ (((x) >> SND_RME_SPDIF_IF_SHIFT) & SND_RME_BINARY_MASK)
+ #define SND_RME_SPDIF_FORMAT(x) \
+- ((x >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK)
++ (((x) >> SND_RME_SPDIF_FORMAT_SHIFT) & SND_RME_BINARY_MASK)
+
+ static const u32 snd_rme_rate_table[] = {
+ 32000, 44100, 48000, 50000,
+--
+2.39.5
+
--- /dev/null
+From c3d57dbf873035e6339871f34de233c205f86e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 21:54:30 -0800
+Subject: apparmor: fix x_table_lookup when stacking is not the first entry
+
+From: John Johansen <john.johansen@canonical.com>
+
+[ Upstream commit a9eb185be84e998aa9a99c7760534ccc06216705 ]
+
+x_table_lookup currently does stacking during label_parse() if the
+target specifies a stack but its only caller ensures that it will
+never be used with stacking.
+
+Refactor to slightly simplify the code in x_to_label(), this
+also fixes a long standing problem where x_to_labels check on stacking
+is only on the first element to the table option list, instead of
+the element that is found and used.
+
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/domain.c | 52 +++++++++++++++++++++-----------------
+ 1 file changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index 5939bd9a9b9b..08ca9057f82b 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -508,6 +508,7 @@ static const char *next_name(int xtype, const char *name)
+ * @name: returns: name tested to find label (NOT NULL)
+ *
+ * Returns: refcounted label, or NULL on failure (MAYBE NULL)
++ * @name will always be set with the last name tried
+ */
+ struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
+ const char **name)
+@@ -517,6 +518,7 @@ struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
+ struct aa_label *label = NULL;
+ u32 xtype = xindex & AA_X_TYPE_MASK;
+ int index = xindex & AA_X_INDEX_MASK;
++ const char *next;
+
+ AA_BUG(!name);
+
+@@ -524,25 +526,27 @@ struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
+ /* TODO: move lookup parsing to unpack time so this is a straight
+ * index into the resultant label
+ */
+- for (*name = rules->file->trans.table[index]; !label && *name;
+- *name = next_name(xtype, *name)) {
++ for (next = rules->file->trans.table[index]; next;
++ next = next_name(xtype, next)) {
++ const char *lookup = (*next == '&') ? next + 1 : next;
++ *name = next;
+ if (xindex & AA_X_CHILD) {
+- struct aa_profile *new_profile;
+- /* release by caller */
+- new_profile = aa_find_child(profile, *name);
+- if (new_profile)
+- label = &new_profile->label;
++ /* TODO: switich to parse to get stack of child */
++ struct aa_profile *new = aa_find_child(profile, lookup);
++
++ if (new)
++ /* release by caller */
++ return &new->label;
+ continue;
+ }
+- label = aa_label_parse(&profile->label, *name, GFP_KERNEL,
++ label = aa_label_parse(&profile->label, lookup, GFP_KERNEL,
+ true, false);
+- if (IS_ERR(label))
+- label = NULL;
++ if (!IS_ERR_OR_NULL(label))
++ /* release by caller */
++ return label;
+ }
+
+- /* released by caller */
+-
+- return label;
++ return NULL;
+ }
+
+ /**
+@@ -567,9 +571,9 @@ static struct aa_label *x_to_label(struct aa_profile *profile,
+ struct aa_ruleset *rules = list_first_entry(&profile->rules,
+ typeof(*rules), list);
+ struct aa_label *new = NULL;
++ struct aa_label *stack = NULL;
+ struct aa_ns *ns = profile->ns;
+ u32 xtype = xindex & AA_X_TYPE_MASK;
+- const char *stack = NULL;
+
+ switch (xtype) {
+ case AA_X_NONE:
+@@ -578,13 +582,14 @@ static struct aa_label *x_to_label(struct aa_profile *profile,
+ break;
+ case AA_X_TABLE:
+ /* TODO: fix when perm mapping done at unload */
+- stack = rules->file->trans.table[xindex & AA_X_INDEX_MASK];
+- if (*stack != '&') {
+- /* released by caller */
+- new = x_table_lookup(profile, xindex, lookupname);
+- stack = NULL;
++ /* released by caller
++ * if null for both stack and direct want to try fallback
++ */
++ new = x_table_lookup(profile, xindex, lookupname);
++ if (!new || **lookupname != '&')
+ break;
+- }
++ stack = new;
++ new = NULL;
+ fallthrough; /* to X_NAME */
+ case AA_X_NAME:
+ if (xindex & AA_X_CHILD)
+@@ -599,6 +604,7 @@ static struct aa_label *x_to_label(struct aa_profile *profile,
+ break;
+ }
+
++ /* fallback transition check */
+ if (!new) {
+ if (xindex & AA_X_INHERIT) {
+ /* (p|c|n)ix - don't change profile but do
+@@ -617,12 +623,12 @@ static struct aa_label *x_to_label(struct aa_profile *profile,
+ /* base the stack on post domain transition */
+ struct aa_label *base = new;
+
+- new = aa_label_parse(base, stack, GFP_KERNEL, true, false);
+- if (IS_ERR(new))
+- new = NULL;
++ new = aa_label_merge(base, stack, GFP_KERNEL);
++ /* null on error */
+ aa_put_label(base);
+ }
+
++ aa_put_label(stack);
+ /* released by caller */
+ return new;
+ }
+--
+2.39.5
+
--- /dev/null
+From eda38e77de6763ade1c58319b03baa3a1fe5478a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 18:42:08 -0400
+Subject: apparmor: shift ouid when mediating hard links in userns
+
+From: Gabriel Totev <gabriel.totev@zetier.com>
+
+[ Upstream commit c5bf96d20fd787e4909b755de4705d52f3458836 ]
+
+When using AppArmor profiles inside an unprivileged container,
+the link operation observes an unshifted ouid.
+(tested with LXD and Incus)
+
+For example, root inside container and uid 1000000 outside, with
+`owner /root/link l,` profile entry for ln:
+
+/root$ touch chain && ln chain link
+==> dmesg
+apparmor="DENIED" operation="link" class="file"
+namespace="root//lxd-feet_<var-snap-lxd-common-lxd>" profile="linkit"
+name="/root/link" pid=1655 comm="ln" requested_mask="l" denied_mask="l"
+fsuid=1000000 ouid=0 [<== should be 1000000] target="/root/chain"
+
+Fix by mapping inode uid of old_dentry in aa_path_link() rather than
+using it directly, similarly to how it's mapped in __file_path_perm()
+later in the file.
+
+Signed-off-by: Gabriel Totev <gabriel.totev@zetier.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/file.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/file.c b/security/apparmor/file.c
+index d52a5b14dad4..62bc46e03758 100644
+--- a/security/apparmor/file.c
++++ b/security/apparmor/file.c
+@@ -423,9 +423,11 @@ int aa_path_link(const struct cred *subj_cred,
+ {
+ struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
+ struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
++ struct inode *inode = d_backing_inode(old_dentry);
++ vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_idmap(target.mnt), inode);
+ struct path_cond cond = {
+- d_backing_inode(old_dentry)->i_uid,
+- d_backing_inode(old_dentry)->i_mode
++ .uid = vfsuid_into_kuid(vfsuid),
++ .mode = inode->i_mode,
+ };
+ char *buffer = NULL, *buffer2 = NULL;
+ struct aa_profile *profile;
+--
+2.39.5
+
--- /dev/null
+From 7652e2fe7ceaff1292f51892e6254b18498afea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jan 2025 21:54:04 +0100
+Subject: apparmor: use the condition in AA_BUG_FMT even with debug disabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mateusz Guzik <mjguzik@gmail.com>
+
+[ Upstream commit 67e370aa7f968f6a4f3573ed61a77b36d1b26475 ]
+
+This follows the established practice and fixes a build failure for me:
+security/apparmor/file.c: In function ‘__file_sock_perm’:
+security/apparmor/file.c:544:24: error: unused variable ‘sock’ [-Werror=unused-variable]
+ 544 | struct socket *sock = (struct socket *) file->private_data;
+ | ^~~~
+
+Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/include/lib.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h
+index f11a0db7f51d..e83f45e936a7 100644
+--- a/security/apparmor/include/lib.h
++++ b/security/apparmor/include/lib.h
+@@ -48,7 +48,11 @@ extern struct aa_dfa *stacksplitdfa;
+ #define AA_BUG_FMT(X, fmt, args...) \
+ WARN((X), "AppArmor WARN %s: (" #X "): " fmt, __func__, ##args)
+ #else
+-#define AA_BUG_FMT(X, fmt, args...) no_printk(fmt, ##args)
++#define AA_BUG_FMT(X, fmt, args...) \
++ do { \
++ BUILD_BUG_ON_INVALID(X); \
++ no_printk(fmt, ##args); \
++ } while (0)
+ #endif
+
+ #define AA_ERROR(fmt, args...) \
+--
+2.39.5
+
--- /dev/null
+From 4020524839e254831b639ab8b2832269eb395db0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 17:04:53 +0300
+Subject: ARM: rockchip: fix kernel hang during smp initialization
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+[ Upstream commit 7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 ]
+
+In order to bring up secondary CPUs main CPU write trampoline
+code to SRAM. The trampoline code is written while secondary
+CPUs are powered on (at least that true for RK3188 CPU).
+Sometimes that leads to kernel hang. Probably because secondary
+CPU execute trampoline code while kernel doesn't expect.
+
+The patch moves SRAM initialization step to the point where all
+secondary CPUs are powered down.
+
+That fixes rarely hangs on RK3188:
+[ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
+[ 0.091996] rockchip_smp_prepare_cpus: ncores 4
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Link: https://lore.kernel.org/r/20250703140453.1273027-1-al.kochet@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-rockchip/platsmp.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/mach-rockchip/platsmp.c b/arch/arm/mach-rockchip/platsmp.c
+index 36915a073c23..f432d22bfed8 100644
+--- a/arch/arm/mach-rockchip/platsmp.c
++++ b/arch/arm/mach-rockchip/platsmp.c
+@@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus)
+ }
+
+ if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) {
+- if (rockchip_smp_prepare_sram(node)) {
+- of_node_put(node);
+- return;
+- }
+-
+ /* enable the SCU power domain */
+ pmu_set_power_domain(PMU_PWRDN_SCU, true);
+
+@@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus)
+ asm ("mrc p15, 1, %0, c9, c0, 2\n" : "=r" (l2ctlr));
+ ncores = ((l2ctlr >> 24) & 0x3) + 1;
+ }
+- of_node_put(node);
+
+ /* Make sure that all cores except the first are really off */
+ for (i = 1; i < ncores; i++)
+ pmu_set_power_domain(0 + i, false);
++
++ if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) {
++ if (rockchip_smp_prepare_sram(node)) {
++ of_node_put(node);
++ return;
++ }
++ }
++
++ of_node_put(node);
+ }
+
+ static void __init rk3036_smp_prepare_cpus(unsigned int max_cpus)
+--
+2.39.5
+
--- /dev/null
+From 0662fb44de2d7949155173b3baef55c294ea9de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 11:11:24 -0500
+Subject: ARM: tegra: Use I/O memcpy to write to IRAM
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1 ]
+
+Kasan crashes the kernel trying to check boundaries when using the
+normal memcpy.
+
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Link: https://lore.kernel.org/r/20250522-mach-tegra-kasan-v1-1-419041b8addb@gmail.com
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-tegra/reset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-tegra/reset.c b/arch/arm/mach-tegra/reset.c
+index d5c805adf7a8..ea706fac6358 100644
+--- a/arch/arm/mach-tegra/reset.c
++++ b/arch/arm/mach-tegra/reset.c
+@@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void)
+ BUG_ON(is_enabled);
+ BUG_ON(tegra_cpu_reset_handler_size > TEGRA_IRAM_RESET_HANDLER_SIZE);
+
+- memcpy(iram_base, (void *)__tegra_cpu_reset_handler_start,
++ memcpy_toio(iram_base, (void *)__tegra_cpu_reset_handler_start,
+ tegra_cpu_reset_handler_size);
+
+ err = call_firmware_op(set_cpu_boot_addr, 0, reset_address);
+--
+2.39.5
+
--- /dev/null
+From dd382af33aaeced0a58bfd7fdca095b315b14765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 22:50:25 -0700
+Subject: arm64: Handle KCOV __init vs inline mismatches
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 65c430906efffee9bd7551d474f01a6b1197df90 ]
+
+GCC appears to have kind of fragile inlining heuristics, in the
+sense that it can change whether or not it inlines something based on
+optimizations. It looks like the kcov instrumentation being added (or in
+this case, removed) from a function changes the optimization results,
+and some functions marked "inline" are _not_ inlined. In that case,
+we end up with __init code calling a function not marked __init, and we
+get the build warnings I'm trying to eliminate in the coming patch that
+adds __no_sanitize_coverage to __init functions:
+
+WARNING: modpost: vmlinux: section mismatch in reference: acpi_get_enable_method+0x1c (section: .text.unlikely) -> acpi_psci_present (section: .init.text)
+
+This problem is somewhat fragile (though using either __always_inline
+or __init will deterministically solve it), but we've tripped over
+this before with GCC and the solution has usually been to just use
+__always_inline and move on.
+
+For arm64 this requires forcing one ACPI function to be inlined with
+__always_inline.
+
+Link: https://lore.kernel.org/r/20250724055029.3623499-1-kees@kernel.org
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/acpi.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
+index a407f9cd549e..c07a58b96329 100644
+--- a/arch/arm64/include/asm/acpi.h
++++ b/arch/arm64/include/asm/acpi.h
+@@ -150,7 +150,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor)
+ {}
+ #endif
+
+-static inline const char *acpi_get_enable_method(int cpu)
++static __always_inline const char *acpi_get_enable_method(int cpu)
+ {
+ if (acpi_psci_present())
+ return "psci";
+--
+2.39.5
+
--- /dev/null
+From 1de3db03e144948c434980d0386af37ba040487e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 02:42:01 -0700
+Subject: arm64: Mark kernel as tainted on SAE and SError panic
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit d7ce7e3a84642aadf7c4787f7ec4f58eb163d129 ]
+
+Set TAINT_MACHINE_CHECK when SError or Synchronous External Abort (SEA)
+interrupts trigger a panic to flag potential hardware faults. This
+tainting mechanism aids in debugging and enables correlation of
+hardware-related crashes in large-scale deployments.
+
+This change aligns with similar patches[1] that mark machine check
+events when the system crashes due to hardware errors.
+
+Link: https://lore.kernel.org/all/20250702-add_tain-v1-1-9187b10914b9@debian.org/ [1]
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/20250716-vmcore_hw_error-v2-1-f187f7d62aba@debian.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/traps.c | 1 +
+ arch/arm64/mm/fault.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 529cff825531..35eed1942d85 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -931,6 +931,7 @@ void __noreturn panic_bad_stack(struct pt_regs *regs, unsigned long esr, unsigne
+
+ void __noreturn arm64_serror_panic(struct pt_regs *regs, unsigned long esr)
+ {
++ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK);
+ console_verbose();
+
+ pr_crit("SError Interrupt on CPU%d, code 0x%016lx -- %s\n",
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 11eb8d1adc84..f590dc71ce99 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -838,6 +838,7 @@ static int do_sea(unsigned long far, unsigned long esr, struct pt_regs *regs)
+ */
+ siaddr = untagged_addr(far);
+ }
++ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK);
+ arm64_notify_die(inf->name, regs, inf->sig, inf->code, siaddr, esr);
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 876566618a552063bb1e7436e71cd4df7729611f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 12:09:59 +0100
+Subject: arm64: stacktrace: Check kretprobe_find_ret_addr() return value
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit beecfd6a88a675e20987e70ec532ba734b230fa4 ]
+
+If kretprobe_find_ret_addr() fails to find the original return address,
+it returns 0. Check for this case so that a reliable stacktrace won't
+silently ignore it.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Andrea della Porta <andrea.porta@suse.com>
+Cc: Breno Leitao <leitao@debian.org>
+Cc: Josh Poimboeuf <jpoimboe@kernel.org>
+Cc: Miroslav Benes <mbenes@suse.cz>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Song Liu <song@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Reviewed-and-tested-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20250521111000.2237470-2-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/stacktrace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
+index 1d9d51d7627f..f6494c094214 100644
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -152,6 +152,8 @@ kunwind_recover_return_address(struct kunwind_state *state)
+ orig_pc = kretprobe_find_ret_addr(state->task,
+ (void *)state->common.fp,
+ &state->kr_cur);
++ if (!orig_pc)
++ return -EINVAL;
+ state->common.pc = orig_pc;
+ state->flags.kretprobe = 1;
+ }
+--
+2.39.5
+
--- /dev/null
+From 011ae039599322cb7faeb940c596acb585e5c172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 16:21:19 +0200
+Subject: ASoC: codecs: rt5640: Retry DEVICE_ID verification
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xinxin Wan <xinxin.wan@intel.com>
+
+[ Upstream commit 19f971057b2d7b99c80530ec1052b45de236a8da ]
+
+To be more resilient to codec-detection failures when the hardware
+powers on slowly, add retry mechanism to the device verification check.
+Similar pattern is found throughout a number of Realtek codecs. Our
+tests show that 60ms delay is sufficient to address readiness issues on
+rt5640 chip.
+
+Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Xinxin Wan <xinxin.wan@intel.com>
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20250530142120.2944095-3-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5640.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 21a18012b4c0..55881a5669e2 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -3013,6 +3013,11 @@ static int rt5640_i2c_probe(struct i2c_client *i2c)
+ }
+
+ regmap_read(rt5640->regmap, RT5640_VENDOR_ID2, &val);
++ if (val != RT5640_DEVICE_ID) {
++ usleep_range(60000, 100000);
++ regmap_read(rt5640->regmap, RT5640_VENDOR_ID2, &val);
++ }
++
+ if (val != RT5640_DEVICE_ID) {
+ dev_err(&i2c->dev,
+ "Device with ID register %#x is not rt5640/39\n", val);
+--
+2.39.5
+
--- /dev/null
+From 2bd6f5a5a5c9108d44a87e09a011bd91c3ce84d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jun 2025 11:42:20 +0300
+Subject: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 2d91cb261cac6d885954b8f5da28b5c176c18131 ]
+
+snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will
+leads to null pointer dereference.
+This was reproduced with topology loading and marking a link as ignore
+due to missing hardware component on the system.
+On module removal the soc_tplg_remove_link() would call
+snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored,
+no runtime was created.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://patch.msgid.link/20250619084222.559-3-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 3f97d1f132c6..0db6db16f28b 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1139,6 +1139,9 @@ static int snd_soc_compensate_channel_connection_map(struct snd_soc_card *card,
+ void snd_soc_remove_pcm_runtime(struct snd_soc_card *card,
+ struct snd_soc_pcm_runtime *rtd)
+ {
++ if (!rtd)
++ return;
++
+ lockdep_assert_held(&client_mutex);
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From c4b7bdcd20142756a890fe90f035f276179fd422 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 17:41:04 +0100
+Subject: ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit c4ca928a6db1593802cd945f075a7e21dd0430c1 ]
+
+We currently log parse failures for ELD data and some disconnection events
+as errors without rate limiting. These log messages can be triggered very
+frequently in some situations, especially ELD parsing when there is nothing
+connected to a HDMI port which will generate:
+
+hdmi-audio-codec hdmi-audio-codec.1.auto: HDMI: Unknown ELD version 0
+
+While there's doubtless work that could be done on reducing the number of
+connection notification callbacks it's possible these may be legitimately
+generated by poor quality physical connections so let's use rate limiting
+to mitigate the log spam for the parse errors and lower the severity for
+disconnect logging to debug level.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://patch.msgid.link/20250613-asoc-hdmi-eld-logging-v1-1-76d64154d969@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hdmi.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 1139a2754ca3..056d98154682 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1232,7 +1232,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev,
+ >> DRM_ELD_VER_SHIFT;
+
+ if (ver != ELD_VER_CEA_861D && ver != ELD_VER_PARTIAL) {
+- dev_err(&hdev->dev, "HDMI: Unknown ELD version %d\n", ver);
++ dev_err_ratelimited(&hdev->dev,
++ "HDMI: Unknown ELD version %d\n", ver);
+ return -EINVAL;
+ }
+
+@@ -1240,7 +1241,8 @@ static int hdac_hdmi_parse_eld(struct hdac_device *hdev,
+ DRM_ELD_MNL_MASK) >> DRM_ELD_MNL_SHIFT;
+
+ if (mnl > ELD_MAX_MNL) {
+- dev_err(&hdev->dev, "HDMI: MNL Invalid %d\n", mnl);
++ dev_err_ratelimited(&hdev->dev,
++ "HDMI: MNL Invalid %d\n", mnl);
+ return -EINVAL;
+ }
+
+@@ -1299,8 +1301,8 @@ static void hdac_hdmi_present_sense(struct hdac_hdmi_pin *pin,
+
+ if (!port->eld.monitor_present || !port->eld.eld_valid) {
+
+- dev_err(&hdev->dev, "%s: disconnect for pin:port %d:%d\n",
+- __func__, pin->nid, port->id);
++ dev_dbg(&hdev->dev, "%s: disconnect for pin:port %d:%d\n",
++ __func__, pin->nid, port->id);
+
+ /*
+ * PCMs are not registered during device probe, so don't
+--
+2.39.5
+
--- /dev/null
+From 128b89c89fee09d4de4019586508b7f4838b8d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 14:49:06 +0200
+Subject: ASoC: Intel: avs: Fix uninitialized pointer error in probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 11f74f48c14c1f4fe16541900ea5944c42e30ccf ]
+
+If pcim_request_all_regions() fails, error path operates on
+uninitialized 'bus' pointer. Found out by Coverity static analyzer.
+
+Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20250730124906.351798-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
+index cbbc656fcc3f..6ef49f10e19f 100644
+--- a/sound/soc/intel/avs/core.c
++++ b/sound/soc/intel/avs/core.c
+@@ -446,6 +446,8 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ adev = devm_kzalloc(dev, sizeof(*adev), GFP_KERNEL);
+ if (!adev)
+ return -ENOMEM;
++ bus = &adev->base.core;
++
+ ret = avs_bus_init(adev, pci, id);
+ if (ret < 0) {
+ dev_err(dev, "failed to init avs bus: %d\n", ret);
+@@ -456,7 +458,6 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ if (ret < 0)
+ return ret;
+
+- bus = &adev->base.core;
+ bus->addr = pci_resource_start(pci, 0);
+ bus->remap_addr = pci_ioremap_bar(pci, 0);
+ if (!bus->remap_addr) {
+--
+2.39.5
+
--- /dev/null
+From 6c60fccab29ea92257aa351a232db3c9d8f4af71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 18:21:04 +0100
+Subject: ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCC SKU
+
+From: Peter Jakubek <peterjakubek@gmail.com>
+
+[ Upstream commit 1b03391d073dad748636a1ad9668b837cce58265 ]
+
+Add DMI quirk entry for Alienware systems with SKU "0CCC" to enable
+proper speaker codec configuration (SOC_SDW_CODEC_SPKR).
+
+This system requires the same audio configuration as some existing Dell systems.
+Without this patch, the laptop's speakers and microphone will not work.
+
+Signed-off-by: Peter Jakubek <peterjakubek@gmail.com>
+Link: https://patch.msgid.link/20250731172104.2009007-1-peterjakubek@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 095d08b3fc82..c479b65d73df 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -741,6 +741,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(SOC_SDW_CODEC_SPKR),
+ },
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Alienware"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0CCC")
++ },
++ .driver_data = (void *)(SOC_SDW_CODEC_SPKR),
++ },
+ /* Pantherlake devices*/
+ {
+ .callback = sof_sdw_quirk_cb,
+--
+2.39.5
+
--- /dev/null
+From 58975a01785b1e2e0ee0ac3dcd32232742734ef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jun 2025 02:06:48 +0000
+Subject: ASoC: qcom: use drvdata instead of component to keep id
+
+From: Srinivas Kandagatla <srini@kernel.org>
+
+[ Upstream commit 8167f4f42572818fa8153be2b03e4c2120846603 ]
+
+Qcom lpass is using component->id to keep DAI ID (A).
+
+(S) static int lpass_platform_pcmops_open(
+ sruct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ { ^^^^^^^^^(B0)
+ ...
+(B1) struct snd_soc_pcm_runtime *soc_runtime = snd_soc_substream_to_rtd(substream);
+(B2) struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(soc_runtime, 0);
+ ...
+(B3) unsigned int dai_id = cpu_dai->driver->id;
+
+(A) component->id = dai_id;
+ ...
+ }
+
+This driver can get dai_id from substream (B0 - B3).
+In this driver, below functions get dai_id from component->id (A).
+
+(X) lpass_platform_pcmops_suspend()
+(Y) lpass_platform_pcmops_resume()
+(Z) lpass_platform_copy()
+
+Here, (Z) can get it from substream (B0 - B3), don't need to use
+component->id (A). On suspend/resume (X)(Y), dai_id can only be obtained
+from component->id (A), because there is no substream (B0) in function
+parameter.
+
+But, component->id (A) itself should not be used for such purpose.
+It is intilialized at snd_soc_component_initialize(), and parsed its ID
+(= component->id) from device name (a).
+
+ int snd_soc_component_initialize(...)
+ {
+ ...
+ if (!component->name) {
+(a) component->name = fmt_single_name(dev, &component->id);
+ ... ^^^^^^^^^^^^^
+ }
+ ...
+ }
+
+Unfortunately, current code is broken to start with.
+
+There are many regmaps that the driver cares about, however its only
+managing one (either dp or i2s) in component suspend/resume path.
+
+I2S regmap is mandatory however other regmaps are setup based on flags
+like "hdmi_port_enable" and "codec_dma_enable".
+
+Correct thing for suspend/resume path to handle is by checking these
+flags, instead of using component->id.
+
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Suggested-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://patch.msgid.link/87a56ouuob.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-platform.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 9946f12254b3..b456e096f138 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -202,7 +202,6 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component,
+ struct regmap *map;
+ unsigned int dai_id = cpu_dai->driver->id;
+
+- component->id = dai_id;
+ data = kzalloc(sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+@@ -1190,13 +1189,14 @@ static int lpass_platform_pcmops_suspend(struct snd_soc_component *component)
+ {
+ struct lpass_data *drvdata = snd_soc_component_get_drvdata(component);
+ struct regmap *map;
+- unsigned int dai_id = component->id;
+
+- if (dai_id == LPASS_DP_RX)
++ if (drvdata->hdmi_port_enable) {
+ map = drvdata->hdmiif_map;
+- else
+- map = drvdata->lpaif_map;
++ regcache_cache_only(map, true);
++ regcache_mark_dirty(map);
++ }
+
++ map = drvdata->lpaif_map;
+ regcache_cache_only(map, true);
+ regcache_mark_dirty(map);
+
+@@ -1207,14 +1207,19 @@ static int lpass_platform_pcmops_resume(struct snd_soc_component *component)
+ {
+ struct lpass_data *drvdata = snd_soc_component_get_drvdata(component);
+ struct regmap *map;
+- unsigned int dai_id = component->id;
++ int ret;
+
+- if (dai_id == LPASS_DP_RX)
++ if (drvdata->hdmi_port_enable) {
+ map = drvdata->hdmiif_map;
+- else
+- map = drvdata->lpaif_map;
++ regcache_cache_only(map, false);
++ ret = regcache_sync(map);
++ if (ret)
++ return ret;
++ }
+
++ map = drvdata->lpaif_map;
+ regcache_cache_only(map, false);
++
+ return regcache_sync(map);
+ }
+
+@@ -1224,7 +1229,9 @@ static int lpass_platform_copy(struct snd_soc_component *component,
+ unsigned long bytes)
+ {
+ struct snd_pcm_runtime *rt = substream->runtime;
+- unsigned int dai_id = component->id;
++ struct snd_soc_pcm_runtime *soc_runtime = snd_soc_substream_to_rtd(substream);
++ struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(soc_runtime, 0);
++ unsigned int dai_id = cpu_dai->driver->id;
+ int ret = 0;
+
+ void __iomem *dma_buf = (void __iomem *) (rt->dma_area + pos +
+--
+2.39.5
+
--- /dev/null
+From 34e1ca9c06a14231bb6bae67d4d237135536f490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:28:42 +0100
+Subject: ASoC: SDCA: Add flag for unused IRQs
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 775f5729b47d8737f4f98e0141f61b3358245398 ]
+
+Zero is a valid SDCA IRQ interrupt position so add a special value to
+indicate that the IRQ is not used.
+
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
+Link: https://patch.msgid.link/20250624122844.2761627-6-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/sdca_function.h | 2 ++
+ sound/soc/sdca/sdca_functions.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/include/sound/sdca_function.h b/include/sound/sdca_function.h
+index 253654568a41..1403a9f46976 100644
+--- a/include/sound/sdca_function.h
++++ b/include/sound/sdca_function.h
+@@ -16,6 +16,8 @@ struct device;
+ struct sdca_entity;
+ struct sdca_function_desc;
+
++#define SDCA_NO_INTERRUPT -1
++
+ /*
+ * The addressing space for SDCA relies on 7 bits for Entities, so a
+ * maximum of 128 Entities per function can be represented.
+diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
+index 15aa57a07c73..e1803f0dc590 100644
+--- a/sound/soc/sdca/sdca_functions.c
++++ b/sound/soc/sdca/sdca_functions.c
+@@ -912,6 +912,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti
+ &tmp);
+ if (!ret)
+ control->interrupt_position = tmp;
++ else
++ control->interrupt_position = SDCA_NO_INTERRUPT;
+
+ control->label = find_sdca_control_label(dev, entity, control);
+ if (!control->label)
+--
+2.39.5
+
--- /dev/null
+From de7cbdcf6f901e35b0ce41b0f63707c4cebe43f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 02:26:39 +0000
+Subject: ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
+ successed
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit f40ecc2743652c0b0f19935f81baf57c601eb7f0 ]
+
+ASoC has 2 functions to set bias level.
+ (A) snd_soc_dapm_force_bias_level()
+ (B) snd_soc_dapm_set_bias_level()
+
+snd_soc_dapm_force_bias_level() (A) will set dapm->bias_level (a) if
+successed.
+
+(A) int snd_soc_dapm_force_bias_level(...)
+ {
+ ...
+ if (ret == 0)
+(a) dapm->bias_level = level;
+ ...
+ }
+
+snd_soc_dapm_set_bias_level() (B) is also a function that sets bias_level.
+It will call snd_soc_dapm_force_bias_level() (A) inside, but doesn't
+set dapm->bias_level by itself. One note is that (A) might not be called.
+
+(B) static int snd_soc_dapm_set_bias_level(...)
+ {
+ ...
+ ret = snd_soc_card_set_bias_level(...);
+ ...
+ if (dapm != &card->dapm)
+(A) ret = snd_soc_dapm_force_bias_level(...);
+ ...
+ ret = snd_soc_card_set_bias_level_post(...);
+ ...
+ }
+
+dapm->bias_level will be set if (A) was called, but might not be set
+if (B) was called, even though it calles set_bias_level() function.
+
+We should set dapm->bias_level if we calls
+snd_soc_dapm_set_bias_level() (B), too.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://patch.msgid.link/87qzyn4g4h.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index b7818388984e..227f86752b1e 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -739,6 +739,10 @@ static int snd_soc_dapm_set_bias_level(struct snd_soc_dapm_context *dapm,
+ out:
+ trace_snd_soc_bias_level_done(dapm, level);
+
++ /* success */
++ if (ret == 0)
++ snd_soc_dapm_init_bias_level(dapm, level);
++
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 0004528b07987fd708ebda7810105b17c8a82964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jun 2025 13:26:40 +0300
+Subject: ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless
+ mode
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 6b3cb7f4341cbf62d41ccf6ea906dbe66be8aa3d ]
+
+Parsing the dapm_widget_tokens is also needed for DSPless mode as it is
+setting the snd_soc_dapm_widget.no_wname_in_kcontrol_name flag for the
+kcontrol creation from DAPM widgets.
+Without that flag set, the following warnings might appear because of long
+control names:
+ALSA: Control name 'eqiir.2.1 Post Mixer Analog Playback IIR Eq bytes' truncated to 'eqiir.2.1 Post Mixer Analog Playback IIR Eq'
+ALSA: Control name 'eqfir.2.1 Post Mixer Analog Playback FIR Eq bytes' truncated to 'eqfir.2.1 Post Mixer Analog Playback FIR Eq'
+ALSA: Control name 'drc.2.1 Post Mixer Analog Playback DRC bytes' truncated to 'drc.2.1 Post Mixer Analog Playback DRC byte'
+ALSA: Control name 'drc.2.1 Post Mixer Analog Playback DRC switch' truncated to 'drc.2.1 Post Mixer Analog Playback DRC swit'
+ALSA: Control name 'gain.15.1 Pre Mixer Deepbuffer HDA Analog Volume' truncated to 'gain.15.1 Pre Mixer Deepbuffer HDA Analog V'
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20250619102640.12068-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/topology.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
+index 14aa8ecc4bc4..554808d2dc29 100644
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -2368,14 +2368,25 @@ static int sof_dspless_widget_ready(struct snd_soc_component *scomp, int index,
+ struct snd_soc_dapm_widget *w,
+ struct snd_soc_tplg_dapm_widget *tw)
+ {
++ struct snd_soc_tplg_private *priv = &tw->priv;
++ int ret;
++
++ /* for snd_soc_dapm_widget.no_wname_in_kcontrol_name */
++ ret = sof_parse_tokens(scomp, w, dapm_widget_tokens,
++ ARRAY_SIZE(dapm_widget_tokens),
++ priv->array, le32_to_cpu(priv->size));
++ if (ret < 0) {
++ dev_err(scomp->dev, "failed to parse dapm widget tokens for %s\n",
++ w->name);
++ return ret;
++ }
++
+ if (WIDGET_IS_DAI(w->id)) {
+ static const struct sof_topology_token dai_tokens[] = {
+ {SOF_TKN_DAI_TYPE, SND_SOC_TPLG_TUPLE_TYPE_STRING, get_token_dai_type, 0}};
+ struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp);
+- struct snd_soc_tplg_private *priv = &tw->priv;
+ struct snd_sof_widget *swidget;
+ struct snd_sof_dai *sdai;
+- int ret;
+
+ swidget = kzalloc(sizeof(*swidget), GFP_KERNEL);
+ if (!swidget)
+--
+2.39.5
+
--- /dev/null
+From 75d90abebda3597c2aa6b0de8cf1c22333e8a578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 21:53:17 +0900
+Subject: ata: ahci: Disable DIPM if host lacks support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit f7870e8d345cdabfb94bcbdcba6a07e050f8705e ]
+
+The AHCI specification version 1.3.1 section 8.3.1.4 (Software
+Requirements and Precedence) states that:
+
+If CAP.SSC or CAP.PSC is cleared to ‘0’, software should disable
+device-initiated power management by issuing the appropriate SET
+FEATURES command to the device.
+
+To satisfy this constraint and force ata_dev_configure to disable the
+device DIPM feature, modify ahci_update_initial_lpm_policy() to set the
+ATA_FLAG_NO_DIPM flag on ports that have a host with either the
+ATA_HOST_NO_PART flag set or the ATA_HOST_NO_SSC flag set.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de.>
+Link: https://lore.kernel.org/r/20250701125321.69496-7-dlemoal@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index f52ae776d990..f0c4e225172d 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1784,6 +1784,13 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap)
+ return;
+ }
+
++ /* If no Partial or no Slumber, we cannot support DIPM. */
++ if ((ap->host->flags & ATA_HOST_NO_PART) ||
++ (ap->host->flags & ATA_HOST_NO_SSC)) {
++ ata_port_dbg(ap, "Host does not support DIPM\n");
++ ap->flags |= ATA_FLAG_NO_DIPM;
++ }
++
+ /* If no LPM states are supported by the HBA, do not bother with LPM */
+ if ((ap->host->flags & ATA_HOST_NO_PART) &&
+ (ap->host->flags & ATA_HOST_NO_SSC) &&
+--
+2.39.5
+
--- /dev/null
+From e8e3456fa2efb60a86c7ea0749a065faddfff36c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 21:53:19 +0900
+Subject: ata: ahci: Disallow LPM policy control if not supported
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 65b2c92f69d3df81422d27e5be012e357e733241 ]
+
+Commit fa997b0576c9 ("ata: ahci: Do not enable LPM if no LPM states are
+supported by the HBA") introduced an early return in
+ahci_update_initial_lpm_policy() to ensure that the target_lpm_policy
+of ports belonging to a host that does not support the Partial, Slumber
+and DevSleep power states is unchanged and remains set to
+ATA_LPM_UNKNOWN and thus prevents the execution of
+ata_eh_link_set_lpm().
+
+However, a user or a system daemon (e.g. systemd-udevd) may still
+attempt changing the LPM policy through the sysfs
+link_power_management_policy of the host.
+
+Improve this to prevent sysfs LPM policy changes by setting the flag
+ATA_FLAG_NO_LPM for the port of such host, and initialize the port
+target_lpm_policy to ATA_LPM_MAX_POWER to guarantee that no unsupported
+low power state is being used on the port and its link.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250701125321.69496-9-dlemoal@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 931da4749e80..f52ae776d990 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1788,7 +1788,10 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap)
+ if ((ap->host->flags & ATA_HOST_NO_PART) &&
+ (ap->host->flags & ATA_HOST_NO_SSC) &&
+ (ap->host->flags & ATA_HOST_NO_DEVSLP)) {
+- ata_port_dbg(ap, "no LPM states supported, not enabling LPM\n");
++ ata_port_dbg(ap,
++ "No LPM states supported, forcing LPM max_power\n");
++ ap->flags |= ATA_FLAG_NO_LPM;
++ ap->target_lpm_policy = ATA_LPM_MAX_POWER;
+ return;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a3734a0c924ffa4d209faa632bc5a59dfc39e118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 21:53:16 +0900
+Subject: ata: libata-sata: Disallow changing LPM state if not supported
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 413e800cadbf67550d76c77c230b2ecd96bce83a ]
+
+Modify ata_scsi_lpm_store() to return an error if a user attempts to set
+a link power management policy for a port that does not support LPM,
+that is, ports flagged with ATA_FLAG_NO_LPM.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Link: https://lore.kernel.org/r/20250701125321.69496-6-dlemoal@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-sata.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c
+index 2e4463d3a356..00b7123192e7 100644
+--- a/drivers/ata/libata-sata.c
++++ b/drivers/ata/libata-sata.c
+@@ -924,6 +924,11 @@ static ssize_t ata_scsi_lpm_store(struct device *device,
+
+ spin_lock_irqsave(ap->lock, flags);
+
++ if (ap->flags & ATA_FLAG_NO_LPM) {
++ count = -EOPNOTSUPP;
++ goto out_unlock;
++ }
++
+ ata_for_each_link(link, ap, EDGE) {
+ ata_for_each_dev(dev, &ap->link, ENABLED) {
+ if (dev->quirks & ATA_QUIRK_NOLPM) {
+--
+2.39.5
+
--- /dev/null
+From 4b710ce514655c81338aeedef41e8307c90ae390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 12:35:47 -0700
+Subject: be2net: Use correct byte order and format string for TCP seq and
+ ack_seq
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 4701ee5044fb3992f1c910630a9673c2dc600ce5 ]
+
+The TCP header fields seq and ack_seq are 32-bit values in network
+byte order as (__be32). these fields were earlier printed using
+ntohs(), which converts only 16-bit values and produces incorrect
+results for 32-bit fields. This patch is changeing the conversion
+to ntohl(), ensuring correct interpretation of these sequence numbers.
+
+Notably, the format specifier is updated from %d to %u to reflect the
+unsigned nature of these fields.
+
+improves the accuracy of debug log messages for TCP sequence and
+acknowledgment numbers during TX timeouts.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250717193552.3648791-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/emulex/benet/be_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 3d2e21592119..490af6659429 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -1465,10 +1465,10 @@ static void be_tx_timeout(struct net_device *netdev, unsigned int txqueue)
+ ntohs(tcphdr->source));
+ dev_info(dev, "TCP dest port %d\n",
+ ntohs(tcphdr->dest));
+- dev_info(dev, "TCP sequence num %d\n",
+- ntohs(tcphdr->seq));
+- dev_info(dev, "TCP ack_seq %d\n",
+- ntohs(tcphdr->ack_seq));
++ dev_info(dev, "TCP sequence num %u\n",
++ ntohl(tcphdr->seq));
++ dev_info(dev, "TCP ack_seq %u\n",
++ ntohl(tcphdr->ack_seq));
+ } else if (ip_hdr(skb)->protocol ==
+ IPPROTO_UDP) {
+ udphdr = udp_hdr(skb);
+--
+2.39.5
+
--- /dev/null
+From 58113df91f6506a00715f64d6dcb424cf46a6e56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 22:30:32 -0400
+Subject: better lockdep annotations for simple_recursive_removal()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 2a8061ee5e41034eb14170ec4517b5583dbeff9f ]
+
+We want a class that nests outside of I_MUTEX_NORMAL (for the sake of
+callbacks that might want to lock the victim) and inside I_MUTEX_PARENT
+(so that a variant of that could be used with parent of the victim
+held locked by the caller).
+
+In reality, simple_recursive_removal()
+ * never holds two locks at once
+ * holds the lock on parent of dentry passed to callback
+ * is used only on the trees with fixed topology, so the depths
+are not changing.
+
+So the locking order is actually fine.
+
+AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks
+grabbed by that thing.
+
+Reported-by: syzbot+169de184e9defe7fe709@syzkaller.appspotmail.com
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 14e0e9b18c8e..1149c62a801f 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -612,7 +612,7 @@ void simple_recursive_removal(struct dentry *dentry,
+ struct dentry *victim = NULL, *child;
+ struct inode *inode = this->d_inode;
+
+- inode_lock(inode);
++ inode_lock_nested(inode, I_MUTEX_CHILD);
+ if (d_is_dir(this))
+ inode->i_flags |= S_DEAD;
+ while ((child = find_next_child(this, victim)) == NULL) {
+@@ -624,7 +624,7 @@ void simple_recursive_removal(struct dentry *dentry,
+ victim = this;
+ this = this->d_parent;
+ inode = this->d_inode;
+- inode_lock(inode);
++ inode_lock_nested(inode, I_MUTEX_CHILD);
+ if (simple_positive(victim)) {
+ d_invalidate(victim); // avoid lost mounts
+ if (d_is_dir(victim))
+--
+2.39.5
+
--- /dev/null
+From 81145ff5abccc630f4e04b119efa739ae1861496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 11:53:14 -0700
+Subject: binder: Fix selftest page indexing
+
+From: Tiffany Yang <ynaffit@google.com>
+
+[ Upstream commit bea3e7bfa2957d986683543cbf57092715f9a91b ]
+
+The binder allocator selftest was only checking the last page of buffers
+that ended on a page boundary. Correct the page indexing to account for
+buffers that are not page-aligned.
+
+Signed-off-by: Tiffany Yang <ynaffit@google.com>
+Acked-by: Carlos Llamas <cmllamas@google.com>
+Link: https://lore.kernel.org/r/20250714185321.2417234-2-ynaffit@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binder_alloc_selftest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/android/binder_alloc_selftest.c b/drivers/android/binder_alloc_selftest.c
+index c88735c54848..486af3ec3c02 100644
+--- a/drivers/android/binder_alloc_selftest.c
++++ b/drivers/android/binder_alloc_selftest.c
+@@ -142,12 +142,12 @@ static void binder_selftest_free_buf(struct binder_alloc *alloc,
+ for (i = 0; i < BUFFER_NUM; i++)
+ binder_alloc_free_buf(alloc, buffers[seq[i]]);
+
+- for (i = 0; i < end / PAGE_SIZE; i++) {
+ /**
+ * Error message on a free page can be false positive
+ * if binder shrinker ran during binder_alloc_free_buf
+ * calls above.
+ */
++ for (i = 0; i <= (end - 1) / PAGE_SIZE; i++) {
+ if (list_empty(page_to_lru(alloc->pages[i]))) {
+ pr_err_size_seq(sizes, seq);
+ pr_err("expect lru but is %s at page index %d\n",
+--
+2.39.5
+
--- /dev/null
+From a7ffe2e363d7c500ce1005d160c134bcca331e0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 09:14:47 +0000
+Subject: block: avoid possible overflow for chunk_sectors check in
+ blk_stack_limits()
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit 448dfecc7ff807822ecd47a5c052acedca7d09e8 ]
+
+In blk_stack_limits(), we check that the t->chunk_sectors value is a
+multiple of the t->physical_block_size value.
+
+However, by finding the chunk_sectors value in bytes, we may overflow
+the unsigned int which holds chunk_sectors, so change the check to be
+based on sectors.
+
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250729091448.1691334-2-john.g.garry@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 47a31e1c0909..7a76ff3696c4 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -797,7 +797,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ }
+
+ /* chunk_sectors a multiple of the physical block size? */
+- if ((t->chunk_sectors << 9) & (t->physical_block_size - 1)) {
++ if (t->chunk_sectors % (t->physical_block_size >> SECTOR_SHIFT)) {
+ t->chunk_sectors = 0;
+ t->flags |= BLK_FLAG_MISALIGNED;
+ ret = -1;
+--
+2.39.5
+
--- /dev/null
+From 07ab9f0ccaea00eab9681eb543a6103a3daba259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 14:36:06 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
+
+From: En-Wei Wu <en-wei.wu@canonical.com>
+
+[ Upstream commit 942873c8137fe0015ab37f62f159d88079859c5e ]
+
+Add VID 0489 & PID e14e for MediaTek MT7925 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0489 ProdID=e14e Rev= 1.00
+S: Manufacturer=MediaTek Inc.
+S: Product=Wireless_Device
+S: SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
+I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: En-Wei Wu <en-wei.wu@canonical.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index a2ba32319b6f..338f426e92e2 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -709,6 +709,8 @@ static const struct usb_device_id quirks_table[] = {
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x0489, 0xe14e), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe14f), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe150), .driver_info = BTUSB_MEDIATEK |
+--
+2.39.5
+
--- /dev/null
+From 941a286fe478cc79eb02dd1858cc0bfde68b72bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 May 2025 18:23:32 +0200
+Subject: Bluetooth: btusb: Add support for variant of RTL8851BE (USB ID
+ 13d3:3601)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <ukleinek@debian.org>
+
+[ Upstream commit 65b0dca6f9f2c912a77a6ad6cf56f60a895a496b ]
+
+Teach the btusb driver to recognize another variant of the RTL8851BE
+bluetooth radio.
+
+/sys/kernel/debug/usb/devices reports for that device:
+
+ T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+ D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+ P: Vendor=13d3 ProdID=3601 Rev= 0.00
+ S: Manufacturer=Realtek
+ S: Product=Bluetooth Radio
+ S: SerialNumber=00e04c000001
+ C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+ I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+ E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+ E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+ I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+ I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+ I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+ I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+ I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+ I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+ I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+ E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+ E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+
+Reported-by: shdeb <shdeb3000000@gmail.com>
+Link: https://bugs.debian.org/1106386
+Signed-off-by: Uwe Kleine-König <ukleinek@debian.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 338f426e92e2..c83de1772fdd 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -515,6 +515,7 @@ static const struct usb_device_id quirks_table[] = {
+ /* Realtek 8851BE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK },
++ { USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK },
+
+ /* Realtek 8851BU Bluetooth devices */
+ { USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
+--
+2.39.5
+
--- /dev/null
+From 7ad8420619269a2ecf53c9c81f8a2a0f79702d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 15:56:22 +0800
+Subject: Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event
+
+From: Yang Li <yang.li@amlogic.com>
+
+[ Upstream commit b2a5f2e1c127cb431df22e114998ff72eb4578c8 ]
+
+When the BIS source stops, the controller sends an LE BIG Sync Lost
+event (subevent 0x1E). Currently, this event is not handled, causing
+the BIS stream to remain active in BlueZ and preventing recovery.
+
+Signed-off-by: Yang Li <yang.li@amlogic.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h | 6 +++++
+ include/net/bluetooth/hci_core.h | 5 ++--
+ net/bluetooth/hci_conn.c | 3 ++-
+ net/bluetooth/hci_event.c | 39 +++++++++++++++++++++++++++++++-
+ 4 files changed, 49 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index ebe01eb28264..702b526541e6 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -2851,6 +2851,12 @@ struct hci_evt_le_big_sync_estabilished {
+ __le16 bis[];
+ } __packed;
+
++#define HCI_EVT_LE_BIG_SYNC_LOST 0x1e
++struct hci_evt_le_big_sync_lost {
++ __u8 handle;
++ __u8 reason;
++} __packed;
++
+ #define HCI_EVT_LE_BIG_INFO_ADV_REPORT 0x22
+ struct hci_evt_le_big_info_adv_report {
+ __le16 sync_handle;
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 351a9057e70e..1d62f0cce195 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1348,7 +1348,8 @@ hci_conn_hash_lookup_big_sync_pend(struct hci_dev *hdev,
+ }
+
+ static inline struct hci_conn *
+-hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle, __u16 state)
++hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle, __u16 state,
++ __u8 role)
+ {
+ struct hci_conn_hash *h = &hdev->conn_hash;
+ struct hci_conn *c;
+@@ -1356,7 +1357,7 @@ hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle, __u16 state)
+ rcu_read_lock();
+
+ list_for_each_entry_rcu(c, &h->list, list) {
+- if (c->type != BIS_LINK || c->state != state)
++ if (c->type != BIS_LINK || c->state != state || c->role != role)
+ continue;
+
+ if (handle == c->iso_qos.bcast.big) {
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index fccdb864af72..082cca18db2e 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2144,7 +2144,8 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ struct hci_link *link;
+
+ /* Look for any BIS that is open for rebinding */
+- conn = hci_conn_hash_lookup_big_state(hdev, qos->bcast.big, BT_OPEN);
++ conn = hci_conn_hash_lookup_big_state(hdev, qos->bcast.big, BT_OPEN,
++ HCI_ROLE_MASTER);
+ if (conn) {
+ memcpy(qos, &conn->iso_qos, sizeof(*qos));
+ conn->state = BT_CONNECTED;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index c1dd8d78701f..b83995898da0 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6880,7 +6880,8 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
+
+ /* Connect all BISes that are bound to the BIG */
+ while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
+- BT_BOUND))) {
++ BT_BOUND,
++ HCI_ROLE_MASTER))) {
+ if (ev->status) {
+ hci_connect_cfm(conn, ev->status);
+ hci_conn_del(conn);
+@@ -6996,6 +6997,37 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
+ hci_dev_unlock(hdev);
+ }
+
++static void hci_le_big_sync_lost_evt(struct hci_dev *hdev, void *data,
++ struct sk_buff *skb)
++{
++ struct hci_evt_le_big_sync_lost *ev = data;
++ struct hci_conn *bis, *conn;
++
++ bt_dev_dbg(hdev, "big handle 0x%2.2x", ev->handle);
++
++ hci_dev_lock(hdev);
++
++ /* Delete the pa sync connection */
++ bis = hci_conn_hash_lookup_pa_sync_big_handle(hdev, ev->handle);
++ if (bis) {
++ conn = hci_conn_hash_lookup_pa_sync_handle(hdev,
++ bis->sync_handle);
++ if (conn)
++ hci_conn_del(conn);
++ }
++
++ /* Delete each bis connection */
++ while ((bis = hci_conn_hash_lookup_big_state(hdev, ev->handle,
++ BT_CONNECTED,
++ HCI_ROLE_SLAVE))) {
++ clear_bit(HCI_CONN_BIG_SYNC, &bis->flags);
++ hci_disconn_cfm(bis, ev->reason);
++ hci_conn_del(bis);
++ }
++
++ hci_dev_unlock(hdev);
++}
++
+ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+ {
+@@ -7119,6 +7151,11 @@ static const struct hci_le_ev {
+ hci_le_big_sync_established_evt,
+ sizeof(struct hci_evt_le_big_sync_estabilished),
+ HCI_MAX_EVENT_SIZE),
++ /* [0x1e = HCI_EVT_LE_BIG_SYNC_LOST] */
++ HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_LOST,
++ hci_le_big_sync_lost_evt,
++ sizeof(struct hci_evt_le_big_sync_lost),
++ HCI_MAX_EVENT_SIZE),
+ /* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
+ HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
+ hci_le_big_info_adv_report_evt,
+--
+2.39.5
+
--- /dev/null
+From 6898f349addcd2225a5307ab1d153d754b7f7650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 20:31:16 +0800
+Subject: Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 4d7936e8a5b1fa803f4a631d2da4a80fa4f0f37f ]
+
+Reset cookie value to 0 instead of 0xffffffff in hci_sock_free_cookie()
+since:
+0 : means cookie has not been assigned yet
+0xffffffff: means cookie assignment failure
+
+Also fix generating cookie failure with usage shown below:
+hci_sock_gen_cookie(sk) // generate cookie
+hci_sock_free_cookie(sk) // free cookie
+hci_sock_gen_cookie(sk) // Can't generate cookie any more
+
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 022b86797acd..4ad5296d7934 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -118,7 +118,7 @@ static void hci_sock_free_cookie(struct sock *sk)
+ int id = hci_pi(sk)->cookie;
+
+ if (id) {
+- hci_pi(sk)->cookie = 0xffffffff;
++ hci_pi(sk)->cookie = 0;
+ ida_free(&sock_cookie_ida, id);
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From b66feb0b11757660ea003747d1ef9d0c79fd6913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 12:49:25 +0200
+Subject: bootconfig: Fix unaligned access when building footer
+
+From: Ben Hutchings <benh@debian.org>
+
+[ Upstream commit 6ed5e20466c79e3b3350bae39f678f73cf564b4e ]
+
+Currently we add padding between the bootconfig text and footer to
+ensure that the footer is aligned within the initramfs image.
+However, because only the bootconfig data is held in memory, not the
+full initramfs image, the footer may not be naturally aligned in
+memory.
+
+This can result in an alignment fault (SIGBUS) when writing the footer
+on some architectures, such as sparc.
+
+Build the footer in a struct on the stack before adding it to the
+buffer.
+
+References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0
+Link: https://lore.kernel.org/all/aIC-NTw-cdm9ZGFw@decadent.org.uk/
+
+Signed-off-by: Ben Hutchings <benh@debian.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bootconfig/main.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
+index 8a48cc2536f5..dce2d6ffcca5 100644
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -11,6 +11,7 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <endian.h>
++#include <assert.h>
+
+ #include <linux/bootconfig.h>
+
+@@ -359,7 +360,12 @@ static int delete_xbc(const char *path)
+
+ static int apply_xbc(const char *path, const char *xbc_path)
+ {
+- char *buf, *data, *p;
++ struct {
++ uint32_t size;
++ uint32_t csum;
++ char magic[BOOTCONFIG_MAGIC_LEN];
++ } footer;
++ char *buf, *data;
+ size_t total_size;
+ struct stat stat;
+ const char *msg;
+@@ -430,17 +436,13 @@ static int apply_xbc(const char *path, const char *xbc_path)
+ size += pad;
+
+ /* Add a footer */
+- p = data + size;
+- *(uint32_t *)p = htole32(size);
+- p += sizeof(uint32_t);
++ footer.size = htole32(size);
++ footer.csum = htole32(csum);
++ memcpy(footer.magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
++ static_assert(sizeof(footer) == BOOTCONFIG_FOOTER_SIZE);
++ memcpy(data + size, &footer, BOOTCONFIG_FOOTER_SIZE);
+
+- *(uint32_t *)p = htole32(csum);
+- p += sizeof(uint32_t);
+-
+- memcpy(p, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
+- p += BOOTCONFIG_MAGIC_LEN;
+-
+- total_size = p - data;
++ total_size = size + BOOTCONFIG_FOOTER_SIZE;
+
+ ret = write(fd, data, total_size);
+ if (ret < total_size) {
+--
+2.39.5
+
--- /dev/null
+From 31165e50b972d82c0bec3574ebf1045284d7f117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 20:20:53 +0200
+Subject: bpf: Forget ranges when refining tnum after JSET
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6279846b9b2532e1b04559ef8bd0dec049f29383 ]
+
+Syzbot reported a kernel warning due to a range invariant violation on
+the following BPF program.
+
+ 0: call bpf_get_netns_cookie
+ 1: if r0 == 0 goto <exit>
+ 2: if r0 & Oxffffffff goto <exit>
+
+The issue is on the path where we fall through both jumps.
+
+That path is unreachable at runtime: after insn 1, we know r0 != 0, but
+with the sign extension on the jset, we would only fallthrough insn 2
+if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to
+figure this out, so the verifier walks all branches. The verifier then
+refines the register bounds using the second condition and we end
+up with inconsistent bounds on this unreachable path:
+
+ 1: if r0 == 0 goto <exit>
+ r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)
+ 2: if r0 & 0xffffffff goto <exit>
+ r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)
+ r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0)
+
+Improving the range refinement for JSET to cover all cases is tricky. We
+also don't expect many users to rely on JSET given LLVM doesn't generate
+those instructions. So instead of improving the range refinement for
+JSETs, Eduard suggested we forget the ranges whenever we're narrowing
+tnums after a JSET. This patch implements that approach.
+
+Reported-by: syzbot+c711ce17dd78e5d4fdcf@syzkaller.appspotmail.com
+Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Link: https://lore.kernel.org/r/9d4fd6432a095d281f815770608fdcd16028ce0b.1752171365.git.paul.chaignon@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a1ecad2944a8..bdeed2a24910 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -16014,6 +16014,10 @@ static void regs_refine_cond_op(struct bpf_reg_state *reg1, struct bpf_reg_state
+ if (!is_reg_const(reg2, is_jmp32))
+ break;
+ val = reg_const_value(reg2, is_jmp32);
++ /* Forget the ranges before narrowing tnums, to avoid invariant
++ * violations if we're on a dead branch.
++ */
++ __mark_reg_unbounded(reg1);
+ if (is_jmp32) {
+ t = tnum_and(tnum_subreg(reg1->var_off), tnum_const(~val));
+ reg1->var_off = tnum_with_subreg(reg1->var_off, t);
+--
+2.39.5
+
--- /dev/null
+From dec70c993f721f205481012ba7004656bde1faab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 11:30:22 -0700
+Subject: bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
+
+From: Ihor Solodrai <isolodrai@meta.com>
+
+[ Upstream commit 5534e58f2e9bd72b253d033ee0af6e68eb8ac96b ]
+
+When reg->type is CONST_PTR_TO_MAP, it can not be null. However the
+verifier explores the branches under rX == 0 in check_cond_jmp_op()
+even if reg->type is CONST_PTR_TO_MAP, because it was not checked for
+in reg_not_null().
+
+Fix this by adding CONST_PTR_TO_MAP to the set of types that are
+considered non nullable in reg_not_null().
+
+An old "unpriv: cmp map pointer with zero" selftest fails with this
+change, because now early out correctly triggers in
+check_cond_jmp_op(), making the verification to pass.
+
+In practice verifier may allow pointer to null comparison in unpriv,
+since in many cases the relevant branch and comparison op are removed
+as dead code. So change the expected test result to __success_unpriv.
+
+Signed-off-by: Ihor Solodrai <isolodrai@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250609183024.359974-2-isolodrai@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 3 ++-
+ tools/testing/selftests/bpf/progs/verifier_unpriv.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index bdeed2a24910..ef6c108c468d 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -404,7 +404,8 @@ static bool reg_not_null(const struct bpf_reg_state *reg)
+ type == PTR_TO_MAP_KEY ||
+ type == PTR_TO_SOCK_COMMON ||
+ (type == PTR_TO_BTF_ID && is_trusted_reg(reg)) ||
+- type == PTR_TO_MEM;
++ type == PTR_TO_MEM ||
++ type == CONST_PTR_TO_MAP;
+ }
+
+ static struct btf_record *reg_btf_record(const struct bpf_reg_state *reg)
+diff --git a/tools/testing/selftests/bpf/progs/verifier_unpriv.c b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
+index a4a5e2071604..28200f068ce5 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_unpriv.c
++++ b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
+@@ -619,7 +619,7 @@ __naked void pass_pointer_to_tail_call(void)
+
+ SEC("socket")
+ __description("unpriv: cmp map pointer with zero")
+-__success __failure_unpriv __msg_unpriv("R1 pointer comparison")
++__success __success_unpriv
+ __retval(0)
+ __naked void cmp_map_pointer_with_zero(void)
+ {
+--
+2.39.5
+
--- /dev/null
+From a53fd2c33130dc009149015f03ff9539bbc6c023 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jun 2025 09:24:42 -0400
+Subject: bpftool: Fix JSON writer resource leak in version command
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 85cd83fed8267cde0dd1cea719808aad95ae4de7 ]
+
+When using `bpftool --version -j/-p`, the JSON writer object
+created in do_version() was not properly destroyed after use.
+This caused a memory leak each time the version command was
+executed with JSON output.
+
+Fix: 004b45c0e51a (tools: bpftool: provide JSON output for all possible commands)
+
+Suggested-by: Quentin Monnet <qmo@kernel.org>
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <qmo@kernel.org>
+Link: https://lore.kernel.org/bpf/20250617132442.9998-1-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
+index cd5963cb6058..2b7f2bd3a7db 100644
+--- a/tools/bpf/bpftool/main.c
++++ b/tools/bpf/bpftool/main.c
+@@ -534,9 +534,9 @@ int main(int argc, char **argv)
+ usage();
+
+ if (version_requested)
+- return do_version(argc, argv);
+-
+- ret = cmd_select(commands, argc, argv, do_help);
++ ret = do_version(argc, argv);
++ else
++ ret = cmd_select(commands, argc, argv, do_help);
+
+ if (json_output)
+ jsonw_destroy(&json_wtr);
+--
+2.39.5
+
--- /dev/null
+From 1215891cd9dcbe4d06025ee3da6381cbd099865c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 11:18:36 +0200
+Subject: bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+[ Upstream commit 00559ba3ae740e7544b48fb509b2b97f56615892 ]
+
+Add SDX72 based modem Telit FN990B40, reusing FN920C04 configuration.
+
+01:00.0 Unassigned class [ff00]: Qualcomm Device 0309
+ Subsystem: Device 1c5d:201a
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+[mani: added sdx72 in the comment to identify the chipset]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250716091836.999364-1-dnlplm@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/host/pci_generic.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
+index cd274f4dae93..c8f82219006f 100644
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -818,6 +818,16 @@ static const struct mhi_pci_dev_info mhi_telit_fn920c04_info = {
+ .edl_trigger = true,
+ };
+
++static const struct mhi_pci_dev_info mhi_telit_fn990b40_info = {
++ .name = "telit-fn990b40",
++ .config = &modem_telit_fn920c04_config,
++ .bar_num = MHI_PCI_DEFAULT_BAR_NUM,
++ .dma_data_width = 32,
++ .sideband_wake = false,
++ .mru_default = 32768,
++ .edl_trigger = true,
++};
++
+ static const struct mhi_pci_dev_info mhi_netprisma_lcur57_info = {
+ .name = "netprisma-lcur57",
+ .edl = "qcom/prog_firehose_sdx24.mbn",
+@@ -865,6 +875,9 @@ static const struct pci_device_id mhi_pci_id_table[] = {
+ .driver_data = (kernel_ulong_t) &mhi_telit_fe990a_info },
+ { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0308),
+ .driver_data = (kernel_ulong_t) &mhi_qcom_sdx65_info },
++ /* Telit FN990B40 (sdx72) */
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0309, 0x1c5d, 0x201a),
++ .driver_data = (kernel_ulong_t) &mhi_telit_fn990b40_info },
+ { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0309),
+ .driver_data = (kernel_ulong_t) &mhi_qcom_sdx75_info },
+ /* QDU100, x100-DU */
+--
+2.39.5
+
--- /dev/null
+From 7cb66c5000f147bf34b9d866f50f8b94824a28db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:49:31 +0530
+Subject: bus: mhi: host: pci_generic: Disable runtime PM for QDU100
+
+From: Vivek Pernamitta <quic_vpernami@quicinc.com>
+
+[ Upstream commit 0494cf9793b7c250f63fdb2cb6b648473e9d4ae6 ]
+
+The QDU100 device does not support the MHI M3 state, necessitating the
+disabling of runtime PM for this device. It is essential to disable
+runtime PM if the device does not support M3 state.
+
+Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com>
+[mani: Fixed the kdoc comment for no_m3]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250425-vdev_next-20250411_pm_disable-v4-1-d4870a73ebf9@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/host/pci_generic.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
+index c8f82219006f..e5af0beed050 100644
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -43,6 +43,7 @@
+ * @mru_default: default MRU size for MBIM network packets
+ * @sideband_wake: Devices using dedicated sideband GPIO for wakeup instead
+ * of inband wake support (such as sdx24)
++ * @no_m3: M3 not supported
+ */
+ struct mhi_pci_dev_info {
+ const struct mhi_controller_config *config;
+@@ -54,6 +55,7 @@ struct mhi_pci_dev_info {
+ unsigned int dma_data_width;
+ unsigned int mru_default;
+ bool sideband_wake;
++ bool no_m3;
+ };
+
+ #define MHI_CHANNEL_CONFIG_UL(ch_num, ch_name, el_count, ev_ring) \
+@@ -295,6 +297,7 @@ static const struct mhi_pci_dev_info mhi_qcom_qdu100_info = {
+ .bar_num = MHI_PCI_DEFAULT_BAR_NUM,
+ .dma_data_width = 32,
+ .sideband_wake = false,
++ .no_m3 = true,
+ };
+
+ static const struct mhi_channel_config mhi_qcom_sa8775p_channels[] = {
+@@ -1322,8 +1325,8 @@ static int mhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ /* start health check */
+ mod_timer(&mhi_pdev->health_check_timer, jiffies + HEALTH_CHECK_PERIOD);
+
+- /* Only allow runtime-suspend if PME capable (for wakeup) */
+- if (pci_pme_capable(pdev, PCI_D3hot)) {
++ /* Allow runtime suspend only if both PME from D3Hot and M3 are supported */
++ if (pci_pme_capable(pdev, PCI_D3hot) && !(info->no_m3)) {
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_mark_last_busy(&pdev->dev);
+--
+2.39.5
+
--- /dev/null
+From f37dbcbbea3844900081b44f372f2f4d4be1b5c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 20:28:11 +0900
+Subject: can: ti_hecc: fix -Woverflow compiler warning
+
+From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+
+[ Upstream commit 7cae4d04717b002cffe41169da3f239c845a0723 ]
+
+Fix below default (W=0) warning:
+
+ drivers/net/can/ti_hecc.c: In function 'ti_hecc_start':
+ drivers/net/can/ti_hecc.c:386:20: warning: conversion from 'long unsigned int' to 'u32' {aka 'unsigned int'} changes value from '18446744073709551599' to '4294967279' [-Woverflow]
+ 386 | mbx_mask = ~BIT(HECC_RX_LAST_MBOX);
+ | ^
+
+Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://patch.msgid.link/20250715-can-compile-test-v2-1-f7fd566db86f@wanadoo.fr
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/ti_hecc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index 644e8b8eb91e..e6d6661a908a 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -383,7 +383,7 @@ static void ti_hecc_start(struct net_device *ndev)
+ * overflows instead of the hardware silently dropping the
+ * messages.
+ */
+- mbx_mask = ~BIT(HECC_RX_LAST_MBOX);
++ mbx_mask = ~BIT_U32(HECC_RX_LAST_MBOX);
+ hecc_write(priv, HECC_CANOPC, mbx_mask);
+
+ /* Enable interrupts */
+--
+2.39.5
+
--- /dev/null
+From 2f22e0fad10547c27f6a447f2638b7f724fac416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 22:35:20 +0800
+Subject: char: misc: Fix improper and inaccurate error code returned by
+ misc_init()
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 0ef1fe4bc38673db72e39b700b29c50dfcc5a415 ]
+
+misc_init() returns -EIO for __register_chrdev() invocation failure, but:
+
+- -EIO is for I/O error normally, but __register_chrdev() does not do I/O.
+- -EIO can not cover various error codes returned by __register_chrdev().
+
+Fix by returning error code of __register_chrdev().
+
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250620-fix_mischar-v1-3-6c2716bbf1fa@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index dda466f9181a..30178e20d962 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -314,8 +314,8 @@ static int __init misc_init(void)
+ if (err)
+ goto fail_remove;
+
+- err = -EIO;
+- if (__register_chrdev(MISC_MAJOR, 0, MINORMASK + 1, "misc", &misc_fops))
++ err = __register_chrdev(MISC_MAJOR, 0, MINORMASK + 1, "misc", &misc_fops);
++ if (err < 0)
+ goto fail_printk;
+ return 0;
+
+--
+2.39.5
+
--- /dev/null
+From 9a31e179829b4b042dbd763d0ea0354e6c09211e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 20:54:11 +0100
+Subject: cifs: Fix calling CIFSFindFirst() for root path without msearch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit b460249b9a1dab7a9f58483e5349d045ad6d585c ]
+
+To query root path (without msearch wildcard) it is needed to
+send pattern '\' instead of '' (empty string).
+
+This allows to use CIFSFindFirst() to query information about root path
+which is being used in followup changes.
+
+This change fixes the stat() syscall called on the root path on the mount.
+It is because stat() syscall uses the cifs_query_path_info() function and
+it can fallback to the CIFSFindFirst() usage with msearch=false.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifssmb.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
+index 0e509a0433fb..4a6d1d83630f 100644
+--- a/fs/smb/client/cifssmb.c
++++ b/fs/smb/client/cifssmb.c
+@@ -4000,6 +4000,12 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon,
+ pSMB->FileName[name_len] = 0;
+ pSMB->FileName[name_len+1] = 0;
+ name_len += 2;
++ } else if (!searchName[0]) {
++ pSMB->FileName[0] = CIFS_DIR_SEP(cifs_sb);
++ pSMB->FileName[1] = 0;
++ pSMB->FileName[2] = 0;
++ pSMB->FileName[3] = 0;
++ name_len = 4;
+ }
+ } else {
+ name_len = copy_path_name(pSMB->FileName, searchName);
+@@ -4011,6 +4017,10 @@ CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon,
+ pSMB->FileName[name_len] = '*';
+ pSMB->FileName[name_len+1] = 0;
+ name_len += 2;
++ } else if (!searchName[0]) {
++ pSMB->FileName[0] = CIFS_DIR_SEP(cifs_sb);
++ pSMB->FileName[1] = 0;
++ name_len = 2;
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From f9114aa9b5c081196a5ead15c18b9f5993799f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 16:36:08 +0400
+Subject: clk: qcom: ipq5018: keep XO clock always on
+
+From: George Moussalem <george.moussalem@outlook.com>
+
+[ Upstream commit 693a723291d0634eaea24cff2f9d807f3223f204 ]
+
+The XO clock must not be disabled to avoid the kernel trying to disable
+the it. As such, keep the XO clock always on by flagging it as critical.
+
+Signed-off-by: George Moussalem <george.moussalem@outlook.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250516-ipq5018-cmn-pll-v4-1-389a6b30e504@outlook.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
+index 70f5dcb96700..24eb4c40da63 100644
+--- a/drivers/clk/qcom/gcc-ipq5018.c
++++ b/drivers/clk/qcom/gcc-ipq5018.c
+@@ -1371,7 +1371,7 @@ static struct clk_branch gcc_xo_clk = {
+ &gcc_xo_clk_src.clkr.hw,
+ },
+ .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL,
+ .ops = &clk_branch2_ops,
+ },
+ },
+--
+2.39.5
+
--- /dev/null
+From bad839351d947dae9479a2954f344898a5811bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 12:04:08 +0300
+Subject: clk: renesas: rzg2l: Postpone updating priv->clks[]
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 2f96afdffad4ef74e3c511207058c41c54a2d014 ]
+
+Since the sibling data is filled after the priv->clks[] array entry is
+populated, the first clock that is probed and has a sibling will
+temporarily behave as its own sibling until its actual sibling is
+populated. To avoid any issues, postpone updating priv->clks[] until after
+the sibling is populated.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250514090415.4098534-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index b91dfbfb01e3..0dd10c3e2919 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1388,10 +1388,6 @@ rzg2l_cpg_register_mod_clk(const struct rzg2l_mod_clk *mod,
+ goto fail;
+ }
+
+- clk = clock->hw.clk;
+- dev_dbg(dev, "Module clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
+- priv->clks[id] = clk;
+-
+ if (mod->is_coupled) {
+ struct mstp_clock *sibling;
+
+@@ -1403,6 +1399,10 @@ rzg2l_cpg_register_mod_clk(const struct rzg2l_mod_clk *mod,
+ }
+ }
+
++ clk = clock->hw.clk;
++ dev_dbg(dev, "Module clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
++ priv->clks[id] = clk;
++
+ return;
+
+ fail:
+--
+2.39.5
+
--- /dev/null
+From 8f8b98b83cd6e2ef11630211626f050c1b6421a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 15:37:13 +0800
+Subject: clk: tegra: periph: Fix error handling and resolve unsigned compare
+ warning
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit 2dc2ca9000eea2eb749f658196204cb84d4306f7 ]
+
+./drivers/clk/tegra/clk-periph.c:59:5-9: WARNING:
+ Unsigned expression compared with zero: rate < 0
+
+The unsigned long 'rate' variable caused:
+- Incorrect handling of negative errors
+- Compile warning: "Unsigned expression compared with zero"
+
+Fix by changing to long type and adding req->rate cast.
+
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Link: https://lore.kernel.org/r/79c7f01e29876c612e90d6d0157fb1572ca8b3fb.1752046270.git.xiaopei01@kylinos.cn
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-periph.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-periph.c b/drivers/clk/tegra/clk-periph.c
+index 0626650a7011..c9fc52a36fce 100644
+--- a/drivers/clk/tegra/clk-periph.c
++++ b/drivers/clk/tegra/clk-periph.c
+@@ -51,7 +51,7 @@ static int clk_periph_determine_rate(struct clk_hw *hw,
+ struct tegra_clk_periph *periph = to_clk_periph(hw);
+ const struct clk_ops *div_ops = periph->div_ops;
+ struct clk_hw *div_hw = &periph->divider.hw;
+- unsigned long rate;
++ long rate;
+
+ __clk_hw_set_clk(div_hw, hw);
+
+@@ -59,7 +59,7 @@ static int clk_periph_determine_rate(struct clk_hw *hw,
+ if (rate < 0)
+ return rate;
+
+- req->rate = rate;
++ req->rate = (unsigned long)rate;
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b26179d040de17471e0c9751343cac2f9663358e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 20:08:53 +0200
+Subject: clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
+
+From: Michal Wilczynski <m.wilczynski@samsung.com>
+
+[ Upstream commit 0370395d45ca6dd53bb931978f0e91ac8dd6f1c5 ]
+
+Probing peripherals in the AON and PERI domains, such as the PVT thermal
+sensor and the PWM controller, can lead to boot hangs or unresponsive
+devices on the LPi4A board. The root cause is that their parent bus
+clocks ('CLK_CPU2AON_X2H' and the 'CLK_PERISYS_APB' clocks) are
+automatically gated by the kernel's power-saving mechanisms when the bus
+is perceived as idle.
+
+Alternative solutions were investigated, including modeling the parent
+bus in the Device Tree with 'simple-pm-bus' or refactoring the clock
+driver's parentage. The 'simple-pm-bus' approach is not viable due to
+the lack of defined bus address ranges in the hardware manual and its
+creation of improper dependencies on the 'pm_runtime' API for consumer
+drivers.
+
+Therefore, applying the'`CLK_IGNORE_UNUSED' flag directly to the
+essential bus clocks is the most direct and targeted fix. This prevents
+the kernel from auto-gating these buses and ensures peripherals remain
+accessible.
+
+This change fixes the boot hang associated with the PVT sensor and
+resolves the functional issues with the PWM controller.
+
+Link: https://lore.kernel.org/all/9e8a12db-236d-474c-b110-b3be96edf057@samsung.com/ [1]
+
+Reviewed-by: Drew Fustini <drew@pdp7.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
+Signed-off-by: Drew Fustini <drew@pdp7.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/thead/clk-th1520-ap.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c
+index 6ab89245af12..c8ebacc6934a 100644
+--- a/drivers/clk/thead/clk-th1520-ap.c
++++ b/drivers/clk/thead/clk-th1520-ap.c
+@@ -799,11 +799,12 @@ static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_ac
+ 0x134, BIT(8), 0);
+ static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd,
+ 0x134, BIT(7), 0);
+-static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd, 0x138, BIT(8), 0);
++static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd,
++ 0x138, BIT(8), CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd,
+ 0x140, BIT(9), CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd,
+- 0x150, BIT(9), 0);
++ 0x150, BIT(9), CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd,
+ 0x150, BIT(10), CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd,
+--
+2.39.5
+
--- /dev/null
+From 01594538fa34edd146d9529db3d65fcb91fc51e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 05:55:40 +0000
+Subject: cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
+
+From: Prashant Malani <pmalani@google.com>
+
+[ Upstream commit 0a1416a49e63c320f6e6c1c8d07e1b58c0d4a3f3 ]
+
+AMU counters on certain CPPC-based platforms tend to yield inaccurate
+delivered performance measurements on systems that are idle/mostly idle.
+This results in an inaccurate frequency being stored by cpufreq in its
+policy structure when the CPU is brought online. [1]
+
+Consequently, if the userspace governor tries to set the frequency to a
+new value, there is a possibility that it would be the erroneous value
+stored earlier. In such a scenario, cpufreq would assume that the
+requested frequency has already been set and return early, resulting in
+the correct/new frequency request never making it to the hardware.
+
+Since the operating frequency is liable to this sort of inconsistency,
+mark the CPPC driver with CPUFREQ_NEED_UPDATE_LIMITS so that it is always
+invoked when a target frequency update is requested.
+
+Link: https://lore.kernel.org/linux-pm/20250619000925.415528-3-pmalani@google.com/ [1]
+Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Prashant Malani <pmalani@google.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Link: https://patch.msgid.link/20250722055611.130574-2-pmalani@google.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index cb93f00bafdb..156c1e516cc8 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -816,7 +816,7 @@ static struct freq_attr *cppc_cpufreq_attr[] = {
+ };
+
+ static struct cpufreq_driver cppc_cpufreq_driver = {
+- .flags = CPUFREQ_CONST_LOOPS,
++ .flags = CPUFREQ_CONST_LOOPS | CPUFREQ_NEED_UPDATE_LIMITS,
+ .verify = cppc_verify_policy,
+ .target = cppc_cpufreq_set_target,
+ .get = cppc_cpufreq_get_rate,
+--
+2.39.5
+
--- /dev/null
+From 436c45759534071277d72f74cabe826a6f1b1561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 18:41:45 +0800
+Subject: cpufreq: Exit governor when failed to start old governor
+
+From: Lifeng Zheng <zhenglifeng1@huawei.com>
+
+[ Upstream commit 0ae204405095abfbc2d694ee0fbb49bcbbe55c57 ]
+
+Detect the result of starting old governor in cpufreq_set_policy(). If it
+fails, exit the governor and clear policy->governor.
+
+Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
+Link: https://patch.msgid.link/20250709104145.2348017-5-zhenglifeng1@huawei.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 5c84d56341e2..50aff4afb422 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2785,10 +2785,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy,
+ pr_debug("starting governor %s failed\n", policy->governor->name);
+ if (old_gov) {
+ policy->governor = old_gov;
+- if (cpufreq_init_governor(policy))
++ if (cpufreq_init_governor(policy)) {
+ policy->governor = NULL;
+- else
+- cpufreq_start_governor(policy);
++ } else if (cpufreq_start_governor(policy)) {
++ cpufreq_exit_governor(policy);
++ policy->governor = NULL;
++ }
+ }
+
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 25b012254dbd2497c61e65f18f817109224ba8e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 18:56:01 +0800
+Subject: cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit fc64e0421598aaa87d61184f6777b52614a095be ]
+
+Users may disable HWP in firmware, in which case intel_pstate
+wouldn't load unless the CPU model is explicitly supported.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Link: https://patch.msgid.link/20250623105601.3924-1-lirongqing@baidu.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index f9205fe199b8..c1c42c273d38 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2656,6 +2656,8 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
+ X86_MATCH(INTEL_TIGERLAKE, core_funcs),
+ X86_MATCH(INTEL_SAPPHIRERAPIDS_X, core_funcs),
+ X86_MATCH(INTEL_EMERALDRAPIDS_X, core_funcs),
++ X86_MATCH(INTEL_GRANITERAPIDS_D, core_funcs),
++ X86_MATCH(INTEL_GRANITERAPIDS_X, core_funcs),
+ {}
+ };
+ MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids);
+--
+2.39.5
+
--- /dev/null
+From 6943cf58425410dd707061e4e472d575f05d8901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 May 2025 10:21:01 -0500
+Subject: crypto: ccp - Add missing bootloader info reg for pspv6
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit aaeff14688d0254b39731d9bb303c79bfd610f7d ]
+
+The bootloader info reg for pspv6 is the same as pspv4 and pspv5.
+
+Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sp-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c
+index 2ebc878da160..224edaaa737b 100644
+--- a/drivers/crypto/ccp/sp-pci.c
++++ b/drivers/crypto/ccp/sp-pci.c
+@@ -451,6 +451,7 @@ static const struct psp_vdata pspv6 = {
+ .cmdresp_reg = 0x10944, /* C2PMSG_17 */
+ .cmdbuff_addr_lo_reg = 0x10948, /* C2PMSG_18 */
+ .cmdbuff_addr_hi_reg = 0x1094c, /* C2PMSG_19 */
++ .bootloader_info_reg = 0x109ec, /* C2PMSG_59 */
+ .feature_reg = 0x109fc, /* C2PMSG_63 */
+ .inten_reg = 0x10510, /* P2CMSG_INTEN */
+ .intsts_reg = 0x10514, /* P2CMSG_INTSTS */
+--
+2.39.5
+
--- /dev/null
+From d5786ed04604159a3684f67ea8cbd613e56759c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 18:05:01 +0800
+Subject: crypto: hisilicon/hpre - fix dma unmap sequence
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit 982fd1a74de63c388c060e4fa6f7fbd088d6d02e ]
+
+Perform DMA unmapping operations before processing data.
+Otherwise, there may be unsynchronized data accessed by
+the CPU when the SWIOTLB is enabled.
+
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+index 61b5e1c5d019..1550c3818383 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+@@ -1491,11 +1491,13 @@ static void hpre_ecdh_cb(struct hpre_ctx *ctx, void *resp)
+ if (overtime_thrhld && hpre_is_bd_timeout(req, overtime_thrhld))
+ atomic64_inc(&dfx[HPRE_OVER_THRHLD_CNT].value);
+
++ /* Do unmap before data processing */
++ hpre_ecdh_hw_data_clr_all(ctx, req, areq->dst, areq->src);
++
+ p = sg_virt(areq->dst);
+ memmove(p, p + ctx->key_sz - curve_sz, curve_sz);
+ memmove(p + curve_sz, p + areq->dst_len - curve_sz, curve_sz);
+
+- hpre_ecdh_hw_data_clr_all(ctx, req, areq->dst, areq->src);
+ kpp_request_complete(areq, ret);
+
+ atomic64_inc(&dfx[HPRE_RECV_CNT].value);
+@@ -1808,9 +1810,11 @@ static void hpre_curve25519_cb(struct hpre_ctx *ctx, void *resp)
+ if (overtime_thrhld && hpre_is_bd_timeout(req, overtime_thrhld))
+ atomic64_inc(&dfx[HPRE_OVER_THRHLD_CNT].value);
+
++ /* Do unmap before data processing */
++ hpre_curve25519_hw_data_clr_all(ctx, req, areq->dst, areq->src);
++
+ hpre_key_to_big_end(sg_virt(areq->dst), CURVE25519_KEY_SIZE);
+
+- hpre_curve25519_hw_data_clr_all(ctx, req, areq->dst, areq->src);
+ kpp_request_complete(areq, ret);
+
+ atomic64_inc(&dfx[HPRE_RECV_CNT].value);
+--
+2.39.5
+
--- /dev/null
+From aba49704602ea2aa5f9ae1d6e5b947a996c3ac0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jun 2025 13:36:43 +0200
+Subject: crypto: jitter - fix intermediary handling
+
+From: Markus Theil <theil.markus@gmail.com>
+
+[ Upstream commit 735b72568c73875269a6b73ab9543a70f6ac8a9f ]
+
+The intermediary value was included in the wrong
+hash state. While there, adapt to user-space by
+setting the timestamp to 0 if stuck and inserting
+the values nevertheless.
+
+Acked-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Markus Theil <theil.markus@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/jitterentropy-kcapi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c
+index c24d4ff2b4a8..1266eb790708 100644
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -144,7 +144,7 @@ int jent_hash_time(void *hash_state, __u64 time, u8 *addtl,
+ * Inject the data from the previous loop into the pool. This data is
+ * not considered to contain any entropy, but it stirs the pool a bit.
+ */
+- ret = crypto_shash_update(desc, intermediary, sizeof(intermediary));
++ ret = crypto_shash_update(hash_state_desc, intermediary, sizeof(intermediary));
+ if (ret)
+ goto err;
+
+@@ -157,11 +157,12 @@ int jent_hash_time(void *hash_state, __u64 time, u8 *addtl,
+ * conditioning operation to have an identical amount of input data
+ * according to section 3.1.5.
+ */
+- if (!stuck) {
+- ret = crypto_shash_update(hash_state_desc, (u8 *)&time,
+- sizeof(__u64));
++ if (stuck) {
++ time = 0;
+ }
+
++ ret = crypto_shash_update(hash_state_desc, (u8 *)&time, sizeof(__u64));
++
+ err:
+ shash_desc_zero(desc);
+ memzero_explicit(intermediary, sizeof(intermediary));
+--
+2.39.5
+
--- /dev/null
+From ac42798ddd1f48d772d1dc61aa08da702a77fd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:36:24 +0530
+Subject: crypto: octeontx2 - add timeout for load_fvc completion poll
+
+From: Bharat Bhushan <bbhushan2@marvell.com>
+
+[ Upstream commit 2157e50f65d2030f07ea27ef7ac4cfba772e98ac ]
+
+Adds timeout to exit from possible infinite loop, which polls
+on CPT instruction(load_fvc) completion.
+
+Signed-off-by: Srujana Challa <schalla@marvell.com>
+Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+index 42c5484ce66a..3a818ac89295 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+@@ -1494,6 +1494,7 @@ int otx2_cpt_discover_eng_capabilities(struct otx2_cptpf_dev *cptpf)
+ dma_addr_t rptr_baddr;
+ struct pci_dev *pdev;
+ u32 len, compl_rlen;
++ int timeout = 10000;
+ int ret, etype;
+ void *rptr;
+
+@@ -1556,16 +1557,27 @@ int otx2_cpt_discover_eng_capabilities(struct otx2_cptpf_dev *cptpf)
+ etype);
+ otx2_cpt_fill_inst(&inst, &iq_cmd, rptr_baddr);
+ lfs->ops->send_cmd(&inst, 1, &cptpf->lfs.lf[0]);
++ timeout = 10000;
+
+ while (lfs->ops->cpt_get_compcode(result) ==
+- OTX2_CPT_COMPLETION_CODE_INIT)
++ OTX2_CPT_COMPLETION_CODE_INIT) {
+ cpu_relax();
++ udelay(1);
++ timeout--;
++ if (!timeout) {
++ ret = -ENODEV;
++ cptpf->is_eng_caps_discovered = false;
++ dev_warn(&pdev->dev, "Timeout on CPT load_fvc completion poll\n");
++ goto error_no_response;
++ }
++ }
+
+ cptpf->eng_caps[etype].u = be64_to_cpup(rptr);
+ }
+- dma_unmap_single(&pdev->dev, rptr_baddr, len, DMA_BIDIRECTIONAL);
+ cptpf->is_eng_caps_discovered = true;
+
++error_no_response:
++ dma_unmap_single(&pdev->dev, rptr_baddr, len, DMA_BIDIRECTIONAL);
+ free_result:
+ kfree(result);
+ lf_cleanup:
+--
+2.39.5
+
--- /dev/null
+From eb5a4a239b0ac210d309ce9e5e055b490905533c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 15:24:22 +0200
+Subject: dm-mpath: don't print the "loaded" message if registering fails
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 6e11952a6abc4641dc8ae63f01b318b31b44e8db ]
+
+If dm_register_path_selector, don't print the "version X loaded" message.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-ps-historical-service-time.c | 4 +++-
+ drivers/md/dm-ps-queue-length.c | 4 +++-
+ drivers/md/dm-ps-round-robin.c | 4 +++-
+ drivers/md/dm-ps-service-time.c | 4 +++-
+ 4 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-ps-historical-service-time.c b/drivers/md/dm-ps-historical-service-time.c
+index b49e10d76d03..2c8626a83de4 100644
+--- a/drivers/md/dm-ps-historical-service-time.c
++++ b/drivers/md/dm-ps-historical-service-time.c
+@@ -541,8 +541,10 @@ static int __init dm_hst_init(void)
+ {
+ int r = dm_register_path_selector(&hst_ps);
+
+- if (r < 0)
++ if (r < 0) {
+ DMERR("register failed %d", r);
++ return r;
++ }
+
+ DMINFO("version " HST_VERSION " loaded");
+
+diff --git a/drivers/md/dm-ps-queue-length.c b/drivers/md/dm-ps-queue-length.c
+index e305f05ad1e5..eb543e6431e0 100644
+--- a/drivers/md/dm-ps-queue-length.c
++++ b/drivers/md/dm-ps-queue-length.c
+@@ -260,8 +260,10 @@ static int __init dm_ql_init(void)
+ {
+ int r = dm_register_path_selector(&ql_ps);
+
+- if (r < 0)
++ if (r < 0) {
+ DMERR("register failed %d", r);
++ return r;
++ }
+
+ DMINFO("version " QL_VERSION " loaded");
+
+diff --git a/drivers/md/dm-ps-round-robin.c b/drivers/md/dm-ps-round-robin.c
+index d1745b123dc1..66a15ac0c22c 100644
+--- a/drivers/md/dm-ps-round-robin.c
++++ b/drivers/md/dm-ps-round-robin.c
+@@ -220,8 +220,10 @@ static int __init dm_rr_init(void)
+ {
+ int r = dm_register_path_selector(&rr_ps);
+
+- if (r < 0)
++ if (r < 0) {
+ DMERR("register failed %d", r);
++ return r;
++ }
+
+ DMINFO("version " RR_VERSION " loaded");
+
+diff --git a/drivers/md/dm-ps-service-time.c b/drivers/md/dm-ps-service-time.c
+index 969d31c40272..f8c43aecdb27 100644
+--- a/drivers/md/dm-ps-service-time.c
++++ b/drivers/md/dm-ps-service-time.c
+@@ -341,8 +341,10 @@ static int __init dm_st_init(void)
+ {
+ int r = dm_register_path_selector(&st_ps);
+
+- if (r < 0)
++ if (r < 0) {
+ DMERR("register failed %d", r);
++ return r;
++ }
+
+ DMINFO("version " ST_VERSION " loaded");
+
+--
+2.39.5
+
--- /dev/null
+From 270643bef9bd13fd0db21ab0b024c7383a7264f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 10:52:57 +0000
+Subject: dm-stripe: limit chunk_sectors to the stripe size
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit 5fb9d4341b782a80eefa0dc1664d131ac3c8885d ]
+
+Same as done for raid0, set chunk_sectors limit to appropriately set the
+atomic write size limit.
+
+Setting chunk_sectors limit in this way overrides the stacked limit
+already calculated based on the bottom device limits. This is ok, as
+when any bios are sent to the bottom devices, the block layer will still
+respect the bottom device chunk_sectors.
+
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Link: https://lore.kernel.org/r/20250711105258.3135198-6-john.g.garry@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-stripe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
+index a1b7535c508a..8f61030d3b2d 100644
+--- a/drivers/md/dm-stripe.c
++++ b/drivers/md/dm-stripe.c
+@@ -459,6 +459,7 @@ static void stripe_io_hints(struct dm_target *ti,
+ struct stripe_c *sc = ti->private;
+ unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;
+
++ limits->chunk_sectors = sc->chunk_size;
+ limits->io_min = chunk_size;
+ limits->io_opt = chunk_size * sc->stripes;
+ }
+--
+2.39.5
+
--- /dev/null
+From 6d5fbe52e3114580eced032d6413f9dce26572e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 19:08:52 -0400
+Subject: dm-table: fix checking for rq stackable devices
+
+From: Benjamin Marzinski <bmarzins@redhat.com>
+
+[ Upstream commit 8ca719b81987be690f197e82fdb030580c0a07f3 ]
+
+Due to the semantics of iterate_devices(), the current code allows a
+request-based dm table as long as it includes one request-stackable
+device. It is supposed to only allow tables where there are no
+non-request-stackable devices.
+
+Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
+Reviewed-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-table.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index dd074c8ecbba..587a9833c1f6 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -900,17 +900,17 @@ static bool dm_table_supports_dax(struct dm_table *t,
+ return true;
+ }
+
+-static int device_is_rq_stackable(struct dm_target *ti, struct dm_dev *dev,
+- sector_t start, sector_t len, void *data)
++static int device_is_not_rq_stackable(struct dm_target *ti, struct dm_dev *dev,
++ sector_t start, sector_t len, void *data)
+ {
+ struct block_device *bdev = dev->bdev;
+ struct request_queue *q = bdev_get_queue(bdev);
+
+ /* request-based cannot stack on partitions! */
+ if (bdev_is_partition(bdev))
+- return false;
++ return true;
+
+- return queue_is_mq(q);
++ return !queue_is_mq(q);
+ }
+
+ static int dm_table_determine_type(struct dm_table *t)
+@@ -1006,7 +1006,7 @@ static int dm_table_determine_type(struct dm_table *t)
+
+ /* Non-request-stackable devices can't be used for request-based dm */
+ if (!ti->type->iterate_devices ||
+- !ti->type->iterate_devices(ti, device_is_rq_stackable, NULL)) {
++ ti->type->iterate_devices(ti, device_is_not_rq_stackable, NULL)) {
+ DMERR("table load rejected: including non-request-stackable devices");
+ return -EINVAL;
+ }
+--
+2.39.5
+
--- /dev/null
+From f95d28e8c89f8fac2407e813e0123c97b6f874df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 09:31:37 +0200
+Subject: dmaengine: stm32-dma: configure next sg only if there are more than 2
+ sgs
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit e19bdbaa31082b43dab1d936e20efcebc30aa73d ]
+
+DMA operates in Double Buffer Mode (DBM) when the transfer is cyclic and
+there are at least two periods.
+When DBM is enabled, the DMA toggles between two memory targets (SxM0AR and
+SxM1AR), indicated by the SxSCR.CT bit (Current Target).
+There is no need to update the next memory address if two periods are
+configured, as SxM0AR and SxM1AR are already properly set up before the
+transfer begins in the stm32_dma_start_transfer() function.
+This avoids unnecessary updates to SxM0AR/SxM1AR, thereby preventing
+potential Transfer Errors. Specifically, when the channel is enabled,
+SxM0AR and SxM1AR can only be written if SxSCR.CT=1 and SxSCR.CT=0,
+respectively. Otherwise, a Transfer Error interrupt is triggered, and the
+stream is automatically disabled.
+
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20250624-stm32_dma_dbm_fix-v1-1-337c40d6c93e@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32/stm32-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32/stm32-dma.c b/drivers/dma/stm32/stm32-dma.c
+index 917f8e922373..0e39f99bce8b 100644
+--- a/drivers/dma/stm32/stm32-dma.c
++++ b/drivers/dma/stm32/stm32-dma.c
+@@ -744,7 +744,7 @@ static void stm32_dma_handle_chan_done(struct stm32_dma_chan *chan, u32 scr)
+ /* cyclic while CIRC/DBM disable => post resume reconfiguration needed */
+ if (!(scr & (STM32_DMA_SCR_CIRC | STM32_DMA_SCR_DBM)))
+ stm32_dma_post_resume_reconfigure(chan);
+- else if (scr & STM32_DMA_SCR_DBM)
++ else if (scr & STM32_DMA_SCR_DBM && chan->desc->num_sgs > 2)
+ stm32_dma_configure_next_sg(chan);
+ } else {
+ chan->busy = false;
+--
+2.39.5
+
--- /dev/null
+From b813d7547199162602595eaeeabd12dd275a5ecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 23:24:05 +0200
+Subject: dpaa_eth: don't use fixed_phy_change_carrier
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit d8155c1df5c8b717052567b188455d41fa7a8908 ]
+
+This effectively reverts 6e8b0ff1ba4c ("dpaa_eth: Add change_carrier()
+for Fixed PHYs"). Usage of fixed_phy_change_carrier() requires that
+fixed_phy_register() has been called before, directly or indirectly.
+And that's not the case in this driver.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/7eb189b3-d5fd-4be6-8517-a66671a4e4e3@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 4948b4906584..ebdaa3e7e106 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -28,7 +28,6 @@
+ #include <linux/percpu.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/sort.h>
+-#include <linux/phy_fixed.h>
+ #include <linux/bpf.h>
+ #include <linux/bpf_trace.h>
+ #include <soc/fsl/bman.h>
+@@ -3151,7 +3150,6 @@ static const struct net_device_ops dpaa_ops = {
+ .ndo_stop = dpaa_eth_stop,
+ .ndo_tx_timeout = dpaa_tx_timeout,
+ .ndo_get_stats64 = dpaa_get_stats64,
+- .ndo_change_carrier = fixed_phy_change_carrier,
+ .ndo_set_mac_address = dpaa_set_mac_address,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_rx_mode = dpaa_set_rx_mode,
+--
+2.39.5
+
--- /dev/null
+From 3dd3ae5f8b7aa39ecf4cea492818b20a64188cea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 11:57:28 +0200
+Subject: drbd: add missing kref_get in handle_write_conflicts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sarah Newman <srn@prgmr.com>
+
+[ Upstream commit 00c9c9628b49e368d140cfa61d7df9b8922ec2a8 ]
+
+With `two-primaries` enabled, DRBD tries to detect "concurrent" writes
+and handle write conflicts, so that even if you write to the same sector
+simultaneously on both nodes, they end up with the identical data once
+the writes are completed.
+
+In handling "superseeded" writes, we forgot a kref_get,
+resulting in a premature drbd_destroy_device and use after free,
+and further to kernel crashes with symptoms.
+
+Relevance: No one should use DRBD as a random data generator, and apparently
+all users of "two-primaries" handle concurrent writes correctly on layer up.
+That is cluster file systems use some distributed lock manager,
+and live migration in virtualization environments stops writes on one node
+before starting writes on the other node.
+
+Which means that other than for "test cases",
+this code path is never taken in real life.
+
+FYI, in DRBD 9, things are handled differently nowadays. We still detect
+"write conflicts", but no longer try to be smart about them.
+We decided to disconnect hard instead: upper layers must not submit concurrent
+writes. If they do, that's their fault.
+
+Signed-off-by: Sarah Newman <srn@prgmr.com>
+Signed-off-by: Lars Ellenberg <lars@linbit.com>
+Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Link: https://lore.kernel.org/r/20250627095728.800688-1-christoph.boehmwalder@linbit.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index e5a2e5f7887b..975024cf03c5 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -2500,7 +2500,11 @@ static int handle_write_conflicts(struct drbd_device *device,
+ peer_req->w.cb = superseded ? e_send_superseded :
+ e_send_retry_write;
+ list_add_tail(&peer_req->w.list, &device->done_ee);
+- queue_work(connection->ack_sender, &peer_req->peer_device->send_acks_work);
++ /* put is in drbd_send_acks_wf() */
++ kref_get(&device->kref);
++ if (!queue_work(connection->ack_sender,
++ &peer_req->peer_device->send_acks_work))
++ kref_put(&device->kref, drbd_destroy_device);
+
+ err = -ENOENT;
+ goto out;
+--
+2.39.5
+
--- /dev/null
+From eab655cea8ae64a143fafb8b51d7ef0f7ae28d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jun 2025 22:12:26 -0500
+Subject: drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
+ manual
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 2d1ec1e955414e8e8358178011c35afca1a1c0b1 ]
+
+Several other ASICs allow printing OD SCLK levels without setting DPM
+control to manual. When OD is disabled it will show the range the
+hardware supports. When OD is enabled it will show what values have
+been programmed. Adjust VanGogh to work the same.
+
+Cc: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com>
+Reported-by: Vicki Pfau <vi@endrift.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250609031227.479079-1-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 37 ++++++++-----------
+ 1 file changed, 15 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
+index a55ea76d7399..2c9869feba61 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
+@@ -666,7 +666,6 @@ static int vangogh_print_clk_levels(struct smu_context *smu,
+ {
+ DpmClocks_t *clk_table = smu->smu_table.clocks_table;
+ SmuMetrics_t metrics;
+- struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
+ int i, idx, size = 0, ret = 0;
+ uint32_t cur_value = 0, value = 0, count = 0;
+ bool cur_value_match_level = false;
+@@ -682,31 +681,25 @@ static int vangogh_print_clk_levels(struct smu_context *smu,
+
+ switch (clk_type) {
+ case SMU_OD_SCLK:
+- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) {
+- size += sysfs_emit_at(buf, size, "%s:\n", "OD_SCLK");
+- size += sysfs_emit_at(buf, size, "0: %10uMhz\n",
+- (smu->gfx_actual_hard_min_freq > 0) ? smu->gfx_actual_hard_min_freq : smu->gfx_default_hard_min_freq);
+- size += sysfs_emit_at(buf, size, "1: %10uMhz\n",
+- (smu->gfx_actual_soft_max_freq > 0) ? smu->gfx_actual_soft_max_freq : smu->gfx_default_soft_max_freq);
+- }
++ size += sysfs_emit_at(buf, size, "%s:\n", "OD_SCLK");
++ size += sysfs_emit_at(buf, size, "0: %10uMhz\n",
++ (smu->gfx_actual_hard_min_freq > 0) ? smu->gfx_actual_hard_min_freq : smu->gfx_default_hard_min_freq);
++ size += sysfs_emit_at(buf, size, "1: %10uMhz\n",
++ (smu->gfx_actual_soft_max_freq > 0) ? smu->gfx_actual_soft_max_freq : smu->gfx_default_soft_max_freq);
+ break;
+ case SMU_OD_CCLK:
+- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) {
+- size += sysfs_emit_at(buf, size, "CCLK_RANGE in Core%d:\n", smu->cpu_core_id_select);
+- size += sysfs_emit_at(buf, size, "0: %10uMhz\n",
+- (smu->cpu_actual_soft_min_freq > 0) ? smu->cpu_actual_soft_min_freq : smu->cpu_default_soft_min_freq);
+- size += sysfs_emit_at(buf, size, "1: %10uMhz\n",
+- (smu->cpu_actual_soft_max_freq > 0) ? smu->cpu_actual_soft_max_freq : smu->cpu_default_soft_max_freq);
+- }
++ size += sysfs_emit_at(buf, size, "CCLK_RANGE in Core%d:\n", smu->cpu_core_id_select);
++ size += sysfs_emit_at(buf, size, "0: %10uMhz\n",
++ (smu->cpu_actual_soft_min_freq > 0) ? smu->cpu_actual_soft_min_freq : smu->cpu_default_soft_min_freq);
++ size += sysfs_emit_at(buf, size, "1: %10uMhz\n",
++ (smu->cpu_actual_soft_max_freq > 0) ? smu->cpu_actual_soft_max_freq : smu->cpu_default_soft_max_freq);
+ break;
+ case SMU_OD_RANGE:
+- if (smu_dpm_ctx->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) {
+- size += sysfs_emit_at(buf, size, "%s:\n", "OD_RANGE");
+- size += sysfs_emit_at(buf, size, "SCLK: %7uMhz %10uMhz\n",
+- smu->gfx_default_hard_min_freq, smu->gfx_default_soft_max_freq);
+- size += sysfs_emit_at(buf, size, "CCLK: %7uMhz %10uMhz\n",
+- smu->cpu_default_soft_min_freq, smu->cpu_default_soft_max_freq);
+- }
++ size += sysfs_emit_at(buf, size, "%s:\n", "OD_RANGE");
++ size += sysfs_emit_at(buf, size, "SCLK: %7uMhz %10uMhz\n",
++ smu->gfx_default_hard_min_freq, smu->gfx_default_soft_max_freq);
++ size += sysfs_emit_at(buf, size, "CCLK: %7uMhz %10uMhz\n",
++ smu->cpu_default_soft_min_freq, smu->cpu_default_soft_max_freq);
+ break;
+ case SMU_SOCCLK:
+ /* the level 3 ~ 6 of socclk use the same frequency for vangogh */
+--
+2.39.5
+
--- /dev/null
+From 19583859a107207a800d17fd186b5f788b00856f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 16:06:41 +0800
+Subject: drm/amd/display: add null check
+
+From: Peichen Huang <PeiChen.Huang@amd.com>
+
+[ Upstream commit 158b9201c17fc93ed4253c2f03b77fd2671669a1 ]
+
+[WHY]
+Prevents null pointer dereferences to enhance function robustness
+
+[HOW]
+Adds early null check and return false if invalid.
+
+Reviewed-by: Cruise Hung <cruise.hung@amd.com>
+Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index d6f0c82d8dda..ff94ceea2218 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -6265,11 +6265,13 @@ struct dc_power_profile dc_get_power_profile_for_dc_state(const struct dc_state
+ */
+ bool dc_get_host_router_index(const struct dc_link *link, unsigned int *host_router_index)
+ {
+- struct dc *dc = link->ctx->dc;
++ struct dc *dc;
+
+- if (link->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
++ if (!link || !host_router_index || link->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
+ return false;
+
++ dc = link->ctx->dc;
++
+ if (link->link_index < dc->lowest_dpia_link_index)
+ return false;
+
+--
+2.39.5
+
--- /dev/null
+From 4436f80d79f83d71ceef72bea6857224b96be4e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 08:38:05 -0500
+Subject: drm/amd/display: Avoid configuring PSR granularity if PSR-SU not
+ supported
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit a5ce8695d6d1b40d6960d2d298b579042c158f25 ]
+
+[Why]
+If PSR-SU is disabled on the link, then configuring su_y granularity in
+mod_power_calc_psr_configs() can lead to assertions in
+psr_su_set_dsc_slice_height().
+
+[How]
+Check the PSR version in amdgpu_dm_link_setup_psr() to determine whether
+or not to configure granularity.
+
+Reviewed-by: Sun peng (Leo) Li <sunpeng.li@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c
+index e140b7a04d72..d63038ec4ec7 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c
+@@ -127,8 +127,10 @@ bool amdgpu_dm_link_setup_psr(struct dc_stream_state *stream)
+ psr_config.allow_multi_disp_optimizations =
+ (amdgpu_dc_feature_mask & DC_PSR_ALLOW_MULTI_DISP_OPT);
+
+- if (!psr_su_set_dsc_slice_height(dc, link, stream, &psr_config))
+- return false;
++ if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1) {
++ if (!psr_su_set_dsc_slice_height(dc, link, stream, &psr_config))
++ return false;
++ }
+
+ ret = dc_link_setup_psr(link, stream, &psr_config, &psr_context);
+
+--
+2.39.5
+
--- /dev/null
+From 8e314c6a9928a2dd5f02b262b75d9737843bfa8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 16:06:50 +0800
+Subject: drm/amd/display: Avoid trying AUX transactions on disconnected ports
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit deb24e64c8881c462b29e2c69afd9e6669058be5 ]
+
+[Why & How]
+Observe that we try to access DPCD 0x600h of disconnected DP ports.
+In order not to wasting time on retrying these ports, call
+dpcd_write_rx_power_ctrl() after checking its connection status.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index 53c961f86d43..2c1dcde5e3ea 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -140,7 +140,8 @@ void link_blank_dp_stream(struct dc_link *link, bool hw_init)
+ }
+ }
+
+- if ((!link->wa_flags.dp_keep_receiver_powered) || hw_init)
++ if (((!link->wa_flags.dp_keep_receiver_powered) || hw_init) &&
++ (link->type != dc_connection_none))
+ dpcd_write_rx_power_ctrl(link, false);
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 2aeb487b8f7a8036ac5253e72de0e7fc0a6ca2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 14:37:33 -0400
+Subject: drm/amd/display: Disable dsc_power_gate for dcn314 by default
+
+From: Roman Li <Roman.Li@amd.com>
+
+[ Upstream commit 02f3ec53177243d32ee8b6f8ba99136d7887ee3a ]
+
+[Why]
+"REG_WAIT timeout 1us * 1000 tries - dcn314_dsc_pg_control line"
+warnings seen after resuming from s2idle.
+DCN314 has issues with DSC power gating that cause REG_WAIT timeouts
+when attempting to power down DSC blocks.
+
+[How]
+Disable dsc_power_gate for dcn314 by default.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Roman Li <Roman.Li@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+index f47cd281d6e7..7aab08151e72 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+@@ -926,6 +926,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ .seamless_boot_odm_combine = true,
+ .enable_legacy_fast_update = true,
+ .using_dml2 = false,
++ .disable_dsc_power_gate = true,
+ };
+
+ static const struct dc_panel_config panel_config_defaults = {
+--
+2.39.5
+
--- /dev/null
+From bebdbf0444436cc862cd03cd3cd2d92863d34a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jun 2025 16:37:08 -0400
+Subject: drm/amd/display: Fix 'failed to blank crtc!'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wen Chen <Wen.Chen3@amd.com>
+
+[ Upstream commit 01f60348d8fb6b3fbcdfc7bdde5d669f95b009a4 ]
+
+[why]
+DCN35 is having “DC: failed to blank crtc!” when running HPO
+test cases. It's caused by not having sufficient udelay time.
+
+[how]
+Replace the old wait_for_blank_complete function with fsleep function to
+sleep just until the next frame should come up. This way it doesn't poll
+in case the pixel clock or other clock was bugged or until vactive and
+the vblank are hit again.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Wen Chen <Wen.Chen3@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 637f1235d0b7..977ec7c1c212 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -945,7 +945,7 @@ enum dc_status dcn20_enable_stream_timing(
+ return DC_ERROR_UNEXPECTED;
+ }
+
+- hws->funcs.wait_for_blank_complete(pipe_ctx->stream_res.opp);
++ fsleep(stream->timing.v_total * (stream->timing.h_total * 10000u / stream->timing.pix_clk_100hz));
+
+ params.vertical_total_min = stream->adjust.v_total_min;
+ params.vertical_total_max = stream->adjust.v_total_max;
+--
+2.39.5
+
--- /dev/null
+From 3c66ca4c114bd4926c0f7cae15e47eec9974aa22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 15:40:18 -0600
+Subject: drm/amd/display: Initialize mode_select to 0
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit 592ddac93f8c02e13f19175745465f8c4d0f56cd ]
+
+[WHAT]
+mode_select was supposed to be initialized in mpc_read_gamut_remap but
+is not set in default case. This can cause indeterminate
+behaviors.
+
+This is reported as an UNINIT error by Coverity.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c
+index ad67197557ca..63fb6777c1fd 100644
+--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn401/dcn401_mpc.c
+@@ -571,7 +571,7 @@ void mpc401_get_gamut_remap(struct mpc *mpc,
+ struct mpc_grph_gamut_adjustment *adjust)
+ {
+ uint16_t arr_reg_val[12] = {0};
+- uint32_t mode_select;
++ uint32_t mode_select = MPCC_GAMUT_REMAP_MODE_SELECT_0;
+
+ read_gamut_remap(mpc, mpcc_id, arr_reg_val, adjust->mpcc_gamut_remap_block_id, &mode_select);
+
+--
+2.39.5
+
--- /dev/null
+From efd9ba214382dfa7a102d01db28171aeeb466039 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 16:36:17 -0400
+Subject: drm/amd/display: limit clear_update_flags to dcn32 and above
+
+From: Charlene Liu <Charlene.Liu@amd.com>
+
+[ Upstream commit f354556e29f40ef44fa8b13dc914817db3537e20 ]
+
+[why]
+dc has some code out of sync:
+dc_commit_updates_for_stream handles v1/v2/v3,
+but dc_update_planes_and_stream makes v1 asic to use v2.
+
+as a reression fix: limit clear_update_flags to dcn32 or newer asic.
+need to follow up that v1 asic using v2 issue.
+
+Reviewed-by: Syed Hassan <syed.hassan@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 40561c4deb3c..d6f0c82d8dda 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -5335,8 +5335,7 @@ bool dc_update_planes_and_stream(struct dc *dc,
+ else
+ ret = update_planes_and_stream_v2(dc, srf_updates,
+ surface_count, stream, stream_update);
+-
+- if (ret)
++ if (ret && dc->ctx->dce_version >= DCN_VERSION_3_2)
+ clear_update_flags(srf_updates, surface_count, stream);
+
+ return ret;
+@@ -5367,7 +5366,7 @@ void dc_commit_updates_for_stream(struct dc *dc,
+ ret = update_planes_and_stream_v1(dc, srf_updates, surface_count, stream,
+ stream_update, state);
+
+- if (ret)
++ if (ret && dc->ctx->dce_version >= DCN_VERSION_3_2)
+ clear_update_flags(srf_updates, surface_count, stream);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 61310ab98bf47362245edd41717b28d5057a3aa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 14:41:46 -0500
+Subject: drm/amd/display: Only finalize atomic_obj if it was initialized
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b174084b3fe15ad1acc69530e673c1535d2e4f85 ]
+
+[Why]
+If amdgpu_dm failed to initalize before amdgpu_dm_initialize_drm_device()
+completed then freeing atomic_obj will lead to list corruption.
+
+[How]
+Check if atomic_obj state is initialized before trying to free.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 9c01496ba590..75e7af5c5a3e 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5309,7 +5309,8 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
+
+ static void amdgpu_dm_destroy_drm_device(struct amdgpu_display_manager *dm)
+ {
+- drm_atomic_private_obj_fini(&dm->atomic_obj);
++ if (dm->atomic_obj.state)
++ drm_atomic_private_obj_fini(&dm->atomic_obj);
+ }
+
+ /******************************************************************************
+--
+2.39.5
+
--- /dev/null
+From 4f6c5128381768b918da973468ac26c3f93c9a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 13:07:14 -0400
+Subject: drm/amd/display: Separate set_gsl from set_gsl_source_select
+
+From: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
+
+[ Upstream commit 660a467a5e7366cd6642de61f1aaeaf0d253ee68 ]
+
+[Why/How]
+Separate the checks for set_gsl and set_gsl_source_select, since
+source_select may not be implemented/necessary.
+
+Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com>
+Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 846c9c51f2d9..637f1235d0b7 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -273,14 +273,13 @@ void dcn20_setup_gsl_group_as_lock(
+ }
+
+ /* at this point we want to program whether it's to enable or disable */
+- if (pipe_ctx->stream_res.tg->funcs->set_gsl != NULL &&
+- pipe_ctx->stream_res.tg->funcs->set_gsl_source_select != NULL) {
++ if (pipe_ctx->stream_res.tg->funcs->set_gsl != NULL) {
+ pipe_ctx->stream_res.tg->funcs->set_gsl(
+ pipe_ctx->stream_res.tg,
+ &gsl);
+-
+- pipe_ctx->stream_res.tg->funcs->set_gsl_source_select(
+- pipe_ctx->stream_res.tg, group_idx, enable ? 4 : 0);
++ if (pipe_ctx->stream_res.tg->funcs->set_gsl_source_select != NULL)
++ pipe_ctx->stream_res.tg->funcs->set_gsl_source_select(
++ pipe_ctx->stream_res.tg, group_idx, enable ? 4 : 0);
+ } else
+ BREAK_TO_DEBUGGER();
+ }
+--
+2.39.5
+
--- /dev/null
+From aab79589a9a991b3a53e927fa57ac6a53a2361b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Jun 2025 20:44:31 -0500
+Subject: drm/amd/display: Stop storing failures into adev->dm.cached_state
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 709a37ab9c63297da2194dc36f604537f9d2d417 ]
+
+If drm_atomic_helper_suspend() has failed for any reason, it's stored
+in adev->dm.cached_state. This isn't expected because the resume
+(or complete()) sequence will attempt to use the stored state to
+resume.
+
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Link: https://lore.kernel.org/r/20250602014432.3538345-3-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 25 +++++++++++++------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index f6d71bf7c89c..9c01496ba590 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2998,6 +2998,19 @@ static void hpd_rx_irq_work_suspend(struct amdgpu_display_manager *dm)
+ }
+ }
+
++static int dm_cache_state(struct amdgpu_device *adev)
++{
++ int r;
++
++ adev->dm.cached_state = drm_atomic_helper_suspend(adev_to_drm(adev));
++ if (IS_ERR(adev->dm.cached_state)) {
++ r = PTR_ERR(adev->dm.cached_state);
++ adev->dm.cached_state = NULL;
++ }
++
++ return adev->dm.cached_state ? 0 : r;
++}
++
+ static int dm_prepare_suspend(struct amdgpu_ip_block *ip_block)
+ {
+ struct amdgpu_device *adev = ip_block->adev;
+@@ -3006,11 +3019,8 @@ static int dm_prepare_suspend(struct amdgpu_ip_block *ip_block)
+ return 0;
+
+ WARN_ON(adev->dm.cached_state);
+- adev->dm.cached_state = drm_atomic_helper_suspend(adev_to_drm(adev));
+- if (IS_ERR(adev->dm.cached_state))
+- return PTR_ERR(adev->dm.cached_state);
+
+- return 0;
++ return dm_cache_state(adev);
+ }
+
+ static int dm_suspend(struct amdgpu_ip_block *ip_block)
+@@ -3044,9 +3054,10 @@ static int dm_suspend(struct amdgpu_ip_block *ip_block)
+ }
+
+ if (!adev->dm.cached_state) {
+- adev->dm.cached_state = drm_atomic_helper_suspend(adev_to_drm(adev));
+- if (IS_ERR(adev->dm.cached_state))
+- return PTR_ERR(adev->dm.cached_state);
++ int r = dm_cache_state(adev);
++
++ if (r)
++ return r;
+ }
+
+ s3_handle_hdmi_cec(adev_to_drm(adev), true);
+--
+2.39.5
+
--- /dev/null
+From 32746dd945d881a93af08a6d466ecb47759d88b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 11:18:26 -0400
+Subject: drm/amd/display: Update DMCUB loading sequence for DCN3.5
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit d42b2331e158fa6bcdc89e4c8c470dc5da20be1f ]
+
+[Why]
+New sequence from HW for reset and firmware reloading has been
+provided that aims to stabilize the reload sequence in the case the
+firmware is hung or has outstanding requests.
+
+[How]
+Update the sequence to remove the DMUIF reset and the redundant
+writes in the release.
+
+Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c
+index 72a0f078cd1a..2884977a3dd2 100644
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c
+@@ -92,19 +92,15 @@ void dmub_dcn35_reset(struct dmub_srv *dmub)
+ uint32_t in_reset, is_enabled, scratch, i, pwait_mode;
+
+ REG_GET(DMCUB_CNTL2, DMCUB_SOFT_RESET, &in_reset);
++ REG_GET(DMCUB_CNTL, DMCUB_ENABLE, &is_enabled);
+
+- if (in_reset == 0) {
++ if (in_reset == 0 && is_enabled != 0) {
+ cmd.bits.status = 1;
+ cmd.bits.command_code = DMUB_GPINT__STOP_FW;
+ cmd.bits.param = 0;
+
+ dmub->hw_funcs.set_gpint(dmub, cmd);
+
+- /**
+- * Timeout covers both the ACK and the wait
+- * for remaining work to finish.
+- */
+-
+ for (i = 0; i < timeout; ++i) {
+ if (dmub->hw_funcs.is_gpint_acked(dmub, cmd))
+ break;
+@@ -130,11 +126,9 @@ void dmub_dcn35_reset(struct dmub_srv *dmub)
+ /* Force reset in case we timed out, DMCUB is likely hung. */
+ }
+
+- REG_GET(DMCUB_CNTL, DMCUB_ENABLE, &is_enabled);
+-
+ if (is_enabled) {
+ REG_UPDATE(DMCUB_CNTL2, DMCUB_SOFT_RESET, 1);
+- REG_UPDATE(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET, 1);
++ udelay(1);
+ REG_UPDATE(DMCUB_CNTL, DMCUB_ENABLE, 0);
+ }
+
+@@ -160,11 +154,7 @@ void dmub_dcn35_reset_release(struct dmub_srv *dmub)
+ LONO_SOCCLK_GATE_DISABLE, 1,
+ LONO_DMCUBCLK_GATE_DISABLE, 1);
+
+- REG_UPDATE(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET, 1);
+- udelay(1);
+ REG_UPDATE_2(DMCUB_CNTL, DMCUB_ENABLE, 1, DMCUB_TRACEPORT_EN, 1);
+- REG_UPDATE(DMCUB_CNTL2, DMCUB_SOFT_RESET, 1);
+- udelay(1);
+ REG_UPDATE(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET, 0);
+ REG_UPDATE(DMCUB_CNTL2, DMCUB_SOFT_RESET, 0);
+ }
+--
+2.39.5
+
--- /dev/null
+From e74b608e78b79626486d69ced62a5440a6a47b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 14:44:35 +0000
+Subject: drm/amd/pm: fix null pointer access
+
+From: Umio Yasuno <coelacanth_dream@protonmail.com>
+
+[ Upstream commit d524d40e3a6152a3ea1125af729f8cd8ca65efde ]
+
+Writing a string without delimiters (' ', '\n', '\0') to the under
+gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile
+will result in a null pointer dereference.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4401
+Signed-off-by: Umio Yasuno <coelacanth_dream@protonmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+index 922def51685b..21da5123d95e 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -1398,6 +1398,8 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
+ if (ret)
+ return -EINVAL;
+ parameter_size++;
++ if (!tmp_str)
++ break;
+ while (isspace(*tmp_str))
+ tmp_str++;
+ }
+@@ -3618,6 +3620,9 @@ static int parse_input_od_command_lines(const char *buf,
+ return -EINVAL;
+ parameter_size++;
+
++ if (!tmp_str)
++ break;
++
+ while (isspace(*tmp_str))
+ tmp_str++;
+ }
+--
+2.39.5
+
--- /dev/null
+From ed19b22d606189c1b30c66ad424b9fdfac13511c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 14:00:28 +0800
+Subject: drm/amdgpu: clear pa and mca record counter when resetting eeprom
+
+From: ganglxie <ganglxie@amd.com>
+
+[ Upstream commit d0cc8d2b7df1848f98f0fea8135ba706814b1d13 ]
+
+clear pa and mca record counter when resetting eeprom, so that
+ras_num_bad_pages can be calculated correctly
+
+Signed-off-by: ganglxie <ganglxie@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+index e979a6086178..1a7ec674f579 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+@@ -475,6 +475,8 @@ int amdgpu_ras_eeprom_reset_table(struct amdgpu_ras_eeprom_control *control)
+
+ control->ras_num_recs = 0;
+ control->ras_num_bad_pages = 0;
++ control->ras_num_mca_recs = 0;
++ control->ras_num_pa_recs = 0;
+ control->ras_fri = 0;
+
+ amdgpu_dpm_send_hbm_bad_pages_num(adev, control->ras_num_bad_pages);
+--
+2.39.5
+
--- /dev/null
+From 0b2e6b568618ee122c748759beeec6c6ce59e935 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 11:43:36 +0530
+Subject: drm/amdgpu: Suspend IH during mode-2 reset
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 3f1e81ecb61923934bd11c3f5c1e10893574e607 ]
+
+On multi-aid SOCs, there could be a continuous stream of interrupts from
+GC after poison consumption. Suspend IH to disable them before doing
+mode-2 reset. This avoids conflicts in hardware accesses during
+interrupt handlers while a reset is ongoing.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/aldebaran.c | 33 ++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/aldebaran.c b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+index e13fbd974141..9569dc16dd3d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/aldebaran.c
++++ b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+@@ -71,18 +71,29 @@ aldebaran_get_reset_handler(struct amdgpu_reset_control *reset_ctl,
+ return NULL;
+ }
+
++static inline uint32_t aldebaran_get_ip_block_mask(struct amdgpu_device *adev)
++{
++ uint32_t ip_block_mask = BIT(AMD_IP_BLOCK_TYPE_GFX) |
++ BIT(AMD_IP_BLOCK_TYPE_SDMA);
++
++ if (adev->aid_mask)
++ ip_block_mask |= BIT(AMD_IP_BLOCK_TYPE_IH);
++
++ return ip_block_mask;
++}
++
+ static int aldebaran_mode2_suspend_ip(struct amdgpu_device *adev)
+ {
++ uint32_t ip_block_mask = aldebaran_get_ip_block_mask(adev);
++ uint32_t ip_block;
+ int r, i;
+
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+
+ for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
+- if (!(adev->ip_blocks[i].version->type ==
+- AMD_IP_BLOCK_TYPE_GFX ||
+- adev->ip_blocks[i].version->type ==
+- AMD_IP_BLOCK_TYPE_SDMA))
++ ip_block = BIT(adev->ip_blocks[i].version->type);
++ if (!(ip_block_mask & ip_block))
+ continue;
+
+ r = amdgpu_ip_block_suspend(&adev->ip_blocks[i]);
+@@ -200,8 +211,10 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl,
+ static int aldebaran_mode2_restore_ip(struct amdgpu_device *adev)
+ {
+ struct amdgpu_firmware_info *ucode_list[AMDGPU_UCODE_ID_MAXIMUM];
++ uint32_t ip_block_mask = aldebaran_get_ip_block_mask(adev);
+ struct amdgpu_firmware_info *ucode;
+ struct amdgpu_ip_block *cmn_block;
++ struct amdgpu_ip_block *ih_block;
+ int ucode_count = 0;
+ int i, r;
+
+@@ -243,6 +256,18 @@ static int aldebaran_mode2_restore_ip(struct amdgpu_device *adev)
+ if (r)
+ return r;
+
++ if (ip_block_mask & BIT(AMD_IP_BLOCK_TYPE_IH)) {
++ ih_block = amdgpu_device_ip_get_ip_block(adev,
++ AMD_IP_BLOCK_TYPE_IH);
++ if (unlikely(!ih_block)) {
++ dev_err(adev->dev, "Failed to get IH handle\n");
++ return -EINVAL;
++ }
++ r = amdgpu_ip_block_resume(ih_block);
++ if (r)
++ return r;
++ }
++
+ /* Reinit GFXHUB */
+ adev->gfxhub.funcs->init(adev);
+ r = adev->gfxhub.funcs->gart_enable(adev);
+--
+2.39.5
+
--- /dev/null
+From ab2e06bf9990e77c152ac794e85d3dbeb5ef6b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 23:14:08 +0800
+Subject: drm/amdgpu: Use correct severity for BP threshold exceed event
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 4a33ca3f6ee9a013a423a867426704e9c9d785bd ]
+
+The severity of CPER for BP threshold exceed event should be set as
+CPER_SEV_FATAL to match the OOB implementation.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+index 360e07a5c7c1..1a1f30654b14 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+@@ -212,7 +212,7 @@ int amdgpu_cper_entry_fill_bad_page_threshold_section(struct amdgpu_device *adev
+ NONSTD_SEC_OFFSET(hdr->sec_cnt, idx));
+
+ amdgpu_cper_entry_fill_section_desc(adev, section_desc, true, false,
+- CPER_SEV_NUM, RUNTIME, NONSTD_SEC_LEN,
++ CPER_SEV_FATAL, RUNTIME, NONSTD_SEC_LEN,
+ NONSTD_SEC_OFFSET(hdr->sec_cnt, idx));
+
+ section->hdr.valid_bits.err_info_cnt = 1;
+@@ -326,7 +326,9 @@ int amdgpu_cper_generate_bp_threshold_record(struct amdgpu_device *adev)
+ return -ENOMEM;
+ }
+
+- amdgpu_cper_entry_fill_hdr(adev, bp_threshold, AMDGPU_CPER_TYPE_BP_THRESHOLD, CPER_SEV_NUM);
++ amdgpu_cper_entry_fill_hdr(adev, bp_threshold,
++ AMDGPU_CPER_TYPE_BP_THRESHOLD,
++ CPER_SEV_FATAL);
+ ret = amdgpu_cper_entry_fill_bad_page_threshold_section(adev, bp_threshold, 0);
+ if (ret)
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From aef87bf715fcc5bb26d3f04bea095219e59b2450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 14:28:38 +0200
+Subject: drm/fbdev-client: Skip DRM clients if modesetting is absent
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit cce91f29c088ba902dd2abfc9c3216ba9a2fb2fe ]
+
+Recent generations of Tegra have moved the display components outside of
+host1x, leading to a device that has no CRTCs attached and hence doesn't
+support any of the modesetting functionality. When this is detected, the
+driver clears the DRIVER_MODESET and DRIVER_ATOMIC flags for the device.
+
+Unfortunately, this causes the following errors during boot:
+
+ [ 15.418958] ERR KERN drm drm: [drm] *ERROR* Failed to register client: -95
+ [ 15.425311] WARNING KERN drm drm: [drm] Failed to set up DRM client; error -95
+
+These originate from the fbdev client checking for the presence of the
+DRIVER_MODESET flag and returning -EOPNOTSUPP. However, if a driver does
+not support DRIVER_MODESET this is entirely expected and the error isn't
+helpful.
+
+Prevent this misleading error message by setting up the DRM clients only
+if modesetting is enabled.
+
+Changes in v2:
+- use DRIVER_MODESET check to avoid registering any clients
+
+Reported-by: Jonathan Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://lore.kernel.org/r/20250613122838.2082334-1-thierry.reding@gmail.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/clients/drm_client_setup.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/clients/drm_client_setup.c b/drivers/gpu/drm/clients/drm_client_setup.c
+index e17265039ca8..e460ad354de2 100644
+--- a/drivers/gpu/drm/clients/drm_client_setup.c
++++ b/drivers/gpu/drm/clients/drm_client_setup.c
+@@ -2,6 +2,7 @@
+
+ #include <drm/clients/drm_client_setup.h>
+ #include <drm/drm_device.h>
++#include <drm/drm_drv.h>
+ #include <drm/drm_fourcc.h>
+ #include <drm/drm_print.h>
+
+@@ -31,6 +32,10 @@ MODULE_PARM_DESC(active,
+ */
+ void drm_client_setup(struct drm_device *dev, const struct drm_format_info *format)
+ {
++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
++ drm_dbg(dev, "driver does not support mode-setting, skipping DRM clients\n");
++ return;
++ }
+
+ #ifdef CONFIG_DRM_FBDEV_EMULATION
+ if (!strcmp(drm_client_default, "fbdev")) {
+--
+2.39.5
+
--- /dev/null
+From 3055cf2f62bcebaee07519df8deeb683d5ac6fdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:01:31 +0100
+Subject: drm/imagination: Clear runtime PM errors while resetting the GPU
+
+From: Alessio Belle <alessio.belle@imgtec.com>
+
+[ Upstream commit 551507e0d0bf32ce1d7d27533c4b98307380804c ]
+
+The runtime PM might be left in error state if one of the callbacks
+returned an error, e.g. if the (auto)suspend callback failed following
+a firmware crash.
+
+When that happens, any further attempt to acquire or release a power
+reference will then also fail, making it impossible to do anything else
+with the GPU. The driver logic will eventually reach the reset code.
+
+In pvr_power_reset(), replace pvr_power_get() with a new API
+pvr_power_get_clear() which also attempts to clear any runtime PM error
+state if acquiring a power reference is not possible.
+
+Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
+Reviewed-by: Matt Coster <matt.coster@imgtec.com>
+Link: https://lore.kernel.org/r/20250624-clear-rpm-errors-gpu-reset-v1-1-b8ff2ae55aac@imgtec.com
+Signed-off-by: Matt Coster <matt.coster@imgtec.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imagination/pvr_power.c | 59 ++++++++++++++++++++++++-
+ 1 file changed, 58 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/imagination/pvr_power.c b/drivers/gpu/drm/imagination/pvr_power.c
+index 850b318605da..d97613c6a0a9 100644
+--- a/drivers/gpu/drm/imagination/pvr_power.c
++++ b/drivers/gpu/drm/imagination/pvr_power.c
+@@ -317,6 +317,63 @@ pvr_power_device_idle(struct device *dev)
+ return pvr_power_is_idle(pvr_dev) ? 0 : -EBUSY;
+ }
+
++static int
++pvr_power_clear_error(struct pvr_device *pvr_dev)
++{
++ struct device *dev = from_pvr_device(pvr_dev)->dev;
++ int err;
++
++ /* Ensure the device state is known and nothing is happening past this point */
++ pm_runtime_disable(dev);
++
++ /* Attempt to clear the runtime PM error by setting the current state again */
++ if (pm_runtime_status_suspended(dev))
++ err = pm_runtime_set_suspended(dev);
++ else
++ err = pm_runtime_set_active(dev);
++
++ if (err) {
++ drm_err(from_pvr_device(pvr_dev),
++ "%s: Failed to clear runtime PM error (new error %d)\n",
++ __func__, err);
++ }
++
++ pm_runtime_enable(dev);
++
++ return err;
++}
++
++/**
++ * pvr_power_get_clear() - Acquire a power reference, correcting any errors
++ * @pvr_dev: Device pointer
++ *
++ * Attempt to acquire a power reference on the device. If the runtime PM
++ * is in error state, attempt to clear the error and retry.
++ *
++ * Returns:
++ * * 0 on success, or
++ * * Any error code returned by pvr_power_get() or the runtime PM API.
++ */
++static int
++pvr_power_get_clear(struct pvr_device *pvr_dev)
++{
++ int err;
++
++ err = pvr_power_get(pvr_dev);
++ if (err == 0)
++ return err;
++
++ drm_warn(from_pvr_device(pvr_dev),
++ "%s: pvr_power_get returned error %d, attempting recovery\n",
++ __func__, err);
++
++ err = pvr_power_clear_error(pvr_dev);
++ if (err)
++ return err;
++
++ return pvr_power_get(pvr_dev);
++}
++
+ /**
+ * pvr_power_reset() - Reset the GPU
+ * @pvr_dev: Device pointer
+@@ -341,7 +398,7 @@ pvr_power_reset(struct pvr_device *pvr_dev, bool hard_reset)
+ * Take a power reference during the reset. This should prevent any interference with the
+ * power state during reset.
+ */
+- WARN_ON(pvr_power_get(pvr_dev));
++ WARN_ON(pvr_power_get_clear(pvr_dev));
+
+ down_write(&pvr_dev->reset_sem);
+
+--
+2.39.5
+
--- /dev/null
+From d7c7b68b37ac78583cd126ff39e1b405a0ffc780 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:16:43 +0800
+Subject: drm/msm: Add error handling for krealloc in metadata setup
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 1c8c354098ea9d4376a58c96ae6b65288a6f15d8 ]
+
+Function msm_ioctl_gem_info_set_metadata() now checks for krealloc
+failure and returns -ENOMEM, avoiding potential NULL pointer dereference.
+Explicitly avoids __GFP_NOFAIL due to deadlock risks and allocation constraints.
+
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Patchwork: https://patchwork.freedesktop.org/patch/661235/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index c3588dc9e537..b4e73b015d02 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -551,6 +551,7 @@ static int msm_ioctl_gem_info_set_metadata(struct drm_gem_object *obj,
+ u32 metadata_size)
+ {
+ struct msm_gem_object *msm_obj = to_msm_bo(obj);
++ void *new_metadata;
+ void *buf;
+ int ret;
+
+@@ -568,8 +569,14 @@ static int msm_ioctl_gem_info_set_metadata(struct drm_gem_object *obj,
+ if (ret)
+ goto out;
+
+- msm_obj->metadata =
++ new_metadata =
+ krealloc(msm_obj->metadata, metadata_size, GFP_KERNEL);
++ if (!new_metadata) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
++ msm_obj->metadata = new_metadata;
+ msm_obj->metadata_size = metadata_size;
+ memcpy(msm_obj->metadata, buf, metadata_size);
+
+--
+2.39.5
+
--- /dev/null
+From e7f10122facf5a210676635701b0917597a20299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 10:51:19 -0700
+Subject: drm/msm: Update register xml
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 6733d8276ac02a8790e571d2af4a69a9039d0522 ]
+
+Sync register xml from mesa commit eb3e0b7164a3 ("freedreno/a6xx: Split
+descriptors out into their own file").
+
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Acked-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/662470/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/Makefile | 5 +
+ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 +-
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 4 +
+ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +-
+ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h | 2 +-
+ drivers/gpu/drm/msm/adreno/a6xx_preempt.c | 2 +-
+ .../drm/msm/adreno/adreno_gen7_9_0_snapshot.h | 4 +-
+ drivers/gpu/drm/msm/registers/adreno/a6xx.xml | 3582 +++--------------
+ .../msm/registers/adreno/a6xx_descriptors.xml | 198 +
+ .../drm/msm/registers/adreno/a6xx_enums.xml | 383 ++
+ .../msm/registers/adreno/a6xx_perfcntrs.xml | 600 +++
+ .../drm/msm/registers/adreno/a7xx_enums.xml | 223 +
+ .../msm/registers/adreno/a7xx_perfcntrs.xml | 1030 +++++
+ .../drm/msm/registers/adreno/adreno_pm4.xml | 302 +-
+ 14 files changed, 3312 insertions(+), 3027 deletions(-)
+ create mode 100644 drivers/gpu/drm/msm/registers/adreno/a6xx_descriptors.xml
+ create mode 100644 drivers/gpu/drm/msm/registers/adreno/a6xx_enums.xml
+ create mode 100644 drivers/gpu/drm/msm/registers/adreno/a6xx_perfcntrs.xml
+ create mode 100644 drivers/gpu/drm/msm/registers/adreno/a7xx_enums.xml
+ create mode 100644 drivers/gpu/drm/msm/registers/adreno/a7xx_perfcntrs.xml
+
+diff --git a/drivers/gpu/drm/msm/Makefile b/drivers/gpu/drm/msm/Makefile
+index 5df20cbeafb8..12de9314f6cd 100644
+--- a/drivers/gpu/drm/msm/Makefile
++++ b/drivers/gpu/drm/msm/Makefile
+@@ -196,6 +196,11 @@ ADRENO_HEADERS = \
+ generated/a4xx.xml.h \
+ generated/a5xx.xml.h \
+ generated/a6xx.xml.h \
++ generated/a6xx_descriptors.xml.h \
++ generated/a6xx_enums.xml.h \
++ generated/a6xx_perfcntrs.xml.h \
++ generated/a7xx_enums.xml.h \
++ generated/a7xx_perfcntrs.xml.h \
+ generated/a6xx_gmu.xml.h \
+ generated/adreno_common.xml.h \
+ generated/adreno_pm4.xml.h \
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+index 53e2ff4406d8..b975809efed4 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+@@ -1343,7 +1343,7 @@ static const uint32_t a7xx_pwrup_reglist_regs[] = {
+ REG_A6XX_RB_NC_MODE_CNTL,
+ REG_A6XX_RB_CMP_DBG_ECO_CNTL,
+ REG_A7XX_GRAS_NC_MODE_CNTL,
+- REG_A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE,
++ REG_A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE_ENABLE,
+ REG_A6XX_UCHE_GBIF_GX_CONFIG,
+ REG_A6XX_UCHE_CLIENT_PF,
+ REG_A6XX_TPL1_DBG_ECO_CNTL1,
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+index 9201a53dd341..6e71f617fc3d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+@@ -6,6 +6,10 @@
+
+
+ #include "adreno_gpu.h"
++#include "a6xx_enums.xml.h"
++#include "a7xx_enums.xml.h"
++#include "a6xx_perfcntrs.xml.h"
++#include "a7xx_perfcntrs.xml.h"
+ #include "a6xx.xml.h"
+
+ #include "a6xx_gmu.h"
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+index 341a72a67401..a85d3df7a5fa 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+@@ -158,7 +158,7 @@ static int a6xx_crashdumper_run(struct msm_gpu *gpu,
+ /* Make sure all pending memory writes are posted */
+ wmb();
+
+- gpu_write64(gpu, REG_A6XX_CP_CRASH_SCRIPT_BASE, dumper->iova);
++ gpu_write64(gpu, REG_A6XX_CP_CRASH_DUMP_SCRIPT_BASE, dumper->iova);
+
+ gpu_write(gpu, REG_A6XX_CP_CRASH_DUMP_CNTL, 1);
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h
+index e545106c70be..95d93ac6812a 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h
+@@ -212,7 +212,7 @@ static const struct a6xx_shader_block {
+ SHADER(A6XX_SP_LB_5_DATA, 0x200),
+ SHADER(A6XX_SP_CB_BINDLESS_DATA, 0x800),
+ SHADER(A6XX_SP_CB_LEGACY_DATA, 0x280),
+- SHADER(A6XX_SP_UAV_DATA, 0x80),
++ SHADER(A6XX_SP_GFX_UAV_BASE_DATA, 0x80),
+ SHADER(A6XX_SP_INST_TAG, 0x80),
+ SHADER(A6XX_SP_CB_BINDLESS_TAG, 0x80),
+ SHADER(A6XX_SP_TMO_UMO_TAG, 0x80),
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_preempt.c b/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
+index 9b5e27d2373c..43f58cafda70 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
+@@ -209,7 +209,7 @@ void a6xx_preempt_hw_init(struct msm_gpu *gpu)
+ gpu_write64(gpu, REG_A6XX_CP_CONTEXT_SWITCH_SMMU_INFO, 0);
+
+ /* Enable the GMEM save/restore feature for preemption */
+- gpu_write(gpu, REG_A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE, 0x1);
++ gpu_write(gpu, REG_A6XX_RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE_ENABLE, 0x1);
+
+ /* Reset the preemption state */
+ set_preempt_state(a6xx_gpu, PREEMPT_NONE);
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h b/drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h
+index 9a327d543f27..e02cabb39f19 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h
++++ b/drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h
+@@ -1311,8 +1311,8 @@ static struct a6xx_indexed_registers gen7_9_0_cp_indexed_reg_list[] = {
+ REG_A7XX_CP_BV_SQE_UCODE_DBG_DATA, 0x08000},
+ { "CP_BV_SQE_STAT_ADDR", REG_A7XX_CP_BV_SQE_STAT_ADDR,
+ REG_A7XX_CP_BV_SQE_STAT_DATA, 0x00040},
+- { "CP_RESOURCE_TBL", REG_A7XX_CP_RESOURCE_TBL_DBG_ADDR,
+- REG_A7XX_CP_RESOURCE_TBL_DBG_DATA, 0x04100},
++ { "CP_RESOURCE_TBL", REG_A7XX_CP_RESOURCE_TABLE_DBG_ADDR,
++ REG_A7XX_CP_RESOURCE_TABLE_DBG_DATA, 0x04100},
+ { "CP_LPAC_DRAW_STATE_ADDR", REG_A7XX_CP_LPAC_DRAW_STATE_ADDR,
+ REG_A7XX_CP_LPAC_DRAW_STATE_DATA, 0x00200},
+ { "CP_LPAC_ROQ", REG_A7XX_CP_LPAC_ROQ_DBG_ADDR,
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a6xx.xml b/drivers/gpu/drm/msm/registers/adreno/a6xx.xml
+index 2db425abf0f3..d860fd94feae 100644
+--- a/drivers/gpu/drm/msm/registers/adreno/a6xx.xml
++++ b/drivers/gpu/drm/msm/registers/adreno/a6xx.xml
+@@ -5,6 +5,11 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <import file="freedreno_copyright.xml"/>
+ <import file="adreno/adreno_common.xml"/>
+ <import file="adreno/adreno_pm4.xml"/>
++<import file="adreno/a6xx_enums.xml"/>
++<import file="adreno/a7xx_enums.xml"/>
++<import file="adreno/a6xx_perfcntrs.xml"/>
++<import file="adreno/a7xx_perfcntrs.xml"/>
++<import file="adreno/a6xx_descriptors.xml"/>
+
+ <!--
+ Each register that is actually being used by driver should have "usage" defined,
+@@ -20,2205 +25,6 @@ is either overwritten by renderpass/blit (ib2) or not used if not overwritten
+ by a particular renderpass/blit.
+ -->
+
+-<!-- these might be same as a5xx -->
+-<enum name="a6xx_tile_mode">
+- <value name="TILE6_LINEAR" value="0"/>
+- <value name="TILE6_2" value="2"/>
+- <value name="TILE6_3" value="3"/>
+-</enum>
+-
+-<enum name="a6xx_format">
+- <value value="0x02" name="FMT6_A8_UNORM"/>
+- <value value="0x03" name="FMT6_8_UNORM"/>
+- <value value="0x04" name="FMT6_8_SNORM"/>
+- <value value="0x05" name="FMT6_8_UINT"/>
+- <value value="0x06" name="FMT6_8_SINT"/>
+-
+- <value value="0x08" name="FMT6_4_4_4_4_UNORM"/>
+- <value value="0x0a" name="FMT6_5_5_5_1_UNORM"/>
+- <value value="0x0c" name="FMT6_1_5_5_5_UNORM"/> <!-- read only -->
+- <value value="0x0e" name="FMT6_5_6_5_UNORM"/>
+-
+- <value value="0x0f" name="FMT6_8_8_UNORM"/>
+- <value value="0x10" name="FMT6_8_8_SNORM"/>
+- <value value="0x11" name="FMT6_8_8_UINT"/>
+- <value value="0x12" name="FMT6_8_8_SINT"/>
+- <value value="0x13" name="FMT6_L8_A8_UNORM"/>
+-
+- <value value="0x15" name="FMT6_16_UNORM"/>
+- <value value="0x16" name="FMT6_16_SNORM"/>
+- <value value="0x17" name="FMT6_16_FLOAT"/>
+- <value value="0x18" name="FMT6_16_UINT"/>
+- <value value="0x19" name="FMT6_16_SINT"/>
+-
+- <value value="0x21" name="FMT6_8_8_8_UNORM"/>
+- <value value="0x22" name="FMT6_8_8_8_SNORM"/>
+- <value value="0x23" name="FMT6_8_8_8_UINT"/>
+- <value value="0x24" name="FMT6_8_8_8_SINT"/>
+-
+- <value value="0x30" name="FMT6_8_8_8_8_UNORM"/>
+- <value value="0x31" name="FMT6_8_8_8_X8_UNORM"/> <!-- samples 1 for alpha -->
+- <value value="0x32" name="FMT6_8_8_8_8_SNORM"/>
+- <value value="0x33" name="FMT6_8_8_8_8_UINT"/>
+- <value value="0x34" name="FMT6_8_8_8_8_SINT"/>
+-
+- <value value="0x35" name="FMT6_9_9_9_E5_FLOAT"/>
+-
+- <value value="0x36" name="FMT6_10_10_10_2_UNORM"/>
+- <value value="0x37" name="FMT6_10_10_10_2_UNORM_DEST"/>
+- <value value="0x39" name="FMT6_10_10_10_2_SNORM"/>
+- <value value="0x3a" name="FMT6_10_10_10_2_UINT"/>
+- <value value="0x3b" name="FMT6_10_10_10_2_SINT"/>
+-
+- <value value="0x42" name="FMT6_11_11_10_FLOAT"/>
+-
+- <value value="0x43" name="FMT6_16_16_UNORM"/>
+- <value value="0x44" name="FMT6_16_16_SNORM"/>
+- <value value="0x45" name="FMT6_16_16_FLOAT"/>
+- <value value="0x46" name="FMT6_16_16_UINT"/>
+- <value value="0x47" name="FMT6_16_16_SINT"/>
+-
+- <value value="0x48" name="FMT6_32_UNORM"/>
+- <value value="0x49" name="FMT6_32_SNORM"/>
+- <value value="0x4a" name="FMT6_32_FLOAT"/>
+- <value value="0x4b" name="FMT6_32_UINT"/>
+- <value value="0x4c" name="FMT6_32_SINT"/>
+- <value value="0x4d" name="FMT6_32_FIXED"/>
+-
+- <value value="0x58" name="FMT6_16_16_16_UNORM"/>
+- <value value="0x59" name="FMT6_16_16_16_SNORM"/>
+- <value value="0x5a" name="FMT6_16_16_16_FLOAT"/>
+- <value value="0x5b" name="FMT6_16_16_16_UINT"/>
+- <value value="0x5c" name="FMT6_16_16_16_SINT"/>
+-
+- <value value="0x60" name="FMT6_16_16_16_16_UNORM"/>
+- <value value="0x61" name="FMT6_16_16_16_16_SNORM"/>
+- <value value="0x62" name="FMT6_16_16_16_16_FLOAT"/>
+- <value value="0x63" name="FMT6_16_16_16_16_UINT"/>
+- <value value="0x64" name="FMT6_16_16_16_16_SINT"/>
+-
+- <value value="0x65" name="FMT6_32_32_UNORM"/>
+- <value value="0x66" name="FMT6_32_32_SNORM"/>
+- <value value="0x67" name="FMT6_32_32_FLOAT"/>
+- <value value="0x68" name="FMT6_32_32_UINT"/>
+- <value value="0x69" name="FMT6_32_32_SINT"/>
+- <value value="0x6a" name="FMT6_32_32_FIXED"/>
+-
+- <value value="0x70" name="FMT6_32_32_32_UNORM"/>
+- <value value="0x71" name="FMT6_32_32_32_SNORM"/>
+- <value value="0x72" name="FMT6_32_32_32_UINT"/>
+- <value value="0x73" name="FMT6_32_32_32_SINT"/>
+- <value value="0x74" name="FMT6_32_32_32_FLOAT"/>
+- <value value="0x75" name="FMT6_32_32_32_FIXED"/>
+-
+- <value value="0x80" name="FMT6_32_32_32_32_UNORM"/>
+- <value value="0x81" name="FMT6_32_32_32_32_SNORM"/>
+- <value value="0x82" name="FMT6_32_32_32_32_FLOAT"/>
+- <value value="0x83" name="FMT6_32_32_32_32_UINT"/>
+- <value value="0x84" name="FMT6_32_32_32_32_SINT"/>
+- <value value="0x85" name="FMT6_32_32_32_32_FIXED"/>
+-
+- <value value="0x8c" name="FMT6_G8R8B8R8_422_UNORM"/> <!-- UYVY -->
+- <value value="0x8d" name="FMT6_R8G8R8B8_422_UNORM"/> <!-- YUYV -->
+- <value value="0x8e" name="FMT6_R8_G8B8_2PLANE_420_UNORM"/> <!-- NV12 -->
+- <value value="0x8f" name="FMT6_NV21"/>
+- <value value="0x90" name="FMT6_R8_G8_B8_3PLANE_420_UNORM"/> <!-- YV12 -->
+-
+- <value value="0x91" name="FMT6_Z24_UNORM_S8_UINT_AS_R8G8B8A8"/>
+-
+- <!-- Note: tiling/UBWC for these may be different from equivalent formats
+- For example FMT6_NV12_Y is not compatible with FMT6_8_UNORM
+- -->
+- <value value="0x94" name="FMT6_NV12_Y"/>
+- <value value="0x95" name="FMT6_NV12_UV"/>
+- <value value="0x96" name="FMT6_NV12_VU"/>
+- <value value="0x97" name="FMT6_NV12_4R"/>
+- <value value="0x98" name="FMT6_NV12_4R_Y"/>
+- <value value="0x99" name="FMT6_NV12_4R_UV"/>
+- <value value="0x9a" name="FMT6_P010"/>
+- <value value="0x9b" name="FMT6_P010_Y"/>
+- <value value="0x9c" name="FMT6_P010_UV"/>
+- <value value="0x9d" name="FMT6_TP10"/>
+- <value value="0x9e" name="FMT6_TP10_Y"/>
+- <value value="0x9f" name="FMT6_TP10_UV"/>
+-
+- <value value="0xa0" name="FMT6_Z24_UNORM_S8_UINT"/>
+-
+- <value value="0xab" name="FMT6_ETC2_RG11_UNORM"/>
+- <value value="0xac" name="FMT6_ETC2_RG11_SNORM"/>
+- <value value="0xad" name="FMT6_ETC2_R11_UNORM"/>
+- <value value="0xae" name="FMT6_ETC2_R11_SNORM"/>
+- <value value="0xaf" name="FMT6_ETC1"/>
+- <value value="0xb0" name="FMT6_ETC2_RGB8"/>
+- <value value="0xb1" name="FMT6_ETC2_RGBA8"/>
+- <value value="0xb2" name="FMT6_ETC2_RGB8A1"/>
+- <value value="0xb3" name="FMT6_DXT1"/>
+- <value value="0xb4" name="FMT6_DXT3"/>
+- <value value="0xb5" name="FMT6_DXT5"/>
+- <value value="0xb7" name="FMT6_RGTC1_UNORM"/>
+- <value value="0xb8" name="FMT6_RGTC1_SNORM"/>
+- <value value="0xbb" name="FMT6_RGTC2_UNORM"/>
+- <value value="0xbc" name="FMT6_RGTC2_SNORM"/>
+- <value value="0xbe" name="FMT6_BPTC_UFLOAT"/>
+- <value value="0xbf" name="FMT6_BPTC_FLOAT"/>
+- <value value="0xc0" name="FMT6_BPTC"/>
+- <value value="0xc1" name="FMT6_ASTC_4x4"/>
+- <value value="0xc2" name="FMT6_ASTC_5x4"/>
+- <value value="0xc3" name="FMT6_ASTC_5x5"/>
+- <value value="0xc4" name="FMT6_ASTC_6x5"/>
+- <value value="0xc5" name="FMT6_ASTC_6x6"/>
+- <value value="0xc6" name="FMT6_ASTC_8x5"/>
+- <value value="0xc7" name="FMT6_ASTC_8x6"/>
+- <value value="0xc8" name="FMT6_ASTC_8x8"/>
+- <value value="0xc9" name="FMT6_ASTC_10x5"/>
+- <value value="0xca" name="FMT6_ASTC_10x6"/>
+- <value value="0xcb" name="FMT6_ASTC_10x8"/>
+- <value value="0xcc" name="FMT6_ASTC_10x10"/>
+- <value value="0xcd" name="FMT6_ASTC_12x10"/>
+- <value value="0xce" name="FMT6_ASTC_12x12"/>
+-
+- <!-- for sampling stencil (integer, 2nd channel), not available on a630 -->
+- <value value="0xea" name="FMT6_Z24_UINT_S8_UINT"/>
+-
+- <!-- Not a hw enum, used internally in driver -->
+- <value value="0xff" name="FMT6_NONE"/>
+-
+-</enum>
+-
+-<!-- probably same as a5xx -->
+-<enum name="a6xx_polygon_mode">
+- <value name="POLYMODE6_POINTS" value="1"/>
+- <value name="POLYMODE6_LINES" value="2"/>
+- <value name="POLYMODE6_TRIANGLES" value="3"/>
+-</enum>
+-
+-<enum name="a6xx_depth_format">
+- <value name="DEPTH6_NONE" value="0"/>
+- <value name="DEPTH6_16" value="1"/>
+- <value name="DEPTH6_24_8" value="2"/>
+- <value name="DEPTH6_32" value="4"/>
+-</enum>
+-
+-<bitset name="a6x_cp_protect" inline="yes">
+- <bitfield name="BASE_ADDR" low="0" high="17"/>
+- <bitfield name="MASK_LEN" low="18" high="30"/>
+- <bitfield name="READ" pos="31" type="boolean"/>
+-</bitset>
+-
+-<enum name="a6xx_shader_id">
+- <value value="0x9" name="A6XX_TP0_TMO_DATA"/>
+- <value value="0xa" name="A6XX_TP0_SMO_DATA"/>
+- <value value="0xb" name="A6XX_TP0_MIPMAP_BASE_DATA"/>
+- <value value="0x19" name="A6XX_TP1_TMO_DATA"/>
+- <value value="0x1a" name="A6XX_TP1_SMO_DATA"/>
+- <value value="0x1b" name="A6XX_TP1_MIPMAP_BASE_DATA"/>
+- <value value="0x29" name="A6XX_SP_INST_DATA"/>
+- <value value="0x2a" name="A6XX_SP_LB_0_DATA"/>
+- <value value="0x2b" name="A6XX_SP_LB_1_DATA"/>
+- <value value="0x2c" name="A6XX_SP_LB_2_DATA"/>
+- <value value="0x2d" name="A6XX_SP_LB_3_DATA"/>
+- <value value="0x2e" name="A6XX_SP_LB_4_DATA"/>
+- <value value="0x2f" name="A6XX_SP_LB_5_DATA"/>
+- <value value="0x30" name="A6XX_SP_CB_BINDLESS_DATA"/>
+- <value value="0x31" name="A6XX_SP_CB_LEGACY_DATA"/>
+- <value value="0x32" name="A6XX_SP_UAV_DATA"/>
+- <value value="0x33" name="A6XX_SP_INST_TAG"/>
+- <value value="0x34" name="A6XX_SP_CB_BINDLESS_TAG"/>
+- <value value="0x35" name="A6XX_SP_TMO_UMO_TAG"/>
+- <value value="0x36" name="A6XX_SP_SMO_TAG"/>
+- <value value="0x37" name="A6XX_SP_STATE_DATA"/>
+- <value value="0x49" name="A6XX_HLSQ_CHUNK_CVS_RAM"/>
+- <value value="0x4a" name="A6XX_HLSQ_CHUNK_CPS_RAM"/>
+- <value value="0x4b" name="A6XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+- <value value="0x4c" name="A6XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+- <value value="0x4d" name="A6XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+- <value value="0x4e" name="A6XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+- <value value="0x50" name="A6XX_HLSQ_CVS_MISC_RAM"/>
+- <value value="0x51" name="A6XX_HLSQ_CPS_MISC_RAM"/>
+- <value value="0x52" name="A6XX_HLSQ_INST_RAM"/>
+- <value value="0x53" name="A6XX_HLSQ_GFX_CVS_CONST_RAM"/>
+- <value value="0x54" name="A6XX_HLSQ_GFX_CPS_CONST_RAM"/>
+- <value value="0x55" name="A6XX_HLSQ_CVS_MISC_RAM_TAG"/>
+- <value value="0x56" name="A6XX_HLSQ_CPS_MISC_RAM_TAG"/>
+- <value value="0x57" name="A6XX_HLSQ_INST_RAM_TAG"/>
+- <value value="0x58" name="A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+- <value value="0x59" name="A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+- <value value="0x5a" name="A6XX_HLSQ_PWR_REST_RAM"/>
+- <value value="0x5b" name="A6XX_HLSQ_PWR_REST_TAG"/>
+- <value value="0x60" name="A6XX_HLSQ_DATAPATH_META"/>
+- <value value="0x61" name="A6XX_HLSQ_FRONTEND_META"/>
+- <value value="0x62" name="A6XX_HLSQ_INDIRECT_META"/>
+- <value value="0x63" name="A6XX_HLSQ_BACKEND_META"/>
+- <value value="0x70" name="A6XX_SP_LB_6_DATA"/>
+- <value value="0x71" name="A6XX_SP_LB_7_DATA"/>
+- <value value="0x73" name="A6XX_HLSQ_INST_RAM_1"/>
+-</enum>
+-
+-<enum name="a7xx_statetype_id">
+- <value value="0" name="A7XX_TP0_NCTX_REG"/>
+- <value value="1" name="A7XX_TP0_CTX0_3D_CVS_REG"/>
+- <value value="2" name="A7XX_TP0_CTX0_3D_CPS_REG"/>
+- <value value="3" name="A7XX_TP0_CTX1_3D_CVS_REG"/>
+- <value value="4" name="A7XX_TP0_CTX1_3D_CPS_REG"/>
+- <value value="5" name="A7XX_TP0_CTX2_3D_CPS_REG"/>
+- <value value="6" name="A7XX_TP0_CTX3_3D_CPS_REG"/>
+- <value value="9" name="A7XX_TP0_TMO_DATA"/>
+- <value value="10" name="A7XX_TP0_SMO_DATA"/>
+- <value value="11" name="A7XX_TP0_MIPMAP_BASE_DATA"/>
+- <value value="32" name="A7XX_SP_NCTX_REG"/>
+- <value value="33" name="A7XX_SP_CTX0_3D_CVS_REG"/>
+- <value value="34" name="A7XX_SP_CTX0_3D_CPS_REG"/>
+- <value value="35" name="A7XX_SP_CTX1_3D_CVS_REG"/>
+- <value value="36" name="A7XX_SP_CTX1_3D_CPS_REG"/>
+- <value value="37" name="A7XX_SP_CTX2_3D_CPS_REG"/>
+- <value value="38" name="A7XX_SP_CTX3_3D_CPS_REG"/>
+- <value value="39" name="A7XX_SP_INST_DATA"/>
+- <value value="40" name="A7XX_SP_INST_DATA_1"/>
+- <value value="41" name="A7XX_SP_LB_0_DATA"/>
+- <value value="42" name="A7XX_SP_LB_1_DATA"/>
+- <value value="43" name="A7XX_SP_LB_2_DATA"/>
+- <value value="44" name="A7XX_SP_LB_3_DATA"/>
+- <value value="45" name="A7XX_SP_LB_4_DATA"/>
+- <value value="46" name="A7XX_SP_LB_5_DATA"/>
+- <value value="47" name="A7XX_SP_LB_6_DATA"/>
+- <value value="48" name="A7XX_SP_LB_7_DATA"/>
+- <value value="49" name="A7XX_SP_CB_RAM"/>
+- <value value="50" name="A7XX_SP_LB_13_DATA"/>
+- <value value="51" name="A7XX_SP_LB_14_DATA"/>
+- <value value="52" name="A7XX_SP_INST_TAG"/>
+- <value value="53" name="A7XX_SP_INST_DATA_2"/>
+- <value value="54" name="A7XX_SP_TMO_TAG"/>
+- <value value="55" name="A7XX_SP_SMO_TAG"/>
+- <value value="56" name="A7XX_SP_STATE_DATA"/>
+- <value value="57" name="A7XX_SP_HWAVE_RAM"/>
+- <value value="58" name="A7XX_SP_L0_INST_BUF"/>
+- <value value="59" name="A7XX_SP_LB_8_DATA"/>
+- <value value="60" name="A7XX_SP_LB_9_DATA"/>
+- <value value="61" name="A7XX_SP_LB_10_DATA"/>
+- <value value="62" name="A7XX_SP_LB_11_DATA"/>
+- <value value="63" name="A7XX_SP_LB_12_DATA"/>
+- <value value="64" name="A7XX_HLSQ_DATAPATH_DSTR_META"/>
+- <value value="67" name="A7XX_HLSQ_L2STC_TAG_RAM"/>
+- <value value="68" name="A7XX_HLSQ_L2STC_INFO_CMD"/>
+- <value value="69" name="A7XX_HLSQ_CVS_BE_CTXT_BUF_RAM_TAG"/>
+- <value value="70" name="A7XX_HLSQ_CPS_BE_CTXT_BUF_RAM_TAG"/>
+- <value value="71" name="A7XX_HLSQ_GFX_CVS_BE_CTXT_BUF_RAM"/>
+- <value value="72" name="A7XX_HLSQ_GFX_CPS_BE_CTXT_BUF_RAM"/>
+- <value value="73" name="A7XX_HLSQ_CHUNK_CVS_RAM"/>
+- <value value="74" name="A7XX_HLSQ_CHUNK_CPS_RAM"/>
+- <value value="75" name="A7XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
+- <value value="76" name="A7XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
+- <value value="77" name="A7XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
+- <value value="78" name="A7XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
+- <value value="79" name="A7XX_HLSQ_CVS_MISC_RAM"/>
+- <value value="80" name="A7XX_HLSQ_CPS_MISC_RAM"/>
+- <value value="81" name="A7XX_HLSQ_CPS_MISC_RAM_1"/>
+- <value value="82" name="A7XX_HLSQ_INST_RAM"/>
+- <value value="83" name="A7XX_HLSQ_GFX_CVS_CONST_RAM"/>
+- <value value="84" name="A7XX_HLSQ_GFX_CPS_CONST_RAM"/>
+- <value value="85" name="A7XX_HLSQ_CVS_MISC_RAM_TAG"/>
+- <value value="86" name="A7XX_HLSQ_CPS_MISC_RAM_TAG"/>
+- <value value="87" name="A7XX_HLSQ_INST_RAM_TAG"/>
+- <value value="88" name="A7XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
+- <value value="89" name="A7XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
+- <value value="90" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM"/>
+- <value value="91" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM_TAG"/>
+- <value value="92" name="A7XX_HLSQ_INST_RAM_1"/>
+- <value value="93" name="A7XX_HLSQ_STPROC_META"/>
+- <value value="94" name="A7XX_HLSQ_BV_BE_META"/>
+- <value value="95" name="A7XX_HLSQ_INST_RAM_2"/>
+- <value value="96" name="A7XX_HLSQ_DATAPATH_META"/>
+- <value value="97" name="A7XX_HLSQ_FRONTEND_META"/>
+- <value value="98" name="A7XX_HLSQ_INDIRECT_META"/>
+- <value value="99" name="A7XX_HLSQ_BACKEND_META"/>
+-</enum>
+-
+-<enum name="a6xx_debugbus_id">
+- <value value="0x1" name="A6XX_DBGBUS_CP"/>
+- <value value="0x2" name="A6XX_DBGBUS_RBBM"/>
+- <value value="0x3" name="A6XX_DBGBUS_VBIF"/>
+- <value value="0x4" name="A6XX_DBGBUS_HLSQ"/>
+- <value value="0x5" name="A6XX_DBGBUS_UCHE"/>
+- <value value="0x6" name="A6XX_DBGBUS_DPM"/>
+- <value value="0x7" name="A6XX_DBGBUS_TESS"/>
+- <value value="0x8" name="A6XX_DBGBUS_PC"/>
+- <value value="0x9" name="A6XX_DBGBUS_VFDP"/>
+- <value value="0xa" name="A6XX_DBGBUS_VPC"/>
+- <value value="0xb" name="A6XX_DBGBUS_TSE"/>
+- <value value="0xc" name="A6XX_DBGBUS_RAS"/>
+- <value value="0xd" name="A6XX_DBGBUS_VSC"/>
+- <value value="0xe" name="A6XX_DBGBUS_COM"/>
+- <value value="0x10" name="A6XX_DBGBUS_LRZ"/>
+- <value value="0x11" name="A6XX_DBGBUS_A2D"/>
+- <value value="0x12" name="A6XX_DBGBUS_CCUFCHE"/>
+- <value value="0x13" name="A6XX_DBGBUS_GMU_CX"/>
+- <value value="0x14" name="A6XX_DBGBUS_RBP"/>
+- <value value="0x15" name="A6XX_DBGBUS_DCS"/>
+- <value value="0x16" name="A6XX_DBGBUS_DBGC"/>
+- <value value="0x17" name="A6XX_DBGBUS_CX"/>
+- <value value="0x18" name="A6XX_DBGBUS_GMU_GX"/>
+- <value value="0x19" name="A6XX_DBGBUS_TPFCHE"/>
+- <value value="0x1a" name="A6XX_DBGBUS_GBIF_GX"/>
+- <value value="0x1d" name="A6XX_DBGBUS_GPC"/>
+- <value value="0x1e" name="A6XX_DBGBUS_LARC"/>
+- <value value="0x1f" name="A6XX_DBGBUS_HLSQ_SPTP"/>
+- <value value="0x20" name="A6XX_DBGBUS_RB_0"/>
+- <value value="0x21" name="A6XX_DBGBUS_RB_1"/>
+- <value value="0x22" name="A6XX_DBGBUS_RB_2"/>
+- <value value="0x24" name="A6XX_DBGBUS_UCHE_WRAPPER"/>
+- <value value="0x28" name="A6XX_DBGBUS_CCU_0"/>
+- <value value="0x29" name="A6XX_DBGBUS_CCU_1"/>
+- <value value="0x2a" name="A6XX_DBGBUS_CCU_2"/>
+- <value value="0x38" name="A6XX_DBGBUS_VFD_0"/>
+- <value value="0x39" name="A6XX_DBGBUS_VFD_1"/>
+- <value value="0x3a" name="A6XX_DBGBUS_VFD_2"/>
+- <value value="0x3b" name="A6XX_DBGBUS_VFD_3"/>
+- <value value="0x3c" name="A6XX_DBGBUS_VFD_4"/>
+- <value value="0x3d" name="A6XX_DBGBUS_VFD_5"/>
+- <value value="0x40" name="A6XX_DBGBUS_SP_0"/>
+- <value value="0x41" name="A6XX_DBGBUS_SP_1"/>
+- <value value="0x42" name="A6XX_DBGBUS_SP_2"/>
+- <value value="0x48" name="A6XX_DBGBUS_TPL1_0"/>
+- <value value="0x49" name="A6XX_DBGBUS_TPL1_1"/>
+- <value value="0x4a" name="A6XX_DBGBUS_TPL1_2"/>
+- <value value="0x4b" name="A6XX_DBGBUS_TPL1_3"/>
+- <value value="0x4c" name="A6XX_DBGBUS_TPL1_4"/>
+- <value value="0x4d" name="A6XX_DBGBUS_TPL1_5"/>
+- <value value="0x58" name="A6XX_DBGBUS_SPTP_0"/>
+- <value value="0x59" name="A6XX_DBGBUS_SPTP_1"/>
+- <value value="0x5a" name="A6XX_DBGBUS_SPTP_2"/>
+- <value value="0x5b" name="A6XX_DBGBUS_SPTP_3"/>
+- <value value="0x5c" name="A6XX_DBGBUS_SPTP_4"/>
+- <value value="0x5d" name="A6XX_DBGBUS_SPTP_5"/>
+-</enum>
+-
+-<enum name="a7xx_state_location">
+- <value value="0" name="A7XX_HLSQ_STATE"/>
+- <value value="1" name="A7XX_HLSQ_DP"/>
+- <value value="2" name="A7XX_SP_TOP"/>
+- <value value="3" name="A7XX_USPTP"/>
+- <value value="4" name="A7XX_HLSQ_DP_STR"/>
+-</enum>
+-
+-<enum name="a7xx_pipe">
+- <value value="0" name="A7XX_PIPE_NONE"/>
+- <value value="1" name="A7XX_PIPE_BR"/>
+- <value value="2" name="A7XX_PIPE_BV"/>
+- <value value="3" name="A7XX_PIPE_LPAC"/>
+-</enum>
+-
+-<enum name="a7xx_cluster">
+- <value value="0" name="A7XX_CLUSTER_NONE"/>
+- <value value="1" name="A7XX_CLUSTER_FE"/>
+- <value value="2" name="A7XX_CLUSTER_SP_VS"/>
+- <value value="3" name="A7XX_CLUSTER_PC_VS"/>
+- <value value="4" name="A7XX_CLUSTER_GRAS"/>
+- <value value="5" name="A7XX_CLUSTER_SP_PS"/>
+- <value value="6" name="A7XX_CLUSTER_VPC_PS"/>
+- <value value="7" name="A7XX_CLUSTER_PS"/>
+-</enum>
+-
+-<enum name="a7xx_debugbus_id">
+- <value value="1" name="A7XX_DBGBUS_CP_0_0"/>
+- <value value="2" name="A7XX_DBGBUS_CP_0_1"/>
+- <value value="3" name="A7XX_DBGBUS_RBBM"/>
+- <value value="5" name="A7XX_DBGBUS_GBIF_GX"/>
+- <value value="6" name="A7XX_DBGBUS_GBIF_CX"/>
+- <value value="7" name="A7XX_DBGBUS_HLSQ"/>
+- <value value="9" name="A7XX_DBGBUS_UCHE_0"/>
+- <value value="10" name="A7XX_DBGBUS_UCHE_1"/>
+- <value value="13" name="A7XX_DBGBUS_TESS_BR"/>
+- <value value="14" name="A7XX_DBGBUS_TESS_BV"/>
+- <value value="17" name="A7XX_DBGBUS_PC_BR"/>
+- <value value="18" name="A7XX_DBGBUS_PC_BV"/>
+- <value value="21" name="A7XX_DBGBUS_VFDP_BR"/>
+- <value value="22" name="A7XX_DBGBUS_VFDP_BV"/>
+- <value value="25" name="A7XX_DBGBUS_VPC_BR"/>
+- <value value="26" name="A7XX_DBGBUS_VPC_BV"/>
+- <value value="29" name="A7XX_DBGBUS_TSE_BR"/>
+- <value value="30" name="A7XX_DBGBUS_TSE_BV"/>
+- <value value="33" name="A7XX_DBGBUS_RAS_BR"/>
+- <value value="34" name="A7XX_DBGBUS_RAS_BV"/>
+- <value value="37" name="A7XX_DBGBUS_VSC"/>
+- <value value="39" name="A7XX_DBGBUS_COM_0"/>
+- <value value="43" name="A7XX_DBGBUS_LRZ_BR"/>
+- <value value="44" name="A7XX_DBGBUS_LRZ_BV"/>
+- <value value="47" name="A7XX_DBGBUS_UFC_0"/>
+- <value value="48" name="A7XX_DBGBUS_UFC_1"/>
+- <value value="55" name="A7XX_DBGBUS_GMU_GX"/>
+- <value value="59" name="A7XX_DBGBUS_DBGC"/>
+- <value value="60" name="A7XX_DBGBUS_CX"/>
+- <value value="61" name="A7XX_DBGBUS_GMU_CX"/>
+- <value value="62" name="A7XX_DBGBUS_GPC_BR"/>
+- <value value="63" name="A7XX_DBGBUS_GPC_BV"/>
+- <value value="66" name="A7XX_DBGBUS_LARC"/>
+- <value value="68" name="A7XX_DBGBUS_HLSQ_SPTP"/>
+- <value value="70" name="A7XX_DBGBUS_RB_0"/>
+- <value value="71" name="A7XX_DBGBUS_RB_1"/>
+- <value value="72" name="A7XX_DBGBUS_RB_2"/>
+- <value value="73" name="A7XX_DBGBUS_RB_3"/>
+- <value value="74" name="A7XX_DBGBUS_RB_4"/>
+- <value value="75" name="A7XX_DBGBUS_RB_5"/>
+- <value value="102" name="A7XX_DBGBUS_UCHE_WRAPPER"/>
+- <value value="106" name="A7XX_DBGBUS_CCU_0"/>
+- <value value="107" name="A7XX_DBGBUS_CCU_1"/>
+- <value value="108" name="A7XX_DBGBUS_CCU_2"/>
+- <value value="109" name="A7XX_DBGBUS_CCU_3"/>
+- <value value="110" name="A7XX_DBGBUS_CCU_4"/>
+- <value value="111" name="A7XX_DBGBUS_CCU_5"/>
+- <value value="138" name="A7XX_DBGBUS_VFD_BR_0"/>
+- <value value="139" name="A7XX_DBGBUS_VFD_BR_1"/>
+- <value value="140" name="A7XX_DBGBUS_VFD_BR_2"/>
+- <value value="141" name="A7XX_DBGBUS_VFD_BR_3"/>
+- <value value="142" name="A7XX_DBGBUS_VFD_BR_4"/>
+- <value value="143" name="A7XX_DBGBUS_VFD_BR_5"/>
+- <value value="144" name="A7XX_DBGBUS_VFD_BR_6"/>
+- <value value="145" name="A7XX_DBGBUS_VFD_BR_7"/>
+- <value value="202" name="A7XX_DBGBUS_VFD_BV_0"/>
+- <value value="203" name="A7XX_DBGBUS_VFD_BV_1"/>
+- <value value="204" name="A7XX_DBGBUS_VFD_BV_2"/>
+- <value value="205" name="A7XX_DBGBUS_VFD_BV_3"/>
+- <value value="234" name="A7XX_DBGBUS_USP_0"/>
+- <value value="235" name="A7XX_DBGBUS_USP_1"/>
+- <value value="236" name="A7XX_DBGBUS_USP_2"/>
+- <value value="237" name="A7XX_DBGBUS_USP_3"/>
+- <value value="238" name="A7XX_DBGBUS_USP_4"/>
+- <value value="239" name="A7XX_DBGBUS_USP_5"/>
+- <value value="266" name="A7XX_DBGBUS_TP_0"/>
+- <value value="267" name="A7XX_DBGBUS_TP_1"/>
+- <value value="268" name="A7XX_DBGBUS_TP_2"/>
+- <value value="269" name="A7XX_DBGBUS_TP_3"/>
+- <value value="270" name="A7XX_DBGBUS_TP_4"/>
+- <value value="271" name="A7XX_DBGBUS_TP_5"/>
+- <value value="272" name="A7XX_DBGBUS_TP_6"/>
+- <value value="273" name="A7XX_DBGBUS_TP_7"/>
+- <value value="274" name="A7XX_DBGBUS_TP_8"/>
+- <value value="275" name="A7XX_DBGBUS_TP_9"/>
+- <value value="276" name="A7XX_DBGBUS_TP_10"/>
+- <value value="277" name="A7XX_DBGBUS_TP_11"/>
+- <value value="330" name="A7XX_DBGBUS_USPTP_0"/>
+- <value value="331" name="A7XX_DBGBUS_USPTP_1"/>
+- <value value="332" name="A7XX_DBGBUS_USPTP_2"/>
+- <value value="333" name="A7XX_DBGBUS_USPTP_3"/>
+- <value value="334" name="A7XX_DBGBUS_USPTP_4"/>
+- <value value="335" name="A7XX_DBGBUS_USPTP_5"/>
+- <value value="336" name="A7XX_DBGBUS_USPTP_6"/>
+- <value value="337" name="A7XX_DBGBUS_USPTP_7"/>
+- <value value="338" name="A7XX_DBGBUS_USPTP_8"/>
+- <value value="339" name="A7XX_DBGBUS_USPTP_9"/>
+- <value value="340" name="A7XX_DBGBUS_USPTP_10"/>
+- <value value="341" name="A7XX_DBGBUS_USPTP_11"/>
+- <value value="396" name="A7XX_DBGBUS_CCHE_0"/>
+- <value value="397" name="A7XX_DBGBUS_CCHE_1"/>
+- <value value="398" name="A7XX_DBGBUS_CCHE_2"/>
+- <value value="408" name="A7XX_DBGBUS_VPC_DSTR_0"/>
+- <value value="409" name="A7XX_DBGBUS_VPC_DSTR_1"/>
+- <value value="410" name="A7XX_DBGBUS_VPC_DSTR_2"/>
+- <value value="411" name="A7XX_DBGBUS_HLSQ_DP_STR_0"/>
+- <value value="412" name="A7XX_DBGBUS_HLSQ_DP_STR_1"/>
+- <value value="413" name="A7XX_DBGBUS_HLSQ_DP_STR_2"/>
+- <value value="414" name="A7XX_DBGBUS_HLSQ_DP_STR_3"/>
+- <value value="415" name="A7XX_DBGBUS_HLSQ_DP_STR_4"/>
+- <value value="416" name="A7XX_DBGBUS_HLSQ_DP_STR_5"/>
+- <value value="443" name="A7XX_DBGBUS_UFC_DSTR_0"/>
+- <value value="444" name="A7XX_DBGBUS_UFC_DSTR_1"/>
+- <value value="445" name="A7XX_DBGBUS_UFC_DSTR_2"/>
+- <value value="446" name="A7XX_DBGBUS_CGC_SUBCORE"/>
+- <value value="447" name="A7XX_DBGBUS_CGC_CORE"/>
+-</enum>
+-
+-<enum name="a6xx_cp_perfcounter_select">
+- <value value="0" name="PERF_CP_ALWAYS_COUNT"/>
+- <value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
+- <value value="2" name="PERF_CP_BUSY_CYCLES"/>
+- <value value="3" name="PERF_CP_NUM_PREEMPTIONS"/>
+- <value value="4" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
+- <value value="5" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+- <value value="6" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+- <value value="7" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+- <value value="8" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
+- <value value="9" name="PERF_CP_MODE_SWITCH"/>
+- <value value="10" name="PERF_CP_ZPASS_DONE"/>
+- <value value="11" name="PERF_CP_CONTEXT_DONE"/>
+- <value value="12" name="PERF_CP_CACHE_FLUSH"/>
+- <value value="13" name="PERF_CP_LONG_PREEMPTIONS"/>
+- <value value="14" name="PERF_CP_SQE_I_CACHE_STARVE"/>
+- <value value="15" name="PERF_CP_SQE_IDLE"/>
+- <value value="16" name="PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+- <value value="17" name="PERF_CP_SQE_PM4_STARVE_SDS"/>
+- <value value="18" name="PERF_CP_SQE_MRB_STARVE"/>
+- <value value="19" name="PERF_CP_SQE_RRB_STARVE"/>
+- <value value="20" name="PERF_CP_SQE_VSD_STARVE"/>
+- <value value="21" name="PERF_CP_VSD_DECODE_STARVE"/>
+- <value value="22" name="PERF_CP_SQE_PIPE_OUT_STALL"/>
+- <value value="23" name="PERF_CP_SQE_SYNC_STALL"/>
+- <value value="24" name="PERF_CP_SQE_PM4_WFI_STALL"/>
+- <value value="25" name="PERF_CP_SQE_SYS_WFI_STALL"/>
+- <value value="26" name="PERF_CP_SQE_T4_EXEC"/>
+- <value value="27" name="PERF_CP_SQE_LOAD_STATE_EXEC"/>
+- <value value="28" name="PERF_CP_SQE_SAVE_SDS_STATE"/>
+- <value value="29" name="PERF_CP_SQE_DRAW_EXEC"/>
+- <value value="30" name="PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+- <value value="31" name="PERF_CP_SQE_EXEC_PROFILED"/>
+- <value value="32" name="PERF_CP_MEMORY_POOL_EMPTY"/>
+- <value value="33" name="PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+- <value value="34" name="PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+- <value value="35" name="PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+- <value value="36" name="PERF_CP_AHB_STALL_SQE_GMU"/>
+- <value value="37" name="PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+- <value value="38" name="PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+- <value value="39" name="PERF_CP_CLUSTER0_EMPTY"/>
+- <value value="40" name="PERF_CP_CLUSTER1_EMPTY"/>
+- <value value="41" name="PERF_CP_CLUSTER2_EMPTY"/>
+- <value value="42" name="PERF_CP_CLUSTER3_EMPTY"/>
+- <value value="43" name="PERF_CP_CLUSTER4_EMPTY"/>
+- <value value="44" name="PERF_CP_CLUSTER5_EMPTY"/>
+- <value value="45" name="PERF_CP_PM4_DATA"/>
+- <value value="46" name="PERF_CP_PM4_HEADERS"/>
+- <value value="47" name="PERF_CP_VBIF_READ_BEATS"/>
+- <value value="48" name="PERF_CP_VBIF_WRITE_BEATS"/>
+- <value value="49" name="PERF_CP_SQE_INSTR_COUNTER"/>
+-</enum>
+-
+-<enum name="a6xx_rbbm_perfcounter_select">
+- <value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
+- <value value="1" name="PERF_RBBM_ALWAYS_ON"/>
+- <value value="2" name="PERF_RBBM_TSE_BUSY"/>
+- <value value="3" name="PERF_RBBM_RAS_BUSY"/>
+- <value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
+- <value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
+- <value value="6" name="PERF_RBBM_STATUS_MASKED"/>
+- <value value="7" name="PERF_RBBM_COM_BUSY"/>
+- <value value="8" name="PERF_RBBM_DCOM_BUSY"/>
+- <value value="9" name="PERF_RBBM_VBIF_BUSY"/>
+- <value value="10" name="PERF_RBBM_VSC_BUSY"/>
+- <value value="11" name="PERF_RBBM_TESS_BUSY"/>
+- <value value="12" name="PERF_RBBM_UCHE_BUSY"/>
+- <value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
+-</enum>
+-
+-<enum name="a6xx_pc_perfcounter_select">
+- <value value="0" name="PERF_PC_BUSY_CYCLES"/>
+- <value value="1" name="PERF_PC_WORKING_CYCLES"/>
+- <value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
+- <value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
+- <value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
+- <value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
+- <value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
+- <value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
+- <value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+- <value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
+- <value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+- <value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+- <value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+- <value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
+- <value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
+- <value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
+- <value value="16" name="PERF_PC_INSTANCES"/>
+- <value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
+- <value value="18" name="PERF_PC_DEAD_PRIM"/>
+- <value value="19" name="PERF_PC_LIVE_PRIM"/>
+- <value value="20" name="PERF_PC_VERTEX_HITS"/>
+- <value value="21" name="PERF_PC_IA_VERTICES"/>
+- <value value="22" name="PERF_PC_IA_PRIMITIVES"/>
+- <value value="23" name="PERF_PC_GS_PRIMITIVES"/>
+- <value value="24" name="PERF_PC_HS_INVOCATIONS"/>
+- <value value="25" name="PERF_PC_DS_INVOCATIONS"/>
+- <value value="26" name="PERF_PC_VS_INVOCATIONS"/>
+- <value value="27" name="PERF_PC_GS_INVOCATIONS"/>
+- <value value="28" name="PERF_PC_DS_PRIMITIVES"/>
+- <value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
+- <value value="30" name="PERF_PC_3D_DRAWCALLS"/>
+- <value value="31" name="PERF_PC_2D_DRAWCALLS"/>
+- <value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+- <value value="33" name="PERF_TESS_BUSY_CYCLES"/>
+- <value value="34" name="PERF_TESS_WORKING_CYCLES"/>
+- <value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
+- <value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
+- <value value="37" name="PERF_PC_TSE_TRANSACTION"/>
+- <value value="38" name="PERF_PC_TSE_VERTEX"/>
+- <value value="39" name="PERF_PC_TESS_PC_UV_TRANS"/>
+- <value value="40" name="PERF_PC_TESS_PC_UV_PATCHES"/>
+- <value value="41" name="PERF_PC_TESS_FACTOR_TRANS"/>
+-</enum>
+-
+-<enum name="a6xx_vfd_perfcounter_select">
+- <value value="0" name="PERF_VFD_BUSY_CYCLES"/>
+- <value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
+- <value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+- <value value="3" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
+- <value value="4" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+- <value value="5" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
+- <value value="6" name="PERF_VFD_RBUFFER_FULL"/>
+- <value value="7" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+- <value value="8" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+- <value value="9" name="PERF_VFD_NUM_ATTRIBUTES"/>
+- <value value="10" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
+- <value value="11" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
+- <value value="12" name="PERF_VFD_MODE_0_FIBERS"/>
+- <value value="13" name="PERF_VFD_MODE_1_FIBERS"/>
+- <value value="14" name="PERF_VFD_MODE_2_FIBERS"/>
+- <value value="15" name="PERF_VFD_MODE_3_FIBERS"/>
+- <value value="16" name="PERF_VFD_MODE_4_FIBERS"/>
+- <value value="17" name="PERF_VFD_TOTAL_VERTICES"/>
+- <value value="18" name="PERF_VFDP_STALL_CYCLES_VFD"/>
+- <value value="19" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+- <value value="20" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+- <value value="21" name="PERF_VFDP_STARVE_CYCLES_PC"/>
+- <value value="22" name="PERF_VFDP_VS_STAGE_WAVES"/>
+-</enum>
+-
+-<enum name="a6xx_hlsq_perfcounter_select">
+- <value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
+- <value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
+- <value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+- <value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+- <value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+- <value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+- <value value="6" name="PERF_HLSQ_FS_STAGE_1X_WAVES"/>
+- <value value="7" name="PERF_HLSQ_FS_STAGE_2X_WAVES"/>
+- <value value="8" name="PERF_HLSQ_QUADS"/>
+- <value value="9" name="PERF_HLSQ_CS_INVOCATIONS"/>
+- <value value="10" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+- <value value="11" name="PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+- <value value="12" name="PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+- <value value="13" name="PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+- <value value="14" name="PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+- <value value="15" name="PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+- <value value="16" name="PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+- <value value="17" name="PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+- <value value="18" name="PERF_HLSQ_STALL_CYCLES_VPC"/>
+- <value value="19" name="PERF_HLSQ_PIXELS"/>
+- <value value="20" name="PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+-</enum>
+-
+-<enum name="a6xx_vpc_perfcounter_select">
+- <value value="0" name="PERF_VPC_BUSY_CYCLES"/>
+- <value value="1" name="PERF_VPC_WORKING_CYCLES"/>
+- <value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
+- <value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+- <value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+- <value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
+- <value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
+- <value value="7" name="PERF_VPC_STARVE_CYCLES_SP"/>
+- <value value="8" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
+- <value value="9" name="PERF_VPC_PC_PRIMITIVES"/>
+- <value value="10" name="PERF_VPC_SP_COMPONENTS"/>
+- <value value="11" name="PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+- <value value="12" name="PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+- <value value="13" name="PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+- <value value="14" name="PERF_VPC_LM_TRANSACTION"/>
+- <value value="15" name="PERF_VPC_STREAMOUT_TRANSACTION"/>
+- <value value="16" name="PERF_VPC_VS_BUSY_CYCLES"/>
+- <value value="17" name="PERF_VPC_PS_BUSY_CYCLES"/>
+- <value value="18" name="PERF_VPC_VS_WORKING_CYCLES"/>
+- <value value="19" name="PERF_VPC_PS_WORKING_CYCLES"/>
+- <value value="20" name="PERF_VPC_STARVE_CYCLES_RB"/>
+- <value value="21" name="PERF_VPC_NUM_VPCRAM_READ_POS"/>
+- <value value="22" name="PERF_VPC_WIT_FULL_CYCLES"/>
+- <value value="23" name="PERF_VPC_VPCRAM_FULL_CYCLES"/>
+- <value value="24" name="PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+- <value value="25" name="PERF_VPC_NUM_VPCRAM_WRITE"/>
+- <value value="26" name="PERF_VPC_NUM_VPCRAM_READ_SO"/>
+- <value value="27" name="PERF_VPC_NUM_ATTR_REQ_LM"/>
+-</enum>
+-
+-<enum name="a6xx_tse_perfcounter_select">
+- <value value="0" name="PERF_TSE_BUSY_CYCLES"/>
+- <value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
+- <value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
+- <value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+- <value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+- <value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
+- <value value="6" name="PERF_TSE_INPUT_PRIM"/>
+- <value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
+- <value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
+- <value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
+- <value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
+- <value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
+- <value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
+- <value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
+- <value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+- <value value="15" name="PERF_TSE_CINVOCATION"/>
+- <value value="16" name="PERF_TSE_CPRIMITIVES"/>
+- <value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
+- <value value="18" name="PERF_TSE_2D_ALIVE_CYCLES"/>
+- <value value="19" name="PERF_TSE_CLIP_PLANES"/>
+-</enum>
+-
+-<enum name="a6xx_ras_perfcounter_select">
+- <value value="0" name="PERF_RAS_BUSY_CYCLES"/>
+- <value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+- <value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
+- <value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
+- <value value="4" name="PERF_RAS_SUPER_TILES"/>
+- <value value="5" name="PERF_RAS_8X4_TILES"/>
+- <value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
+- <value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+- <value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+- <value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
+- <value value="10" name="PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+- <value value="11" name="PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+- <value value="12" name="PERF_RAS_BLOCKS"/>
+-</enum>
+-
+-<enum name="a6xx_uche_perfcounter_select">
+- <value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
+- <value value="1" name="PERF_UCHE_STALL_CYCLES_ARBITER"/>
+- <value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+- <value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+- <value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
+- <value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+- <value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+- <value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+- <value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
+- <value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
+- <value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
+- <value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
+- <value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
+- <value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
+- <value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+- <value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
+- <value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
+- <value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
+- <value value="18" name="PERF_UCHE_EVICTS"/>
+- <value value="19" name="PERF_UCHE_BANK_REQ0"/>
+- <value value="20" name="PERF_UCHE_BANK_REQ1"/>
+- <value value="21" name="PERF_UCHE_BANK_REQ2"/>
+- <value value="22" name="PERF_UCHE_BANK_REQ3"/>
+- <value value="23" name="PERF_UCHE_BANK_REQ4"/>
+- <value value="24" name="PERF_UCHE_BANK_REQ5"/>
+- <value value="25" name="PERF_UCHE_BANK_REQ6"/>
+- <value value="26" name="PERF_UCHE_BANK_REQ7"/>
+- <value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+- <value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+- <value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
+- <value value="30" name="PERF_UCHE_TPH_REF_FULL"/>
+- <value value="31" name="PERF_UCHE_TPH_VICTIM_FULL"/>
+- <value value="32" name="PERF_UCHE_TPH_EXT_FULL"/>
+- <value value="33" name="PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+- <value value="34" name="PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+- <value value="35" name="PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+- <value value="36" name="PERF_UCHE_VBIF_READ_BEATS_PC"/>
+- <value value="37" name="PERF_UCHE_READ_REQUESTS_PC"/>
+- <value value="38" name="PERF_UCHE_RAM_READ_REQ"/>
+- <value value="39" name="PERF_UCHE_RAM_WRITE_REQ"/>
+-</enum>
+-
+-<enum name="a6xx_tp_perfcounter_select">
+- <value value="0" name="PERF_TP_BUSY_CYCLES"/>
+- <value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
+- <value value="2" name="PERF_TP_LATENCY_CYCLES"/>
+- <value value="3" name="PERF_TP_LATENCY_TRANS"/>
+- <value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
+- <value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
+- <value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
+- <value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
+- <value value="8" name="PERF_TP_SP_TP_TRANS"/>
+- <value value="9" name="PERF_TP_TP_SP_TRANS"/>
+- <value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
+- <value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
+- <value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
+- <value value="13" name="PERF_TP_QUADS_RECEIVED"/>
+- <value value="14" name="PERF_TP_QUADS_OFFSET"/>
+- <value value="15" name="PERF_TP_QUADS_SHADOW"/>
+- <value value="16" name="PERF_TP_QUADS_ARRAY"/>
+- <value value="17" name="PERF_TP_QUADS_GRADIENT"/>
+- <value value="18" name="PERF_TP_QUADS_1D"/>
+- <value value="19" name="PERF_TP_QUADS_2D"/>
+- <value value="20" name="PERF_TP_QUADS_BUFFER"/>
+- <value value="21" name="PERF_TP_QUADS_3D"/>
+- <value value="22" name="PERF_TP_QUADS_CUBE"/>
+- <value value="23" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+- <value value="24" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+- <value value="25" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
+- <value value="26" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+- <value value="27" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
+- <value value="28" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
+- <value value="29" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+- <value value="30" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
+- <value value="31" name="PERF_TP_FLAG_CACHE_MISSES"/>
+- <value value="32" name="PERF_TP_L1_5_L2_REQUESTS"/>
+- <value value="33" name="PERF_TP_2D_OUTPUT_PIXELS"/>
+- <value value="34" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+- <value value="35" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+- <value value="36" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+- <value value="37" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+- <value value="38" name="PERF_TP_TPA2TPC_TRANS"/>
+- <value value="39" name="PERF_TP_L1_MISSES_ASTC_1TILE"/>
+- <value value="40" name="PERF_TP_L1_MISSES_ASTC_2TILE"/>
+- <value value="41" name="PERF_TP_L1_MISSES_ASTC_4TILE"/>
+- <value value="42" name="PERF_TP_L1_5_L2_COMPRESS_REQS"/>
+- <value value="43" name="PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+- <value value="44" name="PERF_TP_L1_BANK_CONFLICT"/>
+- <value value="45" name="PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+- <value value="46" name="PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+- <value value="47" name="PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+- <value value="48" name="PERF_TP_FRONTEND_WORKING_CYCLES"/>
+- <value value="49" name="PERF_TP_L1_TAG_WORKING_CYCLES"/>
+- <value value="50" name="PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+- <value value="51" name="PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+- <value value="52" name="PERF_TP_BACKEND_WORKING_CYCLES"/>
+- <value value="53" name="PERF_TP_FLAG_CACHE_WORKING_CYCLES"/>
+- <value value="54" name="PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+- <value value="55" name="PERF_TP_STARVE_CYCLES_SP"/>
+- <value value="56" name="PERF_TP_STARVE_CYCLES_UCHE"/>
+-</enum>
+-
+-<enum name="a6xx_sp_perfcounter_select">
+- <value value="0" name="PERF_SP_BUSY_CYCLES"/>
+- <value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
+- <value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
+- <value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
+- <value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
+- <value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
+- <value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
+- <value value="7" name="PERF_SP_NON_EXECUTION_CYCLES"/>
+- <value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
+- <value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
+- <value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
+- <value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
+- <value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+- <value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+- <value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+- <value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+- <value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
+- <value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
+- <value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
+- <value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
+- <value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
+- <value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
+- <value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
+- <value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
+- <value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+- <value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+- <value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
+- <value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+- <value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
+- <value value="29" name="PERF_SP_LM_ATOMICS"/>
+- <value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+- <value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
+- <value value="32" name="PERF_SP_GM_ATOMICS"/>
+- <value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+- <value value="34" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+- <value value="35" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+- <value value="36" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+- <value value="37" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+- <value value="38" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+- <value value="39" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+- <value value="40" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+- <value value="41" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+- <value value="42" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+- <value value="43" name="PERF_SP_VS_INSTRUCTIONS"/>
+- <value value="44" name="PERF_SP_FS_INSTRUCTIONS"/>
+- <value value="45" name="PERF_SP_ADDR_LOCK_COUNT"/>
+- <value value="46" name="PERF_SP_UCHE_READ_TRANS"/>
+- <value value="47" name="PERF_SP_UCHE_WRITE_TRANS"/>
+- <value value="48" name="PERF_SP_EXPORT_VPC_TRANS"/>
+- <value value="49" name="PERF_SP_EXPORT_RB_TRANS"/>
+- <value value="50" name="PERF_SP_PIXELS_KILLED"/>
+- <value value="51" name="PERF_SP_ICL1_REQUESTS"/>
+- <value value="52" name="PERF_SP_ICL1_MISSES"/>
+- <value value="53" name="PERF_SP_HS_INSTRUCTIONS"/>
+- <value value="54" name="PERF_SP_DS_INSTRUCTIONS"/>
+- <value value="55" name="PERF_SP_GS_INSTRUCTIONS"/>
+- <value value="56" name="PERF_SP_CS_INSTRUCTIONS"/>
+- <value value="57" name="PERF_SP_GPR_READ"/>
+- <value value="58" name="PERF_SP_GPR_WRITE"/>
+- <value value="59" name="PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+- <value value="60" name="PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+- <value value="61" name="PERF_SP_LM_BANK_CONFLICTS"/>
+- <value value="62" name="PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+- <value value="63" name="PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+- <value value="64" name="PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+- <value value="65" name="PERF_SP_LM_WORKING_CYCLES"/>
+- <value value="66" name="PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+- <value value="67" name="PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+- <value value="68" name="PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+- <value value="69" name="PERF_SP_STARVE_CYCLES_HLSQ"/>
+- <value value="70" name="PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+- <value value="71" name="PERF_SP_WORKING_EU"/>
+- <value value="72" name="PERF_SP_ANY_EU_WORKING"/>
+- <value value="73" name="PERF_SP_WORKING_EU_FS_STAGE"/>
+- <value value="74" name="PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+- <value value="75" name="PERF_SP_WORKING_EU_VS_STAGE"/>
+- <value value="76" name="PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+- <value value="77" name="PERF_SP_WORKING_EU_CS_STAGE"/>
+- <value value="78" name="PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+- <value value="79" name="PERF_SP_GPR_READ_PREFETCH"/>
+- <value value="80" name="PERF_SP_GPR_READ_CONFLICT"/>
+- <value value="81" name="PERF_SP_GPR_WRITE_CONFLICT"/>
+- <value value="82" name="PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+- <value value="83" name="PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+- <value value="84" name="PERF_SP_EXECUTABLE_WAVES"/>
+-</enum>
+-
+-<enum name="a6xx_rb_perfcounter_select">
+- <value value="0" name="PERF_RB_BUSY_CYCLES"/>
+- <value value="1" name="PERF_RB_STALL_CYCLES_HLSQ"/>
+- <value value="2" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+- <value value="3" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+- <value value="4" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+- <value value="5" name="PERF_RB_STARVE_CYCLES_SP"/>
+- <value value="6" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+- <value value="7" name="PERF_RB_STARVE_CYCLES_CCU"/>
+- <value value="8" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+- <value value="9" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+- <value value="10" name="PERF_RB_Z_WORKLOAD"/>
+- <value value="11" name="PERF_RB_HLSQ_ACTIVE"/>
+- <value value="12" name="PERF_RB_Z_READ"/>
+- <value value="13" name="PERF_RB_Z_WRITE"/>
+- <value value="14" name="PERF_RB_C_READ"/>
+- <value value="15" name="PERF_RB_C_WRITE"/>
+- <value value="16" name="PERF_RB_TOTAL_PASS"/>
+- <value value="17" name="PERF_RB_Z_PASS"/>
+- <value value="18" name="PERF_RB_Z_FAIL"/>
+- <value value="19" name="PERF_RB_S_FAIL"/>
+- <value value="20" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
+- <value value="21" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
+- <value value="22" name="PERF_RB_PS_INVOCATIONS"/>
+- <value value="23" name="PERF_RB_2D_ALIVE_CYCLES"/>
+- <value value="24" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
+- <value value="25" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
+- <value value="26" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
+- <value value="27" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
+- <value value="28" name="PERF_RB_2D_VALID_PIXELS"/>
+- <value value="29" name="PERF_RB_3D_PIXELS"/>
+- <value value="30" name="PERF_RB_BLENDER_WORKING_CYCLES"/>
+- <value value="31" name="PERF_RB_ZPROC_WORKING_CYCLES"/>
+- <value value="32" name="PERF_RB_CPROC_WORKING_CYCLES"/>
+- <value value="33" name="PERF_RB_SAMPLER_WORKING_CYCLES"/>
+- <value value="34" name="PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+- <value value="35" name="PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+- <value value="36" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+- <value value="37" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+- <value value="38" name="PERF_RB_STALL_CYCLES_VPC"/>
+- <value value="39" name="PERF_RB_2D_INPUT_TRANS"/>
+- <value value="40" name="PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+- <value value="41" name="PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+- <value value="42" name="PERF_RB_BLENDED_FP32_COMPONENTS"/>
+- <value value="43" name="PERF_RB_COLOR_PIX_TILES"/>
+- <value value="44" name="PERF_RB_STALL_CYCLES_CCU"/>
+- <value value="45" name="PERF_RB_EARLY_Z_ARB3_GRANT"/>
+- <value value="46" name="PERF_RB_LATE_Z_ARB3_GRANT"/>
+- <value value="47" name="PERF_RB_EARLY_Z_SKIP_GRANT"/>
+-</enum>
+-
+-<enum name="a6xx_vsc_perfcounter_select">
+- <value value="0" name="PERF_VSC_BUSY_CYCLES"/>
+- <value value="1" name="PERF_VSC_WORKING_CYCLES"/>
+- <value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
+- <value value="3" name="PERF_VSC_EOT_NUM"/>
+- <value value="4" name="PERF_VSC_INPUT_TILES"/>
+-</enum>
+-
+-<enum name="a6xx_ccu_perfcounter_select">
+- <value value="0" name="PERF_CCU_BUSY_CYCLES"/>
+- <value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+- <value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+- <value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
+- <value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
+- <value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
+- <value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
+- <value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
+- <value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
+- <value value="9" name="PERF_CCU_GMEM_READ"/>
+- <value value="10" name="PERF_CCU_GMEM_WRITE"/>
+- <value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
+- <value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
+- <value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
+- <value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
+- <value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
+- <value value="16" name="PERF_CCU_DEPTH_READ_FLAG5_COUNT"/>
+- <value value="17" name="PERF_CCU_DEPTH_READ_FLAG6_COUNT"/>
+- <value value="18" name="PERF_CCU_DEPTH_READ_FLAG8_COUNT"/>
+- <value value="19" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
+- <value value="20" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
+- <value value="21" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
+- <value value="22" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
+- <value value="23" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
+- <value value="24" name="PERF_CCU_COLOR_READ_FLAG5_COUNT"/>
+- <value value="25" name="PERF_CCU_COLOR_READ_FLAG6_COUNT"/>
+- <value value="26" name="PERF_CCU_COLOR_READ_FLAG8_COUNT"/>
+- <value value="27" name="PERF_CCU_2D_RD_REQ"/>
+- <value value="28" name="PERF_CCU_2D_WR_REQ"/>
+-</enum>
+-
+-<enum name="a6xx_lrz_perfcounter_select">
+- <value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
+- <value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
+- <value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
+- <value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
+- <value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
+- <value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+- <value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
+- <value value="7" name="PERF_LRZ_LRZ_READ"/>
+- <value value="8" name="PERF_LRZ_LRZ_WRITE"/>
+- <value value="9" name="PERF_LRZ_READ_LATENCY"/>
+- <value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
+- <value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+- <value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+- <value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+- <value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
+- <value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
+- <value value="16" name="PERF_LRZ_TILE_KILLED"/>
+- <value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
+- <value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+- <value value="19" name="PERF_LRZ_FULLY_COVERED_TILES"/>
+- <value value="20" name="PERF_LRZ_PARTIAL_COVERED_TILES"/>
+- <value value="21" name="PERF_LRZ_FEEDBACK_ACCEPT"/>
+- <value value="22" name="PERF_LRZ_FEEDBACK_DISCARD"/>
+- <value value="23" name="PERF_LRZ_FEEDBACK_STALL"/>
+- <value value="24" name="PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+- <value value="25" name="PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+- <value value="26" name="PERF_LRZ_STALL_CYCLES_VC"/>
+- <value value="27" name="PERF_LRZ_RAS_MASK_TRANS"/>
+-</enum>
+-
+-<enum name="a6xx_cmp_perfcounter_select">
+- <value value="0" name="PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+- <value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+- <value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+- <value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+- <value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+- <value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+- <value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+- <value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
+- <value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+- <value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
+- <value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
+- <value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+- <value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+- <value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+- <value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+- <value value="15" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+- <value value="16" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+- <value value="17" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+- <value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+- <value value="19" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+- <value value="20" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+- <value value="21" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+- <value value="22" name="PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+- <value value="23" name="PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+- <value value="24" name="PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+- <value value="25" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
+- <value value="26" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
+- <value value="27" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
+- <value value="28" name="PERF_CMPDECMP_2D_RD_DATA"/>
+- <value value="29" name="PERF_CMPDECMP_2D_WR_DATA"/>
+- <value value="30" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+- <value value="31" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+- <value value="32" name="PERF_CMPDECMP_2D_OUTPUT_TRANS"/>
+- <value value="33" name="PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+- <value value="34" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+- <value value="35" name="PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+- <value value="36" name="PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+- <value value="37" name="PERF_CMPDECMP_2D_BUSY_CYCLES"/>
+- <value value="38" name="PERF_CMPDECMP_2D_REORDER_STARVE_CYCLES"/>
+- <value value="39" name="PERF_CMPDECMP_2D_PIXELS"/>
+-</enum>
+-
+-<!--
+-Used in a6xx_2d_blit_cntl.. the value mostly seems to correlate to the
+-component type/size, so I think it relates to internal format used for
+-blending? The one exception is that 16b unorm and 32b float use the
+-same value... maybe 16b unorm is uncommon enough that it was just easier
+-to upconvert to 32b float internally?
+-
+- 8b unorm: 10 (sometimes 0, is the high bit part of something else?)
+-16b unorm: 4
+-
+-32b int: 7
+-16b int: 6
+- 8b int: 5
+-
+-32b float: 4
+-16b float: 3
+- -->
+-<enum name="a6xx_2d_ifmt">
+- <value value="0x10" name="R2D_UNORM8"/>
+- <value value="0x7" name="R2D_INT32"/>
+- <value value="0x6" name="R2D_INT16"/>
+- <value value="0x5" name="R2D_INT8"/>
+- <value value="0x4" name="R2D_FLOAT32"/>
+- <value value="0x3" name="R2D_FLOAT16"/>
+- <value value="0x1" name="R2D_UNORM8_SRGB"/>
+- <value value="0x0" name="R2D_RAW"/>
+-</enum>
+-
+-<enum name="a6xx_ztest_mode">
+- <doc>Allow early z-test and early-lrz (if applicable)</doc>
+- <value value="0x0" name="A6XX_EARLY_Z"/>
+- <doc>Disable early z-test and early-lrz test (if applicable)</doc>
+- <value value="0x1" name="A6XX_LATE_Z"/>
+- <doc>
+- A special mode that allows early-lrz test but disables
+- early-z test. Which might sound a bit funny, since
+- lrz-test happens before z-test. But as long as a couple
+- conditions are maintained this allows using lrz-test in
+- cases where fragment shader has kill/discard:
+-
+- 1) Disable lrz-write in cases where it is uncertain during
+- binning pass that a fragment will pass. Ie. if frag
+- shader has-kill, writes-z, or alpha/stencil test is
+- enabled. (For correctness, lrz-write must be disabled
+- when blend is enabled.) This is analogous to how a
+- z-prepass works.
+-
+- 2) Disable lrz-write and test if a depth-test direction
+- reversal is detected. Due to condition (1), the contents
+- of the lrz buffer are a conservative estimation of the
+- depth buffer during the draw pass. Meaning that geometry
+- that we know for certain will not be visible will not pass
+- lrz-test. But geometry which may be (or contributes to
+- blend) will pass the lrz-test.
+-
+- This allows us to keep early-lrz-test in cases where the frag
+- shader does not write-z (ie. we know the z-value before FS)
+- and does not have side-effects (image/ssbo writes, etc), but
+- does have kill/discard. Which turns out to be a common
+- enough case that it is useful to keep early-lrz test against
+- the conservative lrz buffer to discard fragments that we
+- know will definitely not be visible.
+- </doc>
+- <value value="0x2" name="A6XX_EARLY_LRZ_LATE_Z"/>
+- <doc>Not a real hw value, used internally by mesa</doc>
+- <value value="0x3" name="A6XX_INVALID_ZTEST"/>
+-</enum>
+-
+-<enum name="a6xx_tess_spacing">
+- <value value="0x0" name="TESS_EQUAL"/>
+- <value value="0x2" name="TESS_FRACTIONAL_ODD"/>
+- <value value="0x3" name="TESS_FRACTIONAL_EVEN"/>
+-</enum>
+-<enum name="a6xx_tess_output">
+- <value value="0x0" name="TESS_POINTS"/>
+- <value value="0x1" name="TESS_LINES"/>
+- <value value="0x2" name="TESS_CW_TRIS"/>
+- <value value="0x3" name="TESS_CCW_TRIS"/>
+-</enum>
+-
+-<enum name="a7xx_cp_perfcounter_select">
+- <value value="0" name="A7XX_PERF_CP_ALWAYS_COUNT"/>
+- <value value="1" name="A7XX_PERF_CP_BUSY_GFX_CORE_IDLE"/>
+- <value value="2" name="A7XX_PERF_CP_BUSY_CYCLES"/>
+- <value value="3" name="A7XX_PERF_CP_NUM_PREEMPTIONS"/>
+- <value value="4" name="A7XX_PERF_CP_PREEMPTION_REACTION_DELAY"/>
+- <value value="5" name="A7XX_PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
+- <value value="6" name="A7XX_PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
+- <value value="7" name="A7XX_PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
+- <value value="8" name="A7XX_PERF_CP_PREDICATED_DRAWS_KILLED"/>
+- <value value="9" name="A7XX_PERF_CP_MODE_SWITCH"/>
+- <value value="10" name="A7XX_PERF_CP_ZPASS_DONE"/>
+- <value value="11" name="A7XX_PERF_CP_CONTEXT_DONE"/>
+- <value value="12" name="A7XX_PERF_CP_CACHE_FLUSH"/>
+- <value value="13" name="A7XX_PERF_CP_LONG_PREEMPTIONS"/>
+- <value value="14" name="A7XX_PERF_CP_SQE_I_CACHE_STARVE"/>
+- <value value="15" name="A7XX_PERF_CP_SQE_IDLE"/>
+- <value value="16" name="A7XX_PERF_CP_SQE_PM4_STARVE_RB_IB"/>
+- <value value="17" name="A7XX_PERF_CP_SQE_PM4_STARVE_SDS"/>
+- <value value="18" name="A7XX_PERF_CP_SQE_MRB_STARVE"/>
+- <value value="19" name="A7XX_PERF_CP_SQE_RRB_STARVE"/>
+- <value value="20" name="A7XX_PERF_CP_SQE_VSD_STARVE"/>
+- <value value="21" name="A7XX_PERF_CP_VSD_DECODE_STARVE"/>
+- <value value="22" name="A7XX_PERF_CP_SQE_PIPE_OUT_STALL"/>
+- <value value="23" name="A7XX_PERF_CP_SQE_SYNC_STALL"/>
+- <value value="24" name="A7XX_PERF_CP_SQE_PM4_WFI_STALL"/>
+- <value value="25" name="A7XX_PERF_CP_SQE_SYS_WFI_STALL"/>
+- <value value="26" name="A7XX_PERF_CP_SQE_T4_EXEC"/>
+- <value value="27" name="A7XX_PERF_CP_SQE_LOAD_STATE_EXEC"/>
+- <value value="28" name="A7XX_PERF_CP_SQE_SAVE_SDS_STATE"/>
+- <value value="29" name="A7XX_PERF_CP_SQE_DRAW_EXEC"/>
+- <value value="30" name="A7XX_PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
+- <value value="31" name="A7XX_PERF_CP_SQE_EXEC_PROFILED"/>
+- <value value="32" name="A7XX_PERF_CP_MEMORY_POOL_EMPTY"/>
+- <value value="33" name="A7XX_PERF_CP_MEMORY_POOL_SYNC_STALL"/>
+- <value value="34" name="A7XX_PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
+- <value value="35" name="A7XX_PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
+- <value value="36" name="A7XX_PERF_CP_AHB_STALL_SQE_GMU"/>
+- <value value="37" name="A7XX_PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
+- <value value="38" name="A7XX_PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
+- <value value="39" name="A7XX_PERF_CP_CLUSTER0_EMPTY"/>
+- <value value="40" name="A7XX_PERF_CP_CLUSTER1_EMPTY"/>
+- <value value="41" name="A7XX_PERF_CP_CLUSTER2_EMPTY"/>
+- <value value="42" name="A7XX_PERF_CP_CLUSTER3_EMPTY"/>
+- <value value="43" name="A7XX_PERF_CP_CLUSTER4_EMPTY"/>
+- <value value="44" name="A7XX_PERF_CP_CLUSTER5_EMPTY"/>
+- <value value="45" name="A7XX_PERF_CP_PM4_DATA"/>
+- <value value="46" name="A7XX_PERF_CP_PM4_HEADERS"/>
+- <value value="47" name="A7XX_PERF_CP_VBIF_READ_BEATS"/>
+- <value value="48" name="A7XX_PERF_CP_VBIF_WRITE_BEATS"/>
+- <value value="49" name="A7XX_PERF_CP_SQE_INSTR_COUNTER"/>
+- <value value="50" name="A7XX_PERF_CP_RESERVED_50"/>
+- <value value="51" name="A7XX_PERF_CP_RESERVED_51"/>
+- <value value="52" name="A7XX_PERF_CP_RESERVED_52"/>
+- <value value="53" name="A7XX_PERF_CP_RESERVED_53"/>
+- <value value="54" name="A7XX_PERF_CP_RESERVED_54"/>
+- <value value="55" name="A7XX_PERF_CP_RESERVED_55"/>
+- <value value="56" name="A7XX_PERF_CP_RESERVED_56"/>
+- <value value="57" name="A7XX_PERF_CP_RESERVED_57"/>
+- <value value="58" name="A7XX_PERF_CP_RESERVED_58"/>
+- <value value="59" name="A7XX_PERF_CP_RESERVED_59"/>
+- <value value="60" name="A7XX_PERF_CP_CLUSTER0_FULL"/>
+- <value value="61" name="A7XX_PERF_CP_CLUSTER1_FULL"/>
+- <value value="62" name="A7XX_PERF_CP_CLUSTER2_FULL"/>
+- <value value="63" name="A7XX_PERF_CP_CLUSTER3_FULL"/>
+- <value value="64" name="A7XX_PERF_CP_CLUSTER4_FULL"/>
+- <value value="65" name="A7XX_PERF_CP_CLUSTER5_FULL"/>
+- <value value="66" name="A7XX_PERF_CP_CLUSTER6_FULL"/>
+- <value value="67" name="A7XX_PERF_CP_CLUSTER6_EMPTY"/>
+- <value value="68" name="A7XX_PERF_CP_ICACHE_MISSES"/>
+- <value value="69" name="A7XX_PERF_CP_ICACHE_HITS"/>
+- <value value="70" name="A7XX_PERF_CP_ICACHE_STALL"/>
+- <value value="71" name="A7XX_PERF_CP_DCACHE_MISSES"/>
+- <value value="72" name="A7XX_PERF_CP_DCACHE_HITS"/>
+- <value value="73" name="A7XX_PERF_CP_DCACHE_STALLS"/>
+- <value value="74" name="A7XX_PERF_CP_AQE_SQE_STALL"/>
+- <value value="75" name="A7XX_PERF_CP_SQE_AQE_STARVE"/>
+- <value value="76" name="A7XX_PERF_CP_PREEMPT_LATENCY"/>
+- <value value="77" name="A7XX_PERF_CP_SQE_MD8_STALL_CYCLES"/>
+- <value value="78" name="A7XX_PERF_CP_SQE_MESH_EXEC_CYCLES"/>
+- <value value="79" name="A7XX_PERF_CP_AQE_NUM_AS_CHUNKS"/>
+- <value value="80" name="A7XX_PERF_CP_AQE_NUM_MS_CHUNKS"/>
+-</enum>
+-
+-<enum name="a7xx_rbbm_perfcounter_select">
+- <value value="0" name="A7XX_PERF_RBBM_ALWAYS_COUNT"/>
+- <value value="1" name="A7XX_PERF_RBBM_ALWAYS_ON"/>
+- <value value="2" name="A7XX_PERF_RBBM_TSE_BUSY"/>
+- <value value="3" name="A7XX_PERF_RBBM_RAS_BUSY"/>
+- <value value="4" name="A7XX_PERF_RBBM_PC_DCALL_BUSY"/>
+- <value value="5" name="A7XX_PERF_RBBM_PC_VSD_BUSY"/>
+- <value value="6" name="A7XX_PERF_RBBM_STATUS_MASKED"/>
+- <value value="7" name="A7XX_PERF_RBBM_COM_BUSY"/>
+- <value value="8" name="A7XX_PERF_RBBM_DCOM_BUSY"/>
+- <value value="9" name="A7XX_PERF_RBBM_VBIF_BUSY"/>
+- <value value="10" name="A7XX_PERF_RBBM_VSC_BUSY"/>
+- <value value="11" name="A7XX_PERF_RBBM_TESS_BUSY"/>
+- <value value="12" name="A7XX_PERF_RBBM_UCHE_BUSY"/>
+- <value value="13" name="A7XX_PERF_RBBM_HLSQ_BUSY"/>
+-</enum>
+-
+-<enum name="a7xx_pc_perfcounter_select">
+- <value value="0" name="A7XX_PERF_PC_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_PC_WORKING_CYCLES"/>
+- <value value="2" name="A7XX_PERF_PC_STALL_CYCLES_VFD"/>
+- <value value="3" name="A7XX_PERF_PC_RESERVED"/>
+- <value value="4" name="A7XX_PERF_PC_STALL_CYCLES_VPC"/>
+- <value value="5" name="A7XX_PERF_PC_STALL_CYCLES_UCHE"/>
+- <value value="6" name="A7XX_PERF_PC_STALL_CYCLES_TESS"/>
+- <value value="7" name="A7XX_PERF_PC_STALL_CYCLES_VFD_ONLY"/>
+- <value value="8" name="A7XX_PERF_PC_STALL_CYCLES_VPC_ONLY"/>
+- <value value="9" name="A7XX_PERF_PC_PASS1_TF_STALL_CYCLES"/>
+- <value value="10" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
+- <value value="11" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
+- <value value="12" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
+- <value value="13" name="A7XX_PERF_PC_STARVE_CYCLES_DI"/>
+- <value value="14" name="A7XX_PERF_PC_VIS_STREAMS_LOADED"/>
+- <value value="15" name="A7XX_PERF_PC_INSTANCES"/>
+- <value value="16" name="A7XX_PERF_PC_VPC_PRIMITIVES"/>
+- <value value="17" name="A7XX_PERF_PC_DEAD_PRIM"/>
+- <value value="18" name="A7XX_PERF_PC_LIVE_PRIM"/>
+- <value value="19" name="A7XX_PERF_PC_VERTEX_HITS"/>
+- <value value="20" name="A7XX_PERF_PC_IA_VERTICES"/>
+- <value value="21" name="A7XX_PERF_PC_IA_PRIMITIVES"/>
+- <value value="22" name="A7XX_PERF_PC_RESERVED_22"/>
+- <value value="23" name="A7XX_PERF_PC_HS_INVOCATIONS"/>
+- <value value="24" name="A7XX_PERF_PC_DS_INVOCATIONS"/>
+- <value value="25" name="A7XX_PERF_PC_VS_INVOCATIONS"/>
+- <value value="26" name="A7XX_PERF_PC_GS_INVOCATIONS"/>
+- <value value="27" name="A7XX_PERF_PC_DS_PRIMITIVES"/>
+- <value value="28" name="A7XX_PERF_PC_3D_DRAWCALLS"/>
+- <value value="29" name="A7XX_PERF_PC_2D_DRAWCALLS"/>
+- <value value="30" name="A7XX_PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
+- <value value="31" name="A7XX_PERF_PC_TESS_BUSY_CYCLES"/>
+- <value value="32" name="A7XX_PERF_PC_TESS_WORKING_CYCLES"/>
+- <value value="33" name="A7XX_PERF_PC_TESS_STALL_CYCLES_PC"/>
+- <value value="34" name="A7XX_PERF_PC_TESS_STARVE_CYCLES_PC"/>
+- <value value="35" name="A7XX_PERF_PC_TESS_SINGLE_PRIM_CYCLES"/>
+- <value value="36" name="A7XX_PERF_PC_TESS_PC_UV_TRANS"/>
+- <value value="37" name="A7XX_PERF_PC_TESS_PC_UV_PATCHES"/>
+- <value value="38" name="A7XX_PERF_PC_TESS_FACTOR_TRANS"/>
+- <value value="39" name="A7XX_PERF_PC_TAG_CHECKED_VERTICES"/>
+- <value value="40" name="A7XX_PERF_PC_MESH_VS_WAVES"/>
+- <value value="41" name="A7XX_PERF_PC_MESH_DRAWS"/>
+- <value value="42" name="A7XX_PERF_PC_MESH_DEAD_DRAWS"/>
+- <value value="43" name="A7XX_PERF_PC_MESH_MVIS_EN_DRAWS"/>
+- <value value="44" name="A7XX_PERF_PC_MESH_DEAD_PRIM"/>
+- <value value="45" name="A7XX_PERF_PC_MESH_LIVE_PRIM"/>
+- <value value="46" name="A7XX_PERF_PC_MESH_PA_EN_PRIM"/>
+- <value value="47" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_MVIS_STREAM"/>
+- <value value="48" name="A7XX_PERF_PC_STARVE_CYCLES_PREDRAW"/>
+- <value value="49" name="A7XX_PERF_PC_STALL_CYCLES_COMPUTE_GFX"/>
+- <value value="50" name="A7XX_PERF_PC_STALL_CYCLES_GFX_COMPUTE"/>
+- <value value="51" name="A7XX_PERF_PC_TESS_PC_MULTI_PATCH_TRANS"/>
+-</enum>
+-
+-<enum name="a7xx_vfd_perfcounter_select">
+- <value value="0" name="A7XX_PERF_VFD_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_VFD_STALL_CYCLES_UCHE"/>
+- <value value="2" name="A7XX_PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
+- <value value="3" name="A7XX_PERF_VFD_STALL_CYCLES_SP_INFO"/>
+- <value value="4" name="A7XX_PERF_VFD_STALL_CYCLES_SP_ATTR"/>
+- <value value="5" name="A7XX_PERF_VFD_STARVE_CYCLES_UCHE"/>
+- <value value="6" name="A7XX_PERF_VFD_RBUFFER_FULL"/>
+- <value value="7" name="A7XX_PERF_VFD_ATTR_INFO_FIFO_FULL"/>
+- <value value="8" name="A7XX_PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
+- <value value="9" name="A7XX_PERF_VFD_NUM_ATTRIBUTES"/>
+- <value value="10" name="A7XX_PERF_VFD_UPPER_SHADER_FIBERS"/>
+- <value value="11" name="A7XX_PERF_VFD_LOWER_SHADER_FIBERS"/>
+- <value value="12" name="A7XX_PERF_VFD_MODE_0_FIBERS"/>
+- <value value="13" name="A7XX_PERF_VFD_MODE_1_FIBERS"/>
+- <value value="14" name="A7XX_PERF_VFD_MODE_2_FIBERS"/>
+- <value value="15" name="A7XX_PERF_VFD_MODE_3_FIBERS"/>
+- <value value="16" name="A7XX_PERF_VFD_MODE_4_FIBERS"/>
+- <value value="17" name="A7XX_PERF_VFD_TOTAL_VERTICES"/>
+- <value value="18" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD"/>
+- <value value="19" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
+- <value value="20" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
+- <value value="21" name="A7XX_PERF_VFDP_STARVE_CYCLES_PC"/>
+- <value value="22" name="A7XX_PERF_VFDP_VS_STAGE_WAVES"/>
+- <value value="23" name="A7XX_PERF_VFD_STALL_CYCLES_PRG_END_FE"/>
+- <value value="24" name="A7XX_PERF_VFD_STALL_CYCLES_CBSYNC"/>
+-</enum>
+-
+-<enum name="a7xx_hlsq_perfcounter_select">
+- <value value="0" name="A7XX_PERF_HLSQ_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_HLSQ_STALL_CYCLES_UCHE"/>
+- <value value="2" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
+- <value value="3" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
+- <value value="4" name="A7XX_PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
+- <value value="5" name="A7XX_PERF_HLSQ_UCHE_LATENCY_COUNT"/>
+- <value value="6" name="A7XX_PERF_HLSQ_RESERVED_6"/>
+- <value value="7" name="A7XX_PERF_HLSQ_RESERVED_7"/>
+- <value value="8" name="A7XX_PERF_HLSQ_RESERVED_8"/>
+- <value value="9" name="A7XX_PERF_HLSQ_RESERVED_9"/>
+- <value value="10" name="A7XX_PERF_HLSQ_COMPUTE_DRAWCALLS"/>
+- <value value="11" name="A7XX_PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
+- <value value="12" name="A7XX_PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
+- <value value="13" name="A7XX_PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
+- <value value="14" name="A7XX_PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
+- <value value="15" name="A7XX_PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
+- <value value="16" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
+- <value value="17" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
+- <value value="18" name="A7XX_PERF_HLSQ_STALL_CYCLES_VPC"/>
+- <value value="19" name="A7XX_PERF_HLSQ_RESERVED_19"/>
+- <value value="20" name="A7XX_PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
+- <value value="21" name="A7XX_PERF_HLSQ_VSBR_STALL_CYCLES"/>
+- <value value="22" name="A7XX_PERF_HLSQ_FS_STALL_CYCLES"/>
+- <value value="23" name="A7XX_PERF_HLSQ_LPAC_STALL_CYCLES"/>
+- <value value="24" name="A7XX_PERF_HLSQ_BV_STALL_CYCLES"/>
+- <value value="25" name="A7XX_PERF_HLSQ_VSBR_DEREF_CYCLES"/>
+- <value value="26" name="A7XX_PERF_HLSQ_FS_DEREF_CYCLES"/>
+- <value value="27" name="A7XX_PERF_HLSQ_LPAC_DEREF_CYCLES"/>
+- <value value="28" name="A7XX_PERF_HLSQ_BV_DEREF_CYCLES"/>
+- <value value="29" name="A7XX_PERF_HLSQ_VSBR_S2W_CYCLES"/>
+- <value value="30" name="A7XX_PERF_HLSQ_FS_S2W_CYCLES"/>
+- <value value="31" name="A7XX_PERF_HLSQ_LPAC_S2W_CYCLES"/>
+- <value value="32" name="A7XX_PERF_HLSQ_BV_S2W_CYCLES"/>
+- <value value="33" name="A7XX_PERF_HLSQ_VSBR_WAIT_FS_S2W"/>
+- <value value="34" name="A7XX_PERF_HLSQ_FS_WAIT_VS_S2W"/>
+- <value value="35" name="A7XX_PERF_HLSQ_LPAC_WAIT_VS_S2W"/>
+- <value value="36" name="A7XX_PERF_HLSQ_BV_WAIT_FS_S2W"/>
+- <value value="37" name="A7XX_PERF_HLSQ_VS_WAIT_CONST_RESOURCE"/>
+- <value value="38" name="A7XX_PERF_HLSQ_FS_WAIT_SAME_VS_S2W"/>
+- <value value="39" name="A7XX_PERF_HLSQ_FS_STARVING_SP"/>
+- <value value="40" name="A7XX_PERF_HLSQ_VS_DATA_WAIT_PROGRAMMING"/>
+- <value value="41" name="A7XX_PERF_HLSQ_BV_DATA_WAIT_PROGRAMMING"/>
+- <value value="42" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_VS"/>
+- <value value="43" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_VS"/>
+- <value value="44" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_FS"/>
+- <value value="45" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_FS"/>
+- <value value="46" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_BV"/>
+- <value value="47" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_BV"/>
+- <value value="48" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_LPAC"/>
+- <value value="49" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_LPAC"/>
+- <value value="50" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_VS"/>
+- <value value="51" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_FS"/>
+- <value value="52" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_BV"/>
+- <value value="53" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_LPAC"/>
+- <value value="54" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_VS"/>
+- <value value="55" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_FS"/>
+- <value value="56" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_BV"/>
+- <value value="57" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_LPAC"/>
+-</enum>
+-
+-<enum name="a7xx_vpc_perfcounter_select">
+- <value value="0" name="A7XX_PERF_VPC_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_VPC_WORKING_CYCLES"/>
+- <value value="2" name="A7XX_PERF_VPC_STALL_CYCLES_UCHE"/>
+- <value value="3" name="A7XX_PERF_VPC_STALL_CYCLES_VFD_WACK"/>
+- <value value="4" name="A7XX_PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
+- <value value="5" name="A7XX_PERF_VPC_RESERVED_5"/>
+- <value value="6" name="A7XX_PERF_VPC_STALL_CYCLES_SP_LM"/>
+- <value value="7" name="A7XX_PERF_VPC_STARVE_CYCLES_SP"/>
+- <value value="8" name="A7XX_PERF_VPC_STARVE_CYCLES_LRZ"/>
+- <value value="9" name="A7XX_PERF_VPC_PC_PRIMITIVES"/>
+- <value value="10" name="A7XX_PERF_VPC_SP_COMPONENTS"/>
+- <value value="11" name="A7XX_PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
+- <value value="12" name="A7XX_PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
+- <value value="13" name="A7XX_PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
+- <value value="14" name="A7XX_PERF_VPC_LM_TRANSACTION"/>
+- <value value="15" name="A7XX_PERF_VPC_STREAMOUT_TRANSACTION"/>
+- <value value="16" name="A7XX_PERF_VPC_VS_BUSY_CYCLES"/>
+- <value value="17" name="A7XX_PERF_VPC_PS_BUSY_CYCLES"/>
+- <value value="18" name="A7XX_PERF_VPC_VS_WORKING_CYCLES"/>
+- <value value="19" name="A7XX_PERF_VPC_PS_WORKING_CYCLES"/>
+- <value value="20" name="A7XX_PERF_VPC_STARVE_CYCLES_RB"/>
+- <value value="21" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_POS"/>
+- <value value="22" name="A7XX_PERF_VPC_WIT_FULL_CYCLES"/>
+- <value value="23" name="A7XX_PERF_VPC_VPCRAM_FULL_CYCLES"/>
+- <value value="24" name="A7XX_PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
+- <value value="25" name="A7XX_PERF_VPC_NUM_VPCRAM_WRITE"/>
+- <value value="26" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_SO"/>
+- <value value="27" name="A7XX_PERF_VPC_NUM_ATTR_REQ_LM"/>
+- <value value="28" name="A7XX_PERF_VPC_STALL_CYCLE_TSE"/>
+- <value value="29" name="A7XX_PERF_VPC_TSE_PRIMITIVES"/>
+- <value value="30" name="A7XX_PERF_VPC_GS_PRIMITIVES"/>
+- <value value="31" name="A7XX_PERF_VPC_TSE_TRANSACTIONS"/>
+- <value value="32" name="A7XX_PERF_VPC_STALL_CYCLES_CCU"/>
+- <value value="33" name="A7XX_PERF_VPC_NUM_WM_HIT"/>
+- <value value="34" name="A7XX_PERF_VPC_STALL_DQ_WACK"/>
+- <value value="35" name="A7XX_PERF_VPC_STALL_CYCLES_CCHE"/>
+- <value value="36" name="A7XX_PERF_VPC_STARVE_CYCLES_CCHE"/>
+- <value value="37" name="A7XX_PERF_VPC_NUM_PA_REQ"/>
+- <value value="38" name="A7XX_PERF_VPC_NUM_LM_REQ_HIT"/>
+- <value value="39" name="A7XX_PERF_VPC_CCHE_REQBUF_FULL"/>
+- <value value="40" name="A7XX_PERF_VPC_STALL_CYCLES_LM_ACK"/>
+- <value value="41" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_FE"/>
+- <value value="42" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_PCVS"/>
+- <value value="43" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_VPCPS"/>
+-</enum>
+-
+-<enum name="a7xx_tse_perfcounter_select">
+- <value value="0" name="A7XX_PERF_TSE_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_TSE_CLIPPING_CYCLES"/>
+- <value value="2" name="A7XX_PERF_TSE_STALL_CYCLES_RAS"/>
+- <value value="3" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
+- <value value="4" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
+- <value value="5" name="A7XX_PERF_TSE_STARVE_CYCLES_PC"/>
+- <value value="6" name="A7XX_PERF_TSE_INPUT_PRIM"/>
+- <value value="7" name="A7XX_PERF_TSE_INPUT_NULL_PRIM"/>
+- <value value="8" name="A7XX_PERF_TSE_TRIVAL_REJ_PRIM"/>
+- <value value="9" name="A7XX_PERF_TSE_CLIPPED_PRIM"/>
+- <value value="10" name="A7XX_PERF_TSE_ZERO_AREA_PRIM"/>
+- <value value="11" name="A7XX_PERF_TSE_FACENESS_CULLED_PRIM"/>
+- <value value="12" name="A7XX_PERF_TSE_ZERO_PIXEL_PRIM"/>
+- <value value="13" name="A7XX_PERF_TSE_OUTPUT_NULL_PRIM"/>
+- <value value="14" name="A7XX_PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
+- <value value="15" name="A7XX_PERF_TSE_CINVOCATION"/>
+- <value value="16" name="A7XX_PERF_TSE_CPRIMITIVES"/>
+- <value value="17" name="A7XX_PERF_TSE_2D_INPUT_PRIM"/>
+- <value value="18" name="A7XX_PERF_TSE_2D_ALIVE_CYCLES"/>
+- <value value="19" name="A7XX_PERF_TSE_CLIP_PLANES"/>
+-</enum>
+-
+-<enum name="a7xx_ras_perfcounter_select">
+- <value value="0" name="A7XX_PERF_RAS_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
+- <value value="2" name="A7XX_PERF_RAS_STALL_CYCLES_LRZ"/>
+- <value value="3" name="A7XX_PERF_RAS_STARVE_CYCLES_TSE"/>
+- <value value="4" name="A7XX_PERF_RAS_SUPER_TILES"/>
+- <value value="5" name="A7XX_PERF_RAS_8X4_TILES"/>
+- <value value="6" name="A7XX_PERF_RAS_MASKGEN_ACTIVE"/>
+- <value value="7" name="A7XX_PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
+- <value value="8" name="A7XX_PERF_RAS_FULLY_COVERED_8X4_TILES"/>
+- <value value="9" name="A7XX_PERF_RAS_PRIM_KILLED_INVISILBE"/>
+- <value value="10" name="A7XX_PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
+- <value value="11" name="A7XX_PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
+- <value value="12" name="A7XX_PERF_RAS_BLOCKS"/>
+- <value value="13" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_0_WORKING_CC_l2"/>
+- <value value="14" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_1_WORKING_CC_l2"/>
+- <value value="15" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_2_WORKING_CC_l2"/>
+- <value value="16" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_3_WORKING_CC_l2"/>
+- <value value="17" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_4_WORKING_CC_l2"/>
+- <value value="18" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_5_WORKING_CC_l2"/>
+- <value value="19" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_6_WORKING_CC_l2"/>
+- <value value="20" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_7_WORKING_CC_l2"/>
+- <value value="21" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_8_WORKING_CC_l2"/>
+- <value value="22" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_9_WORKING_CC_l2"/>
+- <value value="23" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_10_WORKING_CC_l2"/>
+- <value value="24" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_11_WORKING_CC_l2"/>
+- <value value="25" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_12_WORKING_CC_l2"/>
+- <value value="26" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_13_WORKING_CC_l2"/>
+- <value value="27" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_14_WORKING_CC_l2"/>
+- <value value="28" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_15_WORKING_CC_l2"/>
+- <value value="29" name="A7XX_PERF_RAS_FALSE_PARTIAL_STILE"/>
+-
+-</enum>
+-
+-<enum name="a7xx_uche_perfcounter_select">
+- <value value="0" name="A7XX_PERF_UCHE_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_UCHE_STALL_CYCLES_ARBITER"/>
+- <value value="2" name="A7XX_PERF_UCHE_VBIF_LATENCY_CYCLES"/>
+- <value value="3" name="A7XX_PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
+- <value value="4" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_TP"/>
+- <value value="5" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_VFD"/>
+- <value value="6" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
+- <value value="7" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
+- <value value="8" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_SP"/>
+- <value value="9" name="A7XX_PERF_UCHE_READ_REQUESTS_TP"/>
+- <value value="10" name="A7XX_PERF_UCHE_READ_REQUESTS_VFD"/>
+- <value value="11" name="A7XX_PERF_UCHE_READ_REQUESTS_HLSQ"/>
+- <value value="12" name="A7XX_PERF_UCHE_READ_REQUESTS_LRZ"/>
+- <value value="13" name="A7XX_PERF_UCHE_READ_REQUESTS_SP"/>
+- <value value="14" name="A7XX_PERF_UCHE_WRITE_REQUESTS_LRZ"/>
+- <value value="15" name="A7XX_PERF_UCHE_WRITE_REQUESTS_SP"/>
+- <value value="16" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VPC"/>
+- <value value="17" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VSC"/>
+- <value value="18" name="A7XX_PERF_UCHE_EVICTS"/>
+- <value value="19" name="A7XX_PERF_UCHE_BANK_REQ0"/>
+- <value value="20" name="A7XX_PERF_UCHE_BANK_REQ1"/>
+- <value value="21" name="A7XX_PERF_UCHE_BANK_REQ2"/>
+- <value value="22" name="A7XX_PERF_UCHE_BANK_REQ3"/>
+- <value value="23" name="A7XX_PERF_UCHE_BANK_REQ4"/>
+- <value value="24" name="A7XX_PERF_UCHE_BANK_REQ5"/>
+- <value value="25" name="A7XX_PERF_UCHE_BANK_REQ6"/>
+- <value value="26" name="A7XX_PERF_UCHE_BANK_REQ7"/>
+- <value value="27" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH0"/>
+- <value value="28" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH1"/>
+- <value value="29" name="A7XX_PERF_UCHE_GMEM_READ_BEATS"/>
+- <value value="30" name="A7XX_PERF_UCHE_TPH_REF_FULL"/>
+- <value value="31" name="A7XX_PERF_UCHE_TPH_VICTIM_FULL"/>
+- <value value="32" name="A7XX_PERF_UCHE_TPH_EXT_FULL"/>
+- <value value="33" name="A7XX_PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
+- <value value="34" name="A7XX_PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
+- <value value="35" name="A7XX_PERF_UCHE_DCMP_LATENCY_CYCLES"/>
+- <value value="36" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_PC"/>
+- <value value="37" name="A7XX_PERF_UCHE_READ_REQUESTS_PC"/>
+- <value value="38" name="A7XX_PERF_UCHE_RAM_READ_REQ"/>
+- <value value="39" name="A7XX_PERF_UCHE_RAM_WRITE_REQ"/>
+- <value value="40" name="A7XX_PERF_UCHE_STARVED_CYCLES_VBIF_DECMP"/>
+- <value value="41" name="A7XX_PERF_UCHE_STALL_CYCLES_DECMP"/>
+- <value value="42" name="A7XX_PERF_UCHE_ARBITER_STALL_CYCLES_VBIF"/>
+- <value value="43" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_UBWC"/>
+- <value value="44" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_NONUBWC"/>
+- <value value="45" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_GMEM"/>
+- <value value="46" name="A7XX_PERF_UCHE_LONG_LINE_ALL_EVICTS_KAILUA"/>
+- <value value="47" name="A7XX_PERF_UCHE_LONG_LINE_PARTIAL_EVICTS_KAILUA"/>
+- <value value="48" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_CCHE"/>
+- <value value="49" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_OTHER_KAILUA"/>
+- <value value="50" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_CCHE"/>
+- <value value="51" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_OTHER_CLIENTS"/>
+- <value value="52" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH0"/>
+- <value value="53" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH1"/>
+- <value value="54" name="A7XX_PERF_UCHE_CCHE_TPH_QUEUE_FULL"/>
+- <value value="55" name="A7XX_PERF_UCHE_CCHE_DPH_QUEUE_FULL"/>
+- <value value="56" name="A7XX_PERF_UCHE_GMEM_WRITE_BEATS"/>
+- <value value="57" name="A7XX_PERF_UCHE_UBWC_READ_BEATS"/>
+- <value value="58" name="A7XX_PERF_UCHE_UBWC_WRITE_BEATS"/>
+-</enum>
+-
+-<enum name="a7xx_tp_perfcounter_select">
+- <value value="0" name="A7XX_PERF_TP_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_TP_STALL_CYCLES_UCHE"/>
+- <value value="2" name="A7XX_PERF_TP_LATENCY_CYCLES"/>
+- <value value="3" name="A7XX_PERF_TP_LATENCY_TRANS"/>
+- <value value="4" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_SAMPLES"/>
+- <value value="5" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_CYCLES"/>
+- <value value="6" name="A7XX_PERF_TP_L1_CACHELINE_REQUESTS"/>
+- <value value="7" name="A7XX_PERF_TP_L1_CACHELINE_MISSES"/>
+- <value value="8" name="A7XX_PERF_TP_SP_TP_TRANS"/>
+- <value value="9" name="A7XX_PERF_TP_TP_SP_TRANS"/>
+- <value value="10" name="A7XX_PERF_TP_OUTPUT_PIXELS"/>
+- <value value="11" name="A7XX_PERF_TP_FILTER_WORKLOAD_16BIT"/>
+- <value value="12" name="A7XX_PERF_TP_FILTER_WORKLOAD_32BIT"/>
+- <value value="13" name="A7XX_PERF_TP_QUADS_RECEIVED"/>
+- <value value="14" name="A7XX_PERF_TP_QUADS_OFFSET"/>
+- <value value="15" name="A7XX_PERF_TP_QUADS_SHADOW"/>
+- <value value="16" name="A7XX_PERF_TP_QUADS_ARRAY"/>
+- <value value="17" name="A7XX_PERF_TP_QUADS_GRADIENT"/>
+- <value value="18" name="A7XX_PERF_TP_QUADS_1D"/>
+- <value value="19" name="A7XX_PERF_TP_QUADS_2D"/>
+- <value value="20" name="A7XX_PERF_TP_QUADS_BUFFER"/>
+- <value value="21" name="A7XX_PERF_TP_QUADS_3D"/>
+- <value value="22" name="A7XX_PERF_TP_QUADS_CUBE"/>
+- <value value="23" name="A7XX_PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
+- <value value="24" name="A7XX_PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
+- <value value="25" name="A7XX_PERF_TP_OUTPUT_PIXELS_POINT"/>
+- <value value="26" name="A7XX_PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
+- <value value="27" name="A7XX_PERF_TP_OUTPUT_PIXELS_MIP"/>
+- <value value="28" name="A7XX_PERF_TP_OUTPUT_PIXELS_ANISO"/>
+- <value value="29" name="A7XX_PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
+- <value value="30" name="A7XX_PERF_TP_FLAG_CACHE_REQUESTS"/>
+- <value value="31" name="A7XX_PERF_TP_FLAG_CACHE_MISSES"/>
+- <value value="32" name="A7XX_PERF_TP_L1_5_L2_REQUESTS"/>
+- <value value="33" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS"/>
+- <value value="34" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
+- <value value="35" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
+- <value value="36" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
+- <value value="37" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
+- <value value="38" name="A7XX_PERF_TP_TPA2TPC_TRANS"/>
+- <value value="39" name="A7XX_PERF_TP_L1_MISSES_ASTC_1TILE"/>
+- <value value="40" name="A7XX_PERF_TP_L1_MISSES_ASTC_2TILE"/>
+- <value value="41" name="A7XX_PERF_TP_L1_MISSES_ASTC_4TILE"/>
+- <value value="42" name="A7XX_PERF_TP_L1_5_COMPRESS_REQS"/>
+- <value value="43" name="A7XX_PERF_TP_L1_5_L2_COMPRESS_MISS"/>
+- <value value="44" name="A7XX_PERF_TP_L1_BANK_CONFLICT"/>
+- <value value="45" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
+- <value value="46" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
+- <value value="47" name="A7XX_PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
+- <value value="48" name="A7XX_PERF_TP_FRONTEND_WORKING_CYCLES"/>
+- <value value="49" name="A7XX_PERF_TP_L1_TAG_WORKING_CYCLES"/>
+- <value value="50" name="A7XX_PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
+- <value value="51" name="A7XX_PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
+- <value value="52" name="A7XX_PERF_TP_BACKEND_WORKING_CYCLES"/>
+- <value value="53" name="A7XX_PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
+- <value value="54" name="A7XX_PERF_TP_STARVE_CYCLES_SP"/>
+- <value value="55" name="A7XX_PERF_TP_STARVE_CYCLES_UCHE"/>
+- <value value="56" name="A7XX_PERF_TP_STALL_CYCLES_UFC"/>
+- <value value="57" name="A7XX_PERF_TP_FORMAT_DECOMP"/>
+- <value value="58" name="A7XX_PERF_TP_FILTER_POINT_FP16"/>
+- <value value="59" name="A7XX_PERF_TP_FILTER_POINT_FP32"/>
+- <value value="60" name="A7XX_PERF_TP_LATENCY_FIFO_FULL"/>
+- <value value="61" name="A7XX_PERF_TP_RESERVED_61"/>
+- <value value="62" name="A7XX_PERF_TP_RESERVED_62"/>
+- <value value="63" name="A7XX_PERF_TP_RESERVED_63"/>
+- <value value="64" name="A7XX_PERF_TP_RESERVED_64"/>
+- <value value="65" name="A7XX_PERF_TP_RESERVED_65"/>
+- <value value="66" name="A7XX_PERF_TP_RESERVED_66"/>
+- <value value="67" name="A7XX_PERF_TP_RESERVED_67"/>
+- <value value="68" name="A7XX_PERF_TP_RESERVED_68"/>
+- <value value="69" name="A7XX_PERF_TP_RESERVED_69"/>
+- <value value="70" name="A7XX_PERF_TP_RESERVED_70"/>
+- <value value="71" name="A7XX_PERF_TP_RESERVED_71"/>
+- <value value="72" name="A7XX_PERF_TP_RESERVED_72"/>
+- <value value="73" name="A7XX_PERF_TP_RESERVED_73"/>
+- <value value="74" name="A7XX_PERF_TP_RESERVED_74"/>
+- <value value="75" name="A7XX_PERF_TP_RESERVED_75"/>
+- <value value="76" name="A7XX_PERF_TP_RESERVED_76"/>
+- <value value="77" name="A7XX_PERF_TP_RESERVED_77"/>
+- <value value="78" name="A7XX_PERF_TP_RESERVED_78"/>
+- <value value="79" name="A7XX_PERF_TP_RESERVED_79"/>
+- <value value="80" name="A7XX_PERF_TP_RESERVED_80"/>
+- <value value="81" name="A7XX_PERF_TP_RESERVED_81"/>
+- <value value="82" name="A7XX_PERF_TP_RESERVED_82"/>
+- <value value="83" name="A7XX_PERF_TP_RESERVED_83"/>
+- <value value="84" name="A7XX_PERF_TP_RESERVED_84"/>
+- <value value="85" name="A7XX_PERF_TP_RESERVED_85"/>
+- <value value="86" name="A7XX_PERF_TP_RESERVED_86"/>
+- <value value="87" name="A7XX_PERF_TP_RESERVED_87"/>
+- <value value="88" name="A7XX_PERF_TP_RESERVED_88"/>
+- <value value="89" name="A7XX_PERF_TP_RESERVED_89"/>
+- <value value="90" name="A7XX_PERF_TP_RESERVED_90"/>
+- <value value="91" name="A7XX_PERF_TP_RESERVED_91"/>
+- <value value="92" name="A7XX_PERF_TP_RESERVED_92"/>
+- <value value="93" name="A7XX_PERF_TP_RESERVED_93"/>
+- <value value="94" name="A7XX_PERF_TP_RESERVED_94"/>
+- <value value="95" name="A7XX_PERF_TP_RESERVED_95"/>
+- <value value="96" name="A7XX_PERF_TP_RESERVED_96"/>
+- <value value="97" name="A7XX_PERF_TP_RESERVED_97"/>
+- <value value="98" name="A7XX_PERF_TP_RESERVED_98"/>
+- <value value="99" name="A7XX_PERF_TP_RESERVED_99"/>
+- <value value="100" name="A7XX_PERF_TP_RESERVED_100"/>
+- <value value="101" name="A7XX_PERF_TP_RESERVED_101"/>
+- <value value="102" name="A7XX_PERF_TP_RESERVED_102"/>
+- <value value="103" name="A7XX_PERF_TP_RESERVED_103"/>
+- <value value="104" name="A7XX_PERF_TP_RESERVED_104"/>
+- <value value="105" name="A7XX_PERF_TP_RESERVED_105"/>
+- <value value="106" name="A7XX_PERF_TP_RESERVED_106"/>
+- <value value="107" name="A7XX_PERF_TP_RESERVED_107"/>
+- <value value="108" name="A7XX_PERF_TP_RESERVED_108"/>
+- <value value="109" name="A7XX_PERF_TP_RESERVED_109"/>
+- <value value="110" name="A7XX_PERF_TP_RESERVED_110"/>
+- <value value="111" name="A7XX_PERF_TP_RESERVED_111"/>
+- <value value="112" name="A7XX_PERF_TP_RESERVED_112"/>
+- <value value="113" name="A7XX_PERF_TP_RESERVED_113"/>
+- <value value="114" name="A7XX_PERF_TP_RESERVED_114"/>
+- <value value="115" name="A7XX_PERF_TP_RESERVED_115"/>
+- <value value="116" name="A7XX_PERF_TP_RESERVED_116"/>
+- <value value="117" name="A7XX_PERF_TP_RESERVED_117"/>
+- <value value="118" name="A7XX_PERF_TP_RESERVED_118"/>
+- <value value="119" name="A7XX_PERF_TP_RESERVED_119"/>
+- <value value="120" name="A7XX_PERF_TP_RESERVED_120"/>
+- <value value="121" name="A7XX_PERF_TP_RESERVED_121"/>
+- <value value="122" name="A7XX_PERF_TP_RESERVED_122"/>
+- <value value="123" name="A7XX_PERF_TP_RESERVED_123"/>
+- <value value="124" name="A7XX_PERF_TP_RESERVED_124"/>
+- <value value="125" name="A7XX_PERF_TP_RESERVED_125"/>
+- <value value="126" name="A7XX_PERF_TP_RESERVED_126"/>
+- <value value="127" name="A7XX_PERF_TP_RESERVED_127"/>
+- <value value="128" name="A7XX_PERF_TP_FORMAT_DECOMP_BILINEAR"/>
+- <value value="129" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP16"/>
+- <value value="130" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP16"/>
+- <value value="131" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP32"/>
+- <value value="132" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP32"/>
+-</enum>
+-
+-<enum name="a7xx_sp_perfcounter_select">
+- <value value="0" name="A7XX_PERF_SP_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_SP_ALU_WORKING_CYCLES"/>
+- <value value="2" name="A7XX_PERF_SP_EFU_WORKING_CYCLES"/>
+- <value value="3" name="A7XX_PERF_SP_STALL_CYCLES_VPC"/>
+- <value value="4" name="A7XX_PERF_SP_STALL_CYCLES_TP"/>
+- <value value="5" name="A7XX_PERF_SP_STALL_CYCLES_UCHE"/>
+- <value value="6" name="A7XX_PERF_SP_STALL_CYCLES_RB"/>
+- <value value="7" name="A7XX_PERF_SP_NON_EXECUTION_CYCLES"/>
+- <value value="8" name="A7XX_PERF_SP_WAVE_CONTEXTS"/>
+- <value value="9" name="A7XX_PERF_SP_WAVE_CONTEXT_CYCLES"/>
+- <value value="10" name="A7XX_PERF_SP_STAGE_WAVE_CYCLES"/>
+- <value value="11" name="A7XX_PERF_SP_STAGE_WAVE_SAMPLES"/>
+- <value value="12" name="A7XX_PERF_SP_VS_STAGE_WAVE_CYCLES"/>
+- <value value="13" name="A7XX_PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
+- <value value="14" name="A7XX_PERF_SP_FS_STAGE_DURATION_CYCLES"/>
+- <value value="15" name="A7XX_PERF_SP_VS_STAGE_DURATION_CYCLES"/>
+- <value value="16" name="A7XX_PERF_SP_WAVE_CTRL_CYCLES"/>
+- <value value="17" name="A7XX_PERF_SP_WAVE_LOAD_CYCLES"/>
+- <value value="18" name="A7XX_PERF_SP_WAVE_EMIT_CYCLES"/>
+- <value value="19" name="A7XX_PERF_SP_WAVE_NOP_CYCLES"/>
+- <value value="20" name="A7XX_PERF_SP_WAVE_WAIT_CYCLES"/>
+- <value value="21" name="A7XX_PERF_SP_WAVE_FETCH_CYCLES"/>
+- <value value="22" name="A7XX_PERF_SP_WAVE_IDLE_CYCLES"/>
+- <value value="23" name="A7XX_PERF_SP_WAVE_END_CYCLES"/>
+- <value value="24" name="A7XX_PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
+- <value value="25" name="A7XX_PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
+- <value value="26" name="A7XX_PERF_SP_WAVE_JOIN_CYCLES"/>
+- <value value="27" name="A7XX_PERF_SP_LM_LOAD_INSTRUCTIONS"/>
+- <value value="28" name="A7XX_PERF_SP_LM_STORE_INSTRUCTIONS"/>
+- <value value="29" name="A7XX_PERF_SP_LM_ATOMICS"/>
+- <value value="30" name="A7XX_PERF_SP_GM_LOAD_INSTRUCTIONS"/>
+- <value value="31" name="A7XX_PERF_SP_GM_STORE_INSTRUCTIONS"/>
+- <value value="32" name="A7XX_PERF_SP_GM_ATOMICS"/>
+- <value value="33" name="A7XX_PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
+- <value value="34" name="A7XX_PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
+- <value value="35" name="A7XX_PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+- <value value="36" name="A7XX_PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+- <value value="37" name="A7XX_PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
+- <value value="38" name="A7XX_PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
+- <value value="39" name="A7XX_PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
+- <value value="40" name="A7XX_PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
+- <value value="41" name="A7XX_PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
+- <value value="42" name="A7XX_PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
+- <value value="43" name="A7XX_PERF_SP_VS_INSTRUCTIONS"/>
+- <value value="44" name="A7XX_PERF_SP_FS_INSTRUCTIONS"/>
+- <value value="45" name="A7XX_PERF_SP_ADDR_LOCK_COUNT"/>
+- <value value="46" name="A7XX_PERF_SP_UCHE_READ_TRANS"/>
+- <value value="47" name="A7XX_PERF_SP_UCHE_WRITE_TRANS"/>
+- <value value="48" name="A7XX_PERF_SP_EXPORT_VPC_TRANS"/>
+- <value value="49" name="A7XX_PERF_SP_EXPORT_RB_TRANS"/>
+- <value value="50" name="A7XX_PERF_SP_PIXELS_KILLED"/>
+- <value value="51" name="A7XX_PERF_SP_ICL1_REQUESTS"/>
+- <value value="52" name="A7XX_PERF_SP_ICL1_MISSES"/>
+- <value value="53" name="A7XX_PERF_SP_HS_INSTRUCTIONS"/>
+- <value value="54" name="A7XX_PERF_SP_DS_INSTRUCTIONS"/>
+- <value value="55" name="A7XX_PERF_SP_GS_INSTRUCTIONS"/>
+- <value value="56" name="A7XX_PERF_SP_CS_INSTRUCTIONS"/>
+- <value value="57" name="A7XX_PERF_SP_GPR_READ"/>
+- <value value="58" name="A7XX_PERF_SP_GPR_WRITE"/>
+- <value value="59" name="A7XX_PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+- <value value="60" name="A7XX_PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
+- <value value="61" name="A7XX_PERF_SP_LM_BANK_CONFLICTS"/>
+- <value value="62" name="A7XX_PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
+- <value value="63" name="A7XX_PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
+- <value value="64" name="A7XX_PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
+- <value value="65" name="A7XX_PERF_SP_LM_WORKING_CYCLES"/>
+- <value value="66" name="A7XX_PERF_SP_DISPATCHER_WORKING_CYCLES"/>
+- <value value="67" name="A7XX_PERF_SP_SEQUENCER_WORKING_CYCLES"/>
+- <value value="68" name="A7XX_PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
+- <value value="69" name="A7XX_PERF_SP_STARVE_CYCLES_HLSQ"/>
+- <value value="70" name="A7XX_PERF_SP_NON_EXECUTION_LS_CYCLES"/>
+- <value value="71" name="A7XX_PERF_SP_WORKING_EU"/>
+- <value value="72" name="A7XX_PERF_SP_ANY_EU_WORKING"/>
+- <value value="73" name="A7XX_PERF_SP_WORKING_EU_FS_STAGE"/>
+- <value value="74" name="A7XX_PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
+- <value value="75" name="A7XX_PERF_SP_WORKING_EU_VS_STAGE"/>
+- <value value="76" name="A7XX_PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
+- <value value="77" name="A7XX_PERF_SP_WORKING_EU_CS_STAGE"/>
+- <value value="78" name="A7XX_PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
+- <value value="79" name="A7XX_PERF_SP_GPR_READ_PREFETCH"/>
+- <value value="80" name="A7XX_PERF_SP_GPR_READ_CONFLICT"/>
+- <value value="81" name="A7XX_PERF_SP_GPR_WRITE_CONFLICT"/>
+- <value value="82" name="A7XX_PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
+- <value value="83" name="A7XX_PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
+- <value value="84" name="A7XX_PERF_SP_EXECUTABLE_WAVES"/>
+- <value value="85" name="A7XX_PERF_SP_ICL1_MISS_FETCH_CYCLES"/>
+- <value value="86" name="A7XX_PERF_SP_WORKING_EU_LPAC"/>
+- <value value="87" name="A7XX_PERF_SP_BYPASS_BUSY_CYCLES"/>
+- <value value="88" name="A7XX_PERF_SP_ANY_EU_WORKING_LPAC"/>
+- <value value="89" name="A7XX_PERF_SP_WAVE_ALU_CYCLES"/>
+- <value value="90" name="A7XX_PERF_SP_WAVE_EFU_CYCLES"/>
+- <value value="91" name="A7XX_PERF_SP_WAVE_INT_CYCLES"/>
+- <value value="92" name="A7XX_PERF_SP_WAVE_CSP_CYCLES"/>
+- <value value="93" name="A7XX_PERF_SP_EWAVE_CONTEXTS"/>
+- <value value="94" name="A7XX_PERF_SP_EWAVE_CONTEXT_CYCLES"/>
+- <value value="95" name="A7XX_PERF_SP_LPAC_BUSY_CYCLES"/>
+- <value value="96" name="A7XX_PERF_SP_LPAC_INSTRUCTIONS"/>
+- <value value="97" name="A7XX_PERF_SP_FS_STAGE_1X_WAVES"/>
+- <value value="98" name="A7XX_PERF_SP_FS_STAGE_2X_WAVES"/>
+- <value value="99" name="A7XX_PERF_SP_QUADS"/>
+- <value value="100" name="A7XX_PERF_SP_CS_INVOCATIONS"/>
+- <value value="101" name="A7XX_PERF_SP_PIXELS"/>
+- <value value="102" name="A7XX_PERF_SP_LPAC_DRAWCALLS"/>
+- <value value="103" name="A7XX_PERF_SP_PI_WORKING_CYCLES"/>
+- <value value="104" name="A7XX_PERF_SP_WAVE_INPUT_CYCLES"/>
+- <value value="105" name="A7XX_PERF_SP_WAVE_OUTPUT_CYCLES"/>
+- <value value="106" name="A7XX_PERF_SP_WAVE_HWAVE_WAIT_CYCLES"/>
+- <value value="107" name="A7XX_PERF_SP_WAVE_HWAVE_SYNC"/>
+- <value value="108" name="A7XX_PERF_SP_OUTPUT_3D_PIXELS"/>
+- <value value="109" name="A7XX_PERF_SP_FULL_ALU_MAD_INSTRUCTIONS"/>
+- <value value="110" name="A7XX_PERF_SP_HALF_ALU_MAD_INSTRUCTIONS"/>
+- <value value="111" name="A7XX_PERF_SP_FULL_ALU_MUL_INSTRUCTIONS"/>
+- <value value="112" name="A7XX_PERF_SP_HALF_ALU_MUL_INSTRUCTIONS"/>
+- <value value="113" name="A7XX_PERF_SP_FULL_ALU_ADD_INSTRUCTIONS"/>
+- <value value="114" name="A7XX_PERF_SP_HALF_ALU_ADD_INSTRUCTIONS"/>
+- <value value="115" name="A7XX_PERF_SP_BARY_FP32_INSTRUCTIONS"/>
+- <value value="116" name="A7XX_PERF_SP_ALU_GPR_READ_CYCLES"/>
+- <value value="117" name="A7XX_PERF_SP_ALU_DATA_FORWARDING_CYCLES"/>
+- <value value="118" name="A7XX_PERF_SP_LM_FULL_CYCLES"/>
+- <value value="119" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_CYCLES"/>
+- <value value="120" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_SAMPLES"/>
+- <value value="121" name="A7XX_PERF_SP_FS_STAGE_PI_TEX_INSTRUCTION"/>
+- <value value="122" name="A7XX_PERF_SP_RAY_QUERY_INSTRUCTIONS"/>
+- <value value="123" name="A7XX_PERF_SP_RBRT_KICKOFF_FIBERS"/>
+- <value value="124" name="A7XX_PERF_SP_RBRT_KICKOFF_DQUADS"/>
+- <value value="125" name="A7XX_PERF_SP_RTU_BUSY_CYCLES"/>
+- <value value="126" name="A7XX_PERF_SP_RTU_L0_HITS"/>
+- <value value="127" name="A7XX_PERF_SP_RTU_L0_MISSES"/>
+- <value value="128" name="A7XX_PERF_SP_RTU_L0_HIT_ON_MISS"/>
+- <value value="129" name="A7XX_PERF_SP_RTU_STALL_CYCLES_WAVE_QUEUE"/>
+- <value value="130" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_HIT_QUEUE"/>
+- <value value="131" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_MISS_QUEUE"/>
+- <value value="132" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0D_IDX_QUEUE"/>
+- <value value="133" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0DATA"/>
+- <value value="134" name="A7XX_PERF_SP_RTU_STALL_CYCLES_REPLACE_CNT"/>
+- <value value="135" name="A7XX_PERF_SP_RTU_STALL_CYCLES_MRG_CNT"/>
+- <value value="136" name="A7XX_PERF_SP_RTU_STALL_CYCLES_UCHE"/>
+- <value value="137" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_L0"/>
+- <value value="138" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_INS_FIFO"/>
+- <value value="139" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_CYCLES"/>
+- <value value="140" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_SAMPLES"/>
+- <value value="141" name="A7XX_PERF_SP_STCHE_MISS_INC_VS"/>
+- <value value="142" name="A7XX_PERF_SP_STCHE_MISS_INC_FS"/>
+- <value value="143" name="A7XX_PERF_SP_STCHE_MISS_INC_BV"/>
+- <value value="144" name="A7XX_PERF_SP_STCHE_MISS_INC_LPAC"/>
+- <value value="145" name="A7XX_PERF_SP_VGPR_ACTIVE_CONTEXTS"/>
+- <value value="146" name="A7XX_PERF_SP_PGPR_ALLOC_CONTEXTS"/>
+- <value value="147" name="A7XX_PERF_SP_VGPR_ALLOC_CONTEXTS"/>
+- <value value="148" name="A7XX_PERF_SP_RTU_RAY_BOX_INTERSECTIONS"/>
+- <value value="149" name="A7XX_PERF_SP_RTU_RAY_TRIANGLE_INTERSECTIONS"/>
+- <value value="150" name="A7XX_PERF_SP_SCH_STALL_CYCLES_RTU"/>
+-</enum>
+-
+-<enum name="a7xx_rb_perfcounter_select">
+- <value value="0" name="A7XX_PERF_RB_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_RB_STALL_CYCLES_HLSQ"/>
+- <value value="2" name="A7XX_PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
+- <value value="3" name="A7XX_PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
+- <value value="4" name="A7XX_PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
+- <value value="5" name="A7XX_PERF_RB_STARVE_CYCLES_SP"/>
+- <value value="6" name="A7XX_PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
+- <value value="7" name="A7XX_PERF_RB_STARVE_CYCLES_CCU"/>
+- <value value="8" name="A7XX_PERF_RB_STARVE_CYCLES_Z_PLANE"/>
+- <value value="9" name="A7XX_PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
+- <value value="10" name="A7XX_PERF_RB_Z_WORKLOAD"/>
+- <value value="11" name="A7XX_PERF_RB_HLSQ_ACTIVE"/>
+- <value value="12" name="A7XX_PERF_RB_Z_READ"/>
+- <value value="13" name="A7XX_PERF_RB_Z_WRITE"/>
+- <value value="14" name="A7XX_PERF_RB_C_READ"/>
+- <value value="15" name="A7XX_PERF_RB_C_WRITE"/>
+- <value value="16" name="A7XX_PERF_RB_TOTAL_PASS"/>
+- <value value="17" name="A7XX_PERF_RB_Z_PASS"/>
+- <value value="18" name="A7XX_PERF_RB_Z_FAIL"/>
+- <value value="19" name="A7XX_PERF_RB_S_FAIL"/>
+- <value value="20" name="A7XX_PERF_RB_BLENDED_FXP_COMPONENTS"/>
+- <value value="21" name="A7XX_PERF_RB_BLENDED_FP16_COMPONENTS"/>
+- <value value="22" name="A7XX_PERF_RB_PS_INVOCATIONS"/>
+- <value value="23" name="A7XX_PERF_RB_2D_ALIVE_CYCLES"/>
+- <value value="24" name="A7XX_PERF_RB_2D_STALL_CYCLES_A2D"/>
+- <value value="25" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SRC"/>
+- <value value="26" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SP"/>
+- <value value="27" name="A7XX_PERF_RB_2D_STARVE_CYCLES_DST"/>
+- <value value="28" name="A7XX_PERF_RB_2D_VALID_PIXELS"/>
+- <value value="29" name="A7XX_PERF_RB_3D_PIXELS"/>
+- <value value="30" name="A7XX_PERF_RB_BLENDER_WORKING_CYCLES"/>
+- <value value="31" name="A7XX_PERF_RB_ZPROC_WORKING_CYCLES"/>
+- <value value="32" name="A7XX_PERF_RB_CPROC_WORKING_CYCLES"/>
+- <value value="33" name="A7XX_PERF_RB_SAMPLER_WORKING_CYCLES"/>
+- <value value="34" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
+- <value value="35" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
+- <value value="36" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
+- <value value="37" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
+- <value value="38" name="A7XX_PERF_RB_STALL_CYCLES_VPC"/>
+- <value value="39" name="A7XX_PERF_RB_2D_INPUT_TRANS"/>
+- <value value="40" name="A7XX_PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
+- <value value="41" name="A7XX_PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
+- <value value="42" name="A7XX_PERF_RB_BLENDED_FP32_COMPONENTS"/>
+- <value value="43" name="A7XX_PERF_RB_COLOR_PIX_TILES"/>
+- <value value="44" name="A7XX_PERF_RB_STALL_CYCLES_CCU"/>
+- <value value="45" name="A7XX_PERF_RB_EARLY_Z_ARB3_GRANT"/>
+- <value value="46" name="A7XX_PERF_RB_LATE_Z_ARB3_GRANT"/>
+- <value value="47" name="A7XX_PERF_RB_EARLY_Z_SKIP_GRANT"/>
+- <value value="48" name="A7XX_PERF_RB_VRS_1x1_QUADS"/>
+- <value value="49" name="A7XX_PERF_RB_VRS_2x1_QUADS"/>
+- <value value="50" name="A7XX_PERF_RB_VRS_1x2_QUADS"/>
+- <value value="51" name="A7XX_PERF_RB_VRS_2x2_QUADS"/>
+- <value value="52" name="A7XX_PERF_RB_VRS_4x2_QUADS"/>
+- <value value="53" name="A7XX_PERF_RB_VRS_4x4_QUADS"/>
+-</enum>
+-
+-<enum name="a7xx_vsc_perfcounter_select">
+- <value value="0" name="A7XX_PERF_VSC_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_VSC_WORKING_CYCLES"/>
+- <value value="2" name="A7XX_PERF_VSC_STALL_CYCLES_UCHE"/>
+- <value value="3" name="A7XX_PERF_VSC_EOT_NUM"/>
+- <value value="4" name="A7XX_PERF_VSC_INPUT_TILES"/>
+-</enum>
+-
+-<enum name="a7xx_ccu_perfcounter_select">
+- <value value="0" name="A7XX_PERF_CCU_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
+- <value value="2" name="A7XX_PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
+- <value value="3" name="A7XX_PERF_CCU_DEPTH_BLOCKS"/>
+- <value value="4" name="A7XX_PERF_CCU_COLOR_BLOCKS"/>
+- <value value="5" name="A7XX_PERF_CCU_DEPTH_BLOCK_HIT"/>
+- <value value="6" name="A7XX_PERF_CCU_COLOR_BLOCK_HIT"/>
+- <value value="7" name="A7XX_PERF_CCU_PARTIAL_BLOCK_READ"/>
+- <value value="8" name="A7XX_PERF_CCU_GMEM_READ"/>
+- <value value="9" name="A7XX_PERF_CCU_GMEM_WRITE"/>
+- <value value="10" name="A7XX_PERF_CCU_2D_RD_REQ"/>
+- <value value="11" name="A7XX_PERF_CCU_2D_WR_REQ"/>
+- <value value="12" name="A7XX_PERF_CCU_UBWC_COLOR_BLOCKS_CONCURRENT"/>
+- <value value="13" name="A7XX_PERF_CCU_UBWC_DEPTH_BLOCKS_CONCURRENT"/>
+- <value value="14" name="A7XX_PERF_CCU_COLOR_RESOLVE_DROPPED"/>
+- <value value="15" name="A7XX_PERF_CCU_DEPTH_RESOLVE_DROPPED"/>
+- <value value="16" name="A7XX_PERF_CCU_COLOR_RENDER_CONCURRENT"/>
+- <value value="17" name="A7XX_PERF_CCU_DEPTH_RENDER_CONCURRENT"/>
+- <value value="18" name="A7XX_PERF_CCU_COLOR_RESOLVE_AFTER_RENDER"/>
+- <value value="19" name="A7XX_PERF_CCU_DEPTH_RESOLVE_AFTER_RENDER"/>
+- <value value="20" name="A7XX_PERF_CCU_GMEM_EXTRA_DEPTH_READ"/>
+- <value value="21" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA"/>
+- <value value="22" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA_FULL"/>
+-</enum>
+-
+-<enum name="a7xx_lrz_perfcounter_select">
+- <value value="0" name="A7XX_PERF_LRZ_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_LRZ_STARVE_CYCLES_RAS"/>
+- <value value="2" name="A7XX_PERF_LRZ_STALL_CYCLES_RB"/>
+- <value value="3" name="A7XX_PERF_LRZ_STALL_CYCLES_VSC"/>
+- <value value="4" name="A7XX_PERF_LRZ_STALL_CYCLES_VPC"/>
+- <value value="5" name="A7XX_PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
+- <value value="6" name="A7XX_PERF_LRZ_STALL_CYCLES_UCHE"/>
+- <value value="7" name="A7XX_PERF_LRZ_LRZ_READ"/>
+- <value value="8" name="A7XX_PERF_LRZ_LRZ_WRITE"/>
+- <value value="9" name="A7XX_PERF_LRZ_READ_LATENCY"/>
+- <value value="10" name="A7XX_PERF_LRZ_MERGE_CACHE_UPDATING"/>
+- <value value="11" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
+- <value value="12" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
+- <value value="13" name="A7XX_PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
+- <value value="14" name="A7XX_PERF_LRZ_FULL_8X8_TILES"/>
+- <value value="15" name="A7XX_PERF_LRZ_PARTIAL_8X8_TILES"/>
+- <value value="16" name="A7XX_PERF_LRZ_TILE_KILLED"/>
+- <value value="17" name="A7XX_PERF_LRZ_TOTAL_PIXEL"/>
+- <value value="18" name="A7XX_PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
+- <value value="19" name="A7XX_PERF_LRZ_FEEDBACK_ACCEPT"/>
+- <value value="20" name="A7XX_PERF_LRZ_FEEDBACK_DISCARD"/>
+- <value value="21" name="A7XX_PERF_LRZ_FEEDBACK_STALL"/>
+- <value value="22" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
+- <value value="23" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
+- <value value="24" name="A7XX_PERF_LRZ_RAS_MASK_TRANS"/>
+- <value value="25" name="A7XX_PERF_LRZ_STALL_CYCLES_MVC"/>
+- <value value="26" name="A7XX_PERF_LRZ_TILE_KILLED_BY_IMAGE_VRS"/>
+- <value value="27" name="A7XX_PERF_LRZ_TILE_KILLED_BY_Z"/>
+-</enum>
+-
+-<enum name="a7xx_cmp_perfcounter_select">
+- <value value="0" name="A7XX_PERF_CMPDECMP_STALL_CYCLES_ARB"/>
+- <value value="1" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
+- <value value="2" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
+- <value value="3" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
+- <value value="4" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
+- <value value="5" name="A7XX_PERF_CMPDECMP_VBIF_READ_REQUEST"/>
+- <value value="6" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
+- <value value="7" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA"/>
+- <value value="8" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA"/>
+- <value value="9" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
+- <value value="10" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
+- <value value="11" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
+- <value value="12" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
+- <value value="13" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
+- <value value="14" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
+- <value value="15" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
+- <value value="16" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
+- <value value="17" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
+- <value value="18" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
+- <value value="19" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
+- <value value="20" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
+- <value value="21" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
+- <value value="22" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
+- <value value="23" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
+- <value value="24" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
+- <value value="25" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
+- <value value="26" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
+- <value value="27" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
+- <value value="28" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
+- <value value="29" name="A7XX_PERF_CMPDECMP_RESOLVE_EVENTS"/>
+- <value value="30" name="A7XX_PERF_CMPDECMP_CONCURRENT_RESOLVE_EVENTS"/>
+- <value value="31" name="A7XX_PERF_CMPDECMP_DROPPED_CLEAR_EVENTS"/>
+- <value value="32" name="A7XX_PERF_CMPDECMP_ST_BLOCKS_CONCURRENT"/>
+- <value value="33" name="A7XX_PERF_CMPDECMP_LRZ_ST_BLOCKS_CONCURRENT"/>
+- <value value="34" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG0_COUNT"/>
+- <value value="35" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG1_COUNT"/>
+- <value value="36" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG2_COUNT"/>
+- <value value="37" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG3_COUNT"/>
+- <value value="38" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG4_COUNT"/>
+- <value value="39" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG5_COUNT"/>
+- <value value="40" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG6_COUNT"/>
+- <value value="41" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG8_COUNT"/>
+- <value value="42" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG0_COUNT"/>
+- <value value="43" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG1_COUNT"/>
+- <value value="44" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG2_COUNT"/>
+- <value value="45" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG3_COUNT"/>
+- <value value="46" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG4_COUNT"/>
+- <value value="47" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG5_COUNT"/>
+- <value value="48" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG6_COUNT"/>
+- <value value="49" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG8_COUNT"/>
+-</enum>
+-
+-<enum name="a7xx_gbif_perfcounter_select">
+- <value value="0" name="A7XX_PERF_GBIF_RESERVED_0"/>
+- <value value="1" name="A7XX_PERF_GBIF_RESERVED_1"/>
+- <value value="2" name="A7XX_PERF_GBIF_RESERVED_2"/>
+- <value value="3" name="A7XX_PERF_GBIF_RESERVED_3"/>
+- <value value="4" name="A7XX_PERF_GBIF_RESERVED_4"/>
+- <value value="5" name="A7XX_PERF_GBIF_RESERVED_5"/>
+- <value value="6" name="A7XX_PERF_GBIF_RESERVED_6"/>
+- <value value="7" name="A7XX_PERF_GBIF_RESERVED_7"/>
+- <value value="8" name="A7XX_PERF_GBIF_RESERVED_8"/>
+- <value value="9" name="A7XX_PERF_GBIF_RESERVED_9"/>
+- <value value="10" name="A7XX_PERF_GBIF_AXI0_READ_REQUESTS_TOTAL"/>
+- <value value="11" name="A7XX_PERF_GBIF_AXI1_READ_REQUESTS_TOTAL"/>
+- <value value="12" name="A7XX_PERF_GBIF_RESERVED_12"/>
+- <value value="13" name="A7XX_PERF_GBIF_RESERVED_13"/>
+- <value value="14" name="A7XX_PERF_GBIF_RESERVED_14"/>
+- <value value="15" name="A7XX_PERF_GBIF_RESERVED_15"/>
+- <value value="16" name="A7XX_PERF_GBIF_RESERVED_16"/>
+- <value value="17" name="A7XX_PERF_GBIF_RESERVED_17"/>
+- <value value="18" name="A7XX_PERF_GBIF_RESERVED_18"/>
+- <value value="19" name="A7XX_PERF_GBIF_RESERVED_19"/>
+- <value value="20" name="A7XX_PERF_GBIF_RESERVED_20"/>
+- <value value="21" name="A7XX_PERF_GBIF_RESERVED_21"/>
+- <value value="22" name="A7XX_PERF_GBIF_AXI0_WRITE_REQUESTS_TOTAL"/>
+- <value value="23" name="A7XX_PERF_GBIF_AXI1_WRITE_REQUESTS_TOTAL"/>
+- <value value="24" name="A7XX_PERF_GBIF_RESERVED_24"/>
+- <value value="25" name="A7XX_PERF_GBIF_RESERVED_25"/>
+- <value value="26" name="A7XX_PERF_GBIF_RESERVED_26"/>
+- <value value="27" name="A7XX_PERF_GBIF_RESERVED_27"/>
+- <value value="28" name="A7XX_PERF_GBIF_RESERVED_28"/>
+- <value value="29" name="A7XX_PERF_GBIF_RESERVED_29"/>
+- <value value="30" name="A7XX_PERF_GBIF_RESERVED_30"/>
+- <value value="31" name="A7XX_PERF_GBIF_RESERVED_31"/>
+- <value value="32" name="A7XX_PERF_GBIF_RESERVED_32"/>
+- <value value="33" name="A7XX_PERF_GBIF_RESERVED_33"/>
+- <value value="34" name="A7XX_PERF_GBIF_AXI0_READ_DATA_BEATS_TOTAL"/>
+- <value value="35" name="A7XX_PERF_GBIF_AXI1_READ_DATA_BEATS_TOTAL"/>
+- <value value="36" name="A7XX_PERF_GBIF_RESERVED_36"/>
+- <value value="37" name="A7XX_PERF_GBIF_RESERVED_37"/>
+- <value value="38" name="A7XX_PERF_GBIF_RESERVED_38"/>
+- <value value="39" name="A7XX_PERF_GBIF_RESERVED_39"/>
+- <value value="40" name="A7XX_PERF_GBIF_RESERVED_40"/>
+- <value value="41" name="A7XX_PERF_GBIF_RESERVED_41"/>
+- <value value="42" name="A7XX_PERF_GBIF_RESERVED_42"/>
+- <value value="43" name="A7XX_PERF_GBIF_RESERVED_43"/>
+- <value value="44" name="A7XX_PERF_GBIF_RESERVED_44"/>
+- <value value="45" name="A7XX_PERF_GBIF_RESERVED_45"/>
+- <value value="46" name="A7XX_PERF_GBIF_AXI0_WRITE_DATA_BEATS_TOTAL"/>
+- <value value="47" name="A7XX_PERF_GBIF_AXI1_WRITE_DATA_BEATS_TOTAL"/>
+- <value value="48" name="A7XX_PERF_GBIF_RESERVED_48"/>
+- <value value="49" name="A7XX_PERF_GBIF_RESERVED_49"/>
+- <value value="50" name="A7XX_PERF_GBIF_RESERVED_50"/>
+- <value value="51" name="A7XX_PERF_GBIF_RESERVED_51"/>
+- <value value="52" name="A7XX_PERF_GBIF_RESERVED_52"/>
+- <value value="53" name="A7XX_PERF_GBIF_RESERVED_53"/>
+- <value value="54" name="A7XX_PERF_GBIF_RESERVED_54"/>
+- <value value="55" name="A7XX_PERF_GBIF_RESERVED_55"/>
+- <value value="56" name="A7XX_PERF_GBIF_RESERVED_56"/>
+- <value value="57" name="A7XX_PERF_GBIF_RESERVED_57"/>
+- <value value="58" name="A7XX_PERF_GBIF_RESERVED_58"/>
+- <value value="59" name="A7XX_PERF_GBIF_RESERVED_59"/>
+- <value value="60" name="A7XX_PERF_GBIF_RESERVED_60"/>
+- <value value="61" name="A7XX_PERF_GBIF_RESERVED_61"/>
+- <value value="62" name="A7XX_PERF_GBIF_RESERVED_62"/>
+- <value value="63" name="A7XX_PERF_GBIF_RESERVED_63"/>
+- <value value="64" name="A7XX_PERF_GBIF_RESERVED_64"/>
+- <value value="65" name="A7XX_PERF_GBIF_RESERVED_65"/>
+- <value value="66" name="A7XX_PERF_GBIF_RESERVED_66"/>
+- <value value="67" name="A7XX_PERF_GBIF_RESERVED_67"/>
+- <value value="68" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_RD_ALL"/>
+- <value value="69" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_RD_ALL"/>
+- <value value="70" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_WR_ALL"/>
+- <value value="71" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_WR_ALL"/>
+- <value value="72" name="A7XX_PERF_GBIF_AXI_CH0_REQUEST_HELD_OFF"/>
+- <value value="73" name="A7XX_PERF_GBIF_AXI_CH1_REQUEST_HELD_OFF"/>
+- <value value="74" name="A7XX_PERF_GBIF_AXI_REQUEST_HELD_OFF"/>
+- <value value="75" name="A7XX_PERF_GBIF_AXI_CH0_WRITE_DATA_HELD_OFF"/>
+- <value value="76" name="A7XX_PERF_GBIF_AXI_CH1_WRITE_DATA_HELD_OFF"/>
+- <value value="77" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_DATA_HELD_OFF"/>
+- <value value="78" name="A7XX_PERF_GBIF_AXI_ALL_READ_BEATS"/>
+- <value value="79" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_BEATS"/>
+- <value value="80" name="A7XX_PERF_GBIF_AXI_ALL_BEATS"/>
+-</enum>
+-
+-<enum name="a7xx_ufc_perfcounter_select">
+- <value value="0" name="A7XX_PERF_UFC_BUSY_CYCLES"/>
+- <value value="1" name="A7XX_PERF_UFC_READ_DATA_VBIF"/>
+- <value value="2" name="A7XX_PERF_UFC_WRITE_DATA_VBIF"/>
+- <value value="3" name="A7XX_PERF_UFC_READ_REQUEST_VBIF"/>
+- <value value="4" name="A7XX_PERF_UFC_WRITE_REQUEST_VBIF"/>
+- <value value="5" name="A7XX_PERF_UFC_LRZ_FILTER_HIT"/>
+- <value value="6" name="A7XX_PERF_UFC_LRZ_FILTER_MISS"/>
+- <value value="7" name="A7XX_PERF_UFC_CRE_FILTER_HIT"/>
+- <value value="8" name="A7XX_PERF_UFC_CRE_FILTER_MISS"/>
+- <value value="9" name="A7XX_PERF_UFC_SP_FILTER_HIT"/>
+- <value value="10" name="A7XX_PERF_UFC_SP_FILTER_MISS"/>
+- <value value="11" name="A7XX_PERF_UFC_SP_REQUESTS"/>
+- <value value="12" name="A7XX_PERF_UFC_TP_FILTER_HIT"/>
+- <value value="13" name="A7XX_PERF_UFC_TP_FILTER_MISS"/>
+- <value value="14" name="A7XX_PERF_UFC_TP_REQUESTS"/>
+- <value value="15" name="A7XX_PERF_UFC_MAIN_HIT_LRZ_PREFETCH"/>
+- <value value="16" name="A7XX_PERF_UFC_MAIN_HIT_CRE_PREFETCH"/>
+- <value value="17" name="A7XX_PERF_UFC_MAIN_HIT_SP_PREFETCH"/>
+- <value value="18" name="A7XX_PERF_UFC_MAIN_HIT_TP_PREFETCH"/>
+- <value value="19" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_READ"/>
+- <value value="20" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_WRITE"/>
+- <value value="21" name="A7XX_PERF_UFC_MAIN_MISS_LRZ_PREFETCH"/>
+- <value value="22" name="A7XX_PERF_UFC_MAIN_MISS_CRE_PREFETCH"/>
+- <value value="23" name="A7XX_PERF_UFC_MAIN_MISS_SP_PREFETCH"/>
+- <value value="24" name="A7XX_PERF_UFC_MAIN_MISS_TP_PREFETCH"/>
+- <value value="25" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_READ"/>
+- <value value="26" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_WRITE"/>
+- <value value="27" name="A7XX_PERF_UFC_UBWC_READ_UFC_TRANS"/>
+- <value value="28" name="A7XX_PERF_UFC_UBWC_WRITE_UFC_TRANS"/>
+- <value value="29" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_CMD"/>
+- <value value="30" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_RDATA"/>
+- <value value="31" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_WDATA"/>
+- <value value="32" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_WR_FLAG"/>
+- <value value="33" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_FLAG_RTN"/>
+- <value value="34" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_EVENT"/>
+- <value value="35" name="A7XX_PERF_UFC_LRZ_PREFETCH_STALLED_CYCLES"/>
+- <value value="36" name="A7XX_PERF_UFC_CRE_PREFETCH_STALLED_CYCLES"/>
+- <value value="37" name="A7XX_PERF_UFC_SPTP_PREFETCH_STALLED_CYCLES"/>
+- <value value="38" name="A7XX_PERF_UFC_UBWC_RD_STALLED_CYCLES"/>
+- <value value="39" name="A7XX_PERF_UFC_UBWC_WR_STALLED_CYCLES"/>
+- <value value="40" name="A7XX_PERF_UFC_PREFETCH_STALLED_CYCLES"/>
+- <value value="41" name="A7XX_PERF_UFC_EVICTION_STALLED_CYCLES"/>
+- <value value="42" name="A7XX_PERF_UFC_LOCK_STALLED_CYCLES"/>
+- <value value="43" name="A7XX_PERF_UFC_MISS_LATENCY_CYCLES"/>
+- <value value="44" name="A7XX_PERF_UFC_MISS_LATENCY_SAMPLES"/>
+- <value value="45" name="A7XX_PERF_UFC_UBWC_REQ_STALLED_CYCLES"/>
+- <value value="46" name="A7XX_PERF_UFC_TP_HINT_TAG_MISS"/>
+- <value value="47" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_RDY"/>
+- <value value="48" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_NRDY"/>
+- <value value="49" name="A7XX_PERF_UFC_TP_HINT_IS_FCLEAR"/>
+- <value value="50" name="A7XX_PERF_UFC_TP_HINT_IS_ALPHA0"/>
+- <value value="51" name="A7XX_PERF_UFC_SP_L1_FILTER_HIT"/>
+- <value value="52" name="A7XX_PERF_UFC_SP_L1_FILTER_MISS"/>
+- <value value="53" name="A7XX_PERF_UFC_SP_L1_FILTER_REQUESTS"/>
+- <value value="54" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_RDY"/>
+- <value value="55" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_NRDY"/>
+- <value value="56" name="A7XX_PERF_UFC_TP_L1_TAG_MISS"/>
+- <value value="57" name="A7XX_PERF_UFC_TP_L1_FILTER_REQUESTS"/>
+-</enum>
+-
+ <domain name="A6XX" width="32" prefix="variant" varset="chip">
+ <bitset name="A6XX_RBBM_INT_0_MASK" inline="no" varset="chip">
+ <bitfield name="RBBM_GPU_IDLE" pos="0" type="boolean"/>
+@@ -2371,7 +177,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x08ab" name="CP_CONTEXT_SWITCH_LEVEL_STATUS" variants="A7XX-"/>
+ <array offset="0x08D0" name="CP_PERFCTR_CP_SEL" stride="1" length="14"/>
+ <array offset="0x08e0" name="CP_BV_PERFCTR_CP_SEL" stride="1" length="7" variants="A7XX-"/>
+- <reg64 offset="0x0900" name="CP_CRASH_SCRIPT_BASE"/>
++ <reg64 offset="0x0900" name="CP_CRASH_DUMP_SCRIPT_BASE"/>
+ <reg32 offset="0x0902" name="CP_CRASH_DUMP_CNTL"/>
+ <reg32 offset="0x0903" name="CP_CRASH_DUMP_STATUS"/>
+ <reg32 offset="0x0908" name="CP_SQE_STAT_ADDR"/>
+@@ -2400,22 +206,22 @@ to upconvert to 32b float internally?
+ -->
+ <reg64 offset="0x0934" name="CP_VSD_BASE"/>
+
+- <bitset name="a6xx_roq_stat" inline="yes">
++ <bitset name="a6xx_roq_status" inline="yes">
+ <bitfield name="RPTR" low="0" high="9"/>
+ <bitfield name="WPTR" low="16" high="25"/>
+ </bitset>
+- <reg32 offset="0x0939" name="CP_ROQ_RB_STAT" type="a6xx_roq_stat"/>
+- <reg32 offset="0x093a" name="CP_ROQ_IB1_STAT" type="a6xx_roq_stat"/>
+- <reg32 offset="0x093b" name="CP_ROQ_IB2_STAT" type="a6xx_roq_stat"/>
+- <reg32 offset="0x093c" name="CP_ROQ_SDS_STAT" type="a6xx_roq_stat"/>
+- <reg32 offset="0x093d" name="CP_ROQ_MRB_STAT" type="a6xx_roq_stat"/>
+- <reg32 offset="0x093e" name="CP_ROQ_VSD_STAT" type="a6xx_roq_stat"/>
+-
+- <reg32 offset="0x0943" name="CP_IB1_DWORDS"/>
+- <reg32 offset="0x0944" name="CP_IB2_DWORDS"/>
+- <reg32 offset="0x0945" name="CP_SDS_DWORDS"/>
+- <reg32 offset="0x0946" name="CP_MRB_DWORDS"/>
+- <reg32 offset="0x0947" name="CP_VSD_DWORDS"/>
++ <reg32 offset="0x0939" name="CP_ROQ_RB_STATUS" type="a6xx_roq_status"/>
++ <reg32 offset="0x093a" name="CP_ROQ_IB1_STATUS" type="a6xx_roq_status"/>
++ <reg32 offset="0x093b" name="CP_ROQ_IB2_STATUS" type="a6xx_roq_status"/>
++ <reg32 offset="0x093c" name="CP_ROQ_SDS_STATUS" type="a6xx_roq_status"/>
++ <reg32 offset="0x093d" name="CP_ROQ_MRB_STATUS" type="a6xx_roq_status"/>
++ <reg32 offset="0x093e" name="CP_ROQ_VSD_STATUS" type="a6xx_roq_status"/>
++
++ <reg32 offset="0x0943" name="CP_IB1_INIT_SIZE"/>
++ <reg32 offset="0x0944" name="CP_IB2_INIT_SIZE"/>
++ <reg32 offset="0x0945" name="CP_SDS_INIT_SIZE"/>
++ <reg32 offset="0x0946" name="CP_MRB_INIT_SIZE"/>
++ <reg32 offset="0x0947" name="CP_VSD_INIT_SIZE"/>
+
+ <reg32 offset="0x0948" name="CP_ROQ_AVAIL_RB">
+ <doc>number of remaining dwords incl current dword being consumed?</doc>
+@@ -2451,6 +257,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x098D" name="CP_AHB_CNTL"/>
+ <reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" variants="A6XX"/>
+ <reg32 offset="0x0A00" name="CP_APERTURE_CNTL_HOST" type="a7xx_aperture_cntl" variants="A7XX-"/>
++ <reg32 offset="0x0A01" name="CP_APERTURE_CNTL_SQE" variants="A6XX"/>
+ <reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" variants="A6XX"/>
+ <reg32 offset="0x0A03" name="CP_APERTURE_CNTL_CD" type="a7xx_aperture_cntl" variants="A7XX-"/>
+
+@@ -2468,8 +275,8 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x0a97" name="CP_BV_MEM_POOL_DBG_DATA" variants="A7XX-"/>
+ <reg64 offset="0x0a98" name="CP_BV_RB_RPTR_ADDR" variants="A7XX-"/>
+
+- <reg32 offset="0x0a9a" name="CP_RESOURCE_TBL_DBG_ADDR" variants="A7XX-"/>
+- <reg32 offset="0x0a9b" name="CP_RESOURCE_TBL_DBG_DATA" variants="A7XX-"/>
++ <reg32 offset="0x0a9a" name="CP_RESOURCE_TABLE_DBG_ADDR" variants="A7XX-"/>
++ <reg32 offset="0x0a9b" name="CP_RESOURCE_TABLE_DBG_DATA" variants="A7XX-"/>
+ <reg32 offset="0x0ad0" name="CP_BV_APRIV_CNTL" variants="A7XX-"/>
+ <reg32 offset="0x0ada" name="CP_BV_CHICKEN_DBG" variants="A7XX-"/>
+
+@@ -2619,28 +426,17 @@ to upconvert to 32b float internally?
+ vertices in, number of primnitives assembled etc.
+ -->
+
+- <reg32 offset="0x0540" name="RBBM_PRIMCTR_0_LO"/> <!-- vs vertices in -->
+- <reg32 offset="0x0541" name="RBBM_PRIMCTR_0_HI"/>
+- <reg32 offset="0x0542" name="RBBM_PRIMCTR_1_LO"/> <!-- vs primitives out -->
+- <reg32 offset="0x0543" name="RBBM_PRIMCTR_1_HI"/>
+- <reg32 offset="0x0544" name="RBBM_PRIMCTR_2_LO"/> <!-- hs vertices in -->
+- <reg32 offset="0x0545" name="RBBM_PRIMCTR_2_HI"/>
+- <reg32 offset="0x0546" name="RBBM_PRIMCTR_3_LO"/> <!-- hs patches out -->
+- <reg32 offset="0x0547" name="RBBM_PRIMCTR_3_HI"/>
+- <reg32 offset="0x0548" name="RBBM_PRIMCTR_4_LO"/> <!-- dss vertices in -->
+- <reg32 offset="0x0549" name="RBBM_PRIMCTR_4_HI"/>
+- <reg32 offset="0x054a" name="RBBM_PRIMCTR_5_LO"/> <!-- ds primitives out -->
+- <reg32 offset="0x054b" name="RBBM_PRIMCTR_5_HI"/>
+- <reg32 offset="0x054c" name="RBBM_PRIMCTR_6_LO"/> <!-- gs primitives in -->
+- <reg32 offset="0x054d" name="RBBM_PRIMCTR_6_HI"/>
+- <reg32 offset="0x054e" name="RBBM_PRIMCTR_7_LO"/> <!-- gs primitives out -->
+- <reg32 offset="0x054f" name="RBBM_PRIMCTR_7_HI"/>
+- <reg32 offset="0x0550" name="RBBM_PRIMCTR_8_LO"/> <!-- gs primitives out -->
+- <reg32 offset="0x0551" name="RBBM_PRIMCTR_8_HI"/>
+- <reg32 offset="0x0552" name="RBBM_PRIMCTR_9_LO"/> <!-- raster primitives in -->
+- <reg32 offset="0x0553" name="RBBM_PRIMCTR_9_HI"/>
+- <reg32 offset="0x0554" name="RBBM_PRIMCTR_10_LO"/>
+- <reg32 offset="0x0555" name="RBBM_PRIMCTR_10_HI"/>
++ <reg64 offset="0x0540" name="RBBM_PIPESTAT_IAVERTICES"/>
++ <reg64 offset="0x0542" name="RBBM_PIPESTAT_IAPRIMITIVES"/>
++ <reg64 offset="0x0544" name="RBBM_PIPESTAT_VSINVOCATIONS"/>
++ <reg64 offset="0x0546" name="RBBM_PIPESTAT_HSINVOCATIONS"/>
++ <reg64 offset="0x0548" name="RBBM_PIPESTAT_DSINVOCATIONS"/>
++ <reg64 offset="0x054a" name="RBBM_PIPESTAT_GSINVOCATIONS"/>
++ <reg64 offset="0x054c" name="RBBM_PIPESTAT_GSPRIMITIVES"/>
++ <reg64 offset="0x054e" name="RBBM_PIPESTAT_CINVOCATIONS"/>
++ <reg64 offset="0x0550" name="RBBM_PIPESTAT_CPRIMITIVES"/>
++ <reg64 offset="0x0552" name="RBBM_PIPESTAT_PSINVOCATIONS"/>
++ <reg64 offset="0x0554" name="RBBM_PIPESTAT_CSINVOCATIONS"/>
+
+ <reg32 offset="0xF400" name="RBBM_SECVID_TRUST_CNTL"/>
+ <reg64 offset="0xF800" name="RBBM_SECVID_TSB_TRUSTED_BASE"/>
+@@ -2779,7 +575,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x0011f" name="RBBM_CGC_P2S_TRIG_CMD" variants="A7XX-"/>
+ <reg32 offset="0x00120" name="RBBM_CLOCK_CNTL_TEX_FCHE"/>
+ <reg32 offset="0x00121" name="RBBM_CLOCK_DELAY_TEX_FCHE"/>
+- <reg32 offset="0x00122" name="RBBM_CLOCK_HYST_TEX_FCHE"/>
++ <reg32 offset="0x00122" name="RBBM_CLOCK_HYST_TEX_FCHE" variants="A6XX"/>
+ <reg32 offset="0x00122" name="RBBM_CGC_P2S_STATUS" variants="A7XX-">
+ <bitfield name="TXDONE" pos="0" type="boolean"/>
+ </reg32>
+@@ -2840,7 +636,7 @@ to upconvert to 32b float internally?
+ </reg32>
+ <reg32 offset="0x062f" name="DBGC_CFG_DBGBUS_TRACE_BUF1"/>
+ <reg32 offset="0x0630" name="DBGC_CFG_DBGBUS_TRACE_BUF2"/>
+- <array offset="0x0CD8" name="VSC_PERFCTR_VSC_SEL" stride="1" length="2"/>
++ <array offset="0x0CD8" name="VSC_PERFCTR_VSC_SEL" stride="1" length="2" variants="A6XX"/>
+ <reg32 offset="0x0CD8" name="VSC_UNKNOWN_0CD8" variants="A7XX">
+ <doc>
+ Set to true when binning, isn't changed afterwards
+@@ -2936,8 +732,8 @@ to upconvert to 32b float internally?
+ <bitfield name="WIDTH" low="0" high="7" shr="5" type="uint"/>
+ <bitfield name="HEIGHT" low="8" high="16" shr="4" type="uint"/>
+ </reg32>
+- <reg64 offset="0x0c03" name="VSC_DRAW_STRM_SIZE_ADDRESS" type="waddress" usage="cmd"/>
+- <reg32 offset="0x0c06" name="VSC_BIN_COUNT" usage="rp_blit">
++ <reg64 offset="0x0c03" name="VSC_SIZE_BASE" type="waddress" usage="cmd"/>
++ <reg32 offset="0x0c06" name="VSC_EXPANDED_BIN_CNTL" usage="rp_blit">
+ <bitfield name="NX" low="1" high="10" type="uint"/>
+ <bitfield name="NY" low="11" high="20" type="uint"/>
+ </reg32>
+@@ -2967,14 +763,14 @@ to upconvert to 32b float internally?
+
+ LIMIT is set to PITCH - 64, to make room for a bit of overflow
+ -->
+- <reg64 offset="0x0c30" name="VSC_PRIM_STRM_ADDRESS" type="waddress" usage="cmd"/>
+- <reg32 offset="0x0c32" name="VSC_PRIM_STRM_PITCH" usage="cmd"/>
+- <reg32 offset="0x0c33" name="VSC_PRIM_STRM_LIMIT" usage="cmd"/>
+- <reg64 offset="0x0c34" name="VSC_DRAW_STRM_ADDRESS" type="waddress" usage="cmd"/>
+- <reg32 offset="0x0c36" name="VSC_DRAW_STRM_PITCH" usage="cmd"/>
+- <reg32 offset="0x0c37" name="VSC_DRAW_STRM_LIMIT" usage="cmd"/>
+-
+- <array offset="0x0c38" name="VSC_STATE" stride="1" length="32" usage="rp_blit">
++ <reg64 offset="0x0c30" name="VSC_PIPE_DATA_PRIM_BASE" type="waddress" usage="cmd"/>
++ <reg32 offset="0x0c32" name="VSC_PIPE_DATA_PRIM_STRIDE" usage="cmd"/>
++ <reg32 offset="0x0c33" name="VSC_PIPE_DATA_PRIM_LENGTH" usage="cmd"/>
++ <reg64 offset="0x0c34" name="VSC_PIPE_DATA_DRAW_BASE" type="waddress" usage="cmd"/>
++ <reg32 offset="0x0c36" name="VSC_PIPE_DATA_DRAW_STRIDE" usage="cmd"/>
++ <reg32 offset="0x0c37" name="VSC_PIPE_DATA_DRAW_LENGTH" usage="cmd"/>
++
++ <array offset="0x0c38" name="VSC_CHANNEL_VISIBILITY" stride="1" length="32" usage="rp_blit">
+ <doc>
+ Seems to be a bitmap of which tiles mapped to the VSC
+ pipe contain geometry.
+@@ -2985,7 +781,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x0" name="REG"/>
+ </array>
+
+- <array offset="0x0c58" name="VSC_PRIM_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
++ <array offset="0x0c58" name="VSC_PIPE_DATA_PRIM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+ <doc>
+ Has the size of data written to corresponding VSC_PRIM_STRM
+ buffer.
+@@ -2993,10 +789,10 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x0" name="REG"/>
+ </array>
+
+- <array offset="0x0c78" name="VSC_DRAW_STRM_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
++ <array offset="0x0c78" name="VSC_PIPE_DATA_DRAW_SIZE" stride="1" length="32" variants="A6XX" usage="rp_blit">
+ <doc>
+ Has the size of data written to corresponding VSC pipe, ie.
+- same thing that is written out to VSC_DRAW_STRM_SIZE_ADDRESS_LO/HI
++ same thing that is written out to VSC_SIZE_BASE
+ </doc>
+ <reg32 offset="0x0" name="REG"/>
+ </array>
+@@ -3028,17 +824,17 @@ to upconvert to 32b float internally?
+ <bitfield name="PERSP_DIVISION_DISABLE" pos="9" type="boolean"/>
+ </reg32>
+
+- <bitset name="a6xx_gras_xs_cl_cntl" inline="yes">
++ <bitset name="a6xx_gras_xs_clip_cull_distance" inline="yes">
+ <bitfield name="CLIP_MASK" low="0" high="7"/>
+ <bitfield name="CULL_MASK" low="8" high="15"/>
+ </bitset>
+- <reg32 offset="0x8001" name="GRAS_VS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+- <reg32 offset="0x8002" name="GRAS_DS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+- <reg32 offset="0x8003" name="GRAS_GS_CL_CNTL" type="a6xx_gras_xs_cl_cntl" usage="rp_blit"/>
+- <reg32 offset="0x8004" name="GRAS_MAX_LAYER_INDEX" low="0" high="10" type="uint" usage="rp_blit"/>
++ <reg32 offset="0x8001" name="GRAS_CL_VS_CLIP_CULL_DISTANCE" type="a6xx_gras_xs_clip_cull_distance" usage="rp_blit"/>
++ <reg32 offset="0x8002" name="GRAS_CL_DS_CLIP_CULL_DISTANCE" type="a6xx_gras_xs_clip_cull_distance" usage="rp_blit"/>
++ <reg32 offset="0x8003" name="GRAS_CL_GS_CLIP_CULL_DISTANCE" type="a6xx_gras_xs_clip_cull_distance" usage="rp_blit"/>
++ <reg32 offset="0x8004" name="GRAS_CL_ARRAY_SIZE" low="0" high="10" type="uint" usage="rp_blit"/>
+
+- <reg32 offset="0x8005" name="GRAS_CNTL" usage="rp_blit">
+- <!-- see also RB_RENDER_CONTROL0 -->
++ <reg32 offset="0x8005" name="GRAS_CL_INTERP_CNTL" usage="rp_blit">
++ <!-- see also RB_INTERP_CNTL -->
+ <bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+ <bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+ <bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+@@ -3067,7 +863,7 @@ to upconvert to 32b float internally?
+ <!-- <reg32 offset="0x80f0" name="GRAS_UNKNOWN_80F0" type="a6xx_reg_xy"/> -->
+
+ <!-- 0x8006-0x800f invalid -->
+- <array offset="0x8010" name="GRAS_CL_VPORT" stride="6" length="16" usage="rp_blit">
++ <array offset="0x8010" name="GRAS_CL_VIEWPORT" stride="6" length="16" usage="rp_blit">
+ <reg32 offset="0" name="XOFFSET" type="float"/>
+ <reg32 offset="1" name="XSCALE" type="float"/>
+ <reg32 offset="2" name="YOFFSET" type="float"/>
+@@ -3075,7 +871,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="4" name="ZOFFSET" type="float"/>
+ <reg32 offset="5" name="ZSCALE" type="float"/>
+ </array>
+- <array offset="0x8070" name="GRAS_CL_Z_CLAMP" stride="2" length="16" usage="rp_blit">
++ <array offset="0x8070" name="GRAS_CL_VIEWPORT_ZCLAMP" stride="2" length="16" usage="rp_blit">
+ <reg32 offset="0" name="MIN" type="float"/>
+ <reg32 offset="1" name="MAX" type="float"/>
+ </array>
+@@ -3124,7 +920,12 @@ to upconvert to 32b float internally?
+
+ <reg32 offset="0x8099" name="GRAS_SU_CONSERVATIVE_RAS_CNTL" usage="cmd">
+ <bitfield name="CONSERVATIVERASEN" pos="0" type="boolean"/>
+- <bitfield name="SHIFTAMOUNT" low="1" high="2"/>
++ <enum name="a6xx_shift_amount">
++ <value value="0" name="NO_SHIFT"/>
++ <value value="1" name="HALF_PIXEL_SHIFT"/>
++ <value value="2" name="FULL_PIXEL_SHIFT"/>
++ </enum>
++ <bitfield name="SHIFTAMOUNT" low="1" high="2" type="a6xx_shift_amount"/>
+ <bitfield name="INNERCONSERVATIVERASEN" pos="3" type="boolean"/>
+ <bitfield name="UNK4" low="4" high="5"/>
+ </reg32>
+@@ -3133,13 +934,13 @@ to upconvert to 32b float internally?
+ <bitfield name="LINELENGTHEN" pos="1" type="boolean"/>
+ </reg32>
+
+- <bitset name="a6xx_gras_layer_cntl" inline="yes">
++ <bitset name="a6xx_gras_us_xs_siv_cntl" inline="yes">
+ <bitfield name="WRITES_LAYER" pos="0" type="boolean"/>
+ <bitfield name="WRITES_VIEW" pos="1" type="boolean"/>
+ </bitset>
+- <reg32 offset="0x809b" name="GRAS_VS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x809c" name="GRAS_GS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x809d" name="GRAS_DS_LAYER_CNTL" type="a6xx_gras_layer_cntl" usage="rp_blit"/>
++ <reg32 offset="0x809b" name="GRAS_SU_VS_SIV_CNTL" type="a6xx_gras_us_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x809c" name="GRAS_SU_GS_SIV_CNTL" type="a6xx_gras_us_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x809d" name="GRAS_SU_DS_SIV_CNTL" type="a6xx_gras_us_xs_siv_cntl" usage="rp_blit"/>
+ <!-- 0x809e/0x809f invalid -->
+
+ <enum name="a6xx_sequenced_thread_dist">
+@@ -3213,13 +1014,13 @@ to upconvert to 32b float internally?
+ <enum name="a6xx_lrz_feedback_mask">
+ <value value="0x0" name="LRZ_FEEDBACK_NONE"/>
+ <value value="0x1" name="LRZ_FEEDBACK_EARLY_Z"/>
+- <value value="0x2" name="LRZ_FEEDBACK_EARLY_LRZ_LATE_Z"/>
++ <value value="0x2" name="LRZ_FEEDBACK_EARLY_Z_LATE_Z"/>
+ <!-- We don't have a flag type and this flags combination is often used -->
+- <value value="0x3" name="LRZ_FEEDBACK_EARLY_Z_OR_EARLY_LRZ_LATE_Z"/>
++ <value value="0x3" name="LRZ_FEEDBACK_EARLY_Z_OR_EARLY_Z_LATE_Z"/>
+ <value value="0x4" name="LRZ_FEEDBACK_LATE_Z"/>
+ </enum>
+
+- <reg32 offset="0x80a1" name="GRAS_BIN_CONTROL" usage="rp_blit">
++ <reg32 offset="0x80a1" name="GRAS_SC_BIN_CNTL" usage="rp_blit">
+ <bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+ <bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+ <bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+@@ -3235,22 +1036,22 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK27" pos="27"/>
+ </reg32>
+
+- <reg32 offset="0x80a2" name="GRAS_RAS_MSAA_CNTL" usage="rp_blit">
++ <reg32 offset="0x80a2" name="GRAS_SC_RAS_MSAA_CNTL" usage="rp_blit">
+ <bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+ <bitfield name="UNK2" pos="2"/>
+ <bitfield name="UNK3" pos="3"/>
+ </reg32>
+- <reg32 offset="0x80a3" name="GRAS_DEST_MSAA_CNTL" usage="rp_blit">
++ <reg32 offset="0x80a3" name="GRAS_SC_DEST_MSAA_CNTL" usage="rp_blit">
+ <bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+ <bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+ </reg32>
+
+- <bitset name="a6xx_sample_config" inline="yes">
++ <bitset name="a6xx_msaa_sample_pos_cntl" inline="yes">
+ <bitfield name="UNK0" pos="0"/>
+ <bitfield name="LOCATION_ENABLE" pos="1" type="boolean"/>
+ </bitset>
+
+- <bitset name="a6xx_sample_locations" inline="yes">
++ <bitset name="a6xx_programmable_msaa_pos" inline="yes">
+ <bitfield name="SAMPLE_0_X" low="0" high="3" radix="4" type="fixed"/>
+ <bitfield name="SAMPLE_0_Y" low="4" high="7" radix="4" type="fixed"/>
+ <bitfield name="SAMPLE_1_X" low="8" high="11" radix="4" type="fixed"/>
+@@ -3261,9 +1062,9 @@ to upconvert to 32b float internally?
+ <bitfield name="SAMPLE_3_Y" low="28" high="31" radix="4" type="fixed"/>
+ </bitset>
+
+- <reg32 offset="0x80a4" name="GRAS_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+- <reg32 offset="0x80a5" name="GRAS_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+- <reg32 offset="0x80a6" name="GRAS_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
++ <reg32 offset="0x80a4" name="GRAS_SC_MSAA_SAMPLE_POS_CNTL" type="a6xx_msaa_sample_pos_cntl" usage="rp_blit"/>
++ <reg32 offset="0x80a5" name="GRAS_SC_PROGRAMMABLE_MSAA_POS_0" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
++ <reg32 offset="0x80a6" name="GRAS_SC_PROGRAMMABLE_MSAA_POS_1" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
+
+ <reg32 offset="0x80a7" name="GRAS_UNKNOWN_80A7" variants="A7XX-" usage="cmd"/>
+
+@@ -3286,13 +1087,36 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x80f0" name="GRAS_SC_WINDOW_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+ <reg32 offset="0x80f1" name="GRAS_SC_WINDOW_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+
+- <!-- 0x80f4 - 0x80fa are used for VK_KHR_fragment_shading_rate -->
+- <reg64 offset="0x80f4" name="GRAS_UNKNOWN_80F4" variants="A7XX-" usage="cmd"/>
+- <reg64 offset="0x80f5" name="GRAS_UNKNOWN_80F5" variants="A7XX-" usage="cmd"/>
+- <reg64 offset="0x80f6" name="GRAS_UNKNOWN_80F6" variants="A7XX-" usage="cmd"/>
+- <reg64 offset="0x80f8" name="GRAS_UNKNOWN_80F8" variants="A7XX-" usage="cmd"/>
+- <reg64 offset="0x80f9" name="GRAS_UNKNOWN_80F9" variants="A7XX-" usage="cmd"/>
+- <reg64 offset="0x80fa" name="GRAS_UNKNOWN_80FA" variants="A7XX-" usage="cmd"/>
++ <enum name="a6xx_fsr_combiner">
++ <value value="0" name="FSR_COMBINER_OP_KEEP"/>
++ <value value="1" name="FSR_COMBINER_OP_REPLACE"/>
++ <value value="2" name="FSR_COMBINER_OP_MIN"/>
++ <value value="3" name="FSR_COMBINER_OP_MAX"/>
++ <value value="4" name="FSR_COMBINER_OP_MUL"/>
++ </enum>
++
++ <reg32 offset="0x80f4" name="GRAS_VRS_CONFIG" variants="A7XX-" usage="rp_blit">
++ <bitfield name="PIPELINE_FSR_ENABLE" pos="0" type="boolean"/>
++ <bitfield name="FRAG_SIZE_X" low="1" high="2" type="uint"/>
++ <bitfield name="FRAG_SIZE_Y" low="3" high="4" type="uint"/>
++ <bitfield name="COMBINER_OP_1" low="5" high="7" type="a6xx_fsr_combiner"/>
++ <bitfield name="COMBINER_OP_2" low="8" high="10" type="a6xx_fsr_combiner"/>
++ <bitfield name="ATTACHMENT_FSR_ENABLE" pos="13" type="boolean"/>
++ <bitfield name="PRIMITIVE_FSR_ENABLE" pos="20" type="boolean"/>
++ </reg32>
++ <reg32 offset="0x80f5" name="GRAS_QUALITY_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
++ <bitfield name="LAYERED" pos="0" type="boolean"/>
++ <bitfield name="TILE_MODE" low="1" high="2" type="a6xx_tile_mode"/>
++ </reg32>
++ <reg32 offset="0x80f6" name="GRAS_QUALITY_BUFFER_DIMENSION" variants="A7XX-" usage="rp_blit">
++ <bitfield name="WIDTH" low="0" high="15" type="uint"/>
++ <bitfield name="HEIGHT" low="16" high="31" type="uint"/>
++ </reg32>
++ <reg64 offset="0x80f8" name="GRAS_QUALITY_BUFFER_BASE" variants="A7XX-" type="waddress" usage="rp_blit"/>
++ <reg32 offset="0x80fa" name="GRAS_QUALITY_BUFFER_PITCH" variants="A7XX-" usage="rp_blit">
++ <bitfield name="PITCH" shr="6" low="0" high="7" type="uint"/>
++ <bitfield name="ARRAY_PITCH" shr="6" low="10" high="28" type="uint"/>
++ </reg32>
+
+ <enum name="a6xx_lrz_dir_status">
+ <value value="0x1" name="LRZ_DIR_LE"/>
+@@ -3313,7 +1137,7 @@ to upconvert to 32b float internally?
+ </doc>
+ <bitfield name="FC_ENABLE" pos="3" type="boolean" variants="A6XX"/>
+ <!-- set when depth-test + depth-write enabled -->
+- <bitfield name="Z_TEST_ENABLE" pos="4" type="boolean"/>
++ <bitfield name="Z_WRITE_ENABLE" pos="4" type="boolean"/>
+ <bitfield name="Z_BOUNDS_ENABLE" pos="5" type="boolean"/>
+ <bitfield name="DIR" low="6" high="7" type="a6xx_lrz_dir_status"/>
+ <doc>
+@@ -3339,14 +1163,13 @@ to upconvert to 32b float internally?
+ <bitfield name="FRAGCOORDSAMPLEMODE" low="1" high="2" type="a6xx_fragcoord_sample_mode"/>
+ </reg32>
+
+- <reg32 offset="0x8102" name="GRAS_LRZ_MRT_BUF_INFO_0" usage="rp_blit">
++ <reg32 offset="0x8102" name="GRAS_LRZ_MRT_BUFFER_INFO_0" usage="rp_blit">
+ <bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+ </reg32>
+ <reg64 offset="0x8103" name="GRAS_LRZ_BUFFER_BASE" align="256" type="waddress" usage="rp_blit"/>
+ <reg32 offset="0x8105" name="GRAS_LRZ_BUFFER_PITCH" usage="rp_blit">
+- <!-- TODO: fix the shr fields -->
+ <bitfield name="PITCH" low="0" high="7" shr="5" type="uint"/>
+- <bitfield name="ARRAY_PITCH" low="10" high="28" shr="4" type="uint"/>
++ <bitfield name="ARRAY_PITCH" low="10" high="28" shr="8" type="uint"/>
+ </reg32>
+
+ <!--
+@@ -3381,18 +1204,18 @@ to upconvert to 32b float internally?
+ -->
+ <reg64 offset="0x8106" name="GRAS_LRZ_FAST_CLEAR_BUFFER_BASE" align="64" type="waddress" usage="rp_blit"/>
+ <!-- 0x8108 invalid -->
+- <reg32 offset="0x8109" name="GRAS_SAMPLE_CNTL" usage="rp_blit">
++ <reg32 offset="0x8109" name="GRAS_LRZ_PS_SAMPLEFREQ_CNTL" usage="rp_blit">
+ <bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+ </reg32>
+ <!--
+ LRZ buffer represents a single array layer + mip level, and there is
+ a single buffer per depth image. Thus to reuse LRZ between renderpasses
+ it is necessary to track the depth view used in the past renderpass, which
+- GRAS_LRZ_DEPTH_VIEW is for.
+- GRAS_LRZ_CNTL checks if current value of GRAS_LRZ_DEPTH_VIEW is equal to
++ GRAS_LRZ_VIEW_INFO is for.
++ GRAS_LRZ_CNTL checks if current value of GRAS_LRZ_VIEW_INFO is equal to
+ the value stored in the LRZ buffer, if not - LRZ is disabled.
+ -->
+- <reg32 offset="0x810a" name="GRAS_LRZ_DEPTH_VIEW" usage="cmd">
++ <reg32 offset="0x810a" name="GRAS_LRZ_VIEW_INFO" usage="cmd">
+ <bitfield name="BASE_LAYER" low="0" high="10" type="uint"/>
+ <bitfield name="LAYER_COUNT" low="16" high="26" type="uint"/>
+ <bitfield name="BASE_MIP_LEVEL" low="28" high="31" type="uint"/>
+@@ -3408,7 +1231,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8110" name="GRAS_UNKNOWN_8110" low="0" high="1" usage="cmd"/>
+
+ <!-- A bit tentative but it's a color and it is followed by LRZ_CLEAR -->
+- <reg32 offset="0x8111" name="GRAS_LRZ_CLEAR_DEPTH_F32" type="float" variants="A7XX-"/>
++ <reg32 offset="0x8111" name="GRAS_LRZ_DEPTH_CLEAR" type="float" variants="A7XX-"/>
+
+ <reg32 offset="0x8113" name="GRAS_LRZ_DEPTH_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+ <bitfield name="DEPTH_FORMAT" low="0" high="2" type="a6xx_depth_format"/>
+@@ -3430,7 +1253,7 @@ to upconvert to 32b float internally?
+ <value value="0x5" name="ROTATE_VFLIP"/>
+ </enum>
+
+- <bitset name="a6xx_2d_blit_cntl" inline="yes">
++ <bitset name="a6xx_a2d_bit_cntl" inline="yes">
+ <bitfield name="ROTATE" low="0" high="2" type="a6xx_rotation"/>
+ <bitfield name="OVERWRITEEN" pos="3" type="boolean"/>
+ <bitfield name="UNK4" low="4" high="6"/>
+@@ -3447,22 +1270,22 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK30" pos="30" type="boolean" variants="A7XX-"/>
+ </bitset>
+
+- <reg32 offset="0x8400" name="GRAS_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
++ <reg32 offset="0x8400" name="GRAS_A2D_BLT_CNTL" type="a6xx_a2d_bit_cntl" usage="rp_blit"/>
+ <!-- note: the low 8 bits for src coords are valid, probably fixed point
+ it would be a bit weird though, since we subtract 1 from BR coords
+ apparently signed, gallium driver uses negative coords and it works?
+ -->
+- <reg32 offset="0x8401" name="GRAS_2D_SRC_TL_X" low="8" high="24" type="int" usage="rp_blit"/>
+- <reg32 offset="0x8402" name="GRAS_2D_SRC_BR_X" low="8" high="24" type="int" usage="rp_blit"/>
+- <reg32 offset="0x8403" name="GRAS_2D_SRC_TL_Y" low="8" high="24" type="int" usage="rp_blit"/>
+- <reg32 offset="0x8404" name="GRAS_2D_SRC_BR_Y" low="8" high="24" type="int" usage="rp_blit"/>
+- <reg32 offset="0x8405" name="GRAS_2D_DST_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0x8406" name="GRAS_2D_DST_BR" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x8401" name="GRAS_A2D_SRC_XMIN" low="8" high="24" type="int" usage="rp_blit"/>
++ <reg32 offset="0x8402" name="GRAS_A2D_SRC_XMAX" low="8" high="24" type="int" usage="rp_blit"/>
++ <reg32 offset="0x8403" name="GRAS_A2D_SRC_YMIN" low="8" high="24" type="int" usage="rp_blit"/>
++ <reg32 offset="0x8404" name="GRAS_A2D_SRC_YMAX" low="8" high="24" type="int" usage="rp_blit"/>
++ <reg32 offset="0x8405" name="GRAS_A2D_DEST_TL" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x8406" name="GRAS_A2D_DEST_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+ <reg32 offset="0x8407" name="GRAS_2D_UNKNOWN_8407" low="0" high="31"/>
+ <reg32 offset="0x8408" name="GRAS_2D_UNKNOWN_8408" low="0" high="31"/>
+ <reg32 offset="0x8409" name="GRAS_2D_UNKNOWN_8409" low="0" high="31"/>
+- <reg32 offset="0x840a" name="GRAS_2D_RESOLVE_CNTL_1" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0x840b" name="GRAS_2D_RESOLVE_CNTL_2" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x840a" name="GRAS_A2D_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x840b" name="GRAS_A2D_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
+ <!-- 0x840c-0x85ff invalid -->
+
+ <!-- always 0x880 ? (and 0 in a640/a650 traces?) -->
+@@ -3481,7 +1304,7 @@ to upconvert to 32b float internally?
+ -->
+
+ <!-- same as GRAS_BIN_CONTROL, but without bit 27: -->
+- <reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0x8800" name="RB_CNTL" variants="A6XX" usage="rp_blit">
+ <bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+ <bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+ <bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+@@ -3490,7 +1313,7 @@ to upconvert to 32b float internally?
+ <bitfield name="LRZ_FEEDBACK_ZMODE_MASK" low="24" high="26" type="a6xx_lrz_feedback_mask"/>
+ </reg32>
+
+- <reg32 offset="0x8800" name="RB_BIN_CONTROL" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x8800" name="RB_CNTL" variants="A7XX-" usage="rp_blit">
+ <bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+ <bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+ <bitfield name="RENDER_MODE" low="18" high="20" type="a6xx_render_mode"/>
+@@ -3501,8 +1324,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A6XX" usage="rp_blit">
+ <bitfield name="CCUSINGLECACHELINESIZE" low="3" high="5"/>
+ <bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+- <!-- set during binning pass: -->
+- <bitfield name="BINNING" pos="7" type="boolean"/>
++ <bitfield name="FS_DISABLE" pos="7" type="boolean"/>
+ <bitfield name="UNK8" low="8" high="10"/>
+ <bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+ <bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+@@ -3515,15 +1337,14 @@ to upconvert to 32b float internally?
+ </reg32>
+ <reg32 offset="0x8801" name="RB_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+ <bitfield name="EARLYVIZOUTEN" pos="6" type="boolean"/>
+- <!-- set during binning pass: -->
+- <bitfield name="BINNING" pos="7" type="boolean"/>
++ <bitfield name="FS_DISABLE" pos="7" type="boolean"/>
+ <bitfield name="RASTER_MODE" pos="8" type="a6xx_raster_mode"/>
+ <bitfield name="RASTER_DIRECTION" low="9" high="10" type="a6xx_raster_direction"/>
+ <bitfield name="CONSERVATIVERASEN" pos="11" type="boolean"/>
+ <bitfield name="INNERCONSERVATIVERASEN" pos="12" type="boolean"/>
+ </reg32>
+ <reg32 offset="0x8116" name="GRAS_SU_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
+- <bitfield name="BINNING" pos="7" type="boolean"/>
++ <bitfield name="FS_DISABLE" pos="7" type="boolean"/>
+ </reg32>
+
+ <reg32 offset="0x8802" name="RB_RAS_MSAA_CNTL" usage="rp_blit">
+@@ -3536,16 +1357,16 @@ to upconvert to 32b float internally?
+ <bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+ </reg32>
+
+- <reg32 offset="0x8804" name="RB_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+- <reg32 offset="0x8805" name="RB_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+- <reg32 offset="0x8806" name="RB_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
++ <reg32 offset="0x8804" name="RB_MSAA_SAMPLE_POS_CNTL" type="a6xx_msaa_sample_pos_cntl" usage="rp_blit"/>
++ <reg32 offset="0x8805" name="RB_PROGRAMMABLE_MSAA_POS_0" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
++ <reg32 offset="0x8806" name="RB_PROGRAMMABLE_MSAA_POS_1" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
+ <!-- 0x8807-0x8808 invalid -->
+ <!--
+ note: maybe not actually called RB_RENDER_CONTROLn (since RB_RENDER_CNTL
+ name comes from kernel and is probably right)
+ -->
+- <reg32 offset="0x8809" name="RB_RENDER_CONTROL0" usage="rp_blit">
+- <!-- see also GRAS_CNTL -->
++ <reg32 offset="0x8809" name="RB_INTERP_CNTL" usage="rp_blit">
++ <!-- see also GRAS_CL_INTERP_CNTL -->
+ <bitfield name="IJ_PERSP_PIXEL" pos="0" type="boolean"/>
+ <bitfield name="IJ_PERSP_CENTROID" pos="1" type="boolean"/>
+ <bitfield name="IJ_PERSP_SAMPLE" pos="2" type="boolean"/>
+@@ -3555,7 +1376,7 @@ to upconvert to 32b float internally?
+ <bitfield name="COORD_MASK" low="6" high="9" type="hex"/>
+ <bitfield name="UNK10" pos="10" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x880a" name="RB_RENDER_CONTROL1" usage="rp_blit">
++ <reg32 offset="0x880a" name="RB_PS_INPUT_CNTL" usage="rp_blit">
+ <!-- enable bits for various FS sysvalue regs: -->
+ <bitfield name="SAMPLEMASK" pos="0" type="boolean"/>
+ <bitfield name="POSTDEPTHCOVERAGE" pos="1" type="boolean"/>
+@@ -3567,16 +1388,16 @@ to upconvert to 32b float internally?
+ <bitfield name="FOVEATION" pos="8" type="boolean"/>
+ </reg32>
+
+- <reg32 offset="0x880b" name="RB_FS_OUTPUT_CNTL0" usage="rp_blit">
++ <reg32 offset="0x880b" name="RB_PS_OUTPUT_CNTL" usage="rp_blit">
+ <bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+ <bitfield name="FRAG_WRITES_Z" pos="1" type="boolean"/>
+ <bitfield name="FRAG_WRITES_SAMPMASK" pos="2" type="boolean"/>
+ <bitfield name="FRAG_WRITES_STENCILREF" pos="3" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x880c" name="RB_FS_OUTPUT_CNTL1" usage="rp_blit">
++ <reg32 offset="0x880c" name="RB_PS_MRT_CNTL" usage="rp_blit">
+ <bitfield name="MRT" low="0" high="3" type="uint"/>
+ </reg32>
+- <reg32 offset="0x880d" name="RB_RENDER_COMPONENTS" usage="rp_blit">
++ <reg32 offset="0x880d" name="RB_PS_OUTPUT_MASK" usage="rp_blit">
+ <bitfield name="RT0" low="0" high="3"/>
+ <bitfield name="RT1" low="4" high="7"/>
+ <bitfield name="RT2" low="8" high="11"/>
+@@ -3608,7 +1429,7 @@ to upconvert to 32b float internally?
+ <bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+ </reg32>
+
+- <reg32 offset="0x8810" name="RB_SAMPLE_CNTL" usage="rp_blit">
++ <reg32 offset="0x8810" name="RB_PS_SAMPLEFREQ_CNTL" usage="rp_blit">
+ <bitfield name="PER_SAMP_MODE" pos="0" type="boolean"/>
+ </reg32>
+ <reg32 offset="0x8811" name="RB_UNKNOWN_8811" low="4" high="6" usage="cmd"/>
+@@ -3672,18 +1493,18 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x7" name="BASE_GMEM" low="12" high="31" shr="12"/>
+ </array>
+
+- <reg32 offset="0x8860" name="RB_BLEND_RED_F32" type="float" usage="rp_blit"/>
+- <reg32 offset="0x8861" name="RB_BLEND_GREEN_F32" type="float" usage="rp_blit"/>
+- <reg32 offset="0x8862" name="RB_BLEND_BLUE_F32" type="float" usage="rp_blit"/>
+- <reg32 offset="0x8863" name="RB_BLEND_ALPHA_F32" type="float" usage="rp_blit"/>
+- <reg32 offset="0x8864" name="RB_ALPHA_CONTROL" usage="cmd">
++ <reg32 offset="0x8860" name="RB_BLEND_CONSTANT_RED_FP32" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8861" name="RB_BLEND_CONSTANT_GREEN_FP32" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8862" name="RB_BLEND_CONSTANT_BLUE_FP32" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8863" name="RB_BLEND_CONSTANT_ALPHA_FP32" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8864" name="RB_ALPHA_TEST_CNTL" usage="cmd">
+ <bitfield name="ALPHA_REF" low="0" high="7" type="hex"/>
+ <bitfield name="ALPHA_TEST" pos="8" type="boolean"/>
+ <bitfield name="ALPHA_TEST_FUNC" low="9" high="11" type="adreno_compare_func"/>
+ </reg32>
+ <reg32 offset="0x8865" name="RB_BLEND_CNTL" usage="rp_blit">
+ <!-- per-mrt enable bit -->
+- <bitfield name="ENABLE_BLEND" low="0" high="7"/>
++ <bitfield name="BLEND_READS_DEST" low="0" high="7"/>
+ <bitfield name="INDEPENDENT_BLEND" pos="8" type="boolean"/>
+ <bitfield name="DUAL_COLOR_IN_ENABLE" pos="9" type="boolean"/>
+ <bitfield name="ALPHA_TO_COVERAGE" pos="10" type="boolean"/>
+@@ -3726,12 +1547,12 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8873" name="RB_DEPTH_BUFFER_PITCH" low="0" high="13" shr="6" type="uint" usage="rp_blit"/>
+ <reg32 offset="0x8874" name="RB_DEPTH_BUFFER_ARRAY_PITCH" low="0" high="27" shr="6" type="uint" usage="rp_blit"/>
+ <reg64 offset="0x8875" name="RB_DEPTH_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8877" name="RB_DEPTH_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
++ <reg32 offset="0x8877" name="RB_DEPTH_GMEM_BASE" low="12" high="31" shr="12" usage="rp_blit"/>
+
+- <reg32 offset="0x8878" name="RB_Z_BOUNDS_MIN" type="float" usage="rp_blit"/>
+- <reg32 offset="0x8879" name="RB_Z_BOUNDS_MAX" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8878" name="RB_DEPTH_BOUND_MIN" type="float" usage="rp_blit"/>
++ <reg32 offset="0x8879" name="RB_DEPTH_BOUND_MAX" type="float" usage="rp_blit"/>
+ <!-- 0x887a-0x887f invalid -->
+- <reg32 offset="0x8880" name="RB_STENCIL_CONTROL" usage="rp_blit">
++ <reg32 offset="0x8880" name="RB_STENCIL_CNTL" usage="rp_blit">
+ <bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+ <bitfield name="STENCIL_ENABLE_BF" pos="1" type="boolean"/>
+ <!--
+@@ -3753,11 +1574,11 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8115" name="GRAS_SU_STENCIL_CNTL" usage="rp_blit">
+ <bitfield name="STENCIL_ENABLE" pos="0" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0x8881" name="RB_STENCIL_BUFFER_INFO" variants="A6XX" usage="rp_blit">
+ <bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+ <bitfield name="UNK1" pos="1" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x8881" name="RB_STENCIL_INFO" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x8881" name="RB_STENCIL_BUFFER_INFO" variants="A7XX-" usage="rp_blit">
+ <bitfield name="SEPARATE_STENCIL" pos="0" type="boolean"/>
+ <bitfield name="UNK1" pos="1" type="boolean"/>
+ <bitfield name="TILEMODE" low="2" high="3" type="a6xx_tile_mode"/>
+@@ -3765,22 +1586,22 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8882" name="RB_STENCIL_BUFFER_PITCH" low="0" high="11" shr="6" type="uint" usage="rp_blit"/>
+ <reg32 offset="0x8883" name="RB_STENCIL_BUFFER_ARRAY_PITCH" low="0" high="23" shr="6" type="uint" usage="rp_blit"/>
+ <reg64 offset="0x8884" name="RB_STENCIL_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8886" name="RB_STENCIL_BUFFER_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
+- <reg32 offset="0x8887" name="RB_STENCILREF" usage="rp_blit">
++ <reg32 offset="0x8886" name="RB_STENCIL_GMEM_BASE" low="12" high="31" shr="12" usage="rp_blit"/>
++ <reg32 offset="0x8887" name="RB_STENCIL_REF_CNTL" usage="rp_blit">
+ <bitfield name="REF" low="0" high="7"/>
+ <bitfield name="BFREF" low="8" high="15"/>
+ </reg32>
+- <reg32 offset="0x8888" name="RB_STENCILMASK" usage="rp_blit">
++ <reg32 offset="0x8888" name="RB_STENCIL_MASK" usage="rp_blit">
+ <bitfield name="MASK" low="0" high="7"/>
+ <bitfield name="BFMASK" low="8" high="15"/>
+ </reg32>
+- <reg32 offset="0x8889" name="RB_STENCILWRMASK" usage="rp_blit">
++ <reg32 offset="0x8889" name="RB_STENCIL_WRITE_MASK" usage="rp_blit">
+ <bitfield name="WRMASK" low="0" high="7"/>
+ <bitfield name="BFWRMASK" low="8" high="15"/>
+ </reg32>
+ <!-- 0x888a-0x888f invalid -->
+ <reg32 offset="0x8890" name="RB_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0x8891" name="RB_SAMPLE_COUNT_CONTROL" usage="cmd">
++ <reg32 offset="0x8891" name="RB_SAMPLE_COUNTER_CNTL" usage="cmd">
+ <bitfield name="DISABLE" pos="0" type="boolean"/>
+ <bitfield name="COPY" pos="1" type="boolean"/>
+ </reg32>
+@@ -3791,27 +1612,27 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8899" name="RB_UNKNOWN_8899" variants="A7XX-" usage="cmd"/>
+ <!-- 0x8899-0x88bf invalid -->
+ <!-- clamps depth value for depth test/write -->
+- <reg32 offset="0x88c0" name="RB_Z_CLAMP_MIN" type="float" usage="rp_blit"/>
+- <reg32 offset="0x88c1" name="RB_Z_CLAMP_MAX" type="float" usage="rp_blit"/>
++ <reg32 offset="0x88c0" name="RB_VIEWPORT_ZCLAMP_MIN" type="float" usage="rp_blit"/>
++ <reg32 offset="0x88c1" name="RB_VIEWPORT_ZCLAMP_MAX" type="float" usage="rp_blit"/>
+ <!-- 0x88c2-0x88cf invalid-->
+- <reg32 offset="0x88d0" name="RB_UNKNOWN_88D0" usage="rp_blit">
++ <reg32 offset="0x88d0" name="RB_RESOLVE_CNTL_0" usage="rp_blit">
+ <bitfield name="UNK0" low="0" high="12"/>
+ <bitfield name="UNK16" low="16" high="26"/>
+ </reg32>
+- <reg32 offset="0x88d1" name="RB_BLIT_SCISSOR_TL" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0x88d2" name="RB_BLIT_SCISSOR_BR" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x88d1" name="RB_RESOLVE_CNTL_1" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x88d2" name="RB_RESOLVE_CNTL_2" type="a6xx_reg_xy" usage="rp_blit"/>
+ <!-- weird to duplicate other regs from same block?? -->
+- <reg32 offset="0x88d3" name="RB_BIN_CONTROL2" usage="rp_blit">
++ <reg32 offset="0x88d3" name="RB_RESOLVE_CNTL_3" usage="rp_blit">
+ <bitfield name="BINW" low="0" high="5" shr="5" type="uint"/>
+ <bitfield name="BINH" low="8" high="14" shr="4" type="uint"/>
+ </reg32>
+- <reg32 offset="0x88d4" name="RB_WINDOW_OFFSET2" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0x88d5" name="RB_BLIT_GMEM_MSAA_CNTL" usage="rp_blit">
++ <reg32 offset="0x88d4" name="RB_RESOLVE_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
++ <reg32 offset="0x88d5" name="RB_RESOLVE_GMEM_BUFFER_INFO" usage="rp_blit">
+ <bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+ </reg32>
+- <reg32 offset="0x88d6" name="RB_BLIT_BASE_GMEM" low="12" high="31" shr="12" usage="rp_blit"/>
++ <reg32 offset="0x88d6" name="RB_RESOLVE_GMEM_BUFFER_BASE" low="12" high="31" shr="12" usage="rp_blit"/>
+ <!-- s/DST_FORMAT/DST_INFO/ probably: -->
+- <reg32 offset="0x88d7" name="RB_BLIT_DST_INFO" usage="rp_blit">
++ <reg32 offset="0x88d7" name="RB_RESOLVE_SYSTEM_BUFFER_INFO" usage="rp_blit">
+ <bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+ <bitfield name="FLAGS" pos="2" type="boolean"/>
+ <bitfield name="SAMPLES" low="3" high="4" type="a3xx_msaa_samples"/>
+@@ -3820,25 +1641,31 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK15" pos="15" type="boolean"/>
+ <bitfield name="MUTABLEEN" pos="16" type="boolean" variants="A7XX-"/>
+ </reg32>
+- <reg64 offset="0x88d8" name="RB_BLIT_DST" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x88da" name="RB_BLIT_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
++ <reg64 offset="0x88d8" name="RB_RESOLVE_SYSTEM_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x88da" name="RB_RESOLVE_SYSTEM_BUFFER_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+ <!-- array-pitch is size of layer -->
+- <reg32 offset="0x88db" name="RB_BLIT_DST_ARRAY_PITCH" low="0" high="28" shr="6" type="uint" usage="rp_blit"/>
+- <reg64 offset="0x88dc" name="RB_BLIT_FLAG_DST" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x88de" name="RB_BLIT_FLAG_DST_PITCH" usage="rp_blit">
++ <reg32 offset="0x88db" name="RB_RESOLVE_SYSTEM_BUFFER_ARRAY_PITCH" low="0" high="28" shr="6" type="uint" usage="rp_blit"/>
++ <reg64 offset="0x88dc" name="RB_RESOLVE_SYSTEM_FLAG_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x88de" name="RB_RESOLVE_SYSTEM_FLAG_BUFFER_PITCH" usage="rp_blit">
+ <bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+ <bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+ </reg32>
+
+- <reg32 offset="0x88df" name="RB_BLIT_CLEAR_COLOR_DW0" usage="rp_blit"/>
+- <reg32 offset="0x88e0" name="RB_BLIT_CLEAR_COLOR_DW1" usage="rp_blit"/>
+- <reg32 offset="0x88e1" name="RB_BLIT_CLEAR_COLOR_DW2" usage="rp_blit"/>
+- <reg32 offset="0x88e2" name="RB_BLIT_CLEAR_COLOR_DW3" usage="rp_blit"/>
++ <reg32 offset="0x88df" name="RB_RESOLVE_CLEAR_COLOR_DW0" usage="rp_blit"/>
++ <reg32 offset="0x88e0" name="RB_RESOLVE_CLEAR_COLOR_DW1" usage="rp_blit"/>
++ <reg32 offset="0x88e1" name="RB_RESOLVE_CLEAR_COLOR_DW2" usage="rp_blit"/>
++ <reg32 offset="0x88e2" name="RB_RESOLVE_CLEAR_COLOR_DW3" usage="rp_blit"/>
++
++ <enum name="a6xx_blit_event_type">
++ <value value="0x0" name="BLIT_EVENT_STORE"/>
++ <value value="0x1" name="BLIT_EVENT_STORE_AND_CLEAR"/>
++ <value value="0x2" name="BLIT_EVENT_CLEAR"/>
++ <value value="0x3" name="BLIT_EVENT_LOAD"/>
++ </enum>
+
+ <!-- seems somewhat similar to what we called RB_CLEAR_CNTL on a5xx: -->
+- <reg32 offset="0x88e3" name="RB_BLIT_INFO" usage="rp_blit">
+- <bitfield name="UNK0" pos="0" type="boolean"/> <!-- s8 stencil restore/clear? But also color restore? -->
+- <bitfield name="GMEM" pos="1" type="boolean"/> <!-- set for restore and clear to gmem? -->
++ <reg32 offset="0x88e3" name="RB_RESOLVE_OPERATION" usage="rp_blit">
++ <bitfield name="TYPE" low="0" high="1" type="a6xx_blit_event_type"/>
+ <bitfield name="SAMPLE_0" pos="2" type="boolean"/> <!-- takes sample 0 instead of averaging -->
+ <bitfield name="DEPTH" pos="3" type="boolean"/> <!-- z16/z32/z24s8/x24x8 clear or resolve? -->
+ <doc>
+@@ -3853,16 +1680,20 @@ to upconvert to 32b float internally?
+ <!-- set when this is the last resolve on a650+ -->
+ <bitfield name="LAST" low="8" high="9"/>
+ <!--
+- a618 GLES: color render target number being resolved for RM6_RESOLVE, 0x8 for depth, 0x9 for separate stencil.
+- a618 VK: 0x8 for depth RM6_RESOLVE, 0x9 for separate stencil, 0 otherwise.
+-
+- We believe this is related to concurrent resolves
++ a618 GLES: color render target number being resolved for CCU_RESOLVE, 0x8 for depth, 0x9 for separate stencil.
++ a618 VK: 0x8 for depth CCU_RESOLVE, 0x9 for separate stencil, 0 otherwise.
++ a7xx VK: 0x8 for depth, 0x9 for separate stencil, 0x0 to 0x7 used for concurrent resolves of color render
++ targets inside a given resolve group.
+ -->
+ <bitfield name="BUFFER_ID" low="12" high="15"/>
+ </reg32>
+- <reg32 offset="0x88e4" name="RB_UNKNOWN_88E4" variants="A7XX-" usage="rp_blit">
+- <!-- Value conditioned based on predicate, changed before blits -->
+- <bitfield name="UNK0" pos="0" type="boolean"/>
++
++ <enum name="a7xx_blit_clear_mode">
++ <value value="0x0" name="CLEAR_MODE_SYSMEM"/>
++ <value value="0x1" name="CLEAR_MODE_GMEM"/>
++ </enum>
++ <reg32 offset="0x88e4" name="RB_CLEAR_TARGET" variants="A7XX-" usage="rp_blit">
++ <bitfield name="CLEAR_MODE" pos="0" type="a7xx_blit_clear_mode"/>
+ </reg32>
+
+ <enum name="a6xx_ccu_cache_size">
+@@ -3871,7 +1702,7 @@ to upconvert to 32b float internally?
+ <value value="0x2" name="CCU_CACHE_SIZE_QUARTER"/>
+ <value value="0x3" name="CCU_CACHE_SIZE_EIGHTH"/>
+ </enum>
+- <reg32 offset="0x88e5" name="RB_CCU_CNTL2" variants="A7XX-" usage="cmd">
++ <reg32 offset="0x88e5" name="RB_CCU_CACHE_CNTL" variants="A7XX-" usage="cmd">
+ <bitfield name="DEPTH_OFFSET_HI" pos="0" type="hex"/>
+ <bitfield name="COLOR_OFFSET_HI" pos="2" type="hex"/>
+ <bitfield name="DEPTH_CACHE_SIZE" low="10" high="11" type="a6xx_ccu_cache_size"/>
+@@ -3895,7 +1726,13 @@ to upconvert to 32b float internally?
+ <bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+ <bitfield name="ARRAY_PITCH" low="11" high="23" shr="7" type="uint"/>
+ </reg32>
+- <reg32 offset="0x88f4" name="RB_UNKNOWN_88F4" low="0" high="2"/>
++
++ <reg32 offset="0x88f4" name="RB_VRS_CONFIG" usage="rp_blit">
++ <bitfield name="UNK2" pos="2" type="boolean"/>
++ <bitfield name="PIPELINE_FSR_ENABLE" pos="4" type="boolean"/>
++ <bitfield name="ATTACHMENT_FSR_ENABLE" pos="5" type="boolean"/>
++ <bitfield name="PRIMITIVE_FSR_ENABLE" pos="18" type="boolean"/>
++ </reg32>
+ <!-- Connected to VK_EXT_fragment_density_map? -->
+ <reg32 offset="0x88f5" name="RB_UNKNOWN_88F5" variants="A7XX-"/>
+ <!-- 0x88f6-0x88ff invalid -->
+@@ -3906,7 +1743,7 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK8" low="8" high="10"/>
+ <bitfield name="ARRAY_PITCH" low="11" high="27" shr="7" type="uint"/>
+ </reg32>
+- <array offset="0x8903" name="RB_MRT_FLAG_BUFFER" stride="3" length="8" usage="rp_blit">
++ <array offset="0x8903" name="RB_COLOR_FLAG_BUFFER" stride="3" length="8" usage="rp_blit">
+ <reg64 offset="0" name="ADDR" type="waddress" align="64"/>
+ <reg32 offset="2" name="PITCH">
+ <bitfield name="PITCH" low="0" high="10" shr="6" type="uint"/>
+@@ -3915,10 +1752,10 @@ to upconvert to 32b float internally?
+ </array>
+ <!-- 0x891b-0x8926 invalid -->
+ <doc>
+- RB_SAMPLE_COUNT_ADDR register is used up to (and including) a730. After that
++ RB_SAMPLE_COUNTER_BASE register is used up to (and including) a730. After that
+ the address is specified through CP_EVENT_WRITE7::WRITE_SAMPLE_COUNT.
+ </doc>
+- <reg64 offset="0x8927" name="RB_SAMPLE_COUNT_ADDR" type="waddress" align="16" usage="cmd"/>
++ <reg64 offset="0x8927" name="RB_SAMPLE_COUNTER_BASE" type="waddress" align="16" usage="cmd"/>
+ <!-- 0x8929-0x89ff invalid -->
+
+ <!-- TODO: there are some registers in the 0x8a00-0x8bff range -->
+@@ -3932,10 +1769,10 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8a20" name="RB_UNKNOWN_8A20" variants="A6XX" usage="rp_blit"/>
+ <reg32 offset="0x8a30" name="RB_UNKNOWN_8A30" variants="A6XX" usage="rp_blit"/>
+
+- <reg32 offset="0x8c00" name="RB_2D_BLIT_CNTL" type="a6xx_2d_blit_cntl" usage="rp_blit"/>
+- <reg32 offset="0x8c01" name="RB_2D_UNKNOWN_8C01" low="0" high="31" usage="rp_blit"/>
++ <reg32 offset="0x8c00" name="RB_A2D_BLT_CNTL" type="a6xx_a2d_bit_cntl" usage="rp_blit"/>
++ <reg32 offset="0x8c01" name="RB_A2D_PIXEL_CNTL" low="0" high="31" usage="rp_blit"/>
+
+- <bitset name="a6xx_2d_src_surf_info" inline="yes">
++ <bitset name="a6xx_a2d_src_texture_info" inline="yes">
+ <bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+ <bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+ <bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+@@ -3954,7 +1791,7 @@ to upconvert to 32b float internally?
+ <bitfield name="MUTABLEEN" pos="29" type="boolean" variants="A7XX-"/>
+ </bitset>
+
+- <bitset name="a6xx_2d_dst_surf_info" inline="yes">
++ <bitset name="a6xx_a2d_dest_buffer_info" inline="yes">
+ <bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+ <bitfield name="TILE_MODE" low="8" high="9" type="a6xx_tile_mode"/>
+ <bitfield name="COLOR_SWAP" low="10" high="11" type="a3xx_color_swap"/>
+@@ -3965,26 +1802,26 @@ to upconvert to 32b float internally?
+ </bitset>
+
+ <!-- 0x8c02-0x8c16 invalid -->
+- <reg32 offset="0x8c17" name="RB_2D_DST_INFO" type="a6xx_2d_dst_surf_info" usage="rp_blit"/>
+- <reg64 offset="0x8c18" name="RB_2D_DST" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8c1a" name="RB_2D_DST_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
++ <reg32 offset="0x8c17" name="RB_A2D_DEST_BUFFER_INFO" type="a6xx_a2d_dest_buffer_info" usage="rp_blit"/>
++ <reg64 offset="0x8c18" name="RB_A2D_DEST_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x8c1a" name="RB_A2D_DEST_BUFFER_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+ <!-- this is a guess but seems likely (for NV12/IYUV): -->
+- <reg64 offset="0x8c1b" name="RB_2D_DST_PLANE1" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8c1d" name="RB_2D_DST_PLANE_PITCH" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
+- <reg64 offset="0x8c1e" name="RB_2D_DST_PLANE2" type="waddress" align="64" usage="rp_blit"/>
++ <reg64 offset="0x8c1b" name="RB_A2D_DEST_BUFFER_BASE_1" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x8c1d" name="RB_A2D_DEST_BUFFER_PITCH_1" low="0" high="15" shr="6" type="uint" usage="rp_blit"/>
++ <reg64 offset="0x8c1e" name="RB_A2D_DEST_BUFFER_BASE_2" type="waddress" align="64" usage="rp_blit"/>
+
+- <reg64 offset="0x8c20" name="RB_2D_DST_FLAGS" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8c22" name="RB_2D_DST_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
++ <reg64 offset="0x8c20" name="RB_A2D_DEST_FLAG_BUFFER_BASE" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x8c22" name="RB_A2D_DEST_FLAG_BUFFER_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+ <!-- this is a guess but seems likely (for NV12 with UBWC): -->
+- <reg64 offset="0x8c23" name="RB_2D_DST_FLAGS_PLANE" type="waddress" align="64" usage="rp_blit"/>
+- <reg32 offset="0x8c25" name="RB_2D_DST_FLAGS_PLANE_PITCH" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
++ <reg64 offset="0x8c23" name="RB_A2D_DEST_FLAG_BUFFER_BASE_1" type="waddress" align="64" usage="rp_blit"/>
++ <reg32 offset="0x8c25" name="RB_A2D_DEST_FLAG_BUFFER_PITCH_1" low="0" high="7" shr="6" type="uint" usage="rp_blit"/>
+
+ <!-- TODO: 0x8c26-0x8c33 are all full 32-bit registers -->
+ <!-- unlike a5xx, these are per channel values rather than packed -->
+- <reg32 offset="0x8c2c" name="RB_2D_SRC_SOLID_C0" usage="rp_blit"/>
+- <reg32 offset="0x8c2d" name="RB_2D_SRC_SOLID_C1" usage="rp_blit"/>
+- <reg32 offset="0x8c2e" name="RB_2D_SRC_SOLID_C2" usage="rp_blit"/>
+- <reg32 offset="0x8c2f" name="RB_2D_SRC_SOLID_C3" usage="rp_blit"/>
++ <reg32 offset="0x8c2c" name="RB_A2D_CLEAR_COLOR_DW0" usage="rp_blit"/>
++ <reg32 offset="0x8c2d" name="RB_A2D_CLEAR_COLOR_DW1" usage="rp_blit"/>
++ <reg32 offset="0x8c2e" name="RB_A2D_CLEAR_COLOR_DW2" usage="rp_blit"/>
++ <reg32 offset="0x8c2f" name="RB_A2D_CLEAR_COLOR_DW3" usage="rp_blit"/>
+
+ <reg32 offset="0x8c34" name="RB_UNKNOWN_8C34" variants="A7XX-" usage="cmd"/>
+
+@@ -3996,7 +1833,7 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8e04" name="RB_DBG_ECO_CNTL" usage="cmd"/> <!-- TODO: valid mask 0xfffffeff -->
+ <reg32 offset="0x8e05" name="RB_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+ <!-- 0x02080000 in GMEM, zero otherwise? -->
+- <reg32 offset="0x8e06" name="RB_UNKNOWN_8E06" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0x8e06" name="RB_CCU_DBG_ECO_CNTL" variants="A7XX-" usage="cmd"/>
+
+ <reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A6XX">
+ <bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+@@ -4017,10 +1854,21 @@ to upconvert to 32b float internally?
+ <bitfield name="COLOR_OFFSET" low="23" high="31" shr="12" type="hex"/>
+ <!--TODO: valid mask 0xfffffc1f -->
+ </reg32>
++ <enum name="a7xx_concurrent_resolve_mode">
++ <value value="0x0" name="CONCURRENT_RESOLVE_MODE_DISABLED"/>
++ <value value="0x1" name="CONCURRENT_RESOLVE_MODE_1"/>
++ <value value="0x2" name="CONCURRENT_RESOLVE_MODE_2"/>
++ </enum>
++ <enum name="a7xx_concurrent_unresolve_mode">
++ <value value="0x0" name="CONCURRENT_UNRESOLVE_MODE_DISABLED"/>
++ <value value="0x1" name="CONCURRENT_UNRESOLVE_MODE_PARTIAL"/>
++ <value value="0x3" name="CONCURRENT_UNRESOLVE_MODE_FULL"/>
++ </enum>
+ <reg32 offset="0x8e07" name="RB_CCU_CNTL" usage="cmd" variants="A7XX-">
+ <bitfield name="GMEM_FAST_CLEAR_DISABLE" pos="0" type="boolean"/>
+- <bitfield name="CONCURRENT_RESOLVE" pos="2" type="boolean"/>
+- <!-- rest of the bits were moved to RB_CCU_CNTL2 -->
++ <bitfield name="CONCURRENT_RESOLVE_MODE" low="2" high="3" type="a7xx_concurrent_resolve_mode"/>
++ <bitfield name="CONCURRENT_UNRESOLVE_MODE" low="5" high="6" type="a7xx_concurrent_unresolve_mode"/>
++ <!-- rest of the bits were moved to RB_CCU_CACHE_CNTL -->
+ </reg32>
+ <reg32 offset="0x8e08" name="RB_NC_MODE_CNTL">
+ <bitfield name="MODE" pos="0" type="boolean"/>
+@@ -4046,9 +1894,9 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x8e3d" name="RB_RB_SUB_BLOCK_SEL_CNTL_CD"/>
+ <!-- 0x8e3e-0x8e4f invalid -->
+ <!-- GMEM save/restore for preemption: -->
+- <reg32 offset="0x8e50" name="RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE" pos="0" type="boolean"/>
++ <reg32 offset="0x8e50" name="RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE_ENABLE" pos="0" type="boolean"/>
+ <!-- address for GMEM save/restore? -->
+- <reg32 offset="0x8e51" name="RB_UNKNOWN_8E51" type="waddress" align="1"/>
++ <reg32 offset="0x8e51" name="RB_CONTEXT_SWITCH_GMEM_SAVE_RESTORE_ADDR" type="waddress" align="1"/>
+ <!-- 0x8e53-0x8e7f invalid -->
+ <reg32 offset="0x8e79" name="RB_UNKNOWN_8E79" variants="A7XX-" usage="cmd"/>
+ <!-- 0x8e80-0x8e83 are valid -->
+@@ -4069,38 +1917,38 @@ to upconvert to 32b float internally?
+ <bitfield name="CLIP_DIST_03_LOC" low="8" high="15" type="uint"/>
+ <bitfield name="CLIP_DIST_47_LOC" low="16" high="23" type="uint"/>
+ </bitset>
+- <reg32 offset="0x9101" name="VPC_VS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9102" name="VPC_GS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9103" name="VPC_DS_CLIP_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9101" name="VPC_VS_CLIP_CULL_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9102" name="VPC_GS_CLIP_CULL_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9103" name="VPC_DS_CLIP_CULL_CNTL" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+- <reg32 offset="0x9311" name="VPC_VS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9312" name="VPC_GS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9313" name="VPC_DS_CLIP_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9311" name="VPC_VS_CLIP_CULL_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9312" name="VPC_GS_CLIP_CULL_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9313" name="VPC_DS_CLIP_CULL_CNTL_V2" type="a6xx_vpc_xs_clip_cntl" usage="rp_blit"/>
+
+- <bitset name="a6xx_vpc_xs_layer_cntl" inline="yes">
++ <bitset name="a6xx_vpc_xs_siv_cntl" inline="yes">
+ <bitfield name="LAYERLOC" low="0" high="7" type="uint"/>
+ <bitfield name="VIEWLOC" low="8" high="15" type="uint"/>
+ <bitfield name="SHADINGRATELOC" low="16" high="23" type="uint" variants="A7XX-"/>
+ </bitset>
+
+- <reg32 offset="0x9104" name="VPC_VS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9105" name="VPC_GS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9106" name="VPC_DS_LAYER_CNTL" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9104" name="VPC_VS_SIV_CNTL" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9105" name="VPC_GS_SIV_CNTL" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9106" name="VPC_DS_SIV_CNTL" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
+
+- <reg32 offset="0x9314" name="VPC_VS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9315" name="VPC_GS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9316" name="VPC_DS_LAYER_CNTL_V2" type="a6xx_vpc_xs_layer_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9314" name="VPC_VS_SIV_CNTL_V2" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9315" name="VPC_GS_SIV_CNTL_V2" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9316" name="VPC_DS_SIV_CNTL_V2" type="a6xx_vpc_xs_siv_cntl" usage="rp_blit"/>
+
+ <reg32 offset="0x9107" name="VPC_UNKNOWN_9107" variants="A6XX" usage="rp_blit">
+- <!-- this mirrors PC_RASTER_CNTL::DISCARD, although it seems it's unused -->
++ <!-- this mirrors VPC_RAST_STREAM_CNTL::DISCARD, although it seems it's unused -->
+ <bitfield name="RASTER_DISCARD" pos="0" type="boolean"/>
+ <bitfield name="UNK2" pos="2" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x9108" name="VPC_POLYGON_MODE" usage="rp_blit">
++ <reg32 offset="0x9108" name="VPC_RAST_CNTL" usage="rp_blit">
+ <bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+ </reg32>
+
+- <bitset name="a6xx_primitive_cntl_0" inline="yes">
++ <bitset name="a6xx_pc_cntl" inline="yes">
+ <bitfield name="PRIMITIVE_RESTART" pos="0" type="boolean"/>
+ <bitfield name="PROVOKING_VTX_LAST" pos="1" type="boolean"/>
+ <bitfield name="D3D_VERTEX_ORDERING" pos="2" type="boolean">
+@@ -4113,7 +1961,7 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK3" pos="3" type="boolean"/>
+ </bitset>
+
+- <bitset name="a6xx_primitive_cntl_5" inline="yes">
++ <bitset name="a6xx_gs_param_0" inline="yes">
+ <doc>
+ geometry shader
+ </doc>
+@@ -4125,7 +1973,7 @@ to upconvert to 32b float internally?
+ <bitfield name="UNK18" pos="18"/>
+ </bitset>
+
+- <bitset name="a6xx_multiview_cntl" inline="yes">
++ <bitset name="a6xx_stereo_rendering_cntl" inline="yes">
+ <bitfield name="ENABLE" pos="0" type="boolean"/>
+ <bitfield name="DISABLEMULTIPOS" pos="1" type="boolean">
+ <doc>
+@@ -4139,10 +1987,10 @@ to upconvert to 32b float internally?
+ <bitfield name="VIEWS" low="2" high="6" type="uint"/>
+ </bitset>
+
+- <reg32 offset="0x9109" name="VPC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0x910a" name="VPC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0x910b" name="VPC_MULTIVIEW_MASK" type="hex" low="0" high="15" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0x910c" name="VPC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0x9109" name="VPC_PC_CNTL" type="a6xx_pc_cntl" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0x910a" name="VPC_GS_PARAM_0" type="a6xx_gs_param_0" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0x910b" name="VPC_STEREO_RENDERING_VIEWMASK" type="hex" low="0" high="15" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0x910c" name="VPC_STEREO_RENDERING_CNTL" type="a6xx_stereo_rendering_cntl" variants="A7XX-" usage="rp_blit"/>
+
+ <enum name="a6xx_varying_interp_mode">
+ <value value="0" name="INTERP_SMOOTH"/>
+@@ -4159,11 +2007,11 @@ to upconvert to 32b float internally?
+ </enum>
+
+ <!-- 0x9109-0x91ff invalid -->
+- <array offset="0x9200" name="VPC_VARYING_INTERP" stride="1" length="8" usage="rp_blit">
++ <array offset="0x9200" name="VPC_VARYING_INTERP_MODE" stride="1" length="8" usage="rp_blit">
+ <doc>Packed array of a6xx_varying_interp_mode</doc>
+ <reg32 offset="0x0" name="MODE"/>
+ </array>
+- <array offset="0x9208" name="VPC_VARYING_PS_REPL" stride="1" length="8" usage="rp_blit">
++ <array offset="0x9208" name="VPC_VARYING_REPLACE_MODE_0" stride="1" length="8" usage="rp_blit">
+ <doc>Packed array of a6xx_varying_ps_repl_mode</doc>
+ <reg32 offset="0x0" name="MODE"/>
+ </array>
+@@ -4172,12 +2020,12 @@ to upconvert to 32b float internally?
+ <reg32 offset="0x9210" name="VPC_UNKNOWN_9210" low="0" high="31" variants="A6XX" usage="cmd"/>
+ <reg32 offset="0x9211" name="VPC_UNKNOWN_9211" low="0" high="31" variants="A6XX" usage="cmd"/>
+
+- <array offset="0x9212" name="VPC_VAR" stride="1" length="4" usage="rp_blit">
++ <array offset="0x9212" name="VPC_VARYING_LM_TRANSFER_CNTL_0" stride="1" length="4" usage="rp_blit">
+ <!-- one bit per varying component: -->
+ <reg32 offset="0" name="DISABLE"/>
+ </array>
+
+- <reg32 offset="0x9216" name="VPC_SO_CNTL" usage="rp_blit">
++ <reg32 offset="0x9216" name="VPC_SO_MAPPING_WPTR" usage="rp_blit">
+ <!--
+ Choose which DWORD to write to. There is an array of
+ (4 * 64) DWORD's, dumped in the devcoredump at
+@@ -4198,7 +2046,7 @@ to upconvert to 32b float internally?
+ When EmitStreamVertex(N) happens, the HW goes to DWORD
+ 64 * N and then "executes" the next 64 DWORD's.
+
+- This field is auto-incremented when VPC_SO_PROG is
++ This field is auto-incremented when VPC_SO_MAPPING_PORT is
+ written to.
+ -->
+ <bitfield name="ADDR" low="0" high="7" type="hex"/>
+@@ -4206,7 +2054,7 @@ to upconvert to 32b float internally?
+ <bitfield name="RESET" pos="16" type="boolean"/>
+ </reg32>
+ <!-- special register, write multiple times to load SO program (not readable) -->
+- <reg32 offset="0x9217" name="VPC_SO_PROG" usage="rp_blit">
++ <reg32 offset="0x9217" name="VPC_SO_MAPPING_PORT" usage="rp_blit">
+ <bitfield name="A_BUF" low="0" high="1" type="uint"/>
+ <bitfield name="A_OFF" low="2" high="10" shr="2" type="uint"/>
+ <bitfield name="A_EN" pos="11" type="boolean"/>
+@@ -4215,7 +2063,7 @@ to upconvert to 32b float internally?
+ <bitfield name="B_EN" pos="23" type="boolean"/>
+ </reg32>
+
+- <reg64 offset="0x9218" name="VPC_SO_STREAM_COUNTS" type="waddress" align="32" usage="cmd"/>
++ <reg64 offset="0x9218" name="VPC_SO_QUERY_BASE" type="waddress" align="32" usage="cmd"/>
+
+ <array offset="0x921a" name="VPC_SO" stride="7" length="4" usage="cmd">
+ <reg64 offset="0" name="BUFFER_BASE" type="waddress" align="32"/>
+@@ -4225,14 +2073,14 @@ to upconvert to 32b float internally?
+ <reg64 offset="5" name="FLUSH_BASE" type="waddress" align="32"/>
+ </array>
+
+- <reg32 offset="0x9236" name="VPC_POINT_COORD_INVERT" usage="cmd">
++ <reg32 offset="0x9236" name="VPC_REPLACE_MODE_CNTL" usage="cmd">
+ <bitfield name="INVERT" pos="0" type="boolean"/>
+ </reg32>
+ <!-- 0x9237-0x92ff invalid -->
+ <!-- always 0x0 ? -->
+ <reg32 offset="0x9300" name="VPC_UNKNOWN_9300" low="0" high="2" usage="cmd"/>
+
+- <bitset name="a6xx_vpc_xs_pack" inline="yes">
++ <bitset name="a6xx_vpc_xs_cntl" inline="yes">
+ <doc>
+ num of varyings plus four for gl_Position (plus one if gl_PointSize)
+ plus # of transform-feedback (streamout) varyings if using the
+@@ -4249,11 +2097,11 @@ to upconvert to 32b float internally?
+ </doc>
+ </bitfield>
+ </bitset>
+- <reg32 offset="0x9301" name="VPC_VS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+- <reg32 offset="0x9302" name="VPC_GS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
+- <reg32 offset="0x9303" name="VPC_DS_PACK" type="a6xx_vpc_xs_pack" usage="rp_blit"/>
++ <reg32 offset="0x9301" name="VPC_VS_CNTL" type="a6xx_vpc_xs_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9302" name="VPC_GS_CNTL" type="a6xx_vpc_xs_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9303" name="VPC_DS_CNTL" type="a6xx_vpc_xs_cntl" usage="rp_blit"/>
+
+- <reg32 offset="0x9304" name="VPC_CNTL_0" usage="rp_blit">
++ <reg32 offset="0x9304" name="VPC_PS_CNTL" usage="rp_blit">
+ <bitfield name="NUMNONPOSVAR" low="0" high="7" type="uint"/>
+ <!-- for fixed-function (i.e. no GS) gl_PrimitiveID in FS -->
+ <bitfield name="PRIMIDLOC" low="8" high="15" type="uint"/>
+@@ -4272,7 +2120,7 @@ to upconvert to 32b float internally?
+ </bitfield>
+ </reg32>
+
+- <reg32 offset="0x9305" name="VPC_SO_STREAM_CNTL" usage="rp_blit">
++ <reg32 offset="0x9305" name="VPC_SO_CNTL" usage="rp_blit">
+ <!--
+ It's offset by 1, and 0 means "disabled"
+ -->
+@@ -4282,19 +2130,19 @@ to upconvert to 32b float internally?
+ <bitfield name="BUF3_STREAM" low="9" high="11" type="uint"/>
+ <bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+ </reg32>
+- <reg32 offset="0x9306" name="VPC_SO_DISABLE" usage="rp_blit">
++ <reg32 offset="0x9306" name="VPC_SO_OVERRIDE" usage="rp_blit">
+ <bitfield name="DISABLE" pos="0" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x9307" name="VPC_POLYGON_MODE2" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9307" name="VPC_PS_RAST_CNTL" variants="A6XX-" usage="rp_blit"> <!-- A702 + A7xx -->
+ <bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+ </reg32>
+- <reg32 offset="0x9308" name="VPC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9308" name="VPC_ATTR_BUF_GMEM_SIZE" variants="A7XX-" usage="rp_blit">
+ <bitfield name="SIZE_GMEM" low="0" high="31"/>
+ </reg32>
+- <reg32 offset="0x9309" name="VPC_ATTR_BUF_BASE_GMEM" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9309" name="VPC_ATTR_BUF_GMEM_BASE" variants="A7XX-" usage="rp_blit">
+ <bitfield name="BASE_GMEM" low="0" high="31"/>
+ </reg32>
+- <reg32 offset="0x9b09" name="PC_ATTR_BUF_SIZE_GMEM" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9b09" name="PC_ATTR_BUF_GMEM_SIZE" variants="A7XX-" usage="rp_blit">
+ <bitfield name="SIZE_GMEM" low="0" high="31"/>
+ </reg32>
+
+@@ -4311,15 +2159,15 @@ to upconvert to 32b float internally?
+ <!-- TODO: regs from 0x9624-0x963a -->
+ <!-- 0x963b-0x97ff invalid -->
+
+- <reg32 offset="0x9800" name="PC_TESS_NUM_VERTEX" low="0" high="5" type="uint" usage="rp_blit"/>
++ <reg32 offset="0x9800" name="PC_HS_PARAM_0" low="0" high="5" type="uint" usage="rp_blit"/>
+
+ <!-- always 0x0 ? -->
+- <reg32 offset="0x9801" name="PC_HS_INPUT_SIZE" usage="rp_blit">
++ <reg32 offset="0x9801" name="PC_HS_PARAM_1" usage="rp_blit">
+ <bitfield name="SIZE" low="0" high="10" type="uint"/>
+ <bitfield name="UNK13" pos="13"/>
+ </reg32>
+
+- <reg32 offset="0x9802" name="PC_TESS_CNTL" usage="rp_blit">
++ <reg32 offset="0x9802" name="PC_DS_PARAM" usage="rp_blit">
+ <bitfield name="SPACING" low="0" high="1" type="a6xx_tess_spacing"/>
+ <bitfield name="OUTPUT" low="2" high="3" type="a6xx_tess_output"/>
+ </reg32>
+@@ -4334,7 +2182,7 @@ to upconvert to 32b float internally?
+ </reg32>
+
+ <!-- New in a6xx gen3+ -->
+- <reg32 offset="0x9808" name="PC_SO_STREAM_CNTL" usage="rp_blit">
++ <reg32 offset="0x9808" name="PC_DGEN_SO_CNTL" usage="rp_blit">
+ <bitfield name="STREAM_ENABLE" low="15" high="18" type="hex"/>
+ </reg32>
+
+@@ -4344,15 +2192,15 @@ to upconvert to 32b float internally?
+ <!-- 0x980b-0x983f invalid -->
+
+ <!-- 0x9840 - 0x9842 are not readable -->
+- <reg32 offset="0x9840" name="PC_DRAW_CMD">
++ <reg32 offset="0x9840" name="PC_DRAW_INITIATOR">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0x9841" name="PC_DISPATCH_CMD">
++ <reg32 offset="0x9841" name="PC_KERNEL_INITIATOR">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0x9842" name="PC_EVENT_CMD">
++ <reg32 offset="0x9842" name="PC_EVENT_INITIATOR">
+ <!-- I think only the low bit is actually used? -->
+ <bitfield name="STATE_ID" low="16" high="23"/>
+ <bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+@@ -4367,27 +2215,27 @@ to upconvert to 32b float internally?
+
+ <!-- 0x9843-0x997f invalid -->
+
+- <reg32 offset="0x9981" name="PC_POLYGON_MODE" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0x9981" name="PC_DGEN_RAST_CNTL" variants="A6XX" usage="rp_blit">
+ <bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+ </reg32>
+- <reg32 offset="0x9809" name="PC_POLYGON_MODE" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9809" name="PC_DGEN_RAST_CNTL" variants="A7XX-" usage="rp_blit">
+ <bitfield name="MODE" low="0" high="1" type="a6xx_polygon_mode"/>
+ </reg32>
+
+- <reg32 offset="0x9980" name="PC_RASTER_CNTL" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0x9980" name="VPC_RAST_STREAM_CNTL" variants="A6XX" usage="rp_blit">
+ <!-- which stream to send to GRAS -->
+ <bitfield name="STREAM" low="0" high="1" type="uint"/>
+ <!-- discard primitives before rasterization -->
+ <bitfield name="DISCARD" pos="2" type="boolean"/>
+ </reg32>
+- <!-- VPC_RASTER_CNTL -->
+- <reg32 offset="0x9107" name="PC_RASTER_CNTL" variants="A7XX-" usage="rp_blit">
++ <!-- VPC_RAST_STREAM_CNTL -->
++ <reg32 offset="0x9107" name="VPC_RAST_STREAM_CNTL" variants="A7XX-" usage="rp_blit">
+ <!-- which stream to send to GRAS -->
+ <bitfield name="STREAM" low="0" high="1" type="uint"/>
+ <!-- discard primitives before rasterization -->
+ <bitfield name="DISCARD" pos="2" type="boolean"/>
+ </reg32>
+- <reg32 offset="0x9317" name="PC_RASTER_CNTL_V2" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0x9317" name="VPC_RAST_STREAM_CNTL_V2" variants="A7XX-" usage="rp_blit">
+ <!-- which stream to send to GRAS -->
+ <bitfield name="STREAM" low="0" high="1" type="uint"/>
+ <!-- discard primitives before rasterization -->
+@@ -4397,17 +2245,17 @@ to upconvert to 32b float internally?
+ <!-- Both are a750+.
+ Probably needed to correctly overlap execution of several draws.
+ -->
+- <reg32 offset="0x9885" name="PC_TESS_PARAM_SIZE" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0x9885" name="PC_HS_BUFFER_SIZE" variants="A7XX-" usage="cmd"/>
+ <!-- Blob adds a bit more space {0x10, 0x20, 0x30, 0x40} bytes, but the meaning of
+ this additional space is not known.
+ -->
+- <reg32 offset="0x9886" name="PC_TESS_FACTOR_SIZE" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0x9886" name="PC_TF_BUFFER_SIZE" variants="A7XX-" usage="cmd"/>
+
+ <!-- 0x9982-0x9aff invalid -->
+
+- <reg32 offset="0x9b00" name="PC_PRIMITIVE_CNTL_0" type="a6xx_primitive_cntl_0" usage="rp_blit"/>
++ <reg32 offset="0x9b00" name="PC_CNTL" type="a6xx_pc_cntl" usage="rp_blit"/>
+
+- <bitset name="a6xx_xs_out_cntl" inline="yes">
++ <bitset name="a6xx_pc_xs_cntl" inline="yes">
+ <doc>
+ num of varyings plus four for gl_Position (plus one if gl_PointSize)
+ plus # of transform-feedback (streamout) varyings if using the
+@@ -4417,19 +2265,19 @@ to upconvert to 32b float internally?
+ <bitfield name="PSIZE" pos="8" type="boolean"/>
+ <bitfield name="LAYER" pos="9" type="boolean"/>
+ <bitfield name="VIEW" pos="10" type="boolean"/>
+- <!-- note: PC_VS_OUT_CNTL doesn't have the PRIMITIVE_ID bit -->
++ <!-- note: PC_VS_CNTL doesn't have the PRIMITIVE_ID bit -->
+ <bitfield name="PRIMITIVE_ID" pos="11" type="boolean"/>
+ <bitfield name="CLIP_MASK" low="16" high="23" type="uint"/>
+ <bitfield name="SHADINGRATE" pos="24" type="boolean" variants="A7XX-"/>
+ </bitset>
+
+- <reg32 offset="0x9b01" name="PC_VS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9b02" name="PC_GS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9b01" name="PC_VS_CNTL" type="a6xx_pc_xs_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9b02" name="PC_GS_CNTL" type="a6xx_pc_xs_cntl" usage="rp_blit"/>
+ <!-- since HS can't output anything, only PRIMITIVE_ID is valid -->
+- <reg32 offset="0x9b03" name="PC_HS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
+- <reg32 offset="0x9b04" name="PC_DS_OUT_CNTL" type="a6xx_xs_out_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9b03" name="PC_HS_CNTL" type="a6xx_pc_xs_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9b04" name="PC_DS_CNTL" type="a6xx_pc_xs_cntl" usage="rp_blit"/>
+
+- <reg32 offset="0x9b05" name="PC_PRIMITIVE_CNTL_5" type="a6xx_primitive_cntl_5" usage="rp_blit"/>
++ <reg32 offset="0x9b05" name="PC_GS_PARAM_0" type="a6xx_gs_param_0" usage="rp_blit"/>
+
+ <reg32 offset="0x9b06" name="PC_PRIMITIVE_CNTL_6" variants="A6XX" usage="rp_blit">
+ <doc>
+@@ -4438,9 +2286,9 @@ to upconvert to 32b float internally?
+ <bitfield name="STRIDE_IN_VPC" low="0" high="10" type="uint"/>
+ </reg32>
+
+- <reg32 offset="0x9b07" name="PC_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
++ <reg32 offset="0x9b07" name="PC_STEREO_RENDERING_CNTL" type="a6xx_stereo_rendering_cntl" usage="rp_blit"/>
+ <!-- mask of enabled views, doesn't exist on A630 -->
+- <reg32 offset="0x9b08" name="PC_MULTIVIEW_MASK" type="hex" low="0" high="15" usage="rp_blit"/>
++ <reg32 offset="0x9b08" name="PC_STEREO_RENDERING_VIEWMASK" type="hex" low="0" high="15" usage="rp_blit"/>
+ <!-- 0x9b09-0x9bff invalid -->
+ <reg32 offset="0x9c00" name="PC_2D_EVENT_CMD">
+ <!-- special register (but note first 8 bits can be written/read) -->
+@@ -4451,31 +2299,31 @@ to upconvert to 32b float internally?
+ <!-- TODO: 0x9e00-0xa000 range incomplete -->
+ <reg32 offset="0x9e00" name="PC_DBG_ECO_CNTL"/>
+ <reg32 offset="0x9e01" name="PC_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+- <reg64 offset="0x9e04" name="PC_DRAW_INDX_BASE"/>
+- <reg32 offset="0x9e06" name="PC_DRAW_FIRST_INDX" type="uint"/>
+- <reg32 offset="0x9e07" name="PC_DRAW_MAX_INDICES" type="uint"/>
+- <reg64 offset="0x9e08" name="PC_TESSFACTOR_ADDR" variants="A6XX" type="waddress" align="32" usage="cmd"/>
+- <reg64 offset="0x9810" name="PC_TESSFACTOR_ADDR" variants="A7XX-" type="waddress" align="32" usage="cmd"/>
++ <reg64 offset="0x9e04" name="PC_DMA_BASE"/>
++ <reg32 offset="0x9e06" name="PC_DMA_OFFSET" type="uint"/>
++ <reg32 offset="0x9e07" name="PC_DMA_SIZE" type="uint"/>
++ <reg64 offset="0x9e08" name="PC_TESS_BASE" variants="A6XX" type="waddress" align="32" usage="cmd"/>
++ <reg64 offset="0x9810" name="PC_TESS_BASE" variants="A7XX-" type="waddress" align="32" usage="cmd"/>
+
+- <reg32 offset="0x9e0b" name="PC_DRAW_INITIATOR" type="vgt_draw_initiator_a4xx">
++ <reg32 offset="0x9e0b" name="PC_DRAWCALL_CNTL" type="vgt_draw_initiator_a4xx">
+ <doc>
+ Possibly not really "initiating" the draw but the layout is similar
+ to VGT_DRAW_INITIATOR on older gens
+ </doc>
+ </reg32>
+- <reg32 offset="0x9e0c" name="PC_DRAW_NUM_INSTANCES" type="uint"/>
+- <reg32 offset="0x9e0d" name="PC_DRAW_NUM_INDICES" type="uint"/>
++ <reg32 offset="0x9e0c" name="PC_DRAWCALL_INSTANCE_NUM" type="uint"/>
++ <reg32 offset="0x9e0d" name="PC_DRAWCALL_SIZE" type="uint"/>
+
+ <!-- These match the contents of CP_SET_BIN_DATA (not written directly) -->
+- <reg32 offset="0x9e11" name="PC_VSTREAM_CONTROL">
++ <reg32 offset="0x9e11" name="PC_VIS_STREAM_CNTL">
+ <bitfield name="UNK0" low="0" high="15"/>
+ <bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+ <bitfield name="VSC_N" low="22" high="26" type="uint"/>
+ </reg32>
+- <reg64 offset="0x9e12" name="PC_BIN_PRIM_STRM" type="waddress" align="32"/>
+- <reg64 offset="0x9e14" name="PC_BIN_DRAW_STRM" type="waddress" align="32"/>
++ <reg64 offset="0x9e12" name="PC_PVIS_STREAM_BIN_BASE" type="waddress" align="32"/>
++ <reg64 offset="0x9e14" name="PC_DVIS_STREAM_BIN_BASE" type="waddress" align="32"/>
+
+- <reg32 offset="0x9e1c" name="PC_VISIBILITY_OVERRIDE">
++ <reg32 offset="0x9e1c" name="PC_DRAWCALL_CNTL_OVERRIDE">
+ <doc>Written by CP_SET_VISIBILITY_OVERRIDE handler</doc>
+ <bitfield name="OVERRIDE" pos="0" type="boolean"/>
+ </reg32>
+@@ -4488,18 +2336,18 @@ to upconvert to 32b float internally?
+ <!-- always 0x0 -->
+ <reg32 offset="0x9e72" name="PC_UNKNOWN_9E72" usage="cmd"/>
+
+- <reg32 offset="0xa000" name="VFD_CONTROL_0" usage="rp_blit">
++ <reg32 offset="0xa000" name="VFD_CNTL_0" usage="rp_blit">
+ <bitfield name="FETCH_CNT" low="0" high="5" type="uint"/>
+ <bitfield name="DECODE_CNT" low="8" high="13" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa001" name="VFD_CONTROL_1" usage="rp_blit">
++ <reg32 offset="0xa001" name="VFD_CNTL_1" usage="rp_blit">
+ <bitfield name="REGID4VTX" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="REGID4INST" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="REGID4PRIMID" low="16" high="23" type="a3xx_regid"/>
+ <!-- only used for VS in non-multi-position-output case -->
+ <bitfield name="REGID4VIEWID" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa002" name="VFD_CONTROL_2" usage="rp_blit">
++ <reg32 offset="0xa002" name="VFD_CNTL_2" usage="rp_blit">
+ <bitfield name="REGID_HSRELPATCHID" low="0" high="7" type="a3xx_regid">
+ <doc>
+ This is the ID of the current patch within the
+@@ -4512,32 +2360,32 @@ to upconvert to 32b float internally?
+ </bitfield>
+ <bitfield name="REGID_INVOCATIONID" low="8" high="15" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa003" name="VFD_CONTROL_3" usage="rp_blit">
++ <reg32 offset="0xa003" name="VFD_CNTL_3" usage="rp_blit">
+ <bitfield name="REGID_DSPRIMID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="REGID_DSRELPATCHID" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="REGID_TESSX" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="REGID_TESSY" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa004" name="VFD_CONTROL_4" usage="rp_blit">
++ <reg32 offset="0xa004" name="VFD_CNTL_4" usage="rp_blit">
+ <bitfield name="UNK0" low="0" high="7" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa005" name="VFD_CONTROL_5" usage="rp_blit">
++ <reg32 offset="0xa005" name="VFD_CNTL_5" usage="rp_blit">
+ <bitfield name="REGID_GSHEADER" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="UNK8" low="8" high="15" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa006" name="VFD_CONTROL_6" usage="rp_blit">
++ <reg32 offset="0xa006" name="VFD_CNTL_6" usage="rp_blit">
+ <!--
+ True if gl_PrimitiveID is read via the FS
+ -->
+ <bitfield name="PRIMID4PSEN" pos="0" type="boolean"/>
+ </reg32>
+
+- <reg32 offset="0xa007" name="VFD_MODE_CNTL" usage="cmd">
++ <reg32 offset="0xa007" name="VFD_RENDER_MODE" usage="cmd">
+ <bitfield name="RENDER_MODE" low="0" high="2" type="a6xx_render_mode"/>
+ </reg32>
+
+- <reg32 offset="0xa008" name="VFD_MULTIVIEW_CNTL" type="a6xx_multiview_cntl" usage="rp_blit"/>
+- <reg32 offset="0xa009" name="VFD_ADD_OFFSET" usage="cmd">
++ <reg32 offset="0xa008" name="VFD_STEREO_RENDERING_CNTL" type="a6xx_stereo_rendering_cntl" usage="rp_blit"/>
++ <reg32 offset="0xa009" name="VFD_MODE_CNTL" usage="cmd">
+ <!-- add VFD_INDEX_OFFSET to REGID4VTX -->
+ <bitfield name="VERTEX" pos="0" type="boolean"/>
+ <!-- add VFD_INSTANCE_START_OFFSET to REGID4INST -->
+@@ -4546,14 +2394,14 @@ to upconvert to 32b float internally?
+
+ <reg32 offset="0xa00e" name="VFD_INDEX_OFFSET" usage="rp_blit"/>
+ <reg32 offset="0xa00f" name="VFD_INSTANCE_START_OFFSET" usage="rp_blit"/>
+- <array offset="0xa010" name="VFD_FETCH" stride="4" length="32" usage="rp_blit">
++ <array offset="0xa010" name="VFD_VERTEX_BUFFER" stride="4" length="32" usage="rp_blit">
+ <reg64 offset="0x0" name="BASE" type="address" align="1"/>
+ <reg32 offset="0x2" name="SIZE" type="uint"/>
+ <reg32 offset="0x3" name="STRIDE" low="0" high="11" type="uint"/>
+ </array>
+- <array offset="0xa090" name="VFD_DECODE" stride="2" length="32" usage="rp_blit">
++ <array offset="0xa090" name="VFD_FETCH_INSTR" stride="2" length="32" usage="rp_blit">
+ <reg32 offset="0x0" name="INSTR">
+- <!-- IDX and byte OFFSET into VFD_FETCH -->
++ <!-- IDX and byte OFFSET into VFD_VERTEX_BUFFER -->
+ <bitfield name="IDX" low="0" high="4" type="uint"/>
+ <bitfield name="OFFSET" low="5" high="16"/>
+ <bitfield name="INSTANCED" pos="17" type="boolean"/>
+@@ -4573,7 +2421,7 @@ to upconvert to 32b float internally?
+
+ <reg32 offset="0xa0f8" name="VFD_POWER_CNTL" low="0" high="2" usage="rp_blit"/>
+
+- <reg32 offset="0xa600" name="VFD_UNKNOWN_A600" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa600" name="VFD_DBG_ECO_CNTL" variants="A7XX-" usage="cmd"/>
+
+ <reg32 offset="0xa601" name="VFD_ADDR_MODE_CNTL" type="a5xx_address_mode"/>
+ <array offset="0xa610" name="VFD_PERFCTR_VFD_SEL" stride="1" length="8" variants="A6XX"/>
+@@ -4588,7 +2436,7 @@ to upconvert to 32b float internally?
+ <value value="1" name="THREAD128"/>
+ </enum>
+
+- <bitset name="a6xx_sp_xs_ctrl_reg0" inline="yes">
++ <bitset name="a6xx_sp_xs_cntl_0" inline="yes">
+ <!-- if set to SINGLE, only use 1 concurrent wave on each SP -->
+ <bitfield name="THREADMODE" pos="0" type="a3xx_threadmode"/>
+ <!--
+@@ -4620,7 +2468,7 @@ to upconvert to 32b float internally?
+ -->
+ <bitfield name="BINDLESS_TEX" pos="0" type="boolean"/>
+ <bitfield name="BINDLESS_SAMP" pos="1" type="boolean"/>
+- <bitfield name="BINDLESS_IBO" pos="2" type="boolean"/>
++ <bitfield name="BINDLESS_UAV" pos="2" type="boolean"/>
+ <bitfield name="BINDLESS_UBO" pos="3" type="boolean"/>
+
+ <bitfield name="ENABLED" pos="8" type="boolean"/>
+@@ -4630,17 +2478,17 @@ to upconvert to 32b float internally?
+ -->
+ <bitfield name="NTEX" low="9" high="16" type="uint"/>
+ <bitfield name="NSAMP" low="17" high="21" type="uint"/>
+- <bitfield name="NIBO" low="22" high="28" type="uint"/>
++ <bitfield name="NUAV" low="22" high="28" type="uint"/>
+ </bitset>
+
+- <bitset name="a6xx_sp_xs_prim_cntl" inline="yes">
++ <bitset name="a6xx_sp_xs_output_cntl" inline="yes">
+ <!-- # of VS outputs including pos/psize -->
+ <bitfield name="OUT" low="0" high="5" type="uint"/>
+ <!-- FLAGS_REGID only for GS -->
+ <bitfield name="FLAGS_REGID" low="6" high="13" type="a3xx_regid"/>
+ </bitset>
+
+- <reg32 offset="0xa800" name="SP_VS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
++ <reg32 offset="0xa800" name="SP_VS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="rp_blit">
+ <!--
+ This field actually controls all geometry stages. TCS, TES, and
+ GS must have the same mergedregs setting as VS.
+@@ -4665,10 +2513,10 @@ to upconvert to 32b float internally?
+ </reg32>
+ <!-- bitmask of true/false conditions for VS brac.N instructions,
+ bit N corresponds to brac.N -->
+- <reg32 offset="0xa801" name="SP_VS_BRANCH_COND" type="hex"/>
++ <reg32 offset="0xa801" name="SP_VS_BOOLEAN_CF_MASK" type="hex"/>
+ <!-- # of VS outputs including pos/psize -->
+- <reg32 offset="0xa802" name="SP_VS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+- <array offset="0xa803" name="SP_VS_OUT" stride="1" length="16" usage="rp_blit">
++ <reg32 offset="0xa802" name="SP_VS_OUTPUT_CNTL" type="a6xx_sp_xs_output_cntl" usage="rp_blit"/>
++ <array offset="0xa803" name="SP_VS_OUTPUT" stride="1" length="16" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+@@ -4678,12 +2526,12 @@ to upconvert to 32b float internally?
+ </array>
+ <!--
+ Starting with a5xx, position/psize outputs from shader end up in the
+- SP_VS_OUT map, with highest OUTLOCn position. (Generally they are
++ SP_VS_OUTPUT map, with highest OUTLOCn position. (Generally they are
+ the last entries too, except when gl_PointCoord is used, blob inserts
+ an extra varying after, but with a lower OUTLOC position. If present,
+ psize is last, preceded by position.
+ -->
+- <array offset="0xa813" name="SP_VS_VPC_DST" stride="1" length="8" usage="rp_blit">
++ <array offset="0xa813" name="SP_VS_VPC_DEST" stride="1" length="8" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+ <bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+@@ -4752,7 +2600,7 @@ to upconvert to 32b float internally?
+ </bitfield>
+ </bitset>
+
+- <bitset name="a6xx_sp_xs_pvt_mem_hw_stack_offset" inline="yes">
++ <bitset name="a6xx_sp_xs_pvt_mem_stack_offset" inline="yes">
+ <doc>
+ This seems to be be the equivalent of HWSTACKOFFSET in
+ a3xx. The ldp/stp offset formula above isn't affected by
+@@ -4763,18 +2611,18 @@ to upconvert to 32b float internally?
+ <bitfield name="OFFSET" low="0" high="18" shr="11"/>
+ </bitset>
+
+- <reg32 offset="0xa81b" name="SP_VS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+- <reg64 offset="0xa81c" name="SP_VS_OBJ_START" type="address" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa81b" name="SP_VS_PROGRAM_COUNTER_OFFSET" type="uint" usage="rp_blit"/>
++ <reg64 offset="0xa81c" name="SP_VS_BASE" type="address" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa81e" name="SP_VS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+- <reg64 offset="0xa81f" name="SP_VS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
++ <reg64 offset="0xa81f" name="SP_VS_PVT_MEM_BASE" type="waddress" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa821" name="SP_VS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+- <reg32 offset="0xa822" name="SP_VS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa822" name="SP_VS_TSIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+ <reg32 offset="0xa823" name="SP_VS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+- <reg32 offset="0xa824" name="SP_VS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+- <reg32 offset="0xa825" name="SP_VS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+- <reg32 offset="0xa82d" name="SP_VS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa824" name="SP_VS_INSTR_SIZE" low="0" high="27" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa825" name="SP_VS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa82d" name="SP_VS_VGS_CNTL" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xa830" name="SP_HS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
++ <reg32 offset="0xa830" name="SP_HS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="rp_blit">
+ <!-- There is no mergedregs bit, that comes from the VS. -->
+ <bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+ </reg32>
+@@ -4782,32 +2630,32 @@ to upconvert to 32b float internally?
+ Total size of local storage in dwords divided by the wave size.
+ The maximum value is 64. With the wave size being always 64 for HS,
+ the maximum size of local storage should be:
+- 64 (wavesize) * 64 (SP_HS_WAVE_INPUT_SIZE) * 4 = 16k
++ 64 (wavesize) * 64 (SP_HS_CNTL_1) * 4 = 16k
+ -->
+- <reg32 offset="0xa831" name="SP_HS_WAVE_INPUT_SIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+- <reg32 offset="0xa832" name="SP_HS_BRANCH_COND" type="hex" usage="rp_blit"/>
++ <reg32 offset="0xa831" name="SP_HS_CNTL_1" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa832" name="SP_HS_BOOLEAN_CF_MASK" type="hex" usage="rp_blit"/>
+
+ <!-- TODO: exact same layout as 0xa81b-0xa825 -->
+- <reg32 offset="0xa833" name="SP_HS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+- <reg64 offset="0xa834" name="SP_HS_OBJ_START" type="address" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa833" name="SP_HS_PROGRAM_COUNTER_OFFSET" type="uint" usage="rp_blit"/>
++ <reg64 offset="0xa834" name="SP_HS_BASE" type="address" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa836" name="SP_HS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+- <reg64 offset="0xa837" name="SP_HS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
++ <reg64 offset="0xa837" name="SP_HS_PVT_MEM_BASE" type="waddress" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa839" name="SP_HS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+- <reg32 offset="0xa83a" name="SP_HS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa83a" name="SP_HS_TSIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+ <reg32 offset="0xa83b" name="SP_HS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+- <reg32 offset="0xa83c" name="SP_HS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+- <reg32 offset="0xa83d" name="SP_HS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+- <reg32 offset="0xa82f" name="SP_HS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa83c" name="SP_HS_INSTR_SIZE" low="0" high="27" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa83d" name="SP_HS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa82f" name="SP_HS_VGS_CNTL" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xa840" name="SP_DS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
++ <reg32 offset="0xa840" name="SP_DS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="rp_blit">
+ <!-- There is no mergedregs bit, that comes from the VS. -->
+ <bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+ </reg32>
+- <reg32 offset="0xa841" name="SP_DS_BRANCH_COND" type="hex"/>
++ <reg32 offset="0xa841" name="SP_DS_BOOLEAN_CF_MASK" type="hex"/>
+
+ <!-- TODO: exact same layout as 0xa802-0xa81a -->
+- <reg32 offset="0xa842" name="SP_DS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+- <array offset="0xa843" name="SP_DS_OUT" stride="1" length="16" usage="rp_blit">
++ <reg32 offset="0xa842" name="SP_DS_OUTPUT_CNTL" type="a6xx_sp_xs_output_cntl" usage="rp_blit"/>
++ <array offset="0xa843" name="SP_DS_OUTPUT" stride="1" length="16" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+@@ -4815,7 +2663,7 @@ to upconvert to 32b float internally?
+ <bitfield name="B_COMPMASK" low="24" high="27" type="hex"/>
+ </reg32>
+ </array>
+- <array offset="0xa853" name="SP_DS_VPC_DST" stride="1" length="8" usage="rp_blit">
++ <array offset="0xa853" name="SP_DS_VPC_DEST" stride="1" length="8" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+ <bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+@@ -4825,22 +2673,22 @@ to upconvert to 32b float internally?
+ </array>
+
+ <!-- TODO: exact same layout as 0xa81b-0xa825 -->
+- <reg32 offset="0xa85b" name="SP_DS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+- <reg64 offset="0xa85c" name="SP_DS_OBJ_START" type="address" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa85b" name="SP_DS_PROGRAM_COUNTER_OFFSET" type="uint" usage="rp_blit"/>
++ <reg64 offset="0xa85c" name="SP_DS_BASE" type="address" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa85e" name="SP_DS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+- <reg64 offset="0xa85f" name="SP_DS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
++ <reg64 offset="0xa85f" name="SP_DS_PVT_MEM_BASE" type="waddress" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa861" name="SP_DS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+- <reg32 offset="0xa862" name="SP_DS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa862" name="SP_DS_TSIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+ <reg32 offset="0xa863" name="SP_DS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+- <reg32 offset="0xa864" name="SP_DS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+- <reg32 offset="0xa865" name="SP_DS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+- <reg32 offset="0xa868" name="SP_DS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa864" name="SP_DS_INSTR_SIZE" low="0" high="27" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa865" name="SP_DS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa868" name="SP_DS_VGS_CNTL" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xa870" name="SP_GS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
++ <reg32 offset="0xa870" name="SP_GS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="rp_blit">
+ <!-- There is no mergedregs bit, that comes from the VS. -->
+ <bitfield name="EARLYPREAMBLE" pos="20" type="boolean"/>
+ </reg32>
+- <reg32 offset="0xa871" name="SP_GS_PRIM_SIZE" low="0" high="7" type="uint" usage="rp_blit">
++ <reg32 offset="0xa871" name="SP_GS_CNTL_1" low="0" high="7" type="uint" usage="rp_blit">
+ <doc>
+ Normally the size of the output of the last stage in
+ dwords. It should be programmed as follows:
+@@ -4854,11 +2702,11 @@ to upconvert to 32b float internally?
+ doesn't matter in practice.
+ </doc>
+ </reg32>
+- <reg32 offset="0xa872" name="SP_GS_BRANCH_COND" type="hex" usage="rp_blit"/>
++ <reg32 offset="0xa872" name="SP_GS_BOOLEAN_CF_MASK" type="hex" usage="rp_blit"/>
+
+ <!-- TODO: exact same layout as 0xa802-0xa81a -->
+- <reg32 offset="0xa873" name="SP_GS_PRIMITIVE_CNTL" type="a6xx_sp_xs_prim_cntl" usage="rp_blit"/>
+- <array offset="0xa874" name="SP_GS_OUT" stride="1" length="16" usage="rp_blit">
++ <reg32 offset="0xa873" name="SP_GS_OUTPUT_CNTL" type="a6xx_sp_xs_output_cntl" usage="rp_blit"/>
++ <array offset="0xa874" name="SP_GS_OUTPUT" stride="1" length="16" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="A_REGID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="A_COMPMASK" low="8" high="11" type="hex"/>
+@@ -4867,7 +2715,7 @@ to upconvert to 32b float internally?
+ </reg32>
+ </array>
+
+- <array offset="0xa884" name="SP_GS_VPC_DST" stride="1" length="8" usage="rp_blit">
++ <array offset="0xa884" name="SP_GS_VPC_DEST" stride="1" length="8" usage="rp_blit">
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="OUTLOC0" low="0" high="7" type="uint"/>
+ <bitfield name="OUTLOC1" low="8" high="15" type="uint"/>
+@@ -4877,29 +2725,29 @@ to upconvert to 32b float internally?
+ </array>
+
+ <!-- TODO: exact same layout as 0xa81b-0xa825 -->
+- <reg32 offset="0xa88c" name="SP_GS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+- <reg64 offset="0xa88d" name="SP_GS_OBJ_START" type="address" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa88c" name="SP_GS_PROGRAM_COUNTER_OFFSET" type="uint" usage="rp_blit"/>
++ <reg64 offset="0xa88d" name="SP_GS_BASE" type="address" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa88f" name="SP_GS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+- <reg64 offset="0xa890" name="SP_GS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
++ <reg64 offset="0xa890" name="SP_GS_PVT_MEM_BASE" type="waddress" align="32" usage="rp_blit"/>
+ <reg32 offset="0xa892" name="SP_GS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+- <reg32 offset="0xa893" name="SP_GS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa893" name="SP_GS_TSIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+ <reg32 offset="0xa894" name="SP_GS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+- <reg32 offset="0xa895" name="SP_GS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
+- <reg32 offset="0xa896" name="SP_GS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
+- <reg32 offset="0xa899" name="SP_GS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
+-
+- <reg64 offset="0xa8a0" name="SP_VS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+- <reg64 offset="0xa8a2" name="SP_HS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+- <reg64 offset="0xa8a4" name="SP_DS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+- <reg64 offset="0xa8a6" name="SP_GS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+- <reg64 offset="0xa8a8" name="SP_VS_TEX_CONST" type="address" align="64" usage="cmd"/>
+- <reg64 offset="0xa8aa" name="SP_HS_TEX_CONST" type="address" align="64" usage="cmd"/>
+- <reg64 offset="0xa8ac" name="SP_DS_TEX_CONST" type="address" align="64" usage="cmd"/>
+- <reg64 offset="0xa8ae" name="SP_GS_TEX_CONST" type="address" align="64" usage="cmd"/>
++ <reg32 offset="0xa895" name="SP_GS_INSTR_SIZE" low="0" high="27" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa896" name="SP_GS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa899" name="SP_GS_VGS_CNTL" variants="A7XX-" usage="cmd"/>
++
++ <reg64 offset="0xa8a0" name="SP_VS_SAMPLER_BASE" type="address" align="16" usage="cmd"/>
++ <reg64 offset="0xa8a2" name="SP_HS_SAMPLER_BASE" type="address" align="16" usage="cmd"/>
++ <reg64 offset="0xa8a4" name="SP_DS_SAMPLER_BASE" type="address" align="16" usage="cmd"/>
++ <reg64 offset="0xa8a6" name="SP_GS_SAMPLER_BASE" type="address" align="16" usage="cmd"/>
++ <reg64 offset="0xa8a8" name="SP_VS_TEXMEMOBJ_BASE" type="address" align="64" usage="cmd"/>
++ <reg64 offset="0xa8aa" name="SP_HS_TEXMEMOBJ_BASE" type="address" align="64" usage="cmd"/>
++ <reg64 offset="0xa8ac" name="SP_DS_TEXMEMOBJ_BASE" type="address" align="64" usage="cmd"/>
++ <reg64 offset="0xa8ae" name="SP_GS_TEXMEMOBJ_BASE" type="address" align="64" usage="cmd"/>
+
+ <!-- TODO: 4 unknown bool registers 0xa8c0-0xa8c3 -->
+
+- <reg32 offset="0xa980" name="SP_FS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="rp_blit">
++ <reg32 offset="0xa980" name="SP_PS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="rp_blit">
+ <bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+ <bitfield name="UNK21" pos="21" type="boolean"/>
+ <bitfield name="VARYING" pos="22" type="boolean"/>
+@@ -4909,8 +2757,7 @@ to upconvert to 32b float internally?
+ fine derivatives and quad subgroup ops.
+ </doc>
+ </bitfield>
+- <!-- note: vk blob uses bit24 -->
+- <bitfield name="UNK24" pos="24" type="boolean"/>
++ <bitfield name="INOUTREGOVERLAP" pos="24" type="boolean"/>
+ <bitfield name="UNK25" pos="25" type="boolean"/>
+ <bitfield name="PIXLODENABLE" pos="26" type="boolean">
+ <doc>
+@@ -4923,12 +2770,12 @@ to upconvert to 32b float internally?
+ <bitfield name="EARLYPREAMBLE" pos="28" type="boolean"/>
+ <bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+ </reg32>
+- <reg32 offset="0xa981" name="SP_FS_BRANCH_COND" type="hex"/>
+- <reg32 offset="0xa982" name="SP_FS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="rp_blit"/>
+- <reg64 offset="0xa983" name="SP_FS_OBJ_START" type="address" align="32" usage="rp_blit"/>
+- <reg32 offset="0xa985" name="SP_FS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
+- <reg64 offset="0xa986" name="SP_FS_PVT_MEM_ADDR" type="waddress" align="32" usage="rp_blit"/>
+- <reg32 offset="0xa988" name="SP_FS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
++ <reg32 offset="0xa981" name="SP_PS_BOOLEAN_CF_MASK" type="hex"/>
++ <reg32 offset="0xa982" name="SP_PS_PROGRAM_COUNTER_OFFSET" type="uint" usage="rp_blit"/>
++ <reg64 offset="0xa983" name="SP_PS_BASE" type="address" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa985" name="SP_PS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="rp_blit"/>
++ <reg64 offset="0xa986" name="SP_PS_PVT_MEM_BASE" type="waddress" align="32" usage="rp_blit"/>
++ <reg32 offset="0xa988" name="SP_PS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="rp_blit"/>
+
+ <reg32 offset="0xa989" name="SP_BLEND_CNTL" usage="rp_blit">
+ <!-- per-mrt enable bit -->
+@@ -4948,7 +2795,7 @@ to upconvert to 32b float internally?
+ <bitfield name="SRGB_MRT6" pos="6" type="boolean"/>
+ <bitfield name="SRGB_MRT7" pos="7" type="boolean"/>
+ </reg32>
+- <reg32 offset="0xa98b" name="SP_FS_RENDER_COMPONENTS" usage="rp_blit">
++ <reg32 offset="0xa98b" name="SP_PS_OUTPUT_MASK" usage="rp_blit">
+ <bitfield name="RT0" low="0" high="3"/>
+ <bitfield name="RT1" low="4" high="7"/>
+ <bitfield name="RT2" low="8" high="11"/>
+@@ -4958,17 +2805,17 @@ to upconvert to 32b float internally?
+ <bitfield name="RT6" low="24" high="27"/>
+ <bitfield name="RT7" low="28" high="31"/>
+ </reg32>
+- <reg32 offset="0xa98c" name="SP_FS_OUTPUT_CNTL0" usage="rp_blit">
++ <reg32 offset="0xa98c" name="SP_PS_OUTPUT_CNTL" usage="rp_blit">
+ <bitfield name="DUAL_COLOR_IN_ENABLE" pos="0" type="boolean"/>
+ <bitfield name="DEPTH_REGID" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="SAMPMASK_REGID" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="STENCILREF_REGID" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa98d" name="SP_FS_OUTPUT_CNTL1" usage="rp_blit">
++ <reg32 offset="0xa98d" name="SP_PS_MRT_CNTL" usage="rp_blit">
+ <bitfield name="MRT" low="0" high="3" type="uint"/>
+ </reg32>
+
+- <array offset="0xa98e" name="SP_FS_OUTPUT" stride="1" length="8" usage="rp_blit">
++ <array offset="0xa98e" name="SP_PS_OUTPUT" stride="1" length="8" usage="rp_blit">
+ <doc>per MRT</doc>
+ <reg32 offset="0x0" name="REG">
+ <bitfield name="REGID" low="0" high="7" type="a3xx_regid"/>
+@@ -4976,7 +2823,7 @@ to upconvert to 32b float internally?
+ </reg32>
+ </array>
+
+- <array offset="0xa996" name="SP_FS_MRT" stride="1" length="8" usage="rp_blit">
++ <array offset="0xa996" name="SP_PS_MRT" stride="1" length="8" usage="rp_blit">
+ <reg32 offset="0" name="REG">
+ <bitfield name="COLOR_FORMAT" low="0" high="7" type="a6xx_format"/>
+ <bitfield name="COLOR_SINT" pos="8" type="boolean"/>
+@@ -4985,7 +2832,7 @@ to upconvert to 32b float internally?
+ </reg32>
+ </array>
+
+- <reg32 offset="0xa99e" name="SP_FS_PREFETCH_CNTL" usage="rp_blit">
++ <reg32 offset="0xa99e" name="SP_PS_INITIAL_TEX_LOAD_CNTL" usage="rp_blit">
+ <bitfield name="COUNT" low="0" high="2" type="uint"/>
+ <bitfield name="IJ_WRITE_DISABLE" pos="3" type="boolean"/>
+ <doc>
+@@ -5002,7 +2849,7 @@ to upconvert to 32b float internally?
+ <!-- Blob never uses it -->
+ <bitfield name="CONSTSLOTID4COORD" low="16" high="24" type="uint" variants="A7XX-"/>
+ </reg32>
+- <array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A6XX" usage="rp_blit">
++ <array offset="0xa99f" name="SP_PS_INITIAL_TEX_LOAD" stride="1" length="4" variants="A6XX" usage="rp_blit">
+ <reg32 offset="0" name="CMD" variants="A6XX">
+ <bitfield name="SRC" low="0" high="6" type="uint"/>
+ <bitfield name="SAMP_ID" low="7" high="10" type="uint"/>
+@@ -5016,7 +2863,7 @@ to upconvert to 32b float internally?
+ <bitfield name="CMD" low="29" high="31" type="a6xx_tex_prefetch_cmd"/>
+ </reg32>
+ </array>
+- <array offset="0xa99f" name="SP_FS_PREFETCH" stride="1" length="4" variants="A7XX-" usage="rp_blit">
++ <array offset="0xa99f" name="SP_PS_INITIAL_TEX_LOAD" stride="1" length="4" variants="A7XX-" usage="rp_blit">
+ <reg32 offset="0" name="CMD" variants="A7XX-">
+ <bitfield name="SRC" low="0" high="6" type="uint"/>
+ <bitfield name="SAMP_ID" low="7" high="9" type="uint"/>
+@@ -5028,22 +2875,23 @@ to upconvert to 32b float internally?
+ <bitfield name="CMD" low="26" high="29" type="a6xx_tex_prefetch_cmd"/>
+ </reg32>
+ </array>
+- <array offset="0xa9a3" name="SP_FS_BINDLESS_PREFETCH" stride="1" length="4" usage="rp_blit">
++ <array offset="0xa9a3" name="SP_PS_INITIAL_TEX_INDEX" stride="1" length="4" usage="rp_blit">
+ <reg32 offset="0" name="CMD">
+ <bitfield name="SAMP_ID" low="0" high="15" type="uint"/>
+ <bitfield name="TEX_ID" low="16" high="31" type="uint"/>
+ </reg32>
+ </array>
+- <reg32 offset="0xa9a7" name="SP_FS_TEX_COUNT" low="0" high="7" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xa9a7" name="SP_PS_TSIZE" low="0" high="7" type="uint" usage="rp_blit"/>
+ <reg32 offset="0xa9a8" name="SP_UNKNOWN_A9A8" low="0" high="16" usage="cmd"/> <!-- always 0x0 ? -->
+- <reg32 offset="0xa9a9" name="SP_FS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa9a9" name="SP_PS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="rp_blit"/>
++ <reg32 offset="0xa9ab" name="SP_PS_UNKNOWN_A9AB" variants="A7XX-" usage="cmd"/>
+
+ <!-- TODO: unknown bool register at 0xa9aa, likely same as 0xa8c0-0xa8c3 but for FS -->
+
+
+
+
+- <reg32 offset="0xa9b0" name="SP_CS_CTRL_REG0" type="a6xx_sp_xs_ctrl_reg0" usage="cmd">
++ <reg32 offset="0xa9b0" name="SP_CS_CNTL_0" type="a6xx_sp_xs_cntl_0" usage="cmd">
+ <bitfield name="THREADSIZE" pos="20" type="a6xx_threadsize"/>
+ <!-- seems to make SP use less concurrent threads when possible? -->
+ <bitfield name="UNK21" pos="21" type="boolean"/>
+@@ -5053,8 +2901,15 @@ to upconvert to 32b float internally?
+ <bitfield name="MERGEDREGS" pos="31" type="boolean"/>
+ </reg32>
+
++ <enum name="a6xx_const_ram_mode">
++ <value value="0x0" name="CONSTLEN_128"/>
++ <value value="0x1" name="CONSTLEN_192"/>
++ <value value="0x2" name="CONSTLEN_256"/>
++ <value value="0x3" name="CONSTLEN_512"/> <!-- a7xx only -->
++ </enum>
++
+ <!-- set for compute shaders -->
+- <reg32 offset="0xa9b1" name="SP_CS_UNKNOWN_A9B1" usage="cmd">
++ <reg32 offset="0xa9b1" name="SP_CS_CNTL_1" usage="cmd">
+ <bitfield name="SHARED_SIZE" low="0" high="4" type="uint">
+ <doc>
+ If 0 - all 32k of shared storage is enabled, otherwise
+@@ -5065,32 +2920,36 @@ to upconvert to 32b float internally?
+ always return 0)
+ </doc>
+ </bitfield>
+- <bitfield name="UNK5" pos="5" type="boolean"/>
+- <!-- always 1 ? -->
+- <bitfield name="UNK6" pos="6" type="boolean"/>
++ <bitfield name="CONSTANTRAMMODE" low="5" high="6" type="a6xx_const_ram_mode">
++ <doc>
++ This defines the split between consts and local
++ memory in the Local Buffer. The programmed value
++ must be at least the actual CONSTLEN.
++ </doc>
++ </bitfield>
+ </reg32>
+- <reg32 offset="0xa9b2" name="SP_CS_BRANCH_COND" type="hex" usage="cmd"/>
+- <reg32 offset="0xa9b3" name="SP_CS_OBJ_FIRST_EXEC_OFFSET" type="uint" usage="cmd"/>
+- <reg64 offset="0xa9b4" name="SP_CS_OBJ_START" type="address" align="32" usage="cmd"/>
++ <reg32 offset="0xa9b2" name="SP_CS_BOOLEAN_CF_MASK" type="hex" usage="cmd"/>
++ <reg32 offset="0xa9b3" name="SP_CS_PROGRAM_COUNTER_OFFSET" type="uint" usage="cmd"/>
++ <reg64 offset="0xa9b4" name="SP_CS_BASE" type="address" align="32" usage="cmd"/>
+ <reg32 offset="0xa9b6" name="SP_CS_PVT_MEM_PARAM" type="a6xx_sp_xs_pvt_mem_param" usage="cmd"/>
+- <reg64 offset="0xa9b7" name="SP_CS_PVT_MEM_ADDR" align="32" usage="cmd"/>
++ <reg64 offset="0xa9b7" name="SP_CS_PVT_MEM_BASE" align="32" usage="cmd"/>
+ <reg32 offset="0xa9b9" name="SP_CS_PVT_MEM_SIZE" type="a6xx_sp_xs_pvt_mem_size" usage="cmd"/>
+- <reg32 offset="0xa9ba" name="SP_CS_TEX_COUNT" low="0" high="7" type="uint" usage="cmd"/>
++ <reg32 offset="0xa9ba" name="SP_CS_TSIZE" low="0" high="7" type="uint" usage="cmd"/>
+ <reg32 offset="0xa9bb" name="SP_CS_CONFIG" type="a6xx_sp_xs_config" usage="cmd"/>
+- <reg32 offset="0xa9bc" name="SP_CS_INSTRLEN" low="0" high="27" type="uint" usage="cmd"/>
+- <reg32 offset="0xa9bd" name="SP_CS_PVT_MEM_HW_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_hw_stack_offset" usage="cmd"/>
++ <reg32 offset="0xa9bc" name="SP_CS_INSTR_SIZE" low="0" high="27" type="uint" usage="cmd"/>
++ <reg32 offset="0xa9bd" name="SP_CS_PVT_MEM_STACK_OFFSET" type="a6xx_sp_xs_pvt_mem_stack_offset" usage="cmd"/>
+ <reg32 offset="0xa9be" name="SP_CS_UNKNOWN_A9BE" variants="A7XX-" usage="cmd"/>
+- <reg32 offset="0xa9c5" name="SP_CS_VGPR_CONFIG" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa9c5" name="SP_CS_VGS_CNTL" variants="A7XX-" usage="cmd"/>
+
+- <!-- new in a6xx gen4, matches HLSQ_CS_CNTL_0 -->
+- <reg32 offset="0xa9c2" name="SP_CS_CNTL_0" usage="cmd">
++ <!-- new in a6xx gen4, matches SP_CS_CONST_CONFIG_0 -->
++ <reg32 offset="0xa9c2" name="SP_CS_WIE_CNTL_0" usage="cmd">
+ <bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="WGSIZECONSTID" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <!-- new in a6xx gen4, matches HLSQ_CS_CNTL_1 -->
+- <reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A6XX" usage="cmd">
++ <!-- new in a6xx gen4, matches SP_CS_WGE_CNTL -->
++ <reg32 offset="0xa9c3" name="SP_CS_WIE_CNTL_1" variants="A6XX" usage="cmd">
+ <!-- gl_LocalInvocationIndex -->
+ <bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+@@ -5102,7 +2961,18 @@ to upconvert to 32b float internally?
+ <bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+ </reg32>
+
+- <reg32 offset="0xa9c3" name="SP_CS_CNTL_1" variants="A7XX-" usage="cmd">
++ <enum name="a7xx_workitem_rast_order">
++ <value value="0x0" name="WORKITEMRASTORDER_LINEAR"/>
++ <doc>
++ This is a fixed tiling, with 4x4 invocation outer tiles
++ containing 2x2 invocation inner tiles. The intent is to
++ improve cache locality with textures and images accessed
++ using gl_LocalInvocationID.
++ </doc>
++ <value value="0x1" name="WORKITEMRASTORDER_TILED"/>
++ </enum>
++
++ <reg32 offset="0xa9c3" name="SP_CS_WIE_CNTL_1" variants="A7XX-" usage="cmd">
+ <!-- gl_LocalInvocationIndex -->
+ <bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- Must match SP_CS_CTRL -->
+@@ -5110,18 +2980,16 @@ to upconvert to 32b float internally?
+ <!-- 1 thread per wave (would hang if THREAD128 is also set) -->
+ <bitfield name="THREADSIZE_SCALAR" pos="9" type="boolean"/>
+
+- <!-- Affects getone. If enabled, getone sometimes executed 1? less times
+- than there are subgroups.
+- -->
+- <bitfield name="UNK15" pos="15" type="boolean"/>
++ <doc>How invocations/fibers within a workgroup are tiled.</doc>
++ <bitfield name="WORKITEMRASTORDER" pos="15" type="a7xx_workitem_rast_order"/>
+ </reg32>
+
+ <!-- TODO: two 64kb aligned addresses at a9d0/a9d2 -->
+
+- <reg64 offset="0xa9e0" name="SP_FS_TEX_SAMP" type="address" align="16" usage="rp_blit"/>
+- <reg64 offset="0xa9e2" name="SP_CS_TEX_SAMP" type="address" align="16" usage="cmd"/>
+- <reg64 offset="0xa9e4" name="SP_FS_TEX_CONST" type="address" align="64" usage="rp_blit"/>
+- <reg64 offset="0xa9e6" name="SP_CS_TEX_CONST" type="address" align="64" usage="cmd"/>
++ <reg64 offset="0xa9e0" name="SP_PS_SAMPLER_BASE" type="address" align="16" usage="rp_blit"/>
++ <reg64 offset="0xa9e2" name="SP_CS_SAMPLER_BASE" type="address" align="16" usage="cmd"/>
++ <reg64 offset="0xa9e4" name="SP_PS_TEXMEMOBJ_BASE" type="address" align="64" usage="rp_blit"/>
++ <reg64 offset="0xa9e6" name="SP_CS_TEXMEMOBJ_BASE" type="address" align="64" usage="cmd"/>
+
+ <enum name="a6xx_bindless_descriptor_size">
+ <doc>
+@@ -5146,18 +3014,19 @@ to upconvert to 32b float internally?
+ </array>
+
+ <!--
+- IBO state for compute shader:
++ UAV state for compute shader:
+ -->
+- <reg64 offset="0xa9f2" name="SP_CS_IBO" type="address" align="16"/>
+- <reg32 offset="0xaa00" name="SP_CS_IBO_COUNT" low="0" high="6" type="uint"/>
++ <reg64 offset="0xa9f2" name="SP_CS_UAV_BASE" type="address" align="16" variants="A6XX"/>
++ <reg64 offset="0xa9f8" name="SP_CS_UAV_BASE" type="address" align="16" variants="A7XX"/>
++ <reg32 offset="0xaa00" name="SP_CS_USIZE" low="0" high="6" type="uint"/>
+
+ <!-- Correlated with avgs/uvgs usage in FS -->
+- <reg32 offset="0xaa01" name="SP_FS_VGPR_CONFIG" type="uint" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xaa01" name="SP_PS_VGS_CNTL" type="uint" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xaa02" name="SP_PS_ALIASED_COMPONENTS_CONTROL" variants="A7XX-" usage="cmd">
++ <reg32 offset="0xaa02" name="SP_PS_OUTPUT_CONST_CNTL" variants="A7XX-" usage="cmd">
+ <bitfield name="ENABLED" pos="0" type="boolean"/>
+ </reg32>
+- <reg32 offset="0xaa03" name="SP_PS_ALIASED_COMPONENTS" variants="A7XX-" usage="cmd">
++ <reg32 offset="0xaa03" name="SP_PS_OUTPUT_CONST_MASK" variants="A7XX-" usage="cmd">
+ <doc>
+ Specify for which components the output color should be read
+ from alias, e.g. for:
+@@ -5167,7 +3036,7 @@ to upconvert to 32b float internally?
+ alias.1.b32.0 r1.x, c4.x
+ alias.1.b32.0 r0.x, c0.x
+
+- the SP_PS_ALIASED_COMPONENTS would be 0x00001111
++ the SP_PS_OUTPUT_CONST_MASK would be 0x00001111
+ </doc>
+
+ <bitfield name="RT0" low="0" high="3"/>
+@@ -5193,7 +3062,7 @@ to upconvert to 32b float internally?
+ <value value="0x2" name="ISAMMODE_GL"/>
+ </enum>
+
+- <reg32 offset="0xab00" name="SP_MODE_CONTROL" usage="rp_blit">
++ <reg32 offset="0xab00" name="SP_MODE_CNTL" usage="rp_blit">
+ <!--
+ When set, half register loads from the constant file will
+ load a 32-bit value (so hc0.y loads the same value as c0.y)
+@@ -5210,16 +3079,16 @@ to upconvert to 32b float internally?
+ <reg32 offset="0xab01" name="SP_UNKNOWN_AB01" variants="A7XX-" usage="cmd"/>
+ <reg32 offset="0xab02" name="SP_UNKNOWN_AB02" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xab04" name="SP_FS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
+- <reg32 offset="0xab05" name="SP_FS_INSTRLEN" low="0" high="27" type="uint" usage="rp_blit"/>
++ <reg32 offset="0xab04" name="SP_PS_CONFIG" type="a6xx_sp_xs_config" usage="rp_blit"/>
++ <reg32 offset="0xab05" name="SP_PS_INSTR_SIZE" low="0" high="27" type="uint" usage="rp_blit"/>
+
+- <array offset="0xab10" name="SP_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
++ <array offset="0xab10" name="SP_GFX_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="rp_blit">
+ <reg64 offset="0" name="DESCRIPTOR" variants="A6XX">
+ <bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+ <bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+ </reg64>
+ </array>
+- <array offset="0xab0a" name="SP_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="rp_blit">
++ <array offset="0xab0a" name="SP_GFX_BINDLESS_BASE" stride="2" length="8" variants="A7XX-" usage="rp_blit">
+ <reg64 offset="0" name="DESCRIPTOR" variants="A7XX-">
+ <bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+ <bitfield name="ADDR" low="2" high="63" shr="2" type="address"/>
+@@ -5227,15 +3096,15 @@ to upconvert to 32b float internally?
+ </array>
+
+ <!--
+- Combined IBO state for 3d pipe, used for Image and SSBO write/atomic
+- instructions VS/HS/DS/GS/FS. See SP_CS_IBO_* for compute shaders.
++ Combined UAV state for 3d pipe, used for Image and SSBO write/atomic
++ instructions VS/HS/DS/GS/FS. See SP_CS_UAV_BASE_* for compute shaders.
+ -->
+- <reg64 offset="0xab1a" name="SP_IBO" type="address" align="16" usage="cmd"/>
+- <reg32 offset="0xab20" name="SP_IBO_COUNT" low="0" high="6" type="uint" usage="cmd"/>
++ <reg64 offset="0xab1a" name="SP_GFX_UAV_BASE" type="address" align="16" usage="cmd"/>
++ <reg32 offset="0xab20" name="SP_GFX_USIZE" low="0" high="6" type="uint" usage="cmd"/>
+
+ <reg32 offset="0xab22" name="SP_UNKNOWN_AB22" variants="A7XX-" usage="cmd"/>
+
+- <bitset name="a6xx_sp_2d_dst_format" inline="yes">
++ <bitset name="a6xx_sp_a2d_output_info" inline="yes">
+ <bitfield name="NORM" pos="0" type="boolean"/>
+ <bitfield name="SINT" pos="1" type="boolean"/>
+ <bitfield name="UINT" pos="2" type="boolean"/>
+@@ -5248,8 +3117,8 @@ to upconvert to 32b float internally?
+ <bitfield name="MASK" low="12" high="15"/>
+ </bitset>
+
+- <reg32 offset="0xacc0" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xa9bf" name="SP_2D_DST_FORMAT" type="a6xx_sp_2d_dst_format" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xacc0" name="SP_A2D_OUTPUT_INFO" type="a6xx_sp_a2d_output_info" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xa9bf" name="SP_A2D_OUTPUT_INFO" type="a6xx_sp_a2d_output_info" variants="A7XX-" usage="rp_blit"/>
+
+ <reg32 offset="0xae00" name="SP_DBG_ECO_CNTL" usage="cmd"/>
+ <reg32 offset="0xae01" name="SP_ADDR_MODE_CNTL" pos="0" type="a5xx_address_mode"/>
+@@ -5257,16 +3126,16 @@ to upconvert to 32b float internally?
+ <!-- TODO: valid bits 0x3c3f, see kernel -->
+ </reg32>
+ <reg32 offset="0xae03" name="SP_CHICKEN_BITS" usage="cmd"/>
+- <reg32 offset="0xae04" name="SP_FLOAT_CNTL" usage="cmd">
++ <reg32 offset="0xae04" name="SP_NC_MODE_CNTL_2" usage="cmd">
+ <bitfield name="F16_NO_INF" pos="3" type="boolean"/>
+ </reg32>
+
+ <reg32 offset="0xae06" name="SP_UNKNOWN_AE06" variants="A7XX-" usage="cmd"/>
+- <reg32 offset="0xae08" name="SP_UNKNOWN_AE08" variants="A7XX-" usage="cmd"/>
+- <reg32 offset="0xae09" name="SP_UNKNOWN_AE09" variants="A7XX-" usage="cmd"/>
+- <reg32 offset="0xae0a" name="SP_UNKNOWN_AE0A" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xae08" name="SP_CHICKEN_BITS_1" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xae09" name="SP_CHICKEN_BITS_2" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xae0a" name="SP_CHICKEN_BITS_3" variants="A7XX-" usage="cmd"/>
+
+- <reg32 offset="0xae0f" name="SP_PERFCTR_ENABLE" usage="cmd">
++ <reg32 offset="0xae0f" name="SP_PERFCTR_SHADER_MASK" usage="cmd">
+ <!-- some perfcntrs are affected by a per-stage enable bit
+ (PERF_SP_ALU_WORKING_CYCLES for example)
+ TODO: verify position of HS/DS/GS bits -->
+@@ -5281,7 +3150,7 @@ to upconvert to 32b float internally?
+ <array offset="0xae60" name="SP_PERFCTR_HLSQ_SEL" stride="1" length="6" variants="A7XX-"/>
+ <reg32 offset="0xae6a" name="SP_UNKNOWN_AE6A" variants="A7XX-" usage="cmd"/>
+ <reg32 offset="0xae6b" name="SP_UNKNOWN_AE6B" variants="A7XX-" usage="cmd"/>
+- <reg32 offset="0xae6c" name="SP_UNKNOWN_AE6C" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xae6c" name="SP_HLSQ_DBG_ECO_CNTL" variants="A7XX-" usage="cmd"/>
+ <reg32 offset="0xae6d" name="SP_READ_SEL" variants="A7XX-">
+ <bitfield name="LOCATION" low="18" high="19" type="a7xx_state_location"/>
+ <bitfield name="PIPE" low="16" high="17" type="a7xx_pipe"/>
+@@ -5301,33 +3170,44 @@ to upconvert to 32b float internally?
+ "a6xx_sp_ps_tp_cluster" but this actually specifies the border
+ color base for compute shaders.
+ -->
+- <reg64 offset="0xb180" name="SP_PS_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
++ <reg64 offset="0xb180" name="TPL1_CS_BORDER_COLOR_BASE" type="address" align="128" usage="cmd"/>
+ <reg32 offset="0xb182" name="SP_UNKNOWN_B182" low="0" high="2" usage="cmd"/>
+ <reg32 offset="0xb183" name="SP_UNKNOWN_B183" low="0" high="23" usage="cmd"/>
+
+ <reg32 offset="0xb190" name="SP_UNKNOWN_B190"/>
+ <reg32 offset="0xb191" name="SP_UNKNOWN_B191"/>
+
+- <!-- could be all the stuff below here is actually TPL1?? -->
+-
+- <reg32 offset="0xb300" name="SP_TP_RAS_MSAA_CNTL" usage="rp_blit">
++ <reg32 offset="0xb300" name="TPL1_RAS_MSAA_CNTL" usage="rp_blit">
+ <bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+ <bitfield name="UNK2" low="2" high="3"/>
+ </reg32>
+- <reg32 offset="0xb301" name="SP_TP_DEST_MSAA_CNTL" usage="rp_blit">
++ <reg32 offset="0xb301" name="TPL1_DEST_MSAA_CNTL" usage="rp_blit">
+ <bitfield name="SAMPLES" low="0" high="1" type="a3xx_msaa_samples"/>
+ <bitfield name="MSAA_DISABLE" pos="2" type="boolean"/>
+ </reg32>
+
+ <!-- looks to work in the same way as a5xx: -->
+- <reg64 offset="0xb302" name="SP_TP_BORDER_COLOR_BASE_ADDR" type="address" align="128" usage="cmd"/>
+- <reg32 offset="0xb304" name="SP_TP_SAMPLE_CONFIG" type="a6xx_sample_config" usage="rp_blit"/>
+- <reg32 offset="0xb305" name="SP_TP_SAMPLE_LOCATION_0" type="a6xx_sample_locations" usage="rp_blit"/>
+- <reg32 offset="0xb306" name="SP_TP_SAMPLE_LOCATION_1" type="a6xx_sample_locations" usage="rp_blit"/>
+- <reg32 offset="0xb307" name="SP_TP_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
+- <reg32 offset="0xb309" name="SP_TP_MODE_CNTL" usage="cmd">
++ <reg64 offset="0xb302" name="TPL1_GFX_BORDER_COLOR_BASE" type="address" align="128" usage="cmd"/>
++ <reg32 offset="0xb304" name="TPL1_MSAA_SAMPLE_POS_CNTL" type="a6xx_msaa_sample_pos_cntl" usage="rp_blit"/>
++ <reg32 offset="0xb305" name="TPL1_PROGRAMMABLE_MSAA_POS_0" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
++ <reg32 offset="0xb306" name="TPL1_PROGRAMMABLE_MSAA_POS_1" type="a6xx_programmable_msaa_pos" usage="rp_blit"/>
++ <reg32 offset="0xb307" name="TPL1_WINDOW_OFFSET" type="a6xx_reg_xy" usage="rp_blit"/>
++
++ <enum name="a6xx_coord_round">
++ <value value="0" name="COORD_TRUNCATE"/>
++ <value value="1" name="COORD_ROUND_NEAREST_EVEN"/>
++ </enum>
++
++ <enum name="a6xx_nearest_mode">
++ <value value="0" name="ROUND_CLAMP_TRUNCATE"/>
++ <value value="1" name="CLAMP_ROUND_TRUNCATE"/>
++ </enum>
++
++ <reg32 offset="0xb309" name="TPL1_MODE_CNTL" usage="cmd">
+ <bitfield name="ISAMMODE" low="0" high="1" type="a6xx_isam_mode"/>
+- <bitfield name="UNK3" low="2" high="7"/>
++ <bitfield name="TEXCOORDROUNDMODE" pos="2" type="a6xx_coord_round"/>
++ <bitfield name="NEARESTMIPSNAP" pos="5" type="a6xx_nearest_mode"/>
++ <bitfield name="DESTDATATYPEOVERRIDE" pos="7" type="boolean"/>
+ </reg32>
+ <reg32 offset="0xb310" name="SP_UNKNOWN_B310" variants="A7XX-" usage="cmd"/>
+
+@@ -5336,42 +3216,45 @@ to upconvert to 32b float internally?
+ badly named or the functionality moved in a6xx. But downstream kernel
+ calls this "a6xx_sp_ps_tp_2d_cluster"
+ -->
+- <reg32 offset="0xb4c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb4c1" name="SP_PS_2D_SRC_SIZE" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb4c0" name="TPL1_A2D_SRC_TEXTURE_INFO" type="a6xx_a2d_src_texture_info" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb4c1" name="TPL1_A2D_SRC_TEXTURE_SIZE" variants="A6XX" usage="rp_blit">
+ <bitfield name="WIDTH" low="0" high="14" type="uint"/>
+ <bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+ </reg32>
+- <reg64 offset="0xb4c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb4c4" name="SP_PS_2D_SRC_PITCH" variants="A6XX" usage="rp_blit">
++ <reg64 offset="0xb4c2" name="TPL1_A2D_SRC_TEXTURE_BASE" type="address" align="16" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb4c4" name="TPL1_A2D_SRC_TEXTURE_PITCH" variants="A6XX" usage="rp_blit">
+ <bitfield name="UNK0" low="0" high="8"/>
+ <bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
+ </reg32>
+
+- <reg32 offset="0xb2c0" name="SP_PS_2D_SRC_INFO" type="a6xx_2d_src_surf_info" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xb2c1" name="SP_PS_2D_SRC_SIZE" variants="A7XX">
++ <reg32 offset="0xb2c0" name="TPL1_A2D_SRC_TEXTURE_INFO" type="a6xx_a2d_src_texture_info" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xb2c1" name="TPL1_A2D_SRC_TEXTURE_SIZE" variants="A7XX">
+ <bitfield name="WIDTH" low="0" high="14" type="uint"/>
+ <bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+ </reg32>
+- <reg64 offset="0xb2c2" name="SP_PS_2D_SRC" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xb2c4" name="SP_PS_2D_SRC_PITCH" variants="A7XX">
+- <bitfield name="UNK0" low="0" high="8"/>
+- <bitfield name="PITCH" low="9" high="23" shr="6" type="uint"/>
++ <reg64 offset="0xb2c2" name="TPL1_A2D_SRC_TEXTURE_BASE" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xb2c4" name="TPL1_A2D_SRC_TEXTURE_PITCH" variants="A7XX">
++ <!--
++ Bits from 3..9 must be zero unless 'TPL1_A2D_BLT_CNTL::TYPE'
++ is A6XX_TEX_IMG_BUFFER, which allows for lower alignment.
++ -->
++ <bitfield name="PITCH" low="3" high="23" type="uint"/>
+ </reg32>
+
+ <!-- planes for NV12, etc. (TODO: not tested) -->
+- <reg64 offset="0xb4c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A6XX"/>
+- <reg32 offset="0xb4c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A6XX"/>
+- <reg64 offset="0xb4c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A6XX"/>
++ <reg64 offset="0xb4c5" name="TPL1_A2D_SRC_TEXTURE_BASE_1" type="address" align="16" variants="A6XX"/>
++ <reg32 offset="0xb4c7" name="TPL1_A2D_SRC_TEXTURE_PITCH_1" low="0" high="11" shr="6" type="uint" variants="A6XX"/>
++ <reg64 offset="0xb4c8" name="TPL1_A2D_SRC_TEXTURE_BASE_2" type="address" align="16" variants="A6XX"/>
+
+- <reg64 offset="0xb2c5" name="SP_PS_2D_SRC_PLANE1" type="address" align="16" variants="A7XX-"/>
+- <reg32 offset="0xb2c7" name="SP_PS_2D_SRC_PLANE_PITCH" low="0" high="11" shr="6" type="uint" variants="A7XX-"/>
+- <reg64 offset="0xb2c8" name="SP_PS_2D_SRC_PLANE2" type="address" align="16" variants="A7XX-"/>
++ <reg64 offset="0xb2c5" name="TPL1_A2D_SRC_TEXTURE_BASE_1" type="address" align="16" variants="A7XX-"/>
++ <reg32 offset="0xb2c7" name="TPL1_A2D_SRC_TEXTURE_PITCH_1" low="0" high="11" shr="6" type="uint" variants="A7XX-"/>
++ <reg64 offset="0xb2c8" name="TPL1_A2D_SRC_TEXTURE_BASE_2" type="address" align="16" variants="A7XX-"/>
+
+- <reg64 offset="0xb4ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb4cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A6XX" usage="rp_blit"/>
++ <reg64 offset="0xb4ca" name="TPL1_A2D_SRC_TEXTURE_FLAG_BASE" type="address" align="16" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb4cc" name="TPL1_A2D_SRC_TEXTURE_FLAG_PITCH" low="0" high="7" shr="6" type="uint" variants="A6XX" usage="rp_blit"/>
+
+- <reg64 offset="0xb2ca" name="SP_PS_2D_SRC_FLAGS" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xb2cc" name="SP_PS_2D_SRC_FLAGS_PITCH" low="0" high="7" shr="6" type="uint" variants="A7XX-" usage="rp_blit"/>
++ <reg64 offset="0xb2ca" name="TPL1_A2D_SRC_TEXTURE_FLAG_BASE" type="address" align="16" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xb2cc" name="TPL1_A2D_SRC_TEXTURE_FLAG_PITCH" low="0" high="7" shr="6" type="uint" variants="A7XX-" usage="rp_blit"/>
+
+ <reg32 offset="0xb4cd" name="SP_PS_UNKNOWN_B4CD" low="6" high="31" variants="A6XX"/>
+ <reg32 offset="0xb4ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A6XX"/>
+@@ -5383,8 +3266,12 @@ to upconvert to 32b float internally?
+ <reg32 offset="0xb2ce" name="SP_PS_UNKNOWN_B4CE" low="0" high="31" variants="A7XX"/>
+ <reg32 offset="0xb2cf" name="SP_PS_UNKNOWN_B4CF" low="0" high="30" variants="A7XX"/>
+ <reg32 offset="0xb2d0" name="SP_PS_UNKNOWN_B4D0" low="0" high="29" variants="A7XX"/>
+- <reg32 offset="0xb2d1" name="SP_PS_2D_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX"/>
+- <reg32 offset="0xb2d2" name="SP_PS_UNKNOWN_B2D2" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xb2d1" name="TPL1_A2D_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX"/>
++ <reg32 offset="0xb2d2" name="TPL1_A2D_BLT_CNTL" variants="A7XX-" usage="rp_blit">
++ <bitfield name="RAW_COPY" pos="0" type="boolean"/>
++ <bitfield name="START_OFFSET_TEXELS" low="16" high="21"/>
++ <bitfield name="TYPE" low="29" high="31" type="a6xx_tex_type"/>
++ </reg32>
+ <reg32 offset="0xab21" name="SP_WINDOW_OFFSET" type="a6xx_reg_xy" variants="A7XX-" usage="rp_blit"/>
+
+ <!-- always 0x100000 or 0x1000000? -->
+@@ -5422,34 +3309,44 @@ to upconvert to 32b float internally?
+
+ <!-- TODO: 4 more perfcntr sel at 0xb620 ? -->
+
+- <bitset name="a6xx_hlsq_xs_cntl" inline="yes">
++ <bitset name="a6xx_xs_const_config" inline="yes">
+ <bitfield name="CONSTLEN" low="0" high="7" shr="2" type="uint"/>
+ <bitfield name="ENABLED" pos="8" type="boolean"/>
+ <bitfield name="READ_IMM_SHARED_CONSTS" pos="9" type="boolean" variants="A7XX-"/>
+ </bitset>
+
+- <reg32 offset="0xb800" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb801" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb802" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb803" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb800" name="SP_VS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb801" name="SP_HS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb802" name="SP_DS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb803" name="SP_GS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="rp_blit"/>
+
+- <reg32 offset="0xa827" name="HLSQ_VS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa83f" name="HLSQ_HS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa867" name="HLSQ_DS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa898" name="HLSQ_GS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa827" name="SP_VS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa83f" name="SP_HS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa867" name="SP_DS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa898" name="SP_GS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="rp_blit"/>
+
+- <reg32 offset="0xa9aa" name="HLSQ_FS_UNKNOWN_A9AA" variants="A7XX-" usage="rp_blit">
+- <!-- Tentatively named, appears to disable consts being loaded via CP_LOAD_STATE6_FRAG -->
+- <bitfield name="CONSTS_LOAD_DISABLE" pos="0" type="boolean"/>
++ <reg32 offset="0xa9aa" name="SP_RENDER_CNTL" variants="A7XX-" usage="rp_blit">
++ <bitfield name="FS_DISABLE" pos="0" type="boolean"/>
+ </reg32>
+
+- <!-- Always 0 -->
+- <reg32 offset="0xa9ac" name="HLSQ_UNKNOWN_A9AC" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa9ac" name="SP_DITHER_CNTL" variants="A7XX-" usage="cmd">
++ <bitfield name="DITHER_MODE_MRT0" low="0" high="1" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT1" low="2" high="3" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT2" low="4" high="5" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT3" low="6" high="7" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT4" low="8" high="9" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT5" low="10" high="11" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT6" low="12" high="13" type="adreno_rb_dither_mode"/>
++ <bitfield name="DITHER_MODE_MRT7" low="14" high="15" type="adreno_rb_dither_mode"/>
++ </reg32>
+
+- <!-- Used in VK_KHR_fragment_shading_rate -->
+- <reg32 offset="0xa9ad" name="HLSQ_UNKNOWN_A9AD" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa9ad" name="SP_VRS_CONFIG" variants="A7XX-" usage="rp_blit">
++ <bitfield name="PIPELINE_FSR_ENABLE" pos="0" type="boolean"/>
++ <bitfield name="ATTACHMENT_FSR_ENABLE" pos="1" type="boolean"/>
++ <bitfield name="PRIMITIVE_FSR_ENABLE" pos="3" type="boolean"/>
++ </reg32>
+
+- <reg32 offset="0xa9ae" name="HLSQ_UNKNOWN_A9AE" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9ae" name="SP_PS_CNTL_1" variants="A7XX-" usage="rp_blit">
+ <bitfield name="SYSVAL_REGS_COUNT" low="0" high="7" type="uint"/>
+ <!-- UNK8 is set on a730/a740 -->
+ <bitfield name="UNK8" pos="8" type="boolean"/>
+@@ -5462,94 +3359,94 @@ to upconvert to 32b float internally?
+ <reg32 offset="0xb823" name="HLSQ_LOAD_STATE_GEOM_DATA"/>
+
+
+- <bitset name="a6xx_hlsq_fs_cntl_0" inline="yes">
++ <bitset name="a6xx_sp_ps_wave_cntl" inline="yes">
+ <!-- must match SP_FS_CTRL -->
+ <bitfield name="THREADSIZE" pos="0" type="a6xx_threadsize"/>
+ <bitfield name="VARYINGS" pos="1" type="boolean"/>
+ <bitfield name="UNK2" low="2" high="11"/>
+ </bitset>
+- <bitset name="a6xx_hlsq_control_3_reg" inline="yes">
++ <bitset name="a6xx_sp_reg_prog_id_1" inline="yes">
+ <!-- register loaded with position (bary.f) -->
+ <bitfield name="IJ_PERSP_PIXEL" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="IJ_LINEAR_PIXEL" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="IJ_PERSP_CENTROID" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="IJ_LINEAR_CENTROID" low="24" high="31" type="a3xx_regid"/>
+ </bitset>
+- <bitset name="a6xx_hlsq_control_4_reg" inline="yes">
++ <bitset name="a6xx_sp_reg_prog_id_2" inline="yes">
+ <bitfield name="IJ_PERSP_SAMPLE" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="IJ_LINEAR_SAMPLE" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="XYCOORDREGID" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="ZWCOORDREGID" low="24" high="31" type="a3xx_regid"/>
+ </bitset>
+- <bitset name="a6xx_hlsq_control_5_reg" inline="yes">
++ <bitset name="a6xx_sp_reg_prog_id_3" inline="yes">
+ <bitfield name="LINELENGTHREGID" low="0" high="7" type="a3xx_regid"/>
+ <bitfield name="FOVEATIONQUALITYREGID" low="8" high="15" type="a3xx_regid"/>
+ </bitset>
+
+- <reg32 offset="0xb980" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb980" type="a6xx_sp_ps_wave_cntl" name="SP_PS_WAVE_CNTL" variants="A6XX" usage="rp_blit"/>
+ <reg32 offset="0xb981" name="HLSQ_UNKNOWN_B981" pos="0" type="boolean" variants="A6XX"/> <!-- never used by blob -->
+- <reg32 offset="0xb982" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb982" name="SP_LB_PARAM_LIMIT" low="0" high="2" variants="A6XX" usage="rp_blit">
+ <!-- Sets the maximum number of primitives allowed in one FS wave minus one, similarly to the
+ A3xx field, except that it's not necessary to set it to anything but the maximum, since
+ the hardware will simply emit smaller waves when it runs out of space. -->
+ <bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb983" name="HLSQ_CONTROL_2_REG" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb983" name="SP_REG_PROG_ID_0" variants="A6XX" usage="rp_blit">
+ <bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- SAMPLEID is loaded into a half-precision register: -->
+ <bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xb984" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb985" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb986" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb987" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="cmd"/>
+- <reg32 offset="0xa9c6" type="a6xx_hlsq_fs_cntl_0" name="HLSQ_FS_CNTL_0" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9c7" name="HLSQ_CONTROL_1_REG" low="0" high="2" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xb984" type="a6xx_sp_reg_prog_id_1" name="SP_REG_PROG_ID_1" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb985" type="a6xx_sp_reg_prog_id_2" name="SP_REG_PROG_ID_2" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb986" type="a6xx_sp_reg_prog_id_3" name="SP_REG_PROG_ID_3" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb987" name="SP_CS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="cmd"/>
++ <reg32 offset="0xa9c6" type="a6xx_sp_ps_wave_cntl" name="SP_PS_WAVE_CNTL" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9c7" name="SP_LB_PARAM_LIMIT" low="0" high="2" variants="A7XX-" usage="rp_blit">
+ <bitfield name="PRIMALLOCTHRESHOLD" low="0" high="2" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9c8" name="HLSQ_CONTROL_2_REG" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9c8" name="SP_REG_PROG_ID_0" variants="A7XX-" usage="rp_blit">
+ <bitfield name="FACEREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- SAMPLEID is loaded into a half-precision register: -->
+ <bitfield name="SAMPLEID" low="8" high="15" type="a3xx_regid"/>
+ <bitfield name="SAMPLEMASK" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="CENTERRHW" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xa9c9" type="a6xx_hlsq_control_3_reg" name="HLSQ_CONTROL_3_REG" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9ca" type="a6xx_hlsq_control_4_reg" name="HLSQ_CONTROL_4_REG" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9cb" type="a6xx_hlsq_control_5_reg" name="HLSQ_CONTROL_5_REG" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9cd" name="HLSQ_CS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="cmd"/>
++ <reg32 offset="0xa9c9" type="a6xx_sp_reg_prog_id_1" name="SP_REG_PROG_ID_1" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9ca" type="a6xx_sp_reg_prog_id_2" name="SP_REG_PROG_ID_2" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9cb" type="a6xx_sp_reg_prog_id_3" name="SP_REG_PROG_ID_3" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9cd" name="SP_CS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="cmd"/>
+
+ <!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+- <reg32 offset="0xb990" name="HLSQ_CS_NDRANGE_0" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb990" name="SP_CS_NDRANGE_0" variants="A6XX" usage="rp_blit">
+ <bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+ <!-- localsize is value minus one: -->
+ <bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+ <bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+ <bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb991" name="HLSQ_CS_NDRANGE_1" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb991" name="SP_CS_NDRANGE_1" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb992" name="HLSQ_CS_NDRANGE_2" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb992" name="SP_CS_NDRANGE_2" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb993" name="HLSQ_CS_NDRANGE_3" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb993" name="SP_CS_NDRANGE_3" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb994" name="HLSQ_CS_NDRANGE_4" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb994" name="SP_CS_NDRANGE_4" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb995" name="HLSQ_CS_NDRANGE_5" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb995" name="SP_CS_NDRANGE_5" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb996" name="HLSQ_CS_NDRANGE_6" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb996" name="SP_CS_NDRANGE_6" variants="A6XX" usage="rp_blit">
+ <bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xb997" name="HLSQ_CS_CNTL_0" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb997" name="SP_CS_CONST_CONFIG_0" variants="A6XX" usage="rp_blit">
+ <!-- these are all vec3. first 3 need to be high regs
+- WGSIZECONSTID is the local size (from HLSQ_CS_NDRANGE_0)
++ WGSIZECONSTID is the local size (from SP_CS_NDRANGE_0)
+ WGOFFSETCONSTID is WGIDCONSTID*WGSIZECONSTID
+ -->
+ <bitfield name="WGIDCONSTID" low="0" high="7" type="a3xx_regid"/>
+@@ -5557,7 +3454,7 @@ to upconvert to 32b float internally?
+ <bitfield name="WGOFFSETCONSTID" low="16" high="23" type="a3xx_regid"/>
+ <bitfield name="LOCALIDREGID" low="24" high="31" type="a3xx_regid"/>
+ </reg32>
+- <reg32 offset="0xb998" name="HLSQ_CS_CNTL_1" variants="A6XX" usage="rp_blit">
++ <reg32 offset="0xb998" name="SP_CS_WGE_CNTL" variants="A6XX" usage="rp_blit">
+ <!-- gl_LocalInvocationIndex -->
+ <bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- a650 has 6 "SP cores" (but 3 "SP"). this makes it use only
+@@ -5569,40 +3466,40 @@ to upconvert to 32b float internally?
+ <bitfield name="THREADSIZE_SCALAR" pos="10" type="boolean"/>
+ </reg32>
+ <!--note: vulkan blob doesn't use these -->
+- <reg32 offset="0xb999" name="HLSQ_CS_KERNEL_GROUP_X" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb99a" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xb99b" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb999" name="SP_CS_KERNEL_GROUP_X" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb99a" name="SP_CS_KERNEL_GROUP_Y" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xb99b" name="SP_CS_KERNEL_GROUP_Z" variants="A6XX" usage="rp_blit"/>
+
+ <!-- TODO: what does KERNELDIM do exactly (blob sets it differently from turnip) -->
+- <reg32 offset="0xa9d4" name="HLSQ_CS_NDRANGE_0" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d4" name="SP_CS_NDRANGE_0" variants="A7XX-" usage="rp_blit">
+ <bitfield name="KERNELDIM" low="0" high="1" type="uint"/>
+ <!-- localsize is value minus one: -->
+ <bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+ <bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+ <bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9d5" name="HLSQ_CS_NDRANGE_1" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d5" name="SP_CS_NDRANGE_1" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_X" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9d6" name="HLSQ_CS_NDRANGE_2" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d6" name="SP_CS_NDRANGE_2" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALOFF_X" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9d7" name="HLSQ_CS_NDRANGE_3" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d7" name="SP_CS_NDRANGE_3" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_Y" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9d8" name="HLSQ_CS_NDRANGE_4" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d8" name="SP_CS_NDRANGE_4" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALOFF_Y" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9d9" name="HLSQ_CS_NDRANGE_5" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9d9" name="SP_CS_NDRANGE_5" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALSIZE_Z" low="0" high="31" type="uint"/>
+ </reg32>
+- <reg32 offset="0xa9da" name="HLSQ_CS_NDRANGE_6" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9da" name="SP_CS_NDRANGE_6" variants="A7XX-" usage="rp_blit">
+ <bitfield name="GLOBALOFF_Z" low="0" high="31" type="uint"/>
+ </reg32>
+ <!--note: vulkan blob doesn't use these -->
+- <reg32 offset="0xa9dc" name="HLSQ_CS_KERNEL_GROUP_X" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9dd" name="HLSQ_CS_KERNEL_GROUP_Y" variants="A7XX-" usage="rp_blit"/>
+- <reg32 offset="0xa9de" name="HLSQ_CS_KERNEL_GROUP_Z" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9dc" name="SP_CS_KERNEL_GROUP_X" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9dd" name="SP_CS_KERNEL_GROUP_Y" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xa9de" name="SP_CS_KERNEL_GROUP_Z" variants="A7XX-" usage="rp_blit"/>
+
+ <enum name="a7xx_cs_yalign">
+ <value name="CS_YALIGN_1" value="8"/>
+@@ -5611,19 +3508,29 @@ to upconvert to 32b float internally?
+ <value name="CS_YALIGN_8" value="1"/>
+ </enum>
+
+- <reg32 offset="0xa9db" name="HLSQ_CS_CNTL_1" variants="A7XX-" usage="rp_blit">
++ <reg32 offset="0xa9db" name="SP_CS_WGE_CNTL" variants="A7XX-" usage="rp_blit">
+ <!-- gl_LocalInvocationIndex -->
+ <bitfield name="LINEARLOCALIDREGID" low="0" high="7" type="a3xx_regid"/>
+ <!-- Must match SP_CS_CTRL -->
+ <bitfield name="THREADSIZE" pos="9" type="a6xx_threadsize"/>
+- <bitfield name="UNK11" pos="11" type="boolean"/>
+- <bitfield name="UNK22" pos="22" type="boolean"/>
+- <bitfield name="UNK26" pos="26" type="boolean"/>
+- <bitfield name="YALIGN" low="27" high="30" type="a7xx_cs_yalign"/>
++ <doc>
++ When this bit is enabled, the dispatch order interleaves
++ the z coordinate instead of launching all workgroups
++ with z=0, then all with z=1 and so on.
++ </doc>
++ <bitfield name="WORKGROUPRASTORDERZFIRSTEN" pos="11" type="boolean"/>
++ <doc>
++ When both fields are non-0 then the dispatcher uses
++ these tile sizes to launch workgroups in a tiled manner
++ when the x and y workgroup counts are
++ both more than 1.
++ </doc>
++ <bitfield name="WGTILEWIDTH" low="20" high="25"/>
++ <bitfield name="WGTILEHEIGHT" low="26" high="31"/>
+ </reg32>
+
+- <reg32 offset="0xa9df" name="HLSQ_CS_LOCAL_SIZE" variants="A7XX-" usage="cmd">
+- <!-- localsize is value minus one: -->
++ <reg32 offset="0xa9df" name="SP_CS_NDRANGE_7" variants="A7XX-" usage="cmd">
++ <!-- The size of the last workgroup. localsize is value minus one: -->
+ <bitfield name="LOCALSIZEX" low="2" high="11" type="uint"/>
+ <bitfield name="LOCALSIZEY" low="12" high="21" type="uint"/>
+ <bitfield name="LOCALSIZEZ" low="22" high="31" type="uint"/>
+@@ -5641,29 +3548,27 @@ to upconvert to 32b float internally?
+ </reg64>
+ </array>
+
+- <!-- new in a6xx gen4, mirror of SP_CS_UNKNOWN_A9B1? -->
+- <reg32 offset="0xb9d0" name="HLSQ_CS_UNKNOWN_B9D0" variants="A6XX" usage="cmd">
++ <!-- new in a6xx gen4, mirror of SP_CS_CNTL_1? -->
++ <reg32 offset="0xb9d0" name="HLSQ_CS_CTRL_REG1" variants="A6XX" usage="cmd">
+ <bitfield name="SHARED_SIZE" low="0" high="4" type="uint"/>
+- <bitfield name="UNK5" pos="5" type="boolean"/>
+- <!-- always 1 ? -->
+- <bitfield name="UNK6" pos="6" type="boolean"/>
++ <bitfield name="CONSTANTRAMMODE" low="5" high="6" type="a6xx_const_ram_mode"/>
+ </reg32>
+
+- <reg32 offset="0xbb00" name="HLSQ_DRAW_CMD" variants="A6XX">
++ <reg32 offset="0xbb00" name="SP_DRAW_INITIATOR" variants="A6XX">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0xbb01" name="HLSQ_DISPATCH_CMD" variants="A6XX">
++ <reg32 offset="0xbb01" name="SP_KERNEL_INITIATOR" variants="A6XX">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0xbb02" name="HLSQ_EVENT_CMD" variants="A6XX">
++ <reg32 offset="0xbb02" name="SP_EVENT_INITIATOR" variants="A6XX">
+ <!-- I think only the low bit is actually used? -->
+ <bitfield name="STATE_ID" low="16" high="23"/>
+ <bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+ </reg32>
+
+- <reg32 offset="0xbb08" name="HLSQ_INVALIDATE_CMD" variants="A6XX" usage="cmd">
++ <reg32 offset="0xbb08" name="SP_UPDATE_CNTL" variants="A6XX" usage="cmd">
+ <doc>
+ This register clears pending loads queued up by
+ CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+@@ -5678,8 +3583,8 @@ to upconvert to 32b float internally?
+ <bitfield name="FS_STATE" pos="4" type="boolean"/>
+ <bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+- <bitfield name="CS_IBO" pos="6" type="boolean"/>
+- <bitfield name="GFX_IBO" pos="7" type="boolean"/>
++ <bitfield name="CS_UAV" pos="6" type="boolean"/>
++ <bitfield name="GFX_UAV" pos="7" type="boolean"/>
+
+ <!-- Note: these only do something when HLSQ_SHARED_CONSTS is set to 1 -->
+ <bitfield name="CS_SHARED_CONST" pos="19" type="boolean"/>
+@@ -5690,20 +3595,20 @@ to upconvert to 32b float internally?
+ <bitfield name="GFX_BINDLESS" low="14" high="18" type="hex"/>
+ </reg32>
+
+- <reg32 offset="0xab1c" name="HLSQ_DRAW_CMD" variants="A7XX-">
++ <reg32 offset="0xab1c" name="SP_DRAW_INITIATOR" variants="A7XX-">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0xab1d" name="HLSQ_DISPATCH_CMD" variants="A7XX-">
++ <reg32 offset="0xab1d" name="SP_KERNEL_INITIATOR" variants="A7XX-">
+ <bitfield name="STATE_ID" low="0" high="7"/>
+ </reg32>
+
+- <reg32 offset="0xab1e" name="HLSQ_EVENT_CMD" variants="A7XX-">
++ <reg32 offset="0xab1e" name="SP_EVENT_INITIATOR" variants="A7XX-">
+ <bitfield name="STATE_ID" low="16" high="23"/>
+ <bitfield name="EVENT" low="0" high="6" type="vgt_event_type"/>
+ </reg32>
+
+- <reg32 offset="0xab1f" name="HLSQ_INVALIDATE_CMD" variants="A7XX-" usage="cmd">
++ <reg32 offset="0xab1f" name="SP_UPDATE_CNTL" variants="A7XX-" usage="cmd">
+ <doc>
+ This register clears pending loads queued up by
+ CP_LOAD_STATE6. Each bit resets a particular kind(s) of
+@@ -5718,18 +3623,18 @@ to upconvert to 32b float internally?
+ <bitfield name="FS_STATE" pos="4" type="boolean"/>
+ <bitfield name="CS_STATE" pos="5" type="boolean"/>
+
+- <bitfield name="CS_IBO" pos="6" type="boolean"/>
+- <bitfield name="GFX_IBO" pos="7" type="boolean"/>
++ <bitfield name="CS_UAV" pos="6" type="boolean"/>
++ <bitfield name="GFX_UAV" pos="7" type="boolean"/>
+
+ <!-- SS6_BINDLESS: one bit per bindless base -->
+ <bitfield name="CS_BINDLESS" low="9" high="16" type="hex"/>
+ <bitfield name="GFX_BINDLESS" low="17" high="24" type="hex"/>
+ </reg32>
+
+- <reg32 offset="0xbb10" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A6XX" usage="rp_blit"/>
+- <reg32 offset="0xab03" name="HLSQ_FS_CNTL" type="a6xx_hlsq_xs_cntl" variants="A7XX-" usage="rp_blit"/>
++ <reg32 offset="0xbb10" name="SP_PS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A6XX" usage="rp_blit"/>
++ <reg32 offset="0xab03" name="SP_PS_CONST_CONFIG" type="a6xx_xs_const_config" variants="A7XX-" usage="rp_blit"/>
+
+- <array offset="0xab40" name="HLSQ_SHARED_CONSTS_IMM" stride="1" length="64" variants="A7XX-"/>
++ <array offset="0xab40" name="SP_SHARED_CONSTANT_GFX_0" stride="1" length="64" variants="A7XX-"/>
+
+ <reg32 offset="0xbb11" name="HLSQ_SHARED_CONSTS" variants="A6XX" usage="cmd">
+ <doc>
+@@ -5738,7 +3643,7 @@ to upconvert to 32b float internally?
+ const pool and 16 in the geometry const pool although
+ only 8 are actually used (why?) and they are mapped to
+ c504-c511 in each stage. Both VS and FS shared consts
+- are written using ST6_CONSTANTS/SB6_IBO, so that both
++ are written using ST6_CONSTANTS/SB6_UAV, so that both
+ the geometry and FS shared consts can be written at once
+ by using CP_LOAD_STATE6 rather than
+ CP_LOAD_STATE6_FRAG/CP_LOAD_STATE6_GEOM. In addition
+@@ -5747,13 +3652,13 @@ to upconvert to 32b float internally?
+
+ There is also a separate shared constant pool for CS,
+ which is loaded through CP_LOAD_STATE6_FRAG with
+- ST6_UBO/ST6_IBO. However the only real difference for CS
++ ST6_UBO/ST6_UAV. However the only real difference for CS
+ is the dword units.
+ </doc>
+ <bitfield name="ENABLE" pos="0" type="boolean"/>
+ </reg32>
+
+- <!-- mirror of SP_BINDLESS_BASE -->
++ <!-- mirror of SP_GFX_BINDLESS_BASE -->
+ <array offset="0xbb20" name="HLSQ_BINDLESS_BASE" stride="2" length="5" variants="A6XX" usage="cmd">
+ <reg64 offset="0" name="DESCRIPTOR">
+ <bitfield name="DESC_SIZE" low="0" high="1" type="a6xx_bindless_descriptor_size"/>
+@@ -5788,10 +3693,10 @@ to upconvert to 32b float internally?
+ sequence. The sequence used internally for an event looks like:
+ - write EVENT_CMD pipe register
+ - write CP_EVENT_START
+- - write HLSQ_EVENT_CMD with event or HLSQ_DRAW_CMD
+- - write PC_EVENT_CMD with event or PC_DRAW_CMD
+- - write HLSQ_EVENT_CMD(CONTEXT_DONE)
+- - write PC_EVENT_CMD(CONTEXT_DONE)
++ - write SP_EVENT_INITIATOR with event or SP_DRAW_INITIATOR
++ - write PC_EVENT_INITIATOR with event or PC_DRAW_INITIATOR
++ - write SP_EVENT_INITIATOR(CONTEXT_DONE)
++ - write PC_EVENT_INITIATOR(CONTEXT_DONE)
+ - write CP_EVENT_END
+ Writing to CP_EVENT_END seems to actually trigger the context roll
+ -->
+@@ -5809,193 +3714,6 @@ to upconvert to 32b float internally?
+ </reg32>
+ </domain>
+
+-<!-- Seems basically the same as a5xx, maybe move to common.xml.. -->
+-<domain name="A6XX_TEX_SAMP" width="32">
+- <doc>Texture sampler dwords</doc>
+- <enum name="a6xx_tex_filter"> <!-- same as a4xx? -->
+- <value name="A6XX_TEX_NEAREST" value="0"/>
+- <value name="A6XX_TEX_LINEAR" value="1"/>
+- <value name="A6XX_TEX_ANISO" value="2"/>
+- <value name="A6XX_TEX_CUBIC" value="3"/> <!-- a650 only -->
+- </enum>
+- <enum name="a6xx_tex_clamp"> <!-- same as a4xx? -->
+- <value name="A6XX_TEX_REPEAT" value="0"/>
+- <value name="A6XX_TEX_CLAMP_TO_EDGE" value="1"/>
+- <value name="A6XX_TEX_MIRROR_REPEAT" value="2"/>
+- <value name="A6XX_TEX_CLAMP_TO_BORDER" value="3"/>
+- <value name="A6XX_TEX_MIRROR_CLAMP" value="4"/>
+- </enum>
+- <enum name="a6xx_tex_aniso"> <!-- same as a4xx? -->
+- <value name="A6XX_TEX_ANISO_1" value="0"/>
+- <value name="A6XX_TEX_ANISO_2" value="1"/>
+- <value name="A6XX_TEX_ANISO_4" value="2"/>
+- <value name="A6XX_TEX_ANISO_8" value="3"/>
+- <value name="A6XX_TEX_ANISO_16" value="4"/>
+- </enum>
+- <enum name="a6xx_reduction_mode">
+- <value name="A6XX_REDUCTION_MODE_AVERAGE" value="0"/>
+- <value name="A6XX_REDUCTION_MODE_MIN" value="1"/>
+- <value name="A6XX_REDUCTION_MODE_MAX" value="2"/>
+- </enum>
+-
+- <reg32 offset="0" name="0">
+- <bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
+- <bitfield name="XY_MAG" low="1" high="2" type="a6xx_tex_filter"/>
+- <bitfield name="XY_MIN" low="3" high="4" type="a6xx_tex_filter"/>
+- <bitfield name="WRAP_S" low="5" high="7" type="a6xx_tex_clamp"/>
+- <bitfield name="WRAP_T" low="8" high="10" type="a6xx_tex_clamp"/>
+- <bitfield name="WRAP_R" low="11" high="13" type="a6xx_tex_clamp"/>
+- <bitfield name="ANISO" low="14" high="16" type="a6xx_tex_aniso"/>
+- <bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
+- </reg32>
+- <reg32 offset="1" name="1">
+- <bitfield name="CLAMPENABLE" pos="0" type="boolean">
+- <doc>
+- clamp result to [0, 1] if the format is unorm or
+- [-1, 1] if the format is snorm, *after*
+- filtering. Has no effect for other formats.
+- </doc>
+- </bitfield>
+- <bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
+- <bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
+- <bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
+- <bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
+- <bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
+- <bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
+- </reg32>
+- <reg32 offset="2" name="2">
+- <bitfield name="REDUCTION_MODE" low="0" high="1" type="a6xx_reduction_mode"/>
+- <bitfield name="CHROMA_LINEAR" pos="5" type="boolean"/>
+- <bitfield name="BCOLOR" low="7" high="31"/>
+- </reg32>
+- <reg32 offset="3" name="3"/>
+-</domain>
+-
+-<domain name="A6XX_TEX_CONST" width="32" varset="chip">
+- <doc>Texture constant dwords</doc>
+- <enum name="a6xx_tex_swiz"> <!-- same as a4xx? -->
+- <value name="A6XX_TEX_X" value="0"/>
+- <value name="A6XX_TEX_Y" value="1"/>
+- <value name="A6XX_TEX_Z" value="2"/>
+- <value name="A6XX_TEX_W" value="3"/>
+- <value name="A6XX_TEX_ZERO" value="4"/>
+- <value name="A6XX_TEX_ONE" value="5"/>
+- </enum>
+- <enum name="a6xx_tex_type"> <!-- same as a4xx? -->
+- <value name="A6XX_TEX_1D" value="0"/>
+- <value name="A6XX_TEX_2D" value="1"/>
+- <value name="A6XX_TEX_CUBE" value="2"/>
+- <value name="A6XX_TEX_3D" value="3"/>
+- <value name="A6XX_TEX_BUFFER" value="4"/>
+- </enum>
+- <reg32 offset="0" name="0">
+- <bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
+- <bitfield name="SRGB" pos="2" type="boolean"/>
+- <bitfield name="SWIZ_X" low="4" high="6" type="a6xx_tex_swiz"/>
+- <bitfield name="SWIZ_Y" low="7" high="9" type="a6xx_tex_swiz"/>
+- <bitfield name="SWIZ_Z" low="10" high="12" type="a6xx_tex_swiz"/>
+- <bitfield name="SWIZ_W" low="13" high="15" type="a6xx_tex_swiz"/>
+- <bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
+- <!-- overlaps with MIPLVLS -->
+- <bitfield name="CHROMA_MIDPOINT_X" pos="16" type="boolean"/>
+- <bitfield name="CHROMA_MIDPOINT_Y" pos="18" type="boolean"/>
+- <bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
+- <bitfield name="FMT" low="22" high="29" type="a6xx_format"/>
+- <!--
+- Why is the swap needed in addition to SWIZ_*? The swap
+- is performed before border color replacement, while the
+- swizzle is applied after after it.
+- -->
+- <bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
+- </reg32>
+- <reg32 offset="1" name="1">
+- <bitfield name="WIDTH" low="0" high="14" type="uint"/>
+- <bitfield name="HEIGHT" low="15" high="29" type="uint"/>
+- <bitfield name="MUTABLEEN" pos="31" type="boolean" variants="A7XX-"/>
+- </reg32>
+- <reg32 offset="2" name="2">
+- <!--
+- These fields overlap PITCH, and are used instead of
+- PITCH/PITCHALIGN when TYPE is A6XX_TEX_BUFFER.
+- -->
+- <doc> probably for D3D structured UAVs, normally set to 1 </doc>
+- <bitfield name="STRUCTSIZETEXELS" low="4" high="15" type="uint"/>
+- <bitfield name="STARTOFFSETTEXELS" low="16" high="21" type="uint"/>
+-
+- <!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
+- <bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
+- <doc>Pitch in bytes (so actually stride)</doc>
+- <bitfield name="PITCH" low="7" high="28" type="uint"/>
+- <bitfield name="TYPE" low="29" high="31" type="a6xx_tex_type"/>
+- </reg32>
+- <reg32 offset="3" name="3">
+- <!--
+- ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
+- for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
+- layer size at the point that it stops being reduced moving to
+- higher (smaller) mipmap levels
+- -->
+- <bitfield name="ARRAY_PITCH" low="0" high="22" shr="12" type="uint"/>
+- <bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
+- <!--
+- by default levels with w < 16 are linear
+- TILE_ALL makes all levels have tiling
+- seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
+- -->
+- <bitfield name="TILE_ALL" pos="27" type="boolean"/>
+- <bitfield name="FLAG" pos="28" type="boolean"/>
+- </reg32>
+- <!-- for 2-3 plane format, BASE is flag buffer address (if enabled)
+- the address of the non-flag base buffer is determined automatically,
+- and must follow the flag buffer
+- -->
+- <reg32 offset="4" name="4">
+- <bitfield name="BASE_LO" low="5" high="31" shr="5"/>
+- </reg32>
+- <reg32 offset="5" name="5">
+- <bitfield name="BASE_HI" low="0" high="16"/>
+- <bitfield name="DEPTH" low="17" high="29" type="uint"/>
+- </reg32>
+- <reg32 offset="6" name="6">
+- <!-- overlaps with PLANE_PITCH -->
+- <bitfield name="MIN_LOD_CLAMP" low="0" high="11" type="ufixed" radix="8"/>
+- <!-- pitch for plane 2 / plane 3 -->
+- <bitfield name="PLANE_PITCH" low="8" high="31" type="uint"/>
+- </reg32>
+- <!-- 7/8 is plane 2 address for planar formats -->
+- <reg32 offset="7" name="7">
+- <bitfield name="FLAG_LO" low="5" high="31" shr="5"/>
+- </reg32>
+- <reg32 offset="8" name="8">
+- <bitfield name="FLAG_HI" low="0" high="16"/>
+- </reg32>
+- <!-- 9/10 is plane 3 address for planar formats -->
+- <reg32 offset="9" name="9">
+- <bitfield name="FLAG_BUFFER_ARRAY_PITCH" low="0" high="16" shr="4" type="uint"/>
+- </reg32>
+- <reg32 offset="10" name="10">
+- <bitfield name="FLAG_BUFFER_PITCH" low="0" high="6" shr="6" type="uint"/>
+- <!-- log2 size of the first level, required for mipmapping -->
+- <bitfield name="FLAG_BUFFER_LOGW" low="8" high="11" type="uint"/>
+- <bitfield name="FLAG_BUFFER_LOGH" low="12" high="15" type="uint"/>
+- </reg32>
+- <reg32 offset="11" name="11"/>
+- <reg32 offset="12" name="12"/>
+- <reg32 offset="13" name="13"/>
+- <reg32 offset="14" name="14"/>
+- <reg32 offset="15" name="15"/>
+-</domain>
+-
+-<domain name="A6XX_UBO" width="32">
+- <reg32 offset="0" name="0">
+- <bitfield name="BASE_LO" low="0" high="31"/>
+- </reg32>
+- <reg32 offset="1" name="1">
+- <bitfield name="BASE_HI" low="0" high="16"/>
+- <bitfield name="SIZE" low="17" high="31"/> <!-- size in vec4 (4xDWORD) units -->
+- </reg32>
+-</domain>
+-
+ <domain name="A6XX_PDC" width="32">
+ <reg32 offset="0x1140" name="GPU_ENABLE_PDC"/>
+ <reg32 offset="0x1148" name="GPU_SEQ_START_ADDR"/>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a6xx_descriptors.xml b/drivers/gpu/drm/msm/registers/adreno/a6xx_descriptors.xml
+new file mode 100644
+index 000000000000..307d43dda8a2
+--- /dev/null
++++ b/drivers/gpu/drm/msm/registers/adreno/a6xx_descriptors.xml
+@@ -0,0 +1,198 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<database xmlns="http://nouveau.freedesktop.org/"
++xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
++<import file="freedreno_copyright.xml"/>
++<import file="adreno/adreno_common.xml"/>
++<import file="adreno/adreno_pm4.xml"/>
++<import file="adreno/a6xx_enums.xml"/>
++
++<domain name="A6XX_TEX_SAMP" width="32">
++ <doc>Texture sampler dwords</doc>
++ <enum name="a6xx_tex_filter"> <!-- same as a4xx? -->
++ <value name="A6XX_TEX_NEAREST" value="0"/>
++ <value name="A6XX_TEX_LINEAR" value="1"/>
++ <value name="A6XX_TEX_ANISO" value="2"/>
++ <value name="A6XX_TEX_CUBIC" value="3"/> <!-- a650 only -->
++ </enum>
++ <enum name="a6xx_tex_clamp"> <!-- same as a4xx? -->
++ <value name="A6XX_TEX_REPEAT" value="0"/>
++ <value name="A6XX_TEX_CLAMP_TO_EDGE" value="1"/>
++ <value name="A6XX_TEX_MIRROR_REPEAT" value="2"/>
++ <value name="A6XX_TEX_CLAMP_TO_BORDER" value="3"/>
++ <value name="A6XX_TEX_MIRROR_CLAMP" value="4"/>
++ </enum>
++ <enum name="a6xx_tex_aniso"> <!-- same as a4xx? -->
++ <value name="A6XX_TEX_ANISO_1" value="0"/>
++ <value name="A6XX_TEX_ANISO_2" value="1"/>
++ <value name="A6XX_TEX_ANISO_4" value="2"/>
++ <value name="A6XX_TEX_ANISO_8" value="3"/>
++ <value name="A6XX_TEX_ANISO_16" value="4"/>
++ </enum>
++ <enum name="a6xx_reduction_mode">
++ <value name="A6XX_REDUCTION_MODE_AVERAGE" value="0"/>
++ <value name="A6XX_REDUCTION_MODE_MIN" value="1"/>
++ <value name="A6XX_REDUCTION_MODE_MAX" value="2"/>
++ </enum>
++ <enum name="a6xx_fast_border_color">
++ <!-- R B G A -->
++ <value name="A6XX_BORDER_COLOR_0_0_0_0" value="0"/>
++ <value name="A6XX_BORDER_COLOR_0_0_0_1" value="1"/>
++ <value name="A6XX_BORDER_COLOR_1_1_1_0" value="2"/>
++ <value name="A6XX_BORDER_COLOR_1_1_1_1" value="3"/>
++ </enum>
++
++ <reg32 offset="0" name="0">
++ <bitfield name="MIPFILTER_LINEAR_NEAR" pos="0" type="boolean"/>
++ <bitfield name="XY_MAG" low="1" high="2" type="a6xx_tex_filter"/>
++ <bitfield name="XY_MIN" low="3" high="4" type="a6xx_tex_filter"/>
++ <bitfield name="WRAP_S" low="5" high="7" type="a6xx_tex_clamp"/>
++ <bitfield name="WRAP_T" low="8" high="10" type="a6xx_tex_clamp"/>
++ <bitfield name="WRAP_R" low="11" high="13" type="a6xx_tex_clamp"/>
++ <bitfield name="ANISO" low="14" high="16" type="a6xx_tex_aniso"/>
++ <bitfield name="LOD_BIAS" low="19" high="31" type="fixed" radix="8"/><!-- no idea how many bits for real -->
++ </reg32>
++ <reg32 offset="1" name="1">
++ <bitfield name="CLAMPENABLE" pos="0" type="boolean">
++ <doc>
++ clamp result to [0, 1] if the format is unorm or
++ [-1, 1] if the format is snorm, *after*
++ filtering. Has no effect for other formats.
++ </doc>
++ </bitfield>
++ <bitfield name="COMPARE_FUNC" low="1" high="3" type="adreno_compare_func"/>
++ <bitfield name="CUBEMAPSEAMLESSFILTOFF" pos="4" type="boolean"/>
++ <bitfield name="UNNORM_COORDS" pos="5" type="boolean"/>
++ <bitfield name="MIPFILTER_LINEAR_FAR" pos="6" type="boolean"/>
++ <bitfield name="MAX_LOD" low="8" high="19" type="ufixed" radix="8"/>
++ <bitfield name="MIN_LOD" low="20" high="31" type="ufixed" radix="8"/>
++ </reg32>
++ <reg32 offset="2" name="2">
++ <bitfield name="REDUCTION_MODE" low="0" high="1" type="a6xx_reduction_mode"/>
++ <bitfield name="FASTBORDERCOLOR" low="2" high="3" type="a6xx_fast_border_color"/>
++ <bitfield name="FASTBORDERCOLOREN" pos="4" type="boolean"/>
++ <bitfield name="CHROMA_LINEAR" pos="5" type="boolean"/>
++ <bitfield name="BCOLOR" low="7" high="31"/>
++ </reg32>
++ <reg32 offset="3" name="3"/>
++</domain>
++
++<domain name="A6XX_TEX_CONST" width="32" varset="chip">
++ <doc>Texture constant dwords</doc>
++ <enum name="a6xx_tex_swiz"> <!-- same as a4xx? -->
++ <value name="A6XX_TEX_X" value="0"/>
++ <value name="A6XX_TEX_Y" value="1"/>
++ <value name="A6XX_TEX_Z" value="2"/>
++ <value name="A6XX_TEX_W" value="3"/>
++ <value name="A6XX_TEX_ZERO" value="4"/>
++ <value name="A6XX_TEX_ONE" value="5"/>
++ </enum>
++ <reg32 offset="0" name="0">
++ <bitfield name="TILE_MODE" low="0" high="1" type="a6xx_tile_mode"/>
++ <bitfield name="SRGB" pos="2" type="boolean"/>
++ <bitfield name="SWIZ_X" low="4" high="6" type="a6xx_tex_swiz"/>
++ <bitfield name="SWIZ_Y" low="7" high="9" type="a6xx_tex_swiz"/>
++ <bitfield name="SWIZ_Z" low="10" high="12" type="a6xx_tex_swiz"/>
++ <bitfield name="SWIZ_W" low="13" high="15" type="a6xx_tex_swiz"/>
++ <bitfield name="MIPLVLS" low="16" high="19" type="uint"/>
++ <!-- overlaps with MIPLVLS -->
++ <bitfield name="CHROMA_MIDPOINT_X" pos="16" type="boolean"/>
++ <bitfield name="CHROMA_MIDPOINT_Y" pos="18" type="boolean"/>
++ <bitfield name="SAMPLES" low="20" high="21" type="a3xx_msaa_samples"/>
++ <bitfield name="FMT" low="22" high="29" type="a6xx_format"/>
++ <!--
++ Why is the swap needed in addition to SWIZ_*? The swap
++ is performed before border color replacement, while the
++ swizzle is applied after after it.
++ -->
++ <bitfield name="SWAP" low="30" high="31" type="a3xx_color_swap"/>
++ </reg32>
++ <reg32 offset="1" name="1">
++ <bitfield name="WIDTH" low="0" high="14" type="uint"/>
++ <bitfield name="HEIGHT" low="15" high="29" type="uint"/>
++ <bitfield name="MUTABLEEN" pos="31" type="boolean" variants="A7XX-"/>
++ </reg32>
++ <reg32 offset="2" name="2">
++ <!--
++ These fields overlap PITCH, and are used instead of
++ PITCH/PITCHALIGN when TYPE is A6XX_TEX_BUFFER.
++ -->
++ <doc> probably for D3D structured UAVs, normally set to 1 </doc>
++ <bitfield name="STRUCTSIZETEXELS" low="4" high="15" type="uint"/>
++ <bitfield name="STARTOFFSETTEXELS" low="16" high="21" type="uint"/>
++
++ <!-- minimum pitch (for mipmap levels): log2(pitchalign / 64) -->
++ <bitfield name="PITCHALIGN" low="0" high="3" type="uint"/>
++ <doc>Pitch in bytes (so actually stride)</doc>
++ <bitfield name="PITCH" low="7" high="28" type="uint"/>
++ <bitfield name="TYPE" low="29" high="31" type="a6xx_tex_type"/>
++ </reg32>
++ <reg32 offset="3" name="3">
++ <!--
++ ARRAY_PITCH is basically LAYERSZ for the first mipmap level, and
++ for 3d textures (laid out mipmap level first) MIN_LAYERSZ is the
++ layer size at the point that it stops being reduced moving to
++ higher (smaller) mipmap levels
++ -->
++ <bitfield name="ARRAY_PITCH" low="0" high="22" shr="12" type="uint"/>
++ <bitfield name="MIN_LAYERSZ" low="23" high="26" shr="12"/>
++ <!--
++ by default levels with w < 16 are linear
++ TILE_ALL makes all levels have tiling
++ seems required when using UBWC, since all levels have UBWC (can possibly be disabled?)
++ -->
++ <bitfield name="TILE_ALL" pos="27" type="boolean"/>
++ <bitfield name="FLAG" pos="28" type="boolean"/>
++ </reg32>
++ <!-- for 2-3 plane format, BASE is flag buffer address (if enabled)
++ the address of the non-flag base buffer is determined automatically,
++ and must follow the flag buffer
++ -->
++ <reg32 offset="4" name="4">
++ <bitfield name="BASE_LO" low="5" high="31" shr="5"/>
++ </reg32>
++ <reg32 offset="5" name="5">
++ <bitfield name="BASE_HI" low="0" high="16"/>
++ <bitfield name="DEPTH" low="17" high="29" type="uint"/>
++ </reg32>
++ <reg32 offset="6" name="6">
++ <!-- overlaps with PLANE_PITCH -->
++ <bitfield name="MIN_LOD_CLAMP" low="0" high="11" type="ufixed" radix="8"/>
++ <!-- pitch for plane 2 / plane 3 -->
++ <bitfield name="PLANE_PITCH" low="8" high="31" type="uint"/>
++ </reg32>
++ <!-- 7/8 is plane 2 address for planar formats -->
++ <reg32 offset="7" name="7">
++ <bitfield name="FLAG_LO" low="5" high="31" shr="5"/>
++ </reg32>
++ <reg32 offset="8" name="8">
++ <bitfield name="FLAG_HI" low="0" high="16"/>
++ </reg32>
++ <!-- 9/10 is plane 3 address for planar formats -->
++ <reg32 offset="9" name="9">
++ <bitfield name="FLAG_BUFFER_ARRAY_PITCH" low="0" high="16" shr="4" type="uint"/>
++ </reg32>
++ <reg32 offset="10" name="10">
++ <bitfield name="FLAG_BUFFER_PITCH" low="0" high="6" shr="6" type="uint"/>
++ <!-- log2 size of the first level, required for mipmapping -->
++ <bitfield name="FLAG_BUFFER_LOGW" low="8" high="11" type="uint"/>
++ <bitfield name="FLAG_BUFFER_LOGH" low="12" high="15" type="uint"/>
++ </reg32>
++ <reg32 offset="11" name="11"/>
++ <reg32 offset="12" name="12"/>
++ <reg32 offset="13" name="13"/>
++ <reg32 offset="14" name="14"/>
++ <reg32 offset="15" name="15"/>
++</domain>
++
++<domain name="A6XX_UBO" width="32">
++ <reg32 offset="0" name="0">
++ <bitfield name="BASE_LO" low="0" high="31"/>
++ </reg32>
++ <reg32 offset="1" name="1">
++ <bitfield name="BASE_HI" low="0" high="16"/>
++ <bitfield name="SIZE" low="17" high="31"/> <!-- size in vec4 (4xDWORD) units -->
++ </reg32>
++</domain>
++
++</database>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a6xx_enums.xml b/drivers/gpu/drm/msm/registers/adreno/a6xx_enums.xml
+new file mode 100644
+index 000000000000..665539b098c6
+--- /dev/null
++++ b/drivers/gpu/drm/msm/registers/adreno/a6xx_enums.xml
+@@ -0,0 +1,383 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<database xmlns="http://nouveau.freedesktop.org/"
++xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
++<import file="freedreno_copyright.xml"/>
++<import file="adreno/adreno_common.xml"/>
++<import file="adreno/adreno_pm4.xml"/>
++
++<enum name="a6xx_tile_mode">
++ <value name="TILE6_LINEAR" value="0"/>
++ <value name="TILE6_2" value="2"/>
++ <value name="TILE6_3" value="3"/>
++</enum>
++
++<enum name="a6xx_format">
++ <value value="0x02" name="FMT6_A8_UNORM"/>
++ <value value="0x03" name="FMT6_8_UNORM"/>
++ <value value="0x04" name="FMT6_8_SNORM"/>
++ <value value="0x05" name="FMT6_8_UINT"/>
++ <value value="0x06" name="FMT6_8_SINT"/>
++
++ <value value="0x08" name="FMT6_4_4_4_4_UNORM"/>
++ <value value="0x0a" name="FMT6_5_5_5_1_UNORM"/>
++ <value value="0x0c" name="FMT6_1_5_5_5_UNORM"/> <!-- read only -->
++ <value value="0x0e" name="FMT6_5_6_5_UNORM"/>
++
++ <value value="0x0f" name="FMT6_8_8_UNORM"/>
++ <value value="0x10" name="FMT6_8_8_SNORM"/>
++ <value value="0x11" name="FMT6_8_8_UINT"/>
++ <value value="0x12" name="FMT6_8_8_SINT"/>
++ <value value="0x13" name="FMT6_L8_A8_UNORM"/>
++
++ <value value="0x15" name="FMT6_16_UNORM"/>
++ <value value="0x16" name="FMT6_16_SNORM"/>
++ <value value="0x17" name="FMT6_16_FLOAT"/>
++ <value value="0x18" name="FMT6_16_UINT"/>
++ <value value="0x19" name="FMT6_16_SINT"/>
++
++ <value value="0x21" name="FMT6_8_8_8_UNORM"/>
++ <value value="0x22" name="FMT6_8_8_8_SNORM"/>
++ <value value="0x23" name="FMT6_8_8_8_UINT"/>
++ <value value="0x24" name="FMT6_8_8_8_SINT"/>
++
++ <value value="0x30" name="FMT6_8_8_8_8_UNORM"/>
++ <value value="0x31" name="FMT6_8_8_8_X8_UNORM"/> <!-- samples 1 for alpha -->
++ <value value="0x32" name="FMT6_8_8_8_8_SNORM"/>
++ <value value="0x33" name="FMT6_8_8_8_8_UINT"/>
++ <value value="0x34" name="FMT6_8_8_8_8_SINT"/>
++
++ <value value="0x35" name="FMT6_9_9_9_E5_FLOAT"/>
++
++ <value value="0x36" name="FMT6_10_10_10_2_UNORM"/>
++ <value value="0x37" name="FMT6_10_10_10_2_UNORM_DEST"/>
++ <value value="0x39" name="FMT6_10_10_10_2_SNORM"/>
++ <value value="0x3a" name="FMT6_10_10_10_2_UINT"/>
++ <value value="0x3b" name="FMT6_10_10_10_2_SINT"/>
++
++ <value value="0x42" name="FMT6_11_11_10_FLOAT"/>
++
++ <value value="0x43" name="FMT6_16_16_UNORM"/>
++ <value value="0x44" name="FMT6_16_16_SNORM"/>
++ <value value="0x45" name="FMT6_16_16_FLOAT"/>
++ <value value="0x46" name="FMT6_16_16_UINT"/>
++ <value value="0x47" name="FMT6_16_16_SINT"/>
++
++ <value value="0x48" name="FMT6_32_UNORM"/>
++ <value value="0x49" name="FMT6_32_SNORM"/>
++ <value value="0x4a" name="FMT6_32_FLOAT"/>
++ <value value="0x4b" name="FMT6_32_UINT"/>
++ <value value="0x4c" name="FMT6_32_SINT"/>
++ <value value="0x4d" name="FMT6_32_FIXED"/>
++
++ <value value="0x58" name="FMT6_16_16_16_UNORM"/>
++ <value value="0x59" name="FMT6_16_16_16_SNORM"/>
++ <value value="0x5a" name="FMT6_16_16_16_FLOAT"/>
++ <value value="0x5b" name="FMT6_16_16_16_UINT"/>
++ <value value="0x5c" name="FMT6_16_16_16_SINT"/>
++
++ <value value="0x60" name="FMT6_16_16_16_16_UNORM"/>
++ <value value="0x61" name="FMT6_16_16_16_16_SNORM"/>
++ <value value="0x62" name="FMT6_16_16_16_16_FLOAT"/>
++ <value value="0x63" name="FMT6_16_16_16_16_UINT"/>
++ <value value="0x64" name="FMT6_16_16_16_16_SINT"/>
++
++ <value value="0x65" name="FMT6_32_32_UNORM"/>
++ <value value="0x66" name="FMT6_32_32_SNORM"/>
++ <value value="0x67" name="FMT6_32_32_FLOAT"/>
++ <value value="0x68" name="FMT6_32_32_UINT"/>
++ <value value="0x69" name="FMT6_32_32_SINT"/>
++ <value value="0x6a" name="FMT6_32_32_FIXED"/>
++
++ <value value="0x70" name="FMT6_32_32_32_UNORM"/>
++ <value value="0x71" name="FMT6_32_32_32_SNORM"/>
++ <value value="0x72" name="FMT6_32_32_32_UINT"/>
++ <value value="0x73" name="FMT6_32_32_32_SINT"/>
++ <value value="0x74" name="FMT6_32_32_32_FLOAT"/>
++ <value value="0x75" name="FMT6_32_32_32_FIXED"/>
++
++ <value value="0x80" name="FMT6_32_32_32_32_UNORM"/>
++ <value value="0x81" name="FMT6_32_32_32_32_SNORM"/>
++ <value value="0x82" name="FMT6_32_32_32_32_FLOAT"/>
++ <value value="0x83" name="FMT6_32_32_32_32_UINT"/>
++ <value value="0x84" name="FMT6_32_32_32_32_SINT"/>
++ <value value="0x85" name="FMT6_32_32_32_32_FIXED"/>
++
++ <value value="0x8c" name="FMT6_G8R8B8R8_422_UNORM"/> <!-- UYVY -->
++ <value value="0x8d" name="FMT6_R8G8R8B8_422_UNORM"/> <!-- YUYV -->
++ <value value="0x8e" name="FMT6_R8_G8B8_2PLANE_420_UNORM"/> <!-- NV12 -->
++ <value value="0x8f" name="FMT6_NV21"/>
++ <value value="0x90" name="FMT6_R8_G8_B8_3PLANE_420_UNORM"/> <!-- YV12 -->
++
++ <value value="0x91" name="FMT6_Z24_UNORM_S8_UINT_AS_R8G8B8A8"/>
++
++ <!-- Note: tiling/UBWC for these may be different from equivalent formats
++ For example FMT6_NV12_Y is not compatible with FMT6_8_UNORM
++ -->
++ <value value="0x94" name="FMT6_NV12_Y"/>
++ <value value="0x95" name="FMT6_NV12_UV"/>
++ <value value="0x96" name="FMT6_NV12_VU"/>
++ <value value="0x97" name="FMT6_NV12_4R"/>
++ <value value="0x98" name="FMT6_NV12_4R_Y"/>
++ <value value="0x99" name="FMT6_NV12_4R_UV"/>
++ <value value="0x9a" name="FMT6_P010"/>
++ <value value="0x9b" name="FMT6_P010_Y"/>
++ <value value="0x9c" name="FMT6_P010_UV"/>
++ <value value="0x9d" name="FMT6_TP10"/>
++ <value value="0x9e" name="FMT6_TP10_Y"/>
++ <value value="0x9f" name="FMT6_TP10_UV"/>
++
++ <value value="0xa0" name="FMT6_Z24_UNORM_S8_UINT"/>
++
++ <value value="0xab" name="FMT6_ETC2_RG11_UNORM"/>
++ <value value="0xac" name="FMT6_ETC2_RG11_SNORM"/>
++ <value value="0xad" name="FMT6_ETC2_R11_UNORM"/>
++ <value value="0xae" name="FMT6_ETC2_R11_SNORM"/>
++ <value value="0xaf" name="FMT6_ETC1"/>
++ <value value="0xb0" name="FMT6_ETC2_RGB8"/>
++ <value value="0xb1" name="FMT6_ETC2_RGBA8"/>
++ <value value="0xb2" name="FMT6_ETC2_RGB8A1"/>
++ <value value="0xb3" name="FMT6_DXT1"/>
++ <value value="0xb4" name="FMT6_DXT3"/>
++ <value value="0xb5" name="FMT6_DXT5"/>
++ <value value="0xb6" name="FMT6_RGTC1_UNORM"/>
++ <value value="0xb7" name="FMT6_RGTC1_UNORM_FAST"/>
++ <value value="0xb8" name="FMT6_RGTC1_SNORM"/>
++ <value value="0xb9" name="FMT6_RGTC1_SNORM_FAST"/>
++ <value value="0xba" name="FMT6_RGTC2_UNORM"/>
++ <value value="0xbb" name="FMT6_RGTC2_UNORM_FAST"/>
++ <value value="0xbc" name="FMT6_RGTC2_SNORM"/>
++ <value value="0xbd" name="FMT6_RGTC2_SNORM_FAST"/>
++ <value value="0xbe" name="FMT6_BPTC_UFLOAT"/>
++ <value value="0xbf" name="FMT6_BPTC_FLOAT"/>
++ <value value="0xc0" name="FMT6_BPTC"/>
++ <value value="0xc1" name="FMT6_ASTC_4x4"/>
++ <value value="0xc2" name="FMT6_ASTC_5x4"/>
++ <value value="0xc3" name="FMT6_ASTC_5x5"/>
++ <value value="0xc4" name="FMT6_ASTC_6x5"/>
++ <value value="0xc5" name="FMT6_ASTC_6x6"/>
++ <value value="0xc6" name="FMT6_ASTC_8x5"/>
++ <value value="0xc7" name="FMT6_ASTC_8x6"/>
++ <value value="0xc8" name="FMT6_ASTC_8x8"/>
++ <value value="0xc9" name="FMT6_ASTC_10x5"/>
++ <value value="0xca" name="FMT6_ASTC_10x6"/>
++ <value value="0xcb" name="FMT6_ASTC_10x8"/>
++ <value value="0xcc" name="FMT6_ASTC_10x10"/>
++ <value value="0xcd" name="FMT6_ASTC_12x10"/>
++ <value value="0xce" name="FMT6_ASTC_12x12"/>
++
++ <!-- for sampling stencil (integer, 2nd channel), not available on a630 -->
++ <value value="0xea" name="FMT6_Z24_UINT_S8_UINT"/>
++
++ <!-- Not a hw enum, used internally in driver -->
++ <value value="0xff" name="FMT6_NONE"/>
++
++</enum>
++
++<!-- probably same as a5xx -->
++<enum name="a6xx_polygon_mode">
++ <value name="POLYMODE6_POINTS" value="1"/>
++ <value name="POLYMODE6_LINES" value="2"/>
++ <value name="POLYMODE6_TRIANGLES" value="3"/>
++</enum>
++
++<enum name="a6xx_depth_format">
++ <value name="DEPTH6_NONE" value="0"/>
++ <value name="DEPTH6_16" value="1"/>
++ <value name="DEPTH6_24_8" value="2"/>
++ <value name="DEPTH6_32" value="4"/>
++</enum>
++
++<bitset name="a6x_cp_protect" inline="yes">
++ <bitfield name="BASE_ADDR" low="0" high="17"/>
++ <bitfield name="MASK_LEN" low="18" high="30"/>
++ <bitfield name="READ" pos="31" type="boolean"/>
++</bitset>
++
++<enum name="a6xx_shader_id">
++ <value value="0x9" name="A6XX_TP0_TMO_DATA"/>
++ <value value="0xa" name="A6XX_TP0_SMO_DATA"/>
++ <value value="0xb" name="A6XX_TP0_MIPMAP_BASE_DATA"/>
++ <value value="0x19" name="A6XX_TP1_TMO_DATA"/>
++ <value value="0x1a" name="A6XX_TP1_SMO_DATA"/>
++ <value value="0x1b" name="A6XX_TP1_MIPMAP_BASE_DATA"/>
++ <value value="0x29" name="A6XX_SP_INST_DATA"/>
++ <value value="0x2a" name="A6XX_SP_LB_0_DATA"/>
++ <value value="0x2b" name="A6XX_SP_LB_1_DATA"/>
++ <value value="0x2c" name="A6XX_SP_LB_2_DATA"/>
++ <value value="0x2d" name="A6XX_SP_LB_3_DATA"/>
++ <value value="0x2e" name="A6XX_SP_LB_4_DATA"/>
++ <value value="0x2f" name="A6XX_SP_LB_5_DATA"/>
++ <value value="0x30" name="A6XX_SP_CB_BINDLESS_DATA"/>
++ <value value="0x31" name="A6XX_SP_CB_LEGACY_DATA"/>
++ <value value="0x32" name="A6XX_SP_GFX_UAV_BASE_DATA"/>
++ <value value="0x33" name="A6XX_SP_INST_TAG"/>
++ <value value="0x34" name="A6XX_SP_CB_BINDLESS_TAG"/>
++ <value value="0x35" name="A6XX_SP_TMO_UMO_TAG"/>
++ <value value="0x36" name="A6XX_SP_SMO_TAG"/>
++ <value value="0x37" name="A6XX_SP_STATE_DATA"/>
++ <value value="0x49" name="A6XX_HLSQ_CHUNK_CVS_RAM"/>
++ <value value="0x4a" name="A6XX_HLSQ_CHUNK_CPS_RAM"/>
++ <value value="0x4b" name="A6XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
++ <value value="0x4c" name="A6XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
++ <value value="0x4d" name="A6XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
++ <value value="0x4e" name="A6XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
++ <value value="0x50" name="A6XX_HLSQ_CVS_MISC_RAM"/>
++ <value value="0x51" name="A6XX_HLSQ_CPS_MISC_RAM"/>
++ <value value="0x52" name="A6XX_HLSQ_INST_RAM"/>
++ <value value="0x53" name="A6XX_HLSQ_GFX_CVS_CONST_RAM"/>
++ <value value="0x54" name="A6XX_HLSQ_GFX_CPS_CONST_RAM"/>
++ <value value="0x55" name="A6XX_HLSQ_CVS_MISC_RAM_TAG"/>
++ <value value="0x56" name="A6XX_HLSQ_CPS_MISC_RAM_TAG"/>
++ <value value="0x57" name="A6XX_HLSQ_INST_RAM_TAG"/>
++ <value value="0x58" name="A6XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
++ <value value="0x59" name="A6XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
++ <value value="0x5a" name="A6XX_HLSQ_PWR_REST_RAM"/>
++ <value value="0x5b" name="A6XX_HLSQ_PWR_REST_TAG"/>
++ <value value="0x60" name="A6XX_HLSQ_DATAPATH_META"/>
++ <value value="0x61" name="A6XX_HLSQ_FRONTEND_META"/>
++ <value value="0x62" name="A6XX_HLSQ_INDIRECT_META"/>
++ <value value="0x63" name="A6XX_HLSQ_BACKEND_META"/>
++ <value value="0x70" name="A6XX_SP_LB_6_DATA"/>
++ <value value="0x71" name="A6XX_SP_LB_7_DATA"/>
++ <value value="0x73" name="A6XX_HLSQ_INST_RAM_1"/>
++</enum>
++
++<enum name="a6xx_debugbus_id">
++ <value value="0x1" name="A6XX_DBGBUS_CP"/>
++ <value value="0x2" name="A6XX_DBGBUS_RBBM"/>
++ <value value="0x3" name="A6XX_DBGBUS_VBIF"/>
++ <value value="0x4" name="A6XX_DBGBUS_HLSQ"/>
++ <value value="0x5" name="A6XX_DBGBUS_UCHE"/>
++ <value value="0x6" name="A6XX_DBGBUS_DPM"/>
++ <value value="0x7" name="A6XX_DBGBUS_TESS"/>
++ <value value="0x8" name="A6XX_DBGBUS_PC"/>
++ <value value="0x9" name="A6XX_DBGBUS_VFDP"/>
++ <value value="0xa" name="A6XX_DBGBUS_VPC"/>
++ <value value="0xb" name="A6XX_DBGBUS_TSE"/>
++ <value value="0xc" name="A6XX_DBGBUS_RAS"/>
++ <value value="0xd" name="A6XX_DBGBUS_VSC"/>
++ <value value="0xe" name="A6XX_DBGBUS_COM"/>
++ <value value="0x10" name="A6XX_DBGBUS_LRZ"/>
++ <value value="0x11" name="A6XX_DBGBUS_A2D"/>
++ <value value="0x12" name="A6XX_DBGBUS_CCUFCHE"/>
++ <value value="0x13" name="A6XX_DBGBUS_GMU_CX"/>
++ <value value="0x14" name="A6XX_DBGBUS_RBP"/>
++ <value value="0x15" name="A6XX_DBGBUS_DCS"/>
++ <value value="0x16" name="A6XX_DBGBUS_DBGC"/>
++ <value value="0x17" name="A6XX_DBGBUS_CX"/>
++ <value value="0x18" name="A6XX_DBGBUS_GMU_GX"/>
++ <value value="0x19" name="A6XX_DBGBUS_TPFCHE"/>
++ <value value="0x1a" name="A6XX_DBGBUS_GBIF_GX"/>
++ <value value="0x1d" name="A6XX_DBGBUS_GPC"/>
++ <value value="0x1e" name="A6XX_DBGBUS_LARC"/>
++ <value value="0x1f" name="A6XX_DBGBUS_HLSQ_SPTP"/>
++ <value value="0x20" name="A6XX_DBGBUS_RB_0"/>
++ <value value="0x21" name="A6XX_DBGBUS_RB_1"/>
++ <value value="0x22" name="A6XX_DBGBUS_RB_2"/>
++ <value value="0x24" name="A6XX_DBGBUS_UCHE_WRAPPER"/>
++ <value value="0x28" name="A6XX_DBGBUS_CCU_0"/>
++ <value value="0x29" name="A6XX_DBGBUS_CCU_1"/>
++ <value value="0x2a" name="A6XX_DBGBUS_CCU_2"/>
++ <value value="0x38" name="A6XX_DBGBUS_VFD_0"/>
++ <value value="0x39" name="A6XX_DBGBUS_VFD_1"/>
++ <value value="0x3a" name="A6XX_DBGBUS_VFD_2"/>
++ <value value="0x3b" name="A6XX_DBGBUS_VFD_3"/>
++ <value value="0x3c" name="A6XX_DBGBUS_VFD_4"/>
++ <value value="0x3d" name="A6XX_DBGBUS_VFD_5"/>
++ <value value="0x40" name="A6XX_DBGBUS_SP_0"/>
++ <value value="0x41" name="A6XX_DBGBUS_SP_1"/>
++ <value value="0x42" name="A6XX_DBGBUS_SP_2"/>
++ <value value="0x48" name="A6XX_DBGBUS_TPL1_0"/>
++ <value value="0x49" name="A6XX_DBGBUS_TPL1_1"/>
++ <value value="0x4a" name="A6XX_DBGBUS_TPL1_2"/>
++ <value value="0x4b" name="A6XX_DBGBUS_TPL1_3"/>
++ <value value="0x4c" name="A6XX_DBGBUS_TPL1_4"/>
++ <value value="0x4d" name="A6XX_DBGBUS_TPL1_5"/>
++ <value value="0x58" name="A6XX_DBGBUS_SPTP_0"/>
++ <value value="0x59" name="A6XX_DBGBUS_SPTP_1"/>
++ <value value="0x5a" name="A6XX_DBGBUS_SPTP_2"/>
++ <value value="0x5b" name="A6XX_DBGBUS_SPTP_3"/>
++ <value value="0x5c" name="A6XX_DBGBUS_SPTP_4"/>
++ <value value="0x5d" name="A6XX_DBGBUS_SPTP_5"/>
++</enum>
++
++<!--
++Used in a6xx_a2d_bit_cntl.. the value mostly seems to correlate to the
++component type/size, so I think it relates to internal format used for
++blending? The one exception is that 16b unorm and 32b float use the
++same value... maybe 16b unorm is uncommon enough that it was just easier
++to upconvert to 32b float internally?
++
++ 8b unorm: 10 (sometimes 0, is the high bit part of something else?)
++16b unorm: 4
++
++32b int: 7
++16b int: 6
++ 8b int: 5
++
++32b float: 4
++16b float: 3
++ -->
++<enum name="a6xx_2d_ifmt">
++ <value value="0x10" name="R2D_UNORM8"/>
++ <value value="0x7" name="R2D_INT32"/>
++ <value value="0x6" name="R2D_INT16"/>
++ <value value="0x5" name="R2D_INT8"/>
++ <value value="0x4" name="R2D_FLOAT32"/>
++ <value value="0x3" name="R2D_FLOAT16"/>
++ <value value="0x1" name="R2D_UNORM8_SRGB"/>
++ <value value="0x0" name="R2D_RAW"/>
++</enum>
++
++<enum name="a6xx_tex_type">
++ <value name="A6XX_TEX_1D" value="0"/>
++ <value name="A6XX_TEX_2D" value="1"/>
++ <value name="A6XX_TEX_CUBE" value="2"/>
++ <value name="A6XX_TEX_3D" value="3"/>
++ <value name="A6XX_TEX_BUFFER" value="4"/>
++ <doc>
++ A special buffer type for usage as the source for buffer
++ to image copies with lower alignment requirements than
++ A6XX_TEX_2D, available since A7XX.
++ </doc>
++ <value name="A6XX_TEX_IMG_BUFFER" value="5"/>
++</enum>
++
++<enum name="a6xx_ztest_mode">
++ <doc>Allow early z-test and early-lrz (if applicable)</doc>
++ <value value="0x0" name="A6XX_EARLY_Z"/>
++ <doc>Disable early z-test and early-lrz test (if applicable)</doc>
++ <value value="0x1" name="A6XX_LATE_Z"/>
++ <doc>
++ A special mode that allows early-lrz (if applicable) or early-z
++ tests, but also does late-z tests at which point it writes depth.
++
++ This mode is used when fragment can be killed (via discard or
++ sample mask) after early-z tests and it writes depth. In such case
++ depth can be written only at late-z stage, but it's ok to use
++ early-z to discard fragments.
++
++ However this mode is not compatible with:
++ - Lack of D/S attachment
++ - Stencil writes on stencil or depth test failures
++ - Per-sample shading
++ </doc>
++ <value value="0x2" name="A6XX_EARLY_Z_LATE_Z"/>
++ <doc>Not a real hw value, used internally by mesa</doc>
++ <value value="0x3" name="A6XX_INVALID_ZTEST"/>
++</enum>
++
++<enum name="a6xx_tess_spacing">
++ <value value="0x0" name="TESS_EQUAL"/>
++ <value value="0x2" name="TESS_FRACTIONAL_ODD"/>
++ <value value="0x3" name="TESS_FRACTIONAL_EVEN"/>
++</enum>
++<enum name="a6xx_tess_output">
++ <value value="0x0" name="TESS_POINTS"/>
++ <value value="0x1" name="TESS_LINES"/>
++ <value value="0x2" name="TESS_CW_TRIS"/>
++ <value value="0x3" name="TESS_CCW_TRIS"/>
++</enum>
++
++</database>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a6xx_perfcntrs.xml b/drivers/gpu/drm/msm/registers/adreno/a6xx_perfcntrs.xml
+new file mode 100644
+index 000000000000..c446a2eb1120
+--- /dev/null
++++ b/drivers/gpu/drm/msm/registers/adreno/a6xx_perfcntrs.xml
+@@ -0,0 +1,600 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<database xmlns="http://nouveau.freedesktop.org/"
++xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
++<import file="freedreno_copyright.xml"/>
++<import file="adreno/adreno_common.xml"/>
++<import file="adreno/adreno_pm4.xml"/>
++
++<enum name="a6xx_cp_perfcounter_select">
++ <value value="0" name="PERF_CP_ALWAYS_COUNT"/>
++ <value value="1" name="PERF_CP_BUSY_GFX_CORE_IDLE"/>
++ <value value="2" name="PERF_CP_BUSY_CYCLES"/>
++ <value value="3" name="PERF_CP_NUM_PREEMPTIONS"/>
++ <value value="4" name="PERF_CP_PREEMPTION_REACTION_DELAY"/>
++ <value value="5" name="PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
++ <value value="6" name="PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
++ <value value="7" name="PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
++ <value value="8" name="PERF_CP_PREDICATED_DRAWS_KILLED"/>
++ <value value="9" name="PERF_CP_MODE_SWITCH"/>
++ <value value="10" name="PERF_CP_ZPASS_DONE"/>
++ <value value="11" name="PERF_CP_CONTEXT_DONE"/>
++ <value value="12" name="PERF_CP_CACHE_FLUSH"/>
++ <value value="13" name="PERF_CP_LONG_PREEMPTIONS"/>
++ <value value="14" name="PERF_CP_SQE_I_CACHE_STARVE"/>
++ <value value="15" name="PERF_CP_SQE_IDLE"/>
++ <value value="16" name="PERF_CP_SQE_PM4_STARVE_RB_IB"/>
++ <value value="17" name="PERF_CP_SQE_PM4_STARVE_SDS"/>
++ <value value="18" name="PERF_CP_SQE_MRB_STARVE"/>
++ <value value="19" name="PERF_CP_SQE_RRB_STARVE"/>
++ <value value="20" name="PERF_CP_SQE_VSD_STARVE"/>
++ <value value="21" name="PERF_CP_VSD_DECODE_STARVE"/>
++ <value value="22" name="PERF_CP_SQE_PIPE_OUT_STALL"/>
++ <value value="23" name="PERF_CP_SQE_SYNC_STALL"/>
++ <value value="24" name="PERF_CP_SQE_PM4_WFI_STALL"/>
++ <value value="25" name="PERF_CP_SQE_SYS_WFI_STALL"/>
++ <value value="26" name="PERF_CP_SQE_T4_EXEC"/>
++ <value value="27" name="PERF_CP_SQE_LOAD_STATE_EXEC"/>
++ <value value="28" name="PERF_CP_SQE_SAVE_SDS_STATE"/>
++ <value value="29" name="PERF_CP_SQE_DRAW_EXEC"/>
++ <value value="30" name="PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
++ <value value="31" name="PERF_CP_SQE_EXEC_PROFILED"/>
++ <value value="32" name="PERF_CP_MEMORY_POOL_EMPTY"/>
++ <value value="33" name="PERF_CP_MEMORY_POOL_SYNC_STALL"/>
++ <value value="34" name="PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
++ <value value="35" name="PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
++ <value value="36" name="PERF_CP_AHB_STALL_SQE_GMU"/>
++ <value value="37" name="PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
++ <value value="38" name="PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
++ <value value="39" name="PERF_CP_CLUSTER0_EMPTY"/>
++ <value value="40" name="PERF_CP_CLUSTER1_EMPTY"/>
++ <value value="41" name="PERF_CP_CLUSTER2_EMPTY"/>
++ <value value="42" name="PERF_CP_CLUSTER3_EMPTY"/>
++ <value value="43" name="PERF_CP_CLUSTER4_EMPTY"/>
++ <value value="44" name="PERF_CP_CLUSTER5_EMPTY"/>
++ <value value="45" name="PERF_CP_PM4_DATA"/>
++ <value value="46" name="PERF_CP_PM4_HEADERS"/>
++ <value value="47" name="PERF_CP_VBIF_READ_BEATS"/>
++ <value value="48" name="PERF_CP_VBIF_WRITE_BEATS"/>
++ <value value="49" name="PERF_CP_SQE_INSTR_COUNTER"/>
++</enum>
++
++<enum name="a6xx_rbbm_perfcounter_select">
++ <value value="0" name="PERF_RBBM_ALWAYS_COUNT"/>
++ <value value="1" name="PERF_RBBM_ALWAYS_ON"/>
++ <value value="2" name="PERF_RBBM_TSE_BUSY"/>
++ <value value="3" name="PERF_RBBM_RAS_BUSY"/>
++ <value value="4" name="PERF_RBBM_PC_DCALL_BUSY"/>
++ <value value="5" name="PERF_RBBM_PC_VSD_BUSY"/>
++ <value value="6" name="PERF_RBBM_STATUS_MASKED"/>
++ <value value="7" name="PERF_RBBM_COM_BUSY"/>
++ <value value="8" name="PERF_RBBM_DCOM_BUSY"/>
++ <value value="9" name="PERF_RBBM_VBIF_BUSY"/>
++ <value value="10" name="PERF_RBBM_VSC_BUSY"/>
++ <value value="11" name="PERF_RBBM_TESS_BUSY"/>
++ <value value="12" name="PERF_RBBM_UCHE_BUSY"/>
++ <value value="13" name="PERF_RBBM_HLSQ_BUSY"/>
++</enum>
++
++<enum name="a6xx_pc_perfcounter_select">
++ <value value="0" name="PERF_PC_BUSY_CYCLES"/>
++ <value value="1" name="PERF_PC_WORKING_CYCLES"/>
++ <value value="2" name="PERF_PC_STALL_CYCLES_VFD"/>
++ <value value="3" name="PERF_PC_STALL_CYCLES_TSE"/>
++ <value value="4" name="PERF_PC_STALL_CYCLES_VPC"/>
++ <value value="5" name="PERF_PC_STALL_CYCLES_UCHE"/>
++ <value value="6" name="PERF_PC_STALL_CYCLES_TESS"/>
++ <value value="7" name="PERF_PC_STALL_CYCLES_TSE_ONLY"/>
++ <value value="8" name="PERF_PC_STALL_CYCLES_VPC_ONLY"/>
++ <value value="9" name="PERF_PC_PASS1_TF_STALL_CYCLES"/>
++ <value value="10" name="PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
++ <value value="11" name="PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
++ <value value="12" name="PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
++ <value value="13" name="PERF_PC_STARVE_CYCLES_FOR_POSITION"/>
++ <value value="14" name="PERF_PC_STARVE_CYCLES_DI"/>
++ <value value="15" name="PERF_PC_VIS_STREAMS_LOADED"/>
++ <value value="16" name="PERF_PC_INSTANCES"/>
++ <value value="17" name="PERF_PC_VPC_PRIMITIVES"/>
++ <value value="18" name="PERF_PC_DEAD_PRIM"/>
++ <value value="19" name="PERF_PC_LIVE_PRIM"/>
++ <value value="20" name="PERF_PC_VERTEX_HITS"/>
++ <value value="21" name="PERF_PC_IA_VERTICES"/>
++ <value value="22" name="PERF_PC_IA_PRIMITIVES"/>
++ <value value="23" name="PERF_PC_GS_PRIMITIVES"/>
++ <value value="24" name="PERF_PC_HS_INVOCATIONS"/>
++ <value value="25" name="PERF_PC_DS_INVOCATIONS"/>
++ <value value="26" name="PERF_PC_VS_INVOCATIONS"/>
++ <value value="27" name="PERF_PC_GS_INVOCATIONS"/>
++ <value value="28" name="PERF_PC_DS_PRIMITIVES"/>
++ <value value="29" name="PERF_PC_VPC_POS_DATA_TRANSACTION"/>
++ <value value="30" name="PERF_PC_3D_DRAWCALLS"/>
++ <value value="31" name="PERF_PC_2D_DRAWCALLS"/>
++ <value value="32" name="PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
++ <value value="33" name="PERF_TESS_BUSY_CYCLES"/>
++ <value value="34" name="PERF_TESS_WORKING_CYCLES"/>
++ <value value="35" name="PERF_TESS_STALL_CYCLES_PC"/>
++ <value value="36" name="PERF_TESS_STARVE_CYCLES_PC"/>
++ <value value="37" name="PERF_PC_TSE_TRANSACTION"/>
++ <value value="38" name="PERF_PC_TSE_VERTEX"/>
++ <value value="39" name="PERF_PC_TESS_PC_UV_TRANS"/>
++ <value value="40" name="PERF_PC_TESS_PC_UV_PATCHES"/>
++ <value value="41" name="PERF_PC_TESS_FACTOR_TRANS"/>
++</enum>
++
++<enum name="a6xx_vfd_perfcounter_select">
++ <value value="0" name="PERF_VFD_BUSY_CYCLES"/>
++ <value value="1" name="PERF_VFD_STALL_CYCLES_UCHE"/>
++ <value value="2" name="PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
++ <value value="3" name="PERF_VFD_STALL_CYCLES_SP_INFO"/>
++ <value value="4" name="PERF_VFD_STALL_CYCLES_SP_ATTR"/>
++ <value value="5" name="PERF_VFD_STARVE_CYCLES_UCHE"/>
++ <value value="6" name="PERF_VFD_RBUFFER_FULL"/>
++ <value value="7" name="PERF_VFD_ATTR_INFO_FIFO_FULL"/>
++ <value value="8" name="PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
++ <value value="9" name="PERF_VFD_NUM_ATTRIBUTES"/>
++ <value value="10" name="PERF_VFD_UPPER_SHADER_FIBERS"/>
++ <value value="11" name="PERF_VFD_LOWER_SHADER_FIBERS"/>
++ <value value="12" name="PERF_VFD_MODE_0_FIBERS"/>
++ <value value="13" name="PERF_VFD_MODE_1_FIBERS"/>
++ <value value="14" name="PERF_VFD_MODE_2_FIBERS"/>
++ <value value="15" name="PERF_VFD_MODE_3_FIBERS"/>
++ <value value="16" name="PERF_VFD_MODE_4_FIBERS"/>
++ <value value="17" name="PERF_VFD_TOTAL_VERTICES"/>
++ <value value="18" name="PERF_VFDP_STALL_CYCLES_VFD"/>
++ <value value="19" name="PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
++ <value value="20" name="PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
++ <value value="21" name="PERF_VFDP_STARVE_CYCLES_PC"/>
++ <value value="22" name="PERF_VFDP_VS_STAGE_WAVES"/>
++</enum>
++
++<enum name="a6xx_hlsq_perfcounter_select">
++ <value value="0" name="PERF_HLSQ_BUSY_CYCLES"/>
++ <value value="1" name="PERF_HLSQ_STALL_CYCLES_UCHE"/>
++ <value value="2" name="PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
++ <value value="3" name="PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
++ <value value="4" name="PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
++ <value value="5" name="PERF_HLSQ_UCHE_LATENCY_COUNT"/>
++ <value value="6" name="PERF_HLSQ_FS_STAGE_1X_WAVES"/>
++ <value value="7" name="PERF_HLSQ_FS_STAGE_2X_WAVES"/>
++ <value value="8" name="PERF_HLSQ_QUADS"/>
++ <value value="9" name="PERF_HLSQ_CS_INVOCATIONS"/>
++ <value value="10" name="PERF_HLSQ_COMPUTE_DRAWCALLS"/>
++ <value value="11" name="PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
++ <value value="12" name="PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
++ <value value="13" name="PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
++ <value value="14" name="PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
++ <value value="15" name="PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
++ <value value="16" name="PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
++ <value value="17" name="PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
++ <value value="18" name="PERF_HLSQ_STALL_CYCLES_VPC"/>
++ <value value="19" name="PERF_HLSQ_PIXELS"/>
++ <value value="20" name="PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
++</enum>
++
++<enum name="a6xx_vpc_perfcounter_select">
++ <value value="0" name="PERF_VPC_BUSY_CYCLES"/>
++ <value value="1" name="PERF_VPC_WORKING_CYCLES"/>
++ <value value="2" name="PERF_VPC_STALL_CYCLES_UCHE"/>
++ <value value="3" name="PERF_VPC_STALL_CYCLES_VFD_WACK"/>
++ <value value="4" name="PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
++ <value value="5" name="PERF_VPC_STALL_CYCLES_PC"/>
++ <value value="6" name="PERF_VPC_STALL_CYCLES_SP_LM"/>
++ <value value="7" name="PERF_VPC_STARVE_CYCLES_SP"/>
++ <value value="8" name="PERF_VPC_STARVE_CYCLES_LRZ"/>
++ <value value="9" name="PERF_VPC_PC_PRIMITIVES"/>
++ <value value="10" name="PERF_VPC_SP_COMPONENTS"/>
++ <value value="11" name="PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
++ <value value="12" name="PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
++ <value value="13" name="PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
++ <value value="14" name="PERF_VPC_LM_TRANSACTION"/>
++ <value value="15" name="PERF_VPC_STREAMOUT_TRANSACTION"/>
++ <value value="16" name="PERF_VPC_VS_BUSY_CYCLES"/>
++ <value value="17" name="PERF_VPC_PS_BUSY_CYCLES"/>
++ <value value="18" name="PERF_VPC_VS_WORKING_CYCLES"/>
++ <value value="19" name="PERF_VPC_PS_WORKING_CYCLES"/>
++ <value value="20" name="PERF_VPC_STARVE_CYCLES_RB"/>
++ <value value="21" name="PERF_VPC_NUM_VPCRAM_READ_POS"/>
++ <value value="22" name="PERF_VPC_WIT_FULL_CYCLES"/>
++ <value value="23" name="PERF_VPC_VPCRAM_FULL_CYCLES"/>
++ <value value="24" name="PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
++ <value value="25" name="PERF_VPC_NUM_VPCRAM_WRITE"/>
++ <value value="26" name="PERF_VPC_NUM_VPCRAM_READ_SO"/>
++ <value value="27" name="PERF_VPC_NUM_ATTR_REQ_LM"/>
++</enum>
++
++<enum name="a6xx_tse_perfcounter_select">
++ <value value="0" name="PERF_TSE_BUSY_CYCLES"/>
++ <value value="1" name="PERF_TSE_CLIPPING_CYCLES"/>
++ <value value="2" name="PERF_TSE_STALL_CYCLES_RAS"/>
++ <value value="3" name="PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
++ <value value="4" name="PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
++ <value value="5" name="PERF_TSE_STARVE_CYCLES_PC"/>
++ <value value="6" name="PERF_TSE_INPUT_PRIM"/>
++ <value value="7" name="PERF_TSE_INPUT_NULL_PRIM"/>
++ <value value="8" name="PERF_TSE_TRIVAL_REJ_PRIM"/>
++ <value value="9" name="PERF_TSE_CLIPPED_PRIM"/>
++ <value value="10" name="PERF_TSE_ZERO_AREA_PRIM"/>
++ <value value="11" name="PERF_TSE_FACENESS_CULLED_PRIM"/>
++ <value value="12" name="PERF_TSE_ZERO_PIXEL_PRIM"/>
++ <value value="13" name="PERF_TSE_OUTPUT_NULL_PRIM"/>
++ <value value="14" name="PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
++ <value value="15" name="PERF_TSE_CINVOCATION"/>
++ <value value="16" name="PERF_TSE_CPRIMITIVES"/>
++ <value value="17" name="PERF_TSE_2D_INPUT_PRIM"/>
++ <value value="18" name="PERF_TSE_2D_ALIVE_CYCLES"/>
++ <value value="19" name="PERF_TSE_CLIP_PLANES"/>
++</enum>
++
++<enum name="a6xx_ras_perfcounter_select">
++ <value value="0" name="PERF_RAS_BUSY_CYCLES"/>
++ <value value="1" name="PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
++ <value value="2" name="PERF_RAS_STALL_CYCLES_LRZ"/>
++ <value value="3" name="PERF_RAS_STARVE_CYCLES_TSE"/>
++ <value value="4" name="PERF_RAS_SUPER_TILES"/>
++ <value value="5" name="PERF_RAS_8X4_TILES"/>
++ <value value="6" name="PERF_RAS_MASKGEN_ACTIVE"/>
++ <value value="7" name="PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
++ <value value="8" name="PERF_RAS_FULLY_COVERED_8X4_TILES"/>
++ <value value="9" name="PERF_RAS_PRIM_KILLED_INVISILBE"/>
++ <value value="10" name="PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
++ <value value="11" name="PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
++ <value value="12" name="PERF_RAS_BLOCKS"/>
++</enum>
++
++<enum name="a6xx_uche_perfcounter_select">
++ <value value="0" name="PERF_UCHE_BUSY_CYCLES"/>
++ <value value="1" name="PERF_UCHE_STALL_CYCLES_ARBITER"/>
++ <value value="2" name="PERF_UCHE_VBIF_LATENCY_CYCLES"/>
++ <value value="3" name="PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
++ <value value="4" name="PERF_UCHE_VBIF_READ_BEATS_TP"/>
++ <value value="5" name="PERF_UCHE_VBIF_READ_BEATS_VFD"/>
++ <value value="6" name="PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
++ <value value="7" name="PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
++ <value value="8" name="PERF_UCHE_VBIF_READ_BEATS_SP"/>
++ <value value="9" name="PERF_UCHE_READ_REQUESTS_TP"/>
++ <value value="10" name="PERF_UCHE_READ_REQUESTS_VFD"/>
++ <value value="11" name="PERF_UCHE_READ_REQUESTS_HLSQ"/>
++ <value value="12" name="PERF_UCHE_READ_REQUESTS_LRZ"/>
++ <value value="13" name="PERF_UCHE_READ_REQUESTS_SP"/>
++ <value value="14" name="PERF_UCHE_WRITE_REQUESTS_LRZ"/>
++ <value value="15" name="PERF_UCHE_WRITE_REQUESTS_SP"/>
++ <value value="16" name="PERF_UCHE_WRITE_REQUESTS_VPC"/>
++ <value value="17" name="PERF_UCHE_WRITE_REQUESTS_VSC"/>
++ <value value="18" name="PERF_UCHE_EVICTS"/>
++ <value value="19" name="PERF_UCHE_BANK_REQ0"/>
++ <value value="20" name="PERF_UCHE_BANK_REQ1"/>
++ <value value="21" name="PERF_UCHE_BANK_REQ2"/>
++ <value value="22" name="PERF_UCHE_BANK_REQ3"/>
++ <value value="23" name="PERF_UCHE_BANK_REQ4"/>
++ <value value="24" name="PERF_UCHE_BANK_REQ5"/>
++ <value value="25" name="PERF_UCHE_BANK_REQ6"/>
++ <value value="26" name="PERF_UCHE_BANK_REQ7"/>
++ <value value="27" name="PERF_UCHE_VBIF_READ_BEATS_CH0"/>
++ <value value="28" name="PERF_UCHE_VBIF_READ_BEATS_CH1"/>
++ <value value="29" name="PERF_UCHE_GMEM_READ_BEATS"/>
++ <value value="30" name="PERF_UCHE_TPH_REF_FULL"/>
++ <value value="31" name="PERF_UCHE_TPH_VICTIM_FULL"/>
++ <value value="32" name="PERF_UCHE_TPH_EXT_FULL"/>
++ <value value="33" name="PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
++ <value value="34" name="PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
++ <value value="35" name="PERF_UCHE_DCMP_LATENCY_CYCLES"/>
++ <value value="36" name="PERF_UCHE_VBIF_READ_BEATS_PC"/>
++ <value value="37" name="PERF_UCHE_READ_REQUESTS_PC"/>
++ <value value="38" name="PERF_UCHE_RAM_READ_REQ"/>
++ <value value="39" name="PERF_UCHE_RAM_WRITE_REQ"/>
++</enum>
++
++<enum name="a6xx_tp_perfcounter_select">
++ <value value="0" name="PERF_TP_BUSY_CYCLES"/>
++ <value value="1" name="PERF_TP_STALL_CYCLES_UCHE"/>
++ <value value="2" name="PERF_TP_LATENCY_CYCLES"/>
++ <value value="3" name="PERF_TP_LATENCY_TRANS"/>
++ <value value="4" name="PERF_TP_FLAG_CACHE_REQUEST_SAMPLES"/>
++ <value value="5" name="PERF_TP_FLAG_CACHE_REQUEST_LATENCY"/>
++ <value value="6" name="PERF_TP_L1_CACHELINE_REQUESTS"/>
++ <value value="7" name="PERF_TP_L1_CACHELINE_MISSES"/>
++ <value value="8" name="PERF_TP_SP_TP_TRANS"/>
++ <value value="9" name="PERF_TP_TP_SP_TRANS"/>
++ <value value="10" name="PERF_TP_OUTPUT_PIXELS"/>
++ <value value="11" name="PERF_TP_FILTER_WORKLOAD_16BIT"/>
++ <value value="12" name="PERF_TP_FILTER_WORKLOAD_32BIT"/>
++ <value value="13" name="PERF_TP_QUADS_RECEIVED"/>
++ <value value="14" name="PERF_TP_QUADS_OFFSET"/>
++ <value value="15" name="PERF_TP_QUADS_SHADOW"/>
++ <value value="16" name="PERF_TP_QUADS_ARRAY"/>
++ <value value="17" name="PERF_TP_QUADS_GRADIENT"/>
++ <value value="18" name="PERF_TP_QUADS_1D"/>
++ <value value="19" name="PERF_TP_QUADS_2D"/>
++ <value value="20" name="PERF_TP_QUADS_BUFFER"/>
++ <value value="21" name="PERF_TP_QUADS_3D"/>
++ <value value="22" name="PERF_TP_QUADS_CUBE"/>
++ <value value="23" name="PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
++ <value value="24" name="PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
++ <value value="25" name="PERF_TP_OUTPUT_PIXELS_POINT"/>
++ <value value="26" name="PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
++ <value value="27" name="PERF_TP_OUTPUT_PIXELS_MIP"/>
++ <value value="28" name="PERF_TP_OUTPUT_PIXELS_ANISO"/>
++ <value value="29" name="PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
++ <value value="30" name="PERF_TP_FLAG_CACHE_REQUESTS"/>
++ <value value="31" name="PERF_TP_FLAG_CACHE_MISSES"/>
++ <value value="32" name="PERF_TP_L1_5_L2_REQUESTS"/>
++ <value value="33" name="PERF_TP_2D_OUTPUT_PIXELS"/>
++ <value value="34" name="PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
++ <value value="35" name="PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
++ <value value="36" name="PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
++ <value value="37" name="PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
++ <value value="38" name="PERF_TP_TPA2TPC_TRANS"/>
++ <value value="39" name="PERF_TP_L1_MISSES_ASTC_1TILE"/>
++ <value value="40" name="PERF_TP_L1_MISSES_ASTC_2TILE"/>
++ <value value="41" name="PERF_TP_L1_MISSES_ASTC_4TILE"/>
++ <value value="42" name="PERF_TP_L1_5_L2_COMPRESS_REQS"/>
++ <value value="43" name="PERF_TP_L1_5_L2_COMPRESS_MISS"/>
++ <value value="44" name="PERF_TP_L1_BANK_CONFLICT"/>
++ <value value="45" name="PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
++ <value value="46" name="PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
++ <value value="47" name="PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
++ <value value="48" name="PERF_TP_FRONTEND_WORKING_CYCLES"/>
++ <value value="49" name="PERF_TP_L1_TAG_WORKING_CYCLES"/>
++ <value value="50" name="PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
++ <value value="51" name="PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
++ <value value="52" name="PERF_TP_BACKEND_WORKING_CYCLES"/>
++ <value value="53" name="PERF_TP_FLAG_CACHE_WORKING_CYCLES"/>
++ <value value="54" name="PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
++ <value value="55" name="PERF_TP_STARVE_CYCLES_SP"/>
++ <value value="56" name="PERF_TP_STARVE_CYCLES_UCHE"/>
++</enum>
++
++<enum name="a6xx_sp_perfcounter_select">
++ <value value="0" name="PERF_SP_BUSY_CYCLES"/>
++ <value value="1" name="PERF_SP_ALU_WORKING_CYCLES"/>
++ <value value="2" name="PERF_SP_EFU_WORKING_CYCLES"/>
++ <value value="3" name="PERF_SP_STALL_CYCLES_VPC"/>
++ <value value="4" name="PERF_SP_STALL_CYCLES_TP"/>
++ <value value="5" name="PERF_SP_STALL_CYCLES_UCHE"/>
++ <value value="6" name="PERF_SP_STALL_CYCLES_RB"/>
++ <value value="7" name="PERF_SP_NON_EXECUTION_CYCLES"/>
++ <value value="8" name="PERF_SP_WAVE_CONTEXTS"/>
++ <value value="9" name="PERF_SP_WAVE_CONTEXT_CYCLES"/>
++ <value value="10" name="PERF_SP_FS_STAGE_WAVE_CYCLES"/>
++ <value value="11" name="PERF_SP_FS_STAGE_WAVE_SAMPLES"/>
++ <value value="12" name="PERF_SP_VS_STAGE_WAVE_CYCLES"/>
++ <value value="13" name="PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
++ <value value="14" name="PERF_SP_FS_STAGE_DURATION_CYCLES"/>
++ <value value="15" name="PERF_SP_VS_STAGE_DURATION_CYCLES"/>
++ <value value="16" name="PERF_SP_WAVE_CTRL_CYCLES"/>
++ <value value="17" name="PERF_SP_WAVE_LOAD_CYCLES"/>
++ <value value="18" name="PERF_SP_WAVE_EMIT_CYCLES"/>
++ <value value="19" name="PERF_SP_WAVE_NOP_CYCLES"/>
++ <value value="20" name="PERF_SP_WAVE_WAIT_CYCLES"/>
++ <value value="21" name="PERF_SP_WAVE_FETCH_CYCLES"/>
++ <value value="22" name="PERF_SP_WAVE_IDLE_CYCLES"/>
++ <value value="23" name="PERF_SP_WAVE_END_CYCLES"/>
++ <value value="24" name="PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
++ <value value="25" name="PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
++ <value value="26" name="PERF_SP_WAVE_JOIN_CYCLES"/>
++ <value value="27" name="PERF_SP_LM_LOAD_INSTRUCTIONS"/>
++ <value value="28" name="PERF_SP_LM_STORE_INSTRUCTIONS"/>
++ <value value="29" name="PERF_SP_LM_ATOMICS"/>
++ <value value="30" name="PERF_SP_GM_LOAD_INSTRUCTIONS"/>
++ <value value="31" name="PERF_SP_GM_STORE_INSTRUCTIONS"/>
++ <value value="32" name="PERF_SP_GM_ATOMICS"/>
++ <value value="33" name="PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
++ <value value="34" name="PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
++ <value value="35" name="PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
++ <value value="36" name="PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
++ <value value="37" name="PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
++ <value value="38" name="PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
++ <value value="39" name="PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
++ <value value="40" name="PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
++ <value value="41" name="PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
++ <value value="42" name="PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
++ <value value="43" name="PERF_SP_VS_INSTRUCTIONS"/>
++ <value value="44" name="PERF_SP_FS_INSTRUCTIONS"/>
++ <value value="45" name="PERF_SP_ADDR_LOCK_COUNT"/>
++ <value value="46" name="PERF_SP_UCHE_READ_TRANS"/>
++ <value value="47" name="PERF_SP_UCHE_WRITE_TRANS"/>
++ <value value="48" name="PERF_SP_EXPORT_VPC_TRANS"/>
++ <value value="49" name="PERF_SP_EXPORT_RB_TRANS"/>
++ <value value="50" name="PERF_SP_PIXELS_KILLED"/>
++ <value value="51" name="PERF_SP_ICL1_REQUESTS"/>
++ <value value="52" name="PERF_SP_ICL1_MISSES"/>
++ <value value="53" name="PERF_SP_HS_INSTRUCTIONS"/>
++ <value value="54" name="PERF_SP_DS_INSTRUCTIONS"/>
++ <value value="55" name="PERF_SP_GS_INSTRUCTIONS"/>
++ <value value="56" name="PERF_SP_CS_INSTRUCTIONS"/>
++ <value value="57" name="PERF_SP_GPR_READ"/>
++ <value value="58" name="PERF_SP_GPR_WRITE"/>
++ <value value="59" name="PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
++ <value value="60" name="PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
++ <value value="61" name="PERF_SP_LM_BANK_CONFLICTS"/>
++ <value value="62" name="PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
++ <value value="63" name="PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
++ <value value="64" name="PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
++ <value value="65" name="PERF_SP_LM_WORKING_CYCLES"/>
++ <value value="66" name="PERF_SP_DISPATCHER_WORKING_CYCLES"/>
++ <value value="67" name="PERF_SP_SEQUENCER_WORKING_CYCLES"/>
++ <value value="68" name="PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
++ <value value="69" name="PERF_SP_STARVE_CYCLES_HLSQ"/>
++ <value value="70" name="PERF_SP_NON_EXECUTION_LS_CYCLES"/>
++ <value value="71" name="PERF_SP_WORKING_EU"/>
++ <value value="72" name="PERF_SP_ANY_EU_WORKING"/>
++ <value value="73" name="PERF_SP_WORKING_EU_FS_STAGE"/>
++ <value value="74" name="PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
++ <value value="75" name="PERF_SP_WORKING_EU_VS_STAGE"/>
++ <value value="76" name="PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
++ <value value="77" name="PERF_SP_WORKING_EU_CS_STAGE"/>
++ <value value="78" name="PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
++ <value value="79" name="PERF_SP_GPR_READ_PREFETCH"/>
++ <value value="80" name="PERF_SP_GPR_READ_CONFLICT"/>
++ <value value="81" name="PERF_SP_GPR_WRITE_CONFLICT"/>
++ <value value="82" name="PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
++ <value value="83" name="PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
++ <value value="84" name="PERF_SP_EXECUTABLE_WAVES"/>
++</enum>
++
++<enum name="a6xx_rb_perfcounter_select">
++ <value value="0" name="PERF_RB_BUSY_CYCLES"/>
++ <value value="1" name="PERF_RB_STALL_CYCLES_HLSQ"/>
++ <value value="2" name="PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
++ <value value="3" name="PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
++ <value value="4" name="PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
++ <value value="5" name="PERF_RB_STARVE_CYCLES_SP"/>
++ <value value="6" name="PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
++ <value value="7" name="PERF_RB_STARVE_CYCLES_CCU"/>
++ <value value="8" name="PERF_RB_STARVE_CYCLES_Z_PLANE"/>
++ <value value="9" name="PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
++ <value value="10" name="PERF_RB_Z_WORKLOAD"/>
++ <value value="11" name="PERF_RB_HLSQ_ACTIVE"/>
++ <value value="12" name="PERF_RB_Z_READ"/>
++ <value value="13" name="PERF_RB_Z_WRITE"/>
++ <value value="14" name="PERF_RB_C_READ"/>
++ <value value="15" name="PERF_RB_C_WRITE"/>
++ <value value="16" name="PERF_RB_TOTAL_PASS"/>
++ <value value="17" name="PERF_RB_Z_PASS"/>
++ <value value="18" name="PERF_RB_Z_FAIL"/>
++ <value value="19" name="PERF_RB_S_FAIL"/>
++ <value value="20" name="PERF_RB_BLENDED_FXP_COMPONENTS"/>
++ <value value="21" name="PERF_RB_BLENDED_FP16_COMPONENTS"/>
++ <value value="22" name="PERF_RB_PS_INVOCATIONS"/>
++ <value value="23" name="PERF_RB_2D_ALIVE_CYCLES"/>
++ <value value="24" name="PERF_RB_2D_STALL_CYCLES_A2D"/>
++ <value value="25" name="PERF_RB_2D_STARVE_CYCLES_SRC"/>
++ <value value="26" name="PERF_RB_2D_STARVE_CYCLES_SP"/>
++ <value value="27" name="PERF_RB_2D_STARVE_CYCLES_DST"/>
++ <value value="28" name="PERF_RB_2D_VALID_PIXELS"/>
++ <value value="29" name="PERF_RB_3D_PIXELS"/>
++ <value value="30" name="PERF_RB_BLENDER_WORKING_CYCLES"/>
++ <value value="31" name="PERF_RB_ZPROC_WORKING_CYCLES"/>
++ <value value="32" name="PERF_RB_CPROC_WORKING_CYCLES"/>
++ <value value="33" name="PERF_RB_SAMPLER_WORKING_CYCLES"/>
++ <value value="34" name="PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
++ <value value="35" name="PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
++ <value value="36" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
++ <value value="37" name="PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
++ <value value="38" name="PERF_RB_STALL_CYCLES_VPC"/>
++ <value value="39" name="PERF_RB_2D_INPUT_TRANS"/>
++ <value value="40" name="PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
++ <value value="41" name="PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
++ <value value="42" name="PERF_RB_BLENDED_FP32_COMPONENTS"/>
++ <value value="43" name="PERF_RB_COLOR_PIX_TILES"/>
++ <value value="44" name="PERF_RB_STALL_CYCLES_CCU"/>
++ <value value="45" name="PERF_RB_EARLY_Z_ARB3_GRANT"/>
++ <value value="46" name="PERF_RB_LATE_Z_ARB3_GRANT"/>
++ <value value="47" name="PERF_RB_EARLY_Z_SKIP_GRANT"/>
++</enum>
++
++<enum name="a6xx_vsc_perfcounter_select">
++ <value value="0" name="PERF_VSC_BUSY_CYCLES"/>
++ <value value="1" name="PERF_VSC_WORKING_CYCLES"/>
++ <value value="2" name="PERF_VSC_STALL_CYCLES_UCHE"/>
++ <value value="3" name="PERF_VSC_EOT_NUM"/>
++ <value value="4" name="PERF_VSC_INPUT_TILES"/>
++</enum>
++
++<enum name="a6xx_ccu_perfcounter_select">
++ <value value="0" name="PERF_CCU_BUSY_CYCLES"/>
++ <value value="1" name="PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
++ <value value="2" name="PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
++ <value value="3" name="PERF_CCU_STARVE_CYCLES_FLAG_RETURN"/>
++ <value value="4" name="PERF_CCU_DEPTH_BLOCKS"/>
++ <value value="5" name="PERF_CCU_COLOR_BLOCKS"/>
++ <value value="6" name="PERF_CCU_DEPTH_BLOCK_HIT"/>
++ <value value="7" name="PERF_CCU_COLOR_BLOCK_HIT"/>
++ <value value="8" name="PERF_CCU_PARTIAL_BLOCK_READ"/>
++ <value value="9" name="PERF_CCU_GMEM_READ"/>
++ <value value="10" name="PERF_CCU_GMEM_WRITE"/>
++ <value value="11" name="PERF_CCU_DEPTH_READ_FLAG0_COUNT"/>
++ <value value="12" name="PERF_CCU_DEPTH_READ_FLAG1_COUNT"/>
++ <value value="13" name="PERF_CCU_DEPTH_READ_FLAG2_COUNT"/>
++ <value value="14" name="PERF_CCU_DEPTH_READ_FLAG3_COUNT"/>
++ <value value="15" name="PERF_CCU_DEPTH_READ_FLAG4_COUNT"/>
++ <value value="16" name="PERF_CCU_DEPTH_READ_FLAG5_COUNT"/>
++ <value value="17" name="PERF_CCU_DEPTH_READ_FLAG6_COUNT"/>
++ <value value="18" name="PERF_CCU_DEPTH_READ_FLAG8_COUNT"/>
++ <value value="19" name="PERF_CCU_COLOR_READ_FLAG0_COUNT"/>
++ <value value="20" name="PERF_CCU_COLOR_READ_FLAG1_COUNT"/>
++ <value value="21" name="PERF_CCU_COLOR_READ_FLAG2_COUNT"/>
++ <value value="22" name="PERF_CCU_COLOR_READ_FLAG3_COUNT"/>
++ <value value="23" name="PERF_CCU_COLOR_READ_FLAG4_COUNT"/>
++ <value value="24" name="PERF_CCU_COLOR_READ_FLAG5_COUNT"/>
++ <value value="25" name="PERF_CCU_COLOR_READ_FLAG6_COUNT"/>
++ <value value="26" name="PERF_CCU_COLOR_READ_FLAG8_COUNT"/>
++ <value value="27" name="PERF_CCU_2D_RD_REQ"/>
++ <value value="28" name="PERF_CCU_2D_WR_REQ"/>
++</enum>
++
++<enum name="a6xx_lrz_perfcounter_select">
++ <value value="0" name="PERF_LRZ_BUSY_CYCLES"/>
++ <value value="1" name="PERF_LRZ_STARVE_CYCLES_RAS"/>
++ <value value="2" name="PERF_LRZ_STALL_CYCLES_RB"/>
++ <value value="3" name="PERF_LRZ_STALL_CYCLES_VSC"/>
++ <value value="4" name="PERF_LRZ_STALL_CYCLES_VPC"/>
++ <value value="5" name="PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
++ <value value="6" name="PERF_LRZ_STALL_CYCLES_UCHE"/>
++ <value value="7" name="PERF_LRZ_LRZ_READ"/>
++ <value value="8" name="PERF_LRZ_LRZ_WRITE"/>
++ <value value="9" name="PERF_LRZ_READ_LATENCY"/>
++ <value value="10" name="PERF_LRZ_MERGE_CACHE_UPDATING"/>
++ <value value="11" name="PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
++ <value value="12" name="PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
++ <value value="13" name="PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
++ <value value="14" name="PERF_LRZ_FULL_8X8_TILES"/>
++ <value value="15" name="PERF_LRZ_PARTIAL_8X8_TILES"/>
++ <value value="16" name="PERF_LRZ_TILE_KILLED"/>
++ <value value="17" name="PERF_LRZ_TOTAL_PIXEL"/>
++ <value value="18" name="PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
++ <value value="19" name="PERF_LRZ_FULLY_COVERED_TILES"/>
++ <value value="20" name="PERF_LRZ_PARTIAL_COVERED_TILES"/>
++ <value value="21" name="PERF_LRZ_FEEDBACK_ACCEPT"/>
++ <value value="22" name="PERF_LRZ_FEEDBACK_DISCARD"/>
++ <value value="23" name="PERF_LRZ_FEEDBACK_STALL"/>
++ <value value="24" name="PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
++ <value value="25" name="PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
++ <value value="26" name="PERF_LRZ_STALL_CYCLES_VC"/>
++ <value value="27" name="PERF_LRZ_RAS_MASK_TRANS"/>
++</enum>
++
++<enum name="a6xx_cmp_perfcounter_select">
++ <value value="0" name="PERF_CMPDECMP_STALL_CYCLES_ARB"/>
++ <value value="1" name="PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
++ <value value="2" name="PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
++ <value value="3" name="PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
++ <value value="4" name="PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
++ <value value="5" name="PERF_CMPDECMP_VBIF_READ_REQUEST"/>
++ <value value="6" name="PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
++ <value value="7" name="PERF_CMPDECMP_VBIF_READ_DATA"/>
++ <value value="8" name="PERF_CMPDECMP_VBIF_WRITE_DATA"/>
++ <value value="9" name="PERF_CMPDECMP_FLAG_FETCH_CYCLES"/>
++ <value value="10" name="PERF_CMPDECMP_FLAG_FETCH_SAMPLES"/>
++ <value value="11" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
++ <value value="12" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
++ <value value="13" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
++ <value value="14" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
++ <value value="15" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
++ <value value="16" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
++ <value value="17" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
++ <value value="18" name="PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
++ <value value="19" name="PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
++ <value value="20" name="PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
++ <value value="21" name="PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
++ <value value="22" name="PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
++ <value value="23" name="PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
++ <value value="24" name="PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
++ <value value="25" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_REQ"/>
++ <value value="26" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_WR"/>
++ <value value="27" name="PERF_CMPDECMP_2D_STALL_CYCLES_VBIF_RETURN"/>
++ <value value="28" name="PERF_CMPDECMP_2D_RD_DATA"/>
++ <value value="29" name="PERF_CMPDECMP_2D_WR_DATA"/>
++ <value value="30" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
++ <value value="31" name="PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
++ <value value="32" name="PERF_CMPDECMP_2D_OUTPUT_TRANS"/>
++ <value value="33" name="PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
++ <value value="34" name="PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
++ <value value="35" name="PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
++ <value value="36" name="PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
++ <value value="37" name="PERF_CMPDECMP_2D_BUSY_CYCLES"/>
++ <value value="38" name="PERF_CMPDECMP_2D_REORDER_STARVE_CYCLES"/>
++ <value value="39" name="PERF_CMPDECMP_2D_PIXELS"/>
++</enum>
++
++</database>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a7xx_enums.xml b/drivers/gpu/drm/msm/registers/adreno/a7xx_enums.xml
+new file mode 100644
+index 000000000000..661b0dd0f675
+--- /dev/null
++++ b/drivers/gpu/drm/msm/registers/adreno/a7xx_enums.xml
+@@ -0,0 +1,223 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<database xmlns="http://nouveau.freedesktop.org/"
++xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
++<import file="freedreno_copyright.xml"/>
++<import file="adreno/adreno_common.xml"/>
++<import file="adreno/adreno_pm4.xml"/>
++
++<enum name="a7xx_statetype_id">
++ <value value="0" name="A7XX_TP0_NCTX_REG"/>
++ <value value="1" name="A7XX_TP0_CTX0_3D_CVS_REG"/>
++ <value value="2" name="A7XX_TP0_CTX0_3D_CPS_REG"/>
++ <value value="3" name="A7XX_TP0_CTX1_3D_CVS_REG"/>
++ <value value="4" name="A7XX_TP0_CTX1_3D_CPS_REG"/>
++ <value value="5" name="A7XX_TP0_CTX2_3D_CPS_REG"/>
++ <value value="6" name="A7XX_TP0_CTX3_3D_CPS_REG"/>
++ <value value="9" name="A7XX_TP0_TMO_DATA"/>
++ <value value="10" name="A7XX_TP0_SMO_DATA"/>
++ <value value="11" name="A7XX_TP0_MIPMAP_BASE_DATA"/>
++ <value value="32" name="A7XX_SP_NCTX_REG"/>
++ <value value="33" name="A7XX_SP_CTX0_3D_CVS_REG"/>
++ <value value="34" name="A7XX_SP_CTX0_3D_CPS_REG"/>
++ <value value="35" name="A7XX_SP_CTX1_3D_CVS_REG"/>
++ <value value="36" name="A7XX_SP_CTX1_3D_CPS_REG"/>
++ <value value="37" name="A7XX_SP_CTX2_3D_CPS_REG"/>
++ <value value="38" name="A7XX_SP_CTX3_3D_CPS_REG"/>
++ <value value="39" name="A7XX_SP_INST_DATA"/>
++ <value value="40" name="A7XX_SP_INST_DATA_1"/>
++ <value value="41" name="A7XX_SP_LB_0_DATA"/>
++ <value value="42" name="A7XX_SP_LB_1_DATA"/>
++ <value value="43" name="A7XX_SP_LB_2_DATA"/>
++ <value value="44" name="A7XX_SP_LB_3_DATA"/>
++ <value value="45" name="A7XX_SP_LB_4_DATA"/>
++ <value value="46" name="A7XX_SP_LB_5_DATA"/>
++ <value value="47" name="A7XX_SP_LB_6_DATA"/>
++ <value value="48" name="A7XX_SP_LB_7_DATA"/>
++ <value value="49" name="A7XX_SP_CB_RAM"/>
++ <value value="50" name="A7XX_SP_LB_13_DATA"/>
++ <value value="51" name="A7XX_SP_LB_14_DATA"/>
++ <value value="52" name="A7XX_SP_INST_TAG"/>
++ <value value="53" name="A7XX_SP_INST_DATA_2"/>
++ <value value="54" name="A7XX_SP_TMO_TAG"/>
++ <value value="55" name="A7XX_SP_SMO_TAG"/>
++ <value value="56" name="A7XX_SP_STATE_DATA"/>
++ <value value="57" name="A7XX_SP_HWAVE_RAM"/>
++ <value value="58" name="A7XX_SP_L0_INST_BUF"/>
++ <value value="59" name="A7XX_SP_LB_8_DATA"/>
++ <value value="60" name="A7XX_SP_LB_9_DATA"/>
++ <value value="61" name="A7XX_SP_LB_10_DATA"/>
++ <value value="62" name="A7XX_SP_LB_11_DATA"/>
++ <value value="63" name="A7XX_SP_LB_12_DATA"/>
++ <value value="64" name="A7XX_HLSQ_DATAPATH_DSTR_META"/>
++ <value value="67" name="A7XX_HLSQ_L2STC_TAG_RAM"/>
++ <value value="68" name="A7XX_HLSQ_L2STC_INFO_CMD"/>
++ <value value="69" name="A7XX_HLSQ_CVS_BE_CTXT_BUF_RAM_TAG"/>
++ <value value="70" name="A7XX_HLSQ_CPS_BE_CTXT_BUF_RAM_TAG"/>
++ <value value="71" name="A7XX_HLSQ_GFX_CVS_BE_CTXT_BUF_RAM"/>
++ <value value="72" name="A7XX_HLSQ_GFX_CPS_BE_CTXT_BUF_RAM"/>
++ <value value="73" name="A7XX_HLSQ_CHUNK_CVS_RAM"/>
++ <value value="74" name="A7XX_HLSQ_CHUNK_CPS_RAM"/>
++ <value value="75" name="A7XX_HLSQ_CHUNK_CVS_RAM_TAG"/>
++ <value value="76" name="A7XX_HLSQ_CHUNK_CPS_RAM_TAG"/>
++ <value value="77" name="A7XX_HLSQ_ICB_CVS_CB_BASE_TAG"/>
++ <value value="78" name="A7XX_HLSQ_ICB_CPS_CB_BASE_TAG"/>
++ <value value="79" name="A7XX_HLSQ_CVS_MISC_RAM"/>
++ <value value="80" name="A7XX_HLSQ_CPS_MISC_RAM"/>
++ <value value="81" name="A7XX_HLSQ_CPS_MISC_RAM_1"/>
++ <value value="82" name="A7XX_HLSQ_INST_RAM"/>
++ <value value="83" name="A7XX_HLSQ_GFX_CVS_CONST_RAM"/>
++ <value value="84" name="A7XX_HLSQ_GFX_CPS_CONST_RAM"/>
++ <value value="85" name="A7XX_HLSQ_CVS_MISC_RAM_TAG"/>
++ <value value="86" name="A7XX_HLSQ_CPS_MISC_RAM_TAG"/>
++ <value value="87" name="A7XX_HLSQ_INST_RAM_TAG"/>
++ <value value="88" name="A7XX_HLSQ_GFX_CVS_CONST_RAM_TAG"/>
++ <value value="89" name="A7XX_HLSQ_GFX_CPS_CONST_RAM_TAG"/>
++ <value value="90" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM"/>
++ <value value="91" name="A7XX_HLSQ_GFX_LOCAL_MISC_RAM_TAG"/>
++ <value value="92" name="A7XX_HLSQ_INST_RAM_1"/>
++ <value value="93" name="A7XX_HLSQ_STPROC_META"/>
++ <value value="94" name="A7XX_HLSQ_BV_BE_META"/>
++ <value value="95" name="A7XX_HLSQ_INST_RAM_2"/>
++ <value value="96" name="A7XX_HLSQ_DATAPATH_META"/>
++ <value value="97" name="A7XX_HLSQ_FRONTEND_META"/>
++ <value value="98" name="A7XX_HLSQ_INDIRECT_META"/>
++ <value value="99" name="A7XX_HLSQ_BACKEND_META"/>
++</enum>
++
++<enum name="a7xx_state_location">
++ <value value="0" name="A7XX_HLSQ_STATE"/>
++ <value value="1" name="A7XX_HLSQ_DP"/>
++ <value value="2" name="A7XX_SP_TOP"/>
++ <value value="3" name="A7XX_USPTP"/>
++ <value value="4" name="A7XX_HLSQ_DP_STR"/>
++</enum>
++
++<enum name="a7xx_pipe">
++ <value value="0" name="A7XX_PIPE_NONE"/>
++ <value value="1" name="A7XX_PIPE_BR"/>
++ <value value="2" name="A7XX_PIPE_BV"/>
++ <value value="3" name="A7XX_PIPE_LPAC"/>
++</enum>
++
++<enum name="a7xx_cluster">
++ <value value="0" name="A7XX_CLUSTER_NONE"/>
++ <value value="1" name="A7XX_CLUSTER_FE"/>
++ <value value="2" name="A7XX_CLUSTER_SP_VS"/>
++ <value value="3" name="A7XX_CLUSTER_PC_VS"/>
++ <value value="4" name="A7XX_CLUSTER_GRAS"/>
++ <value value="5" name="A7XX_CLUSTER_SP_PS"/>
++ <value value="6" name="A7XX_CLUSTER_VPC_PS"/>
++ <value value="7" name="A7XX_CLUSTER_PS"/>
++</enum>
++
++<enum name="a7xx_debugbus_id">
++ <value value="1" name="A7XX_DBGBUS_CP_0_0"/>
++ <value value="2" name="A7XX_DBGBUS_CP_0_1"/>
++ <value value="3" name="A7XX_DBGBUS_RBBM"/>
++ <value value="5" name="A7XX_DBGBUS_GBIF_GX"/>
++ <value value="6" name="A7XX_DBGBUS_GBIF_CX"/>
++ <value value="7" name="A7XX_DBGBUS_HLSQ"/>
++ <value value="9" name="A7XX_DBGBUS_UCHE_0"/>
++ <value value="10" name="A7XX_DBGBUS_UCHE_1"/>
++ <value value="13" name="A7XX_DBGBUS_TESS_BR"/>
++ <value value="14" name="A7XX_DBGBUS_TESS_BV"/>
++ <value value="17" name="A7XX_DBGBUS_PC_BR"/>
++ <value value="18" name="A7XX_DBGBUS_PC_BV"/>
++ <value value="21" name="A7XX_DBGBUS_VFDP_BR"/>
++ <value value="22" name="A7XX_DBGBUS_VFDP_BV"/>
++ <value value="25" name="A7XX_DBGBUS_VPC_BR"/>
++ <value value="26" name="A7XX_DBGBUS_VPC_BV"/>
++ <value value="29" name="A7XX_DBGBUS_TSE_BR"/>
++ <value value="30" name="A7XX_DBGBUS_TSE_BV"/>
++ <value value="33" name="A7XX_DBGBUS_RAS_BR"/>
++ <value value="34" name="A7XX_DBGBUS_RAS_BV"/>
++ <value value="37" name="A7XX_DBGBUS_VSC"/>
++ <value value="39" name="A7XX_DBGBUS_COM_0"/>
++ <value value="43" name="A7XX_DBGBUS_LRZ_BR"/>
++ <value value="44" name="A7XX_DBGBUS_LRZ_BV"/>
++ <value value="47" name="A7XX_DBGBUS_UFC_0"/>
++ <value value="48" name="A7XX_DBGBUS_UFC_1"/>
++ <value value="55" name="A7XX_DBGBUS_GMU_GX"/>
++ <value value="59" name="A7XX_DBGBUS_DBGC"/>
++ <value value="60" name="A7XX_DBGBUS_CX"/>
++ <value value="61" name="A7XX_DBGBUS_GMU_CX"/>
++ <value value="62" name="A7XX_DBGBUS_GPC_BR"/>
++ <value value="63" name="A7XX_DBGBUS_GPC_BV"/>
++ <value value="66" name="A7XX_DBGBUS_LARC"/>
++ <value value="68" name="A7XX_DBGBUS_HLSQ_SPTP"/>
++ <value value="70" name="A7XX_DBGBUS_RB_0"/>
++ <value value="71" name="A7XX_DBGBUS_RB_1"/>
++ <value value="72" name="A7XX_DBGBUS_RB_2"/>
++ <value value="73" name="A7XX_DBGBUS_RB_3"/>
++ <value value="74" name="A7XX_DBGBUS_RB_4"/>
++ <value value="75" name="A7XX_DBGBUS_RB_5"/>
++ <value value="102" name="A7XX_DBGBUS_UCHE_WRAPPER"/>
++ <value value="106" name="A7XX_DBGBUS_CCU_0"/>
++ <value value="107" name="A7XX_DBGBUS_CCU_1"/>
++ <value value="108" name="A7XX_DBGBUS_CCU_2"/>
++ <value value="109" name="A7XX_DBGBUS_CCU_3"/>
++ <value value="110" name="A7XX_DBGBUS_CCU_4"/>
++ <value value="111" name="A7XX_DBGBUS_CCU_5"/>
++ <value value="138" name="A7XX_DBGBUS_VFD_BR_0"/>
++ <value value="139" name="A7XX_DBGBUS_VFD_BR_1"/>
++ <value value="140" name="A7XX_DBGBUS_VFD_BR_2"/>
++ <value value="141" name="A7XX_DBGBUS_VFD_BR_3"/>
++ <value value="142" name="A7XX_DBGBUS_VFD_BR_4"/>
++ <value value="143" name="A7XX_DBGBUS_VFD_BR_5"/>
++ <value value="144" name="A7XX_DBGBUS_VFD_BR_6"/>
++ <value value="145" name="A7XX_DBGBUS_VFD_BR_7"/>
++ <value value="202" name="A7XX_DBGBUS_VFD_BV_0"/>
++ <value value="203" name="A7XX_DBGBUS_VFD_BV_1"/>
++ <value value="204" name="A7XX_DBGBUS_VFD_BV_2"/>
++ <value value="205" name="A7XX_DBGBUS_VFD_BV_3"/>
++ <value value="234" name="A7XX_DBGBUS_USP_0"/>
++ <value value="235" name="A7XX_DBGBUS_USP_1"/>
++ <value value="236" name="A7XX_DBGBUS_USP_2"/>
++ <value value="237" name="A7XX_DBGBUS_USP_3"/>
++ <value value="238" name="A7XX_DBGBUS_USP_4"/>
++ <value value="239" name="A7XX_DBGBUS_USP_5"/>
++ <value value="266" name="A7XX_DBGBUS_TP_0"/>
++ <value value="267" name="A7XX_DBGBUS_TP_1"/>
++ <value value="268" name="A7XX_DBGBUS_TP_2"/>
++ <value value="269" name="A7XX_DBGBUS_TP_3"/>
++ <value value="270" name="A7XX_DBGBUS_TP_4"/>
++ <value value="271" name="A7XX_DBGBUS_TP_5"/>
++ <value value="272" name="A7XX_DBGBUS_TP_6"/>
++ <value value="273" name="A7XX_DBGBUS_TP_7"/>
++ <value value="274" name="A7XX_DBGBUS_TP_8"/>
++ <value value="275" name="A7XX_DBGBUS_TP_9"/>
++ <value value="276" name="A7XX_DBGBUS_TP_10"/>
++ <value value="277" name="A7XX_DBGBUS_TP_11"/>
++ <value value="330" name="A7XX_DBGBUS_USPTP_0"/>
++ <value value="331" name="A7XX_DBGBUS_USPTP_1"/>
++ <value value="332" name="A7XX_DBGBUS_USPTP_2"/>
++ <value value="333" name="A7XX_DBGBUS_USPTP_3"/>
++ <value value="334" name="A7XX_DBGBUS_USPTP_4"/>
++ <value value="335" name="A7XX_DBGBUS_USPTP_5"/>
++ <value value="336" name="A7XX_DBGBUS_USPTP_6"/>
++ <value value="337" name="A7XX_DBGBUS_USPTP_7"/>
++ <value value="338" name="A7XX_DBGBUS_USPTP_8"/>
++ <value value="339" name="A7XX_DBGBUS_USPTP_9"/>
++ <value value="340" name="A7XX_DBGBUS_USPTP_10"/>
++ <value value="341" name="A7XX_DBGBUS_USPTP_11"/>
++ <value value="396" name="A7XX_DBGBUS_CCHE_0"/>
++ <value value="397" name="A7XX_DBGBUS_CCHE_1"/>
++ <value value="398" name="A7XX_DBGBUS_CCHE_2"/>
++ <value value="408" name="A7XX_DBGBUS_VPC_DSTR_0"/>
++ <value value="409" name="A7XX_DBGBUS_VPC_DSTR_1"/>
++ <value value="410" name="A7XX_DBGBUS_VPC_DSTR_2"/>
++ <value value="411" name="A7XX_DBGBUS_HLSQ_DP_STR_0"/>
++ <value value="412" name="A7XX_DBGBUS_HLSQ_DP_STR_1"/>
++ <value value="413" name="A7XX_DBGBUS_HLSQ_DP_STR_2"/>
++ <value value="414" name="A7XX_DBGBUS_HLSQ_DP_STR_3"/>
++ <value value="415" name="A7XX_DBGBUS_HLSQ_DP_STR_4"/>
++ <value value="416" name="A7XX_DBGBUS_HLSQ_DP_STR_5"/>
++ <value value="443" name="A7XX_DBGBUS_UFC_DSTR_0"/>
++ <value value="444" name="A7XX_DBGBUS_UFC_DSTR_1"/>
++ <value value="445" name="A7XX_DBGBUS_UFC_DSTR_2"/>
++ <value value="446" name="A7XX_DBGBUS_CGC_SUBCORE"/>
++ <value value="447" name="A7XX_DBGBUS_CGC_CORE"/>
++</enum>
++
++</database>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/a7xx_perfcntrs.xml b/drivers/gpu/drm/msm/registers/adreno/a7xx_perfcntrs.xml
+new file mode 100644
+index 000000000000..9bf78b0a854b
+--- /dev/null
++++ b/drivers/gpu/drm/msm/registers/adreno/a7xx_perfcntrs.xml
+@@ -0,0 +1,1030 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<database xmlns="http://nouveau.freedesktop.org/"
++xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
++<import file="freedreno_copyright.xml"/>
++<import file="adreno/adreno_common.xml"/>
++<import file="adreno/adreno_pm4.xml"/>
++
++<enum name="a7xx_cp_perfcounter_select">
++ <value value="0" name="A7XX_PERF_CP_ALWAYS_COUNT"/>
++ <value value="1" name="A7XX_PERF_CP_BUSY_GFX_CORE_IDLE"/>
++ <value value="2" name="A7XX_PERF_CP_BUSY_CYCLES"/>
++ <value value="3" name="A7XX_PERF_CP_NUM_PREEMPTIONS"/>
++ <value value="4" name="A7XX_PERF_CP_PREEMPTION_REACTION_DELAY"/>
++ <value value="5" name="A7XX_PERF_CP_PREEMPTION_SWITCH_OUT_TIME"/>
++ <value value="6" name="A7XX_PERF_CP_PREEMPTION_SWITCH_IN_TIME"/>
++ <value value="7" name="A7XX_PERF_CP_DEAD_DRAWS_IN_BIN_RENDER"/>
++ <value value="8" name="A7XX_PERF_CP_PREDICATED_DRAWS_KILLED"/>
++ <value value="9" name="A7XX_PERF_CP_MODE_SWITCH"/>
++ <value value="10" name="A7XX_PERF_CP_ZPASS_DONE"/>
++ <value value="11" name="A7XX_PERF_CP_CONTEXT_DONE"/>
++ <value value="12" name="A7XX_PERF_CP_CACHE_FLUSH"/>
++ <value value="13" name="A7XX_PERF_CP_LONG_PREEMPTIONS"/>
++ <value value="14" name="A7XX_PERF_CP_SQE_I_CACHE_STARVE"/>
++ <value value="15" name="A7XX_PERF_CP_SQE_IDLE"/>
++ <value value="16" name="A7XX_PERF_CP_SQE_PM4_STARVE_RB_IB"/>
++ <value value="17" name="A7XX_PERF_CP_SQE_PM4_STARVE_SDS"/>
++ <value value="18" name="A7XX_PERF_CP_SQE_MRB_STARVE"/>
++ <value value="19" name="A7XX_PERF_CP_SQE_RRB_STARVE"/>
++ <value value="20" name="A7XX_PERF_CP_SQE_VSD_STARVE"/>
++ <value value="21" name="A7XX_PERF_CP_VSD_DECODE_STARVE"/>
++ <value value="22" name="A7XX_PERF_CP_SQE_PIPE_OUT_STALL"/>
++ <value value="23" name="A7XX_PERF_CP_SQE_SYNC_STALL"/>
++ <value value="24" name="A7XX_PERF_CP_SQE_PM4_WFI_STALL"/>
++ <value value="25" name="A7XX_PERF_CP_SQE_SYS_WFI_STALL"/>
++ <value value="26" name="A7XX_PERF_CP_SQE_T4_EXEC"/>
++ <value value="27" name="A7XX_PERF_CP_SQE_LOAD_STATE_EXEC"/>
++ <value value="28" name="A7XX_PERF_CP_SQE_SAVE_SDS_STATE"/>
++ <value value="29" name="A7XX_PERF_CP_SQE_DRAW_EXEC"/>
++ <value value="30" name="A7XX_PERF_CP_SQE_CTXT_REG_BUNCH_EXEC"/>
++ <value value="31" name="A7XX_PERF_CP_SQE_EXEC_PROFILED"/>
++ <value value="32" name="A7XX_PERF_CP_MEMORY_POOL_EMPTY"/>
++ <value value="33" name="A7XX_PERF_CP_MEMORY_POOL_SYNC_STALL"/>
++ <value value="34" name="A7XX_PERF_CP_MEMORY_POOL_ABOVE_THRESH"/>
++ <value value="35" name="A7XX_PERF_CP_AHB_WR_STALL_PRE_DRAWS"/>
++ <value value="36" name="A7XX_PERF_CP_AHB_STALL_SQE_GMU"/>
++ <value value="37" name="A7XX_PERF_CP_AHB_STALL_SQE_WR_OTHER"/>
++ <value value="38" name="A7XX_PERF_CP_AHB_STALL_SQE_RD_OTHER"/>
++ <value value="39" name="A7XX_PERF_CP_CLUSTER0_EMPTY"/>
++ <value value="40" name="A7XX_PERF_CP_CLUSTER1_EMPTY"/>
++ <value value="41" name="A7XX_PERF_CP_CLUSTER2_EMPTY"/>
++ <value value="42" name="A7XX_PERF_CP_CLUSTER3_EMPTY"/>
++ <value value="43" name="A7XX_PERF_CP_CLUSTER4_EMPTY"/>
++ <value value="44" name="A7XX_PERF_CP_CLUSTER5_EMPTY"/>
++ <value value="45" name="A7XX_PERF_CP_PM4_DATA"/>
++ <value value="46" name="A7XX_PERF_CP_PM4_HEADERS"/>
++ <value value="47" name="A7XX_PERF_CP_VBIF_READ_BEATS"/>
++ <value value="48" name="A7XX_PERF_CP_VBIF_WRITE_BEATS"/>
++ <value value="49" name="A7XX_PERF_CP_SQE_INSTR_COUNTER"/>
++ <value value="50" name="A7XX_PERF_CP_RESERVED_50"/>
++ <value value="51" name="A7XX_PERF_CP_RESERVED_51"/>
++ <value value="52" name="A7XX_PERF_CP_RESERVED_52"/>
++ <value value="53" name="A7XX_PERF_CP_RESERVED_53"/>
++ <value value="54" name="A7XX_PERF_CP_RESERVED_54"/>
++ <value value="55" name="A7XX_PERF_CP_RESERVED_55"/>
++ <value value="56" name="A7XX_PERF_CP_RESERVED_56"/>
++ <value value="57" name="A7XX_PERF_CP_RESERVED_57"/>
++ <value value="58" name="A7XX_PERF_CP_RESERVED_58"/>
++ <value value="59" name="A7XX_PERF_CP_RESERVED_59"/>
++ <value value="60" name="A7XX_PERF_CP_CLUSTER0_FULL"/>
++ <value value="61" name="A7XX_PERF_CP_CLUSTER1_FULL"/>
++ <value value="62" name="A7XX_PERF_CP_CLUSTER2_FULL"/>
++ <value value="63" name="A7XX_PERF_CP_CLUSTER3_FULL"/>
++ <value value="64" name="A7XX_PERF_CP_CLUSTER4_FULL"/>
++ <value value="65" name="A7XX_PERF_CP_CLUSTER5_FULL"/>
++ <value value="66" name="A7XX_PERF_CP_CLUSTER6_FULL"/>
++ <value value="67" name="A7XX_PERF_CP_CLUSTER6_EMPTY"/>
++ <value value="68" name="A7XX_PERF_CP_ICACHE_MISSES"/>
++ <value value="69" name="A7XX_PERF_CP_ICACHE_HITS"/>
++ <value value="70" name="A7XX_PERF_CP_ICACHE_STALL"/>
++ <value value="71" name="A7XX_PERF_CP_DCACHE_MISSES"/>
++ <value value="72" name="A7XX_PERF_CP_DCACHE_HITS"/>
++ <value value="73" name="A7XX_PERF_CP_DCACHE_STALLS"/>
++ <value value="74" name="A7XX_PERF_CP_AQE_SQE_STALL"/>
++ <value value="75" name="A7XX_PERF_CP_SQE_AQE_STARVE"/>
++ <value value="76" name="A7XX_PERF_CP_PREEMPT_LATENCY"/>
++ <value value="77" name="A7XX_PERF_CP_SQE_MD8_STALL_CYCLES"/>
++ <value value="78" name="A7XX_PERF_CP_SQE_MESH_EXEC_CYCLES"/>
++ <value value="79" name="A7XX_PERF_CP_AQE_NUM_AS_CHUNKS"/>
++ <value value="80" name="A7XX_PERF_CP_AQE_NUM_MS_CHUNKS"/>
++</enum>
++
++<enum name="a7xx_rbbm_perfcounter_select">
++ <value value="0" name="A7XX_PERF_RBBM_ALWAYS_COUNT"/>
++ <value value="1" name="A7XX_PERF_RBBM_ALWAYS_ON"/>
++ <value value="2" name="A7XX_PERF_RBBM_TSE_BUSY"/>
++ <value value="3" name="A7XX_PERF_RBBM_RAS_BUSY"/>
++ <value value="4" name="A7XX_PERF_RBBM_PC_DCALL_BUSY"/>
++ <value value="5" name="A7XX_PERF_RBBM_PC_VSD_BUSY"/>
++ <value value="6" name="A7XX_PERF_RBBM_STATUS_MASKED"/>
++ <value value="7" name="A7XX_PERF_RBBM_COM_BUSY"/>
++ <value value="8" name="A7XX_PERF_RBBM_DCOM_BUSY"/>
++ <value value="9" name="A7XX_PERF_RBBM_VBIF_BUSY"/>
++ <value value="10" name="A7XX_PERF_RBBM_VSC_BUSY"/>
++ <value value="11" name="A7XX_PERF_RBBM_TESS_BUSY"/>
++ <value value="12" name="A7XX_PERF_RBBM_UCHE_BUSY"/>
++ <value value="13" name="A7XX_PERF_RBBM_HLSQ_BUSY"/>
++</enum>
++
++<enum name="a7xx_pc_perfcounter_select">
++ <value value="0" name="A7XX_PERF_PC_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_PC_WORKING_CYCLES"/>
++ <value value="2" name="A7XX_PERF_PC_STALL_CYCLES_VFD"/>
++ <value value="3" name="A7XX_PERF_PC_RESERVED"/>
++ <value value="4" name="A7XX_PERF_PC_STALL_CYCLES_VPC"/>
++ <value value="5" name="A7XX_PERF_PC_STALL_CYCLES_UCHE"/>
++ <value value="6" name="A7XX_PERF_PC_STALL_CYCLES_TESS"/>
++ <value value="7" name="A7XX_PERF_PC_STALL_CYCLES_VFD_ONLY"/>
++ <value value="8" name="A7XX_PERF_PC_STALL_CYCLES_VPC_ONLY"/>
++ <value value="9" name="A7XX_PERF_PC_PASS1_TF_STALL_CYCLES"/>
++ <value value="10" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_INDEX"/>
++ <value value="11" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_TESS_FACTOR"/>
++ <value value="12" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_VIZ_STREAM"/>
++ <value value="13" name="A7XX_PERF_PC_STARVE_CYCLES_DI"/>
++ <value value="14" name="A7XX_PERF_PC_VIS_STREAMS_LOADED"/>
++ <value value="15" name="A7XX_PERF_PC_INSTANCES"/>
++ <value value="16" name="A7XX_PERF_PC_VPC_PRIMITIVES"/>
++ <value value="17" name="A7XX_PERF_PC_DEAD_PRIM"/>
++ <value value="18" name="A7XX_PERF_PC_LIVE_PRIM"/>
++ <value value="19" name="A7XX_PERF_PC_VERTEX_HITS"/>
++ <value value="20" name="A7XX_PERF_PC_IA_VERTICES"/>
++ <value value="21" name="A7XX_PERF_PC_IA_PRIMITIVES"/>
++ <value value="22" name="A7XX_PERF_PC_RESERVED_22"/>
++ <value value="23" name="A7XX_PERF_PC_HS_INVOCATIONS"/>
++ <value value="24" name="A7XX_PERF_PC_DS_INVOCATIONS"/>
++ <value value="25" name="A7XX_PERF_PC_VS_INVOCATIONS"/>
++ <value value="26" name="A7XX_PERF_PC_GS_INVOCATIONS"/>
++ <value value="27" name="A7XX_PERF_PC_DS_PRIMITIVES"/>
++ <value value="28" name="A7XX_PERF_PC_3D_DRAWCALLS"/>
++ <value value="29" name="A7XX_PERF_PC_2D_DRAWCALLS"/>
++ <value value="30" name="A7XX_PERF_PC_NON_DRAWCALL_GLOBAL_EVENTS"/>
++ <value value="31" name="A7XX_PERF_PC_TESS_BUSY_CYCLES"/>
++ <value value="32" name="A7XX_PERF_PC_TESS_WORKING_CYCLES"/>
++ <value value="33" name="A7XX_PERF_PC_TESS_STALL_CYCLES_PC"/>
++ <value value="34" name="A7XX_PERF_PC_TESS_STARVE_CYCLES_PC"/>
++ <value value="35" name="A7XX_PERF_PC_TESS_SINGLE_PRIM_CYCLES"/>
++ <value value="36" name="A7XX_PERF_PC_TESS_PC_UV_TRANS"/>
++ <value value="37" name="A7XX_PERF_PC_TESS_PC_UV_PATCHES"/>
++ <value value="38" name="A7XX_PERF_PC_TESS_FACTOR_TRANS"/>
++ <value value="39" name="A7XX_PERF_PC_TAG_CHECKED_VERTICES"/>
++ <value value="40" name="A7XX_PERF_PC_MESH_VS_WAVES"/>
++ <value value="41" name="A7XX_PERF_PC_MESH_DRAWS"/>
++ <value value="42" name="A7XX_PERF_PC_MESH_DEAD_DRAWS"/>
++ <value value="43" name="A7XX_PERF_PC_MESH_MVIS_EN_DRAWS"/>
++ <value value="44" name="A7XX_PERF_PC_MESH_DEAD_PRIM"/>
++ <value value="45" name="A7XX_PERF_PC_MESH_LIVE_PRIM"/>
++ <value value="46" name="A7XX_PERF_PC_MESH_PA_EN_PRIM"/>
++ <value value="47" name="A7XX_PERF_PC_STARVE_CYCLES_FOR_MVIS_STREAM"/>
++ <value value="48" name="A7XX_PERF_PC_STARVE_CYCLES_PREDRAW"/>
++ <value value="49" name="A7XX_PERF_PC_STALL_CYCLES_COMPUTE_GFX"/>
++ <value value="50" name="A7XX_PERF_PC_STALL_CYCLES_GFX_COMPUTE"/>
++ <value value="51" name="A7XX_PERF_PC_TESS_PC_MULTI_PATCH_TRANS"/>
++</enum>
++
++<enum name="a7xx_vfd_perfcounter_select">
++ <value value="0" name="A7XX_PERF_VFD_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_VFD_STALL_CYCLES_UCHE"/>
++ <value value="2" name="A7XX_PERF_VFD_STALL_CYCLES_VPC_ALLOC"/>
++ <value value="3" name="A7XX_PERF_VFD_STALL_CYCLES_SP_INFO"/>
++ <value value="4" name="A7XX_PERF_VFD_STALL_CYCLES_SP_ATTR"/>
++ <value value="5" name="A7XX_PERF_VFD_STARVE_CYCLES_UCHE"/>
++ <value value="6" name="A7XX_PERF_VFD_RBUFFER_FULL"/>
++ <value value="7" name="A7XX_PERF_VFD_ATTR_INFO_FIFO_FULL"/>
++ <value value="8" name="A7XX_PERF_VFD_DECODED_ATTRIBUTE_BYTES"/>
++ <value value="9" name="A7XX_PERF_VFD_NUM_ATTRIBUTES"/>
++ <value value="10" name="A7XX_PERF_VFD_UPPER_SHADER_FIBERS"/>
++ <value value="11" name="A7XX_PERF_VFD_LOWER_SHADER_FIBERS"/>
++ <value value="12" name="A7XX_PERF_VFD_MODE_0_FIBERS"/>
++ <value value="13" name="A7XX_PERF_VFD_MODE_1_FIBERS"/>
++ <value value="14" name="A7XX_PERF_VFD_MODE_2_FIBERS"/>
++ <value value="15" name="A7XX_PERF_VFD_MODE_3_FIBERS"/>
++ <value value="16" name="A7XX_PERF_VFD_MODE_4_FIBERS"/>
++ <value value="17" name="A7XX_PERF_VFD_TOTAL_VERTICES"/>
++ <value value="18" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD"/>
++ <value value="19" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_INDEX"/>
++ <value value="20" name="A7XX_PERF_VFDP_STALL_CYCLES_VFD_PROG"/>
++ <value value="21" name="A7XX_PERF_VFDP_STARVE_CYCLES_PC"/>
++ <value value="22" name="A7XX_PERF_VFDP_VS_STAGE_WAVES"/>
++ <value value="23" name="A7XX_PERF_VFD_STALL_CYCLES_PRG_END_FE"/>
++ <value value="24" name="A7XX_PERF_VFD_STALL_CYCLES_CBSYNC"/>
++</enum>
++
++<enum name="a7xx_hlsq_perfcounter_select">
++ <value value="0" name="A7XX_PERF_HLSQ_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_HLSQ_STALL_CYCLES_UCHE"/>
++ <value value="2" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_STATE"/>
++ <value value="3" name="A7XX_PERF_HLSQ_STALL_CYCLES_SP_FS_STAGE"/>
++ <value value="4" name="A7XX_PERF_HLSQ_UCHE_LATENCY_CYCLES"/>
++ <value value="5" name="A7XX_PERF_HLSQ_UCHE_LATENCY_COUNT"/>
++ <value value="6" name="A7XX_PERF_HLSQ_RESERVED_6"/>
++ <value value="7" name="A7XX_PERF_HLSQ_RESERVED_7"/>
++ <value value="8" name="A7XX_PERF_HLSQ_RESERVED_8"/>
++ <value value="9" name="A7XX_PERF_HLSQ_RESERVED_9"/>
++ <value value="10" name="A7XX_PERF_HLSQ_COMPUTE_DRAWCALLS"/>
++ <value value="11" name="A7XX_PERF_HLSQ_FS_DATA_WAIT_PROGRAMMING"/>
++ <value value="12" name="A7XX_PERF_HLSQ_DUAL_FS_PROG_ACTIVE"/>
++ <value value="13" name="A7XX_PERF_HLSQ_DUAL_VS_PROG_ACTIVE"/>
++ <value value="14" name="A7XX_PERF_HLSQ_FS_BATCH_COUNT_ZERO"/>
++ <value value="15" name="A7XX_PERF_HLSQ_VS_BATCH_COUNT_ZERO"/>
++ <value value="16" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_QUAD"/>
++ <value value="17" name="A7XX_PERF_HLSQ_WAVE_PENDING_NO_PRIM_BASE"/>
++ <value value="18" name="A7XX_PERF_HLSQ_STALL_CYCLES_VPC"/>
++ <value value="19" name="A7XX_PERF_HLSQ_RESERVED_19"/>
++ <value value="20" name="A7XX_PERF_HLSQ_DRAW_MODE_SWITCH_VSFS_SYNC"/>
++ <value value="21" name="A7XX_PERF_HLSQ_VSBR_STALL_CYCLES"/>
++ <value value="22" name="A7XX_PERF_HLSQ_FS_STALL_CYCLES"/>
++ <value value="23" name="A7XX_PERF_HLSQ_LPAC_STALL_CYCLES"/>
++ <value value="24" name="A7XX_PERF_HLSQ_BV_STALL_CYCLES"/>
++ <value value="25" name="A7XX_PERF_HLSQ_VSBR_DEREF_CYCLES"/>
++ <value value="26" name="A7XX_PERF_HLSQ_FS_DEREF_CYCLES"/>
++ <value value="27" name="A7XX_PERF_HLSQ_LPAC_DEREF_CYCLES"/>
++ <value value="28" name="A7XX_PERF_HLSQ_BV_DEREF_CYCLES"/>
++ <value value="29" name="A7XX_PERF_HLSQ_VSBR_S2W_CYCLES"/>
++ <value value="30" name="A7XX_PERF_HLSQ_FS_S2W_CYCLES"/>
++ <value value="31" name="A7XX_PERF_HLSQ_LPAC_S2W_CYCLES"/>
++ <value value="32" name="A7XX_PERF_HLSQ_BV_S2W_CYCLES"/>
++ <value value="33" name="A7XX_PERF_HLSQ_VSBR_WAIT_FS_S2W"/>
++ <value value="34" name="A7XX_PERF_HLSQ_FS_WAIT_VS_S2W"/>
++ <value value="35" name="A7XX_PERF_HLSQ_LPAC_WAIT_VS_S2W"/>
++ <value value="36" name="A7XX_PERF_HLSQ_BV_WAIT_FS_S2W"/>
++ <value value="37" name="A7XX_PERF_HLSQ_VS_WAIT_CONST_RESOURCE"/>
++ <value value="38" name="A7XX_PERF_HLSQ_FS_WAIT_SAME_VS_S2W"/>
++ <value value="39" name="A7XX_PERF_HLSQ_FS_STARVING_SP"/>
++ <value value="40" name="A7XX_PERF_HLSQ_VS_DATA_WAIT_PROGRAMMING"/>
++ <value value="41" name="A7XX_PERF_HLSQ_BV_DATA_WAIT_PROGRAMMING"/>
++ <value value="42" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_VS"/>
++ <value value="43" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_VS"/>
++ <value value="44" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_FS"/>
++ <value value="45" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_FS"/>
++ <value value="46" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_BV"/>
++ <value value="47" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_BV"/>
++ <value value="48" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXTS_LPAC"/>
++ <value value="49" name="A7XX_PERF_HLSQ_STPROC_WAVE_CONTEXT_CYCLES_LPAC"/>
++ <value value="50" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_VS"/>
++ <value value="51" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_FS"/>
++ <value value="52" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_BV"/>
++ <value value="53" name="A7XX_PERF_HLSQ_SPTROC_STCHE_WARMUP_INC_LPAC"/>
++ <value value="54" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_VS"/>
++ <value value="55" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_FS"/>
++ <value value="56" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_BV"/>
++ <value value="57" name="A7XX_PERF_HLSQ_SPTROC_STCHE_MISS_INC_LPAC"/>
++</enum>
++
++<enum name="a7xx_vpc_perfcounter_select">
++ <value value="0" name="A7XX_PERF_VPC_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_VPC_WORKING_CYCLES"/>
++ <value value="2" name="A7XX_PERF_VPC_STALL_CYCLES_UCHE"/>
++ <value value="3" name="A7XX_PERF_VPC_STALL_CYCLES_VFD_WACK"/>
++ <value value="4" name="A7XX_PERF_VPC_STALL_CYCLES_HLSQ_PRIM_ALLOC"/>
++ <value value="5" name="A7XX_PERF_VPC_RESERVED_5"/>
++ <value value="6" name="A7XX_PERF_VPC_STALL_CYCLES_SP_LM"/>
++ <value value="7" name="A7XX_PERF_VPC_STARVE_CYCLES_SP"/>
++ <value value="8" name="A7XX_PERF_VPC_STARVE_CYCLES_LRZ"/>
++ <value value="9" name="A7XX_PERF_VPC_PC_PRIMITIVES"/>
++ <value value="10" name="A7XX_PERF_VPC_SP_COMPONENTS"/>
++ <value value="11" name="A7XX_PERF_VPC_STALL_CYCLES_VPCRAM_POS"/>
++ <value value="12" name="A7XX_PERF_VPC_LRZ_ASSIGN_PRIMITIVES"/>
++ <value value="13" name="A7XX_PERF_VPC_RB_VISIBLE_PRIMITIVES"/>
++ <value value="14" name="A7XX_PERF_VPC_LM_TRANSACTION"/>
++ <value value="15" name="A7XX_PERF_VPC_STREAMOUT_TRANSACTION"/>
++ <value value="16" name="A7XX_PERF_VPC_VS_BUSY_CYCLES"/>
++ <value value="17" name="A7XX_PERF_VPC_PS_BUSY_CYCLES"/>
++ <value value="18" name="A7XX_PERF_VPC_VS_WORKING_CYCLES"/>
++ <value value="19" name="A7XX_PERF_VPC_PS_WORKING_CYCLES"/>
++ <value value="20" name="A7XX_PERF_VPC_STARVE_CYCLES_RB"/>
++ <value value="21" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_POS"/>
++ <value value="22" name="A7XX_PERF_VPC_WIT_FULL_CYCLES"/>
++ <value value="23" name="A7XX_PERF_VPC_VPCRAM_FULL_CYCLES"/>
++ <value value="24" name="A7XX_PERF_VPC_LM_FULL_WAIT_FOR_INTP_END"/>
++ <value value="25" name="A7XX_PERF_VPC_NUM_VPCRAM_WRITE"/>
++ <value value="26" name="A7XX_PERF_VPC_NUM_VPCRAM_READ_SO"/>
++ <value value="27" name="A7XX_PERF_VPC_NUM_ATTR_REQ_LM"/>
++ <value value="28" name="A7XX_PERF_VPC_STALL_CYCLE_TSE"/>
++ <value value="29" name="A7XX_PERF_VPC_TSE_PRIMITIVES"/>
++ <value value="30" name="A7XX_PERF_VPC_GS_PRIMITIVES"/>
++ <value value="31" name="A7XX_PERF_VPC_TSE_TRANSACTIONS"/>
++ <value value="32" name="A7XX_PERF_VPC_STALL_CYCLES_CCU"/>
++ <value value="33" name="A7XX_PERF_VPC_NUM_WM_HIT"/>
++ <value value="34" name="A7XX_PERF_VPC_STALL_DQ_WACK"/>
++ <value value="35" name="A7XX_PERF_VPC_STALL_CYCLES_CCHE"/>
++ <value value="36" name="A7XX_PERF_VPC_STARVE_CYCLES_CCHE"/>
++ <value value="37" name="A7XX_PERF_VPC_NUM_PA_REQ"/>
++ <value value="38" name="A7XX_PERF_VPC_NUM_LM_REQ_HIT"/>
++ <value value="39" name="A7XX_PERF_VPC_CCHE_REQBUF_FULL"/>
++ <value value="40" name="A7XX_PERF_VPC_STALL_CYCLES_LM_ACK"/>
++ <value value="41" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_FE"/>
++ <value value="42" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_PCVS"/>
++ <value value="43" name="A7XX_PERF_VPC_STALL_CYCLES_PRG_END_VPCPS"/>
++</enum>
++
++<enum name="a7xx_tse_perfcounter_select">
++ <value value="0" name="A7XX_PERF_TSE_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_TSE_CLIPPING_CYCLES"/>
++ <value value="2" name="A7XX_PERF_TSE_STALL_CYCLES_RAS"/>
++ <value value="3" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_BARYPLANE"/>
++ <value value="4" name="A7XX_PERF_TSE_STALL_CYCLES_LRZ_ZPLANE"/>
++ <value value="5" name="A7XX_PERF_TSE_STARVE_CYCLES_PC"/>
++ <value value="6" name="A7XX_PERF_TSE_INPUT_PRIM"/>
++ <value value="7" name="A7XX_PERF_TSE_INPUT_NULL_PRIM"/>
++ <value value="8" name="A7XX_PERF_TSE_TRIVAL_REJ_PRIM"/>
++ <value value="9" name="A7XX_PERF_TSE_CLIPPED_PRIM"/>
++ <value value="10" name="A7XX_PERF_TSE_ZERO_AREA_PRIM"/>
++ <value value="11" name="A7XX_PERF_TSE_FACENESS_CULLED_PRIM"/>
++ <value value="12" name="A7XX_PERF_TSE_ZERO_PIXEL_PRIM"/>
++ <value value="13" name="A7XX_PERF_TSE_OUTPUT_NULL_PRIM"/>
++ <value value="14" name="A7XX_PERF_TSE_OUTPUT_VISIBLE_PRIM"/>
++ <value value="15" name="A7XX_PERF_TSE_CINVOCATION"/>
++ <value value="16" name="A7XX_PERF_TSE_CPRIMITIVES"/>
++ <value value="17" name="A7XX_PERF_TSE_2D_INPUT_PRIM"/>
++ <value value="18" name="A7XX_PERF_TSE_2D_ALIVE_CYCLES"/>
++ <value value="19" name="A7XX_PERF_TSE_CLIP_PLANES"/>
++</enum>
++
++<enum name="a7xx_ras_perfcounter_select">
++ <value value="0" name="A7XX_PERF_RAS_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_RAS_SUPERTILE_ACTIVE_CYCLES"/>
++ <value value="2" name="A7XX_PERF_RAS_STALL_CYCLES_LRZ"/>
++ <value value="3" name="A7XX_PERF_RAS_STARVE_CYCLES_TSE"/>
++ <value value="4" name="A7XX_PERF_RAS_SUPER_TILES"/>
++ <value value="5" name="A7XX_PERF_RAS_8X4_TILES"/>
++ <value value="6" name="A7XX_PERF_RAS_MASKGEN_ACTIVE"/>
++ <value value="7" name="A7XX_PERF_RAS_FULLY_COVERED_SUPER_TILES"/>
++ <value value="8" name="A7XX_PERF_RAS_FULLY_COVERED_8X4_TILES"/>
++ <value value="9" name="A7XX_PERF_RAS_PRIM_KILLED_INVISILBE"/>
++ <value value="10" name="A7XX_PERF_RAS_SUPERTILE_GEN_ACTIVE_CYCLES"/>
++ <value value="11" name="A7XX_PERF_RAS_LRZ_INTF_WORKING_CYCLES"/>
++ <value value="12" name="A7XX_PERF_RAS_BLOCKS"/>
++ <value value="13" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_0_WORKING_CC_l2"/>
++ <value value="14" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_1_WORKING_CC_l2"/>
++ <value value="15" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_2_WORKING_CC_l2"/>
++ <value value="16" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_3_WORKING_CC_l2"/>
++ <value value="17" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_4_WORKING_CC_l2"/>
++ <value value="18" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_5_WORKING_CC_l2"/>
++ <value value="19" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_6_WORKING_CC_l2"/>
++ <value value="20" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_7_WORKING_CC_l2"/>
++ <value value="21" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_8_WORKING_CC_l2"/>
++ <value value="22" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_9_WORKING_CC_l2"/>
++ <value value="23" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_10_WORKING_CC_l2"/>
++ <value value="24" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_11_WORKING_CC_l2"/>
++ <value value="25" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_12_WORKING_CC_l2"/>
++ <value value="26" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_13_WORKING_CC_l2"/>
++ <value value="27" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_14_WORKING_CC_l2"/>
++ <value value="28" name="A7XX_PERF_RAS_SAMPLE_MASK_GEN_LANE_15_WORKING_CC_l2"/>
++ <value value="29" name="A7XX_PERF_RAS_FALSE_PARTIAL_STILE"/>
++
++</enum>
++
++<enum name="a7xx_uche_perfcounter_select">
++ <value value="0" name="A7XX_PERF_UCHE_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_UCHE_STALL_CYCLES_ARBITER"/>
++ <value value="2" name="A7XX_PERF_UCHE_VBIF_LATENCY_CYCLES"/>
++ <value value="3" name="A7XX_PERF_UCHE_VBIF_LATENCY_SAMPLES"/>
++ <value value="4" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_TP"/>
++ <value value="5" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_VFD"/>
++ <value value="6" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_HLSQ"/>
++ <value value="7" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_LRZ"/>
++ <value value="8" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_SP"/>
++ <value value="9" name="A7XX_PERF_UCHE_READ_REQUESTS_TP"/>
++ <value value="10" name="A7XX_PERF_UCHE_READ_REQUESTS_VFD"/>
++ <value value="11" name="A7XX_PERF_UCHE_READ_REQUESTS_HLSQ"/>
++ <value value="12" name="A7XX_PERF_UCHE_READ_REQUESTS_LRZ"/>
++ <value value="13" name="A7XX_PERF_UCHE_READ_REQUESTS_SP"/>
++ <value value="14" name="A7XX_PERF_UCHE_WRITE_REQUESTS_LRZ"/>
++ <value value="15" name="A7XX_PERF_UCHE_WRITE_REQUESTS_SP"/>
++ <value value="16" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VPC"/>
++ <value value="17" name="A7XX_PERF_UCHE_WRITE_REQUESTS_VSC"/>
++ <value value="18" name="A7XX_PERF_UCHE_EVICTS"/>
++ <value value="19" name="A7XX_PERF_UCHE_BANK_REQ0"/>
++ <value value="20" name="A7XX_PERF_UCHE_BANK_REQ1"/>
++ <value value="21" name="A7XX_PERF_UCHE_BANK_REQ2"/>
++ <value value="22" name="A7XX_PERF_UCHE_BANK_REQ3"/>
++ <value value="23" name="A7XX_PERF_UCHE_BANK_REQ4"/>
++ <value value="24" name="A7XX_PERF_UCHE_BANK_REQ5"/>
++ <value value="25" name="A7XX_PERF_UCHE_BANK_REQ6"/>
++ <value value="26" name="A7XX_PERF_UCHE_BANK_REQ7"/>
++ <value value="27" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH0"/>
++ <value value="28" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_CH1"/>
++ <value value="29" name="A7XX_PERF_UCHE_GMEM_READ_BEATS"/>
++ <value value="30" name="A7XX_PERF_UCHE_TPH_REF_FULL"/>
++ <value value="31" name="A7XX_PERF_UCHE_TPH_VICTIM_FULL"/>
++ <value value="32" name="A7XX_PERF_UCHE_TPH_EXT_FULL"/>
++ <value value="33" name="A7XX_PERF_UCHE_VBIF_STALL_WRITE_DATA"/>
++ <value value="34" name="A7XX_PERF_UCHE_DCMP_LATENCY_SAMPLES"/>
++ <value value="35" name="A7XX_PERF_UCHE_DCMP_LATENCY_CYCLES"/>
++ <value value="36" name="A7XX_PERF_UCHE_VBIF_READ_BEATS_PC"/>
++ <value value="37" name="A7XX_PERF_UCHE_READ_REQUESTS_PC"/>
++ <value value="38" name="A7XX_PERF_UCHE_RAM_READ_REQ"/>
++ <value value="39" name="A7XX_PERF_UCHE_RAM_WRITE_REQ"/>
++ <value value="40" name="A7XX_PERF_UCHE_STARVED_CYCLES_VBIF_DECMP"/>
++ <value value="41" name="A7XX_PERF_UCHE_STALL_CYCLES_DECMP"/>
++ <value value="42" name="A7XX_PERF_UCHE_ARBITER_STALL_CYCLES_VBIF"/>
++ <value value="43" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_UBWC"/>
++ <value value="44" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_NONUBWC"/>
++ <value value="45" name="A7XX_PERF_UCHE_READ_REQUESTS_TP_GMEM"/>
++ <value value="46" name="A7XX_PERF_UCHE_LONG_LINE_ALL_EVICTS_KAILUA"/>
++ <value value="47" name="A7XX_PERF_UCHE_LONG_LINE_PARTIAL_EVICTS_KAILUA"/>
++ <value value="48" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_CCHE"/>
++ <value value="49" name="A7XX_PERF_UCHE_TPH_CONFLICT_CL_OTHER_KAILUA"/>
++ <value value="50" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_CCHE"/>
++ <value value="51" name="A7XX_PERF_UCHE_DBANK_CONFLICT_CL_OTHER_CLIENTS"/>
++ <value value="52" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH0"/>
++ <value value="53" name="A7XX_PERF_UCHE_VBIF_WRITE_BEATS_CH1"/>
++ <value value="54" name="A7XX_PERF_UCHE_CCHE_TPH_QUEUE_FULL"/>
++ <value value="55" name="A7XX_PERF_UCHE_CCHE_DPH_QUEUE_FULL"/>
++ <value value="56" name="A7XX_PERF_UCHE_GMEM_WRITE_BEATS"/>
++ <value value="57" name="A7XX_PERF_UCHE_UBWC_READ_BEATS"/>
++ <value value="58" name="A7XX_PERF_UCHE_UBWC_WRITE_BEATS"/>
++</enum>
++
++<enum name="a7xx_tp_perfcounter_select">
++ <value value="0" name="A7XX_PERF_TP_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_TP_STALL_CYCLES_UCHE"/>
++ <value value="2" name="A7XX_PERF_TP_LATENCY_CYCLES"/>
++ <value value="3" name="A7XX_PERF_TP_LATENCY_TRANS"/>
++ <value value="4" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_SAMPLES"/>
++ <value value="5" name="A7XX_PERF_TP_FLAG_FIFO_DELAY_CYCLES"/>
++ <value value="6" name="A7XX_PERF_TP_L1_CACHELINE_REQUESTS"/>
++ <value value="7" name="A7XX_PERF_TP_L1_CACHELINE_MISSES"/>
++ <value value="8" name="A7XX_PERF_TP_SP_TP_TRANS"/>
++ <value value="9" name="A7XX_PERF_TP_TP_SP_TRANS"/>
++ <value value="10" name="A7XX_PERF_TP_OUTPUT_PIXELS"/>
++ <value value="11" name="A7XX_PERF_TP_FILTER_WORKLOAD_16BIT"/>
++ <value value="12" name="A7XX_PERF_TP_FILTER_WORKLOAD_32BIT"/>
++ <value value="13" name="A7XX_PERF_TP_QUADS_RECEIVED"/>
++ <value value="14" name="A7XX_PERF_TP_QUADS_OFFSET"/>
++ <value value="15" name="A7XX_PERF_TP_QUADS_SHADOW"/>
++ <value value="16" name="A7XX_PERF_TP_QUADS_ARRAY"/>
++ <value value="17" name="A7XX_PERF_TP_QUADS_GRADIENT"/>
++ <value value="18" name="A7XX_PERF_TP_QUADS_1D"/>
++ <value value="19" name="A7XX_PERF_TP_QUADS_2D"/>
++ <value value="20" name="A7XX_PERF_TP_QUADS_BUFFER"/>
++ <value value="21" name="A7XX_PERF_TP_QUADS_3D"/>
++ <value value="22" name="A7XX_PERF_TP_QUADS_CUBE"/>
++ <value value="23" name="A7XX_PERF_TP_DIVERGENT_QUADS_RECEIVED"/>
++ <value value="24" name="A7XX_PERF_TP_PRT_NON_RESIDENT_EVENTS"/>
++ <value value="25" name="A7XX_PERF_TP_OUTPUT_PIXELS_POINT"/>
++ <value value="26" name="A7XX_PERF_TP_OUTPUT_PIXELS_BILINEAR"/>
++ <value value="27" name="A7XX_PERF_TP_OUTPUT_PIXELS_MIP"/>
++ <value value="28" name="A7XX_PERF_TP_OUTPUT_PIXELS_ANISO"/>
++ <value value="29" name="A7XX_PERF_TP_OUTPUT_PIXELS_ZERO_LOD"/>
++ <value value="30" name="A7XX_PERF_TP_FLAG_CACHE_REQUESTS"/>
++ <value value="31" name="A7XX_PERF_TP_FLAG_CACHE_MISSES"/>
++ <value value="32" name="A7XX_PERF_TP_L1_5_L2_REQUESTS"/>
++ <value value="33" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS"/>
++ <value value="34" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_POINT"/>
++ <value value="35" name="A7XX_PERF_TP_2D_OUTPUT_PIXELS_BILINEAR"/>
++ <value value="36" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_16BIT"/>
++ <value value="37" name="A7XX_PERF_TP_2D_FILTER_WORKLOAD_32BIT"/>
++ <value value="38" name="A7XX_PERF_TP_TPA2TPC_TRANS"/>
++ <value value="39" name="A7XX_PERF_TP_L1_MISSES_ASTC_1TILE"/>
++ <value value="40" name="A7XX_PERF_TP_L1_MISSES_ASTC_2TILE"/>
++ <value value="41" name="A7XX_PERF_TP_L1_MISSES_ASTC_4TILE"/>
++ <value value="42" name="A7XX_PERF_TP_L1_5_COMPRESS_REQS"/>
++ <value value="43" name="A7XX_PERF_TP_L1_5_L2_COMPRESS_MISS"/>
++ <value value="44" name="A7XX_PERF_TP_L1_BANK_CONFLICT"/>
++ <value value="45" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_CYCLES"/>
++ <value value="46" name="A7XX_PERF_TP_L1_5_MISS_LATENCY_TRANS"/>
++ <value value="47" name="A7XX_PERF_TP_QUADS_CONSTANT_MULTIPLIED"/>
++ <value value="48" name="A7XX_PERF_TP_FRONTEND_WORKING_CYCLES"/>
++ <value value="49" name="A7XX_PERF_TP_L1_TAG_WORKING_CYCLES"/>
++ <value value="50" name="A7XX_PERF_TP_L1_DATA_WRITE_WORKING_CYCLES"/>
++ <value value="51" name="A7XX_PERF_TP_PRE_L1_DECOM_WORKING_CYCLES"/>
++ <value value="52" name="A7XX_PERF_TP_BACKEND_WORKING_CYCLES"/>
++ <value value="53" name="A7XX_PERF_TP_L1_5_CACHE_WORKING_CYCLES"/>
++ <value value="54" name="A7XX_PERF_TP_STARVE_CYCLES_SP"/>
++ <value value="55" name="A7XX_PERF_TP_STARVE_CYCLES_UCHE"/>
++ <value value="56" name="A7XX_PERF_TP_STALL_CYCLES_UFC"/>
++ <value value="57" name="A7XX_PERF_TP_FORMAT_DECOMP"/>
++ <value value="58" name="A7XX_PERF_TP_FILTER_POINT_FP16"/>
++ <value value="59" name="A7XX_PERF_TP_FILTER_POINT_FP32"/>
++ <value value="60" name="A7XX_PERF_TP_LATENCY_FIFO_FULL"/>
++ <value value="61" name="A7XX_PERF_TP_RESERVED_61"/>
++ <value value="62" name="A7XX_PERF_TP_RESERVED_62"/>
++ <value value="63" name="A7XX_PERF_TP_RESERVED_63"/>
++ <value value="64" name="A7XX_PERF_TP_RESERVED_64"/>
++ <value value="65" name="A7XX_PERF_TP_RESERVED_65"/>
++ <value value="66" name="A7XX_PERF_TP_RESERVED_66"/>
++ <value value="67" name="A7XX_PERF_TP_RESERVED_67"/>
++ <value value="68" name="A7XX_PERF_TP_RESERVED_68"/>
++ <value value="69" name="A7XX_PERF_TP_RESERVED_69"/>
++ <value value="70" name="A7XX_PERF_TP_RESERVED_70"/>
++ <value value="71" name="A7XX_PERF_TP_RESERVED_71"/>
++ <value value="72" name="A7XX_PERF_TP_RESERVED_72"/>
++ <value value="73" name="A7XX_PERF_TP_RESERVED_73"/>
++ <value value="74" name="A7XX_PERF_TP_RESERVED_74"/>
++ <value value="75" name="A7XX_PERF_TP_RESERVED_75"/>
++ <value value="76" name="A7XX_PERF_TP_RESERVED_76"/>
++ <value value="77" name="A7XX_PERF_TP_RESERVED_77"/>
++ <value value="78" name="A7XX_PERF_TP_RESERVED_78"/>
++ <value value="79" name="A7XX_PERF_TP_RESERVED_79"/>
++ <value value="80" name="A7XX_PERF_TP_RESERVED_80"/>
++ <value value="81" name="A7XX_PERF_TP_RESERVED_81"/>
++ <value value="82" name="A7XX_PERF_TP_RESERVED_82"/>
++ <value value="83" name="A7XX_PERF_TP_RESERVED_83"/>
++ <value value="84" name="A7XX_PERF_TP_RESERVED_84"/>
++ <value value="85" name="A7XX_PERF_TP_RESERVED_85"/>
++ <value value="86" name="A7XX_PERF_TP_RESERVED_86"/>
++ <value value="87" name="A7XX_PERF_TP_RESERVED_87"/>
++ <value value="88" name="A7XX_PERF_TP_RESERVED_88"/>
++ <value value="89" name="A7XX_PERF_TP_RESERVED_89"/>
++ <value value="90" name="A7XX_PERF_TP_RESERVED_90"/>
++ <value value="91" name="A7XX_PERF_TP_RESERVED_91"/>
++ <value value="92" name="A7XX_PERF_TP_RESERVED_92"/>
++ <value value="93" name="A7XX_PERF_TP_RESERVED_93"/>
++ <value value="94" name="A7XX_PERF_TP_RESERVED_94"/>
++ <value value="95" name="A7XX_PERF_TP_RESERVED_95"/>
++ <value value="96" name="A7XX_PERF_TP_RESERVED_96"/>
++ <value value="97" name="A7XX_PERF_TP_RESERVED_97"/>
++ <value value="98" name="A7XX_PERF_TP_RESERVED_98"/>
++ <value value="99" name="A7XX_PERF_TP_RESERVED_99"/>
++ <value value="100" name="A7XX_PERF_TP_RESERVED_100"/>
++ <value value="101" name="A7XX_PERF_TP_RESERVED_101"/>
++ <value value="102" name="A7XX_PERF_TP_RESERVED_102"/>
++ <value value="103" name="A7XX_PERF_TP_RESERVED_103"/>
++ <value value="104" name="A7XX_PERF_TP_RESERVED_104"/>
++ <value value="105" name="A7XX_PERF_TP_RESERVED_105"/>
++ <value value="106" name="A7XX_PERF_TP_RESERVED_106"/>
++ <value value="107" name="A7XX_PERF_TP_RESERVED_107"/>
++ <value value="108" name="A7XX_PERF_TP_RESERVED_108"/>
++ <value value="109" name="A7XX_PERF_TP_RESERVED_109"/>
++ <value value="110" name="A7XX_PERF_TP_RESERVED_110"/>
++ <value value="111" name="A7XX_PERF_TP_RESERVED_111"/>
++ <value value="112" name="A7XX_PERF_TP_RESERVED_112"/>
++ <value value="113" name="A7XX_PERF_TP_RESERVED_113"/>
++ <value value="114" name="A7XX_PERF_TP_RESERVED_114"/>
++ <value value="115" name="A7XX_PERF_TP_RESERVED_115"/>
++ <value value="116" name="A7XX_PERF_TP_RESERVED_116"/>
++ <value value="117" name="A7XX_PERF_TP_RESERVED_117"/>
++ <value value="118" name="A7XX_PERF_TP_RESERVED_118"/>
++ <value value="119" name="A7XX_PERF_TP_RESERVED_119"/>
++ <value value="120" name="A7XX_PERF_TP_RESERVED_120"/>
++ <value value="121" name="A7XX_PERF_TP_RESERVED_121"/>
++ <value value="122" name="A7XX_PERF_TP_RESERVED_122"/>
++ <value value="123" name="A7XX_PERF_TP_RESERVED_123"/>
++ <value value="124" name="A7XX_PERF_TP_RESERVED_124"/>
++ <value value="125" name="A7XX_PERF_TP_RESERVED_125"/>
++ <value value="126" name="A7XX_PERF_TP_RESERVED_126"/>
++ <value value="127" name="A7XX_PERF_TP_RESERVED_127"/>
++ <value value="128" name="A7XX_PERF_TP_FORMAT_DECOMP_BILINEAR"/>
++ <value value="129" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP16"/>
++ <value value="130" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP16"/>
++ <value value="131" name="A7XX_PERF_TP_PACKED_POINT_BOTH_VALID_FP32"/>
++ <value value="132" name="A7XX_PERF_TP_PACKED_POINT_SINGLE_VALID_FP32"/>
++</enum>
++
++<enum name="a7xx_sp_perfcounter_select">
++ <value value="0" name="A7XX_PERF_SP_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_SP_ALU_WORKING_CYCLES"/>
++ <value value="2" name="A7XX_PERF_SP_EFU_WORKING_CYCLES"/>
++ <value value="3" name="A7XX_PERF_SP_STALL_CYCLES_VPC"/>
++ <value value="4" name="A7XX_PERF_SP_STALL_CYCLES_TP"/>
++ <value value="5" name="A7XX_PERF_SP_STALL_CYCLES_UCHE"/>
++ <value value="6" name="A7XX_PERF_SP_STALL_CYCLES_RB"/>
++ <value value="7" name="A7XX_PERF_SP_NON_EXECUTION_CYCLES"/>
++ <value value="8" name="A7XX_PERF_SP_WAVE_CONTEXTS"/>
++ <value value="9" name="A7XX_PERF_SP_WAVE_CONTEXT_CYCLES"/>
++ <value value="10" name="A7XX_PERF_SP_STAGE_WAVE_CYCLES"/>
++ <value value="11" name="A7XX_PERF_SP_STAGE_WAVE_SAMPLES"/>
++ <value value="12" name="A7XX_PERF_SP_VS_STAGE_WAVE_CYCLES"/>
++ <value value="13" name="A7XX_PERF_SP_VS_STAGE_WAVE_SAMPLES"/>
++ <value value="14" name="A7XX_PERF_SP_FS_STAGE_DURATION_CYCLES"/>
++ <value value="15" name="A7XX_PERF_SP_VS_STAGE_DURATION_CYCLES"/>
++ <value value="16" name="A7XX_PERF_SP_WAVE_CTRL_CYCLES"/>
++ <value value="17" name="A7XX_PERF_SP_WAVE_LOAD_CYCLES"/>
++ <value value="18" name="A7XX_PERF_SP_WAVE_EMIT_CYCLES"/>
++ <value value="19" name="A7XX_PERF_SP_WAVE_NOP_CYCLES"/>
++ <value value="20" name="A7XX_PERF_SP_WAVE_WAIT_CYCLES"/>
++ <value value="21" name="A7XX_PERF_SP_WAVE_FETCH_CYCLES"/>
++ <value value="22" name="A7XX_PERF_SP_WAVE_IDLE_CYCLES"/>
++ <value value="23" name="A7XX_PERF_SP_WAVE_END_CYCLES"/>
++ <value value="24" name="A7XX_PERF_SP_WAVE_LONG_SYNC_CYCLES"/>
++ <value value="25" name="A7XX_PERF_SP_WAVE_SHORT_SYNC_CYCLES"/>
++ <value value="26" name="A7XX_PERF_SP_WAVE_JOIN_CYCLES"/>
++ <value value="27" name="A7XX_PERF_SP_LM_LOAD_INSTRUCTIONS"/>
++ <value value="28" name="A7XX_PERF_SP_LM_STORE_INSTRUCTIONS"/>
++ <value value="29" name="A7XX_PERF_SP_LM_ATOMICS"/>
++ <value value="30" name="A7XX_PERF_SP_GM_LOAD_INSTRUCTIONS"/>
++ <value value="31" name="A7XX_PERF_SP_GM_STORE_INSTRUCTIONS"/>
++ <value value="32" name="A7XX_PERF_SP_GM_ATOMICS"/>
++ <value value="33" name="A7XX_PERF_SP_VS_STAGE_TEX_INSTRUCTIONS"/>
++ <value value="34" name="A7XX_PERF_SP_VS_STAGE_EFU_INSTRUCTIONS"/>
++ <value value="35" name="A7XX_PERF_SP_VS_STAGE_FULL_ALU_INSTRUCTIONS"/>
++ <value value="36" name="A7XX_PERF_SP_VS_STAGE_HALF_ALU_INSTRUCTIONS"/>
++ <value value="37" name="A7XX_PERF_SP_FS_STAGE_TEX_INSTRUCTIONS"/>
++ <value value="38" name="A7XX_PERF_SP_FS_STAGE_CFLOW_INSTRUCTIONS"/>
++ <value value="39" name="A7XX_PERF_SP_FS_STAGE_EFU_INSTRUCTIONS"/>
++ <value value="40" name="A7XX_PERF_SP_FS_STAGE_FULL_ALU_INSTRUCTIONS"/>
++ <value value="41" name="A7XX_PERF_SP_FS_STAGE_HALF_ALU_INSTRUCTIONS"/>
++ <value value="42" name="A7XX_PERF_SP_FS_STAGE_BARY_INSTRUCTIONS"/>
++ <value value="43" name="A7XX_PERF_SP_VS_INSTRUCTIONS"/>
++ <value value="44" name="A7XX_PERF_SP_FS_INSTRUCTIONS"/>
++ <value value="45" name="A7XX_PERF_SP_ADDR_LOCK_COUNT"/>
++ <value value="46" name="A7XX_PERF_SP_UCHE_READ_TRANS"/>
++ <value value="47" name="A7XX_PERF_SP_UCHE_WRITE_TRANS"/>
++ <value value="48" name="A7XX_PERF_SP_EXPORT_VPC_TRANS"/>
++ <value value="49" name="A7XX_PERF_SP_EXPORT_RB_TRANS"/>
++ <value value="50" name="A7XX_PERF_SP_PIXELS_KILLED"/>
++ <value value="51" name="A7XX_PERF_SP_ICL1_REQUESTS"/>
++ <value value="52" name="A7XX_PERF_SP_ICL1_MISSES"/>
++ <value value="53" name="A7XX_PERF_SP_HS_INSTRUCTIONS"/>
++ <value value="54" name="A7XX_PERF_SP_DS_INSTRUCTIONS"/>
++ <value value="55" name="A7XX_PERF_SP_GS_INSTRUCTIONS"/>
++ <value value="56" name="A7XX_PERF_SP_CS_INSTRUCTIONS"/>
++ <value value="57" name="A7XX_PERF_SP_GPR_READ"/>
++ <value value="58" name="A7XX_PERF_SP_GPR_WRITE"/>
++ <value value="59" name="A7XX_PERF_SP_FS_STAGE_HALF_EFU_INSTRUCTIONS"/>
++ <value value="60" name="A7XX_PERF_SP_VS_STAGE_HALF_EFU_INSTRUCTIONS"/>
++ <value value="61" name="A7XX_PERF_SP_LM_BANK_CONFLICTS"/>
++ <value value="62" name="A7XX_PERF_SP_TEX_CONTROL_WORKING_CYCLES"/>
++ <value value="63" name="A7XX_PERF_SP_LOAD_CONTROL_WORKING_CYCLES"/>
++ <value value="64" name="A7XX_PERF_SP_FLOW_CONTROL_WORKING_CYCLES"/>
++ <value value="65" name="A7XX_PERF_SP_LM_WORKING_CYCLES"/>
++ <value value="66" name="A7XX_PERF_SP_DISPATCHER_WORKING_CYCLES"/>
++ <value value="67" name="A7XX_PERF_SP_SEQUENCER_WORKING_CYCLES"/>
++ <value value="68" name="A7XX_PERF_SP_LOW_EFFICIENCY_STARVED_BY_TP"/>
++ <value value="69" name="A7XX_PERF_SP_STARVE_CYCLES_HLSQ"/>
++ <value value="70" name="A7XX_PERF_SP_NON_EXECUTION_LS_CYCLES"/>
++ <value value="71" name="A7XX_PERF_SP_WORKING_EU"/>
++ <value value="72" name="A7XX_PERF_SP_ANY_EU_WORKING"/>
++ <value value="73" name="A7XX_PERF_SP_WORKING_EU_FS_STAGE"/>
++ <value value="74" name="A7XX_PERF_SP_ANY_EU_WORKING_FS_STAGE"/>
++ <value value="75" name="A7XX_PERF_SP_WORKING_EU_VS_STAGE"/>
++ <value value="76" name="A7XX_PERF_SP_ANY_EU_WORKING_VS_STAGE"/>
++ <value value="77" name="A7XX_PERF_SP_WORKING_EU_CS_STAGE"/>
++ <value value="78" name="A7XX_PERF_SP_ANY_EU_WORKING_CS_STAGE"/>
++ <value value="79" name="A7XX_PERF_SP_GPR_READ_PREFETCH"/>
++ <value value="80" name="A7XX_PERF_SP_GPR_READ_CONFLICT"/>
++ <value value="81" name="A7XX_PERF_SP_GPR_WRITE_CONFLICT"/>
++ <value value="82" name="A7XX_PERF_SP_GM_LOAD_LATENCY_CYCLES"/>
++ <value value="83" name="A7XX_PERF_SP_GM_LOAD_LATENCY_SAMPLES"/>
++ <value value="84" name="A7XX_PERF_SP_EXECUTABLE_WAVES"/>
++ <value value="85" name="A7XX_PERF_SP_ICL1_MISS_FETCH_CYCLES"/>
++ <value value="86" name="A7XX_PERF_SP_WORKING_EU_LPAC"/>
++ <value value="87" name="A7XX_PERF_SP_BYPASS_BUSY_CYCLES"/>
++ <value value="88" name="A7XX_PERF_SP_ANY_EU_WORKING_LPAC"/>
++ <value value="89" name="A7XX_PERF_SP_WAVE_ALU_CYCLES"/>
++ <value value="90" name="A7XX_PERF_SP_WAVE_EFU_CYCLES"/>
++ <value value="91" name="A7XX_PERF_SP_WAVE_INT_CYCLES"/>
++ <value value="92" name="A7XX_PERF_SP_WAVE_CSP_CYCLES"/>
++ <value value="93" name="A7XX_PERF_SP_EWAVE_CONTEXTS"/>
++ <value value="94" name="A7XX_PERF_SP_EWAVE_CONTEXT_CYCLES"/>
++ <value value="95" name="A7XX_PERF_SP_LPAC_BUSY_CYCLES"/>
++ <value value="96" name="A7XX_PERF_SP_LPAC_INSTRUCTIONS"/>
++ <value value="97" name="A7XX_PERF_SP_FS_STAGE_1X_WAVES"/>
++ <value value="98" name="A7XX_PERF_SP_FS_STAGE_2X_WAVES"/>
++ <value value="99" name="A7XX_PERF_SP_QUADS"/>
++ <value value="100" name="A7XX_PERF_SP_CS_INVOCATIONS"/>
++ <value value="101" name="A7XX_PERF_SP_PIXELS"/>
++ <value value="102" name="A7XX_PERF_SP_LPAC_DRAWCALLS"/>
++ <value value="103" name="A7XX_PERF_SP_PI_WORKING_CYCLES"/>
++ <value value="104" name="A7XX_PERF_SP_WAVE_INPUT_CYCLES"/>
++ <value value="105" name="A7XX_PERF_SP_WAVE_OUTPUT_CYCLES"/>
++ <value value="106" name="A7XX_PERF_SP_WAVE_HWAVE_WAIT_CYCLES"/>
++ <value value="107" name="A7XX_PERF_SP_WAVE_HWAVE_SYNC"/>
++ <value value="108" name="A7XX_PERF_SP_OUTPUT_3D_PIXELS"/>
++ <value value="109" name="A7XX_PERF_SP_FULL_ALU_MAD_INSTRUCTIONS"/>
++ <value value="110" name="A7XX_PERF_SP_HALF_ALU_MAD_INSTRUCTIONS"/>
++ <value value="111" name="A7XX_PERF_SP_FULL_ALU_MUL_INSTRUCTIONS"/>
++ <value value="112" name="A7XX_PERF_SP_HALF_ALU_MUL_INSTRUCTIONS"/>
++ <value value="113" name="A7XX_PERF_SP_FULL_ALU_ADD_INSTRUCTIONS"/>
++ <value value="114" name="A7XX_PERF_SP_HALF_ALU_ADD_INSTRUCTIONS"/>
++ <value value="115" name="A7XX_PERF_SP_BARY_FP32_INSTRUCTIONS"/>
++ <value value="116" name="A7XX_PERF_SP_ALU_GPR_READ_CYCLES"/>
++ <value value="117" name="A7XX_PERF_SP_ALU_DATA_FORWARDING_CYCLES"/>
++ <value value="118" name="A7XX_PERF_SP_LM_FULL_CYCLES"/>
++ <value value="119" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_CYCLES"/>
++ <value value="120" name="A7XX_PERF_SP_TEXTURE_FETCH_LATENCY_SAMPLES"/>
++ <value value="121" name="A7XX_PERF_SP_FS_STAGE_PI_TEX_INSTRUCTION"/>
++ <value value="122" name="A7XX_PERF_SP_RAY_QUERY_INSTRUCTIONS"/>
++ <value value="123" name="A7XX_PERF_SP_RBRT_KICKOFF_FIBERS"/>
++ <value value="124" name="A7XX_PERF_SP_RBRT_KICKOFF_DQUADS"/>
++ <value value="125" name="A7XX_PERF_SP_RTU_BUSY_CYCLES"/>
++ <value value="126" name="A7XX_PERF_SP_RTU_L0_HITS"/>
++ <value value="127" name="A7XX_PERF_SP_RTU_L0_MISSES"/>
++ <value value="128" name="A7XX_PERF_SP_RTU_L0_HIT_ON_MISS"/>
++ <value value="129" name="A7XX_PERF_SP_RTU_STALL_CYCLES_WAVE_QUEUE"/>
++ <value value="130" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_HIT_QUEUE"/>
++ <value value="131" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0_MISS_QUEUE"/>
++ <value value="132" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0D_IDX_QUEUE"/>
++ <value value="133" name="A7XX_PERF_SP_RTU_STALL_CYCLES_L0DATA"/>
++ <value value="134" name="A7XX_PERF_SP_RTU_STALL_CYCLES_REPLACE_CNT"/>
++ <value value="135" name="A7XX_PERF_SP_RTU_STALL_CYCLES_MRG_CNT"/>
++ <value value="136" name="A7XX_PERF_SP_RTU_STALL_CYCLES_UCHE"/>
++ <value value="137" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_L0"/>
++ <value value="138" name="A7XX_PERF_SP_RTU_OPERAND_FETCH_STALL_CYCLES_INS_FIFO"/>
++ <value value="139" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_CYCLES"/>
++ <value value="140" name="A7XX_PERF_SP_RTU_BVH_FETCH_LATENCY_SAMPLES"/>
++ <value value="141" name="A7XX_PERF_SP_STCHE_MISS_INC_VS"/>
++ <value value="142" name="A7XX_PERF_SP_STCHE_MISS_INC_FS"/>
++ <value value="143" name="A7XX_PERF_SP_STCHE_MISS_INC_BV"/>
++ <value value="144" name="A7XX_PERF_SP_STCHE_MISS_INC_LPAC"/>
++ <value value="145" name="A7XX_PERF_SP_VGPR_ACTIVE_CONTEXTS"/>
++ <value value="146" name="A7XX_PERF_SP_PGPR_ALLOC_CONTEXTS"/>
++ <value value="147" name="A7XX_PERF_SP_VGPR_ALLOC_CONTEXTS"/>
++ <value value="148" name="A7XX_PERF_SP_RTU_RAY_BOX_INTERSECTIONS"/>
++ <value value="149" name="A7XX_PERF_SP_RTU_RAY_TRIANGLE_INTERSECTIONS"/>
++ <value value="150" name="A7XX_PERF_SP_SCH_STALL_CYCLES_RTU"/>
++</enum>
++
++<enum name="a7xx_rb_perfcounter_select">
++ <value value="0" name="A7XX_PERF_RB_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_RB_STALL_CYCLES_HLSQ"/>
++ <value value="2" name="A7XX_PERF_RB_STALL_CYCLES_FIFO0_FULL"/>
++ <value value="3" name="A7XX_PERF_RB_STALL_CYCLES_FIFO1_FULL"/>
++ <value value="4" name="A7XX_PERF_RB_STALL_CYCLES_FIFO2_FULL"/>
++ <value value="5" name="A7XX_PERF_RB_STARVE_CYCLES_SP"/>
++ <value value="6" name="A7XX_PERF_RB_STARVE_CYCLES_LRZ_TILE"/>
++ <value value="7" name="A7XX_PERF_RB_STARVE_CYCLES_CCU"/>
++ <value value="8" name="A7XX_PERF_RB_STARVE_CYCLES_Z_PLANE"/>
++ <value value="9" name="A7XX_PERF_RB_STARVE_CYCLES_BARY_PLANE"/>
++ <value value="10" name="A7XX_PERF_RB_Z_WORKLOAD"/>
++ <value value="11" name="A7XX_PERF_RB_HLSQ_ACTIVE"/>
++ <value value="12" name="A7XX_PERF_RB_Z_READ"/>
++ <value value="13" name="A7XX_PERF_RB_Z_WRITE"/>
++ <value value="14" name="A7XX_PERF_RB_C_READ"/>
++ <value value="15" name="A7XX_PERF_RB_C_WRITE"/>
++ <value value="16" name="A7XX_PERF_RB_TOTAL_PASS"/>
++ <value value="17" name="A7XX_PERF_RB_Z_PASS"/>
++ <value value="18" name="A7XX_PERF_RB_Z_FAIL"/>
++ <value value="19" name="A7XX_PERF_RB_S_FAIL"/>
++ <value value="20" name="A7XX_PERF_RB_BLENDED_FXP_COMPONENTS"/>
++ <value value="21" name="A7XX_PERF_RB_BLENDED_FP16_COMPONENTS"/>
++ <value value="22" name="A7XX_PERF_RB_PS_INVOCATIONS"/>
++ <value value="23" name="A7XX_PERF_RB_2D_ALIVE_CYCLES"/>
++ <value value="24" name="A7XX_PERF_RB_2D_STALL_CYCLES_A2D"/>
++ <value value="25" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SRC"/>
++ <value value="26" name="A7XX_PERF_RB_2D_STARVE_CYCLES_SP"/>
++ <value value="27" name="A7XX_PERF_RB_2D_STARVE_CYCLES_DST"/>
++ <value value="28" name="A7XX_PERF_RB_2D_VALID_PIXELS"/>
++ <value value="29" name="A7XX_PERF_RB_3D_PIXELS"/>
++ <value value="30" name="A7XX_PERF_RB_BLENDER_WORKING_CYCLES"/>
++ <value value="31" name="A7XX_PERF_RB_ZPROC_WORKING_CYCLES"/>
++ <value value="32" name="A7XX_PERF_RB_CPROC_WORKING_CYCLES"/>
++ <value value="33" name="A7XX_PERF_RB_SAMPLER_WORKING_CYCLES"/>
++ <value value="34" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_READ"/>
++ <value value="35" name="A7XX_PERF_RB_STALL_CYCLES_CCU_COLOR_WRITE"/>
++ <value value="36" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_READ"/>
++ <value value="37" name="A7XX_PERF_RB_STALL_CYCLES_CCU_DEPTH_WRITE"/>
++ <value value="38" name="A7XX_PERF_RB_STALL_CYCLES_VPC"/>
++ <value value="39" name="A7XX_PERF_RB_2D_INPUT_TRANS"/>
++ <value value="40" name="A7XX_PERF_RB_2D_OUTPUT_RB_DST_TRANS"/>
++ <value value="41" name="A7XX_PERF_RB_2D_OUTPUT_RB_SRC_TRANS"/>
++ <value value="42" name="A7XX_PERF_RB_BLENDED_FP32_COMPONENTS"/>
++ <value value="43" name="A7XX_PERF_RB_COLOR_PIX_TILES"/>
++ <value value="44" name="A7XX_PERF_RB_STALL_CYCLES_CCU"/>
++ <value value="45" name="A7XX_PERF_RB_EARLY_Z_ARB3_GRANT"/>
++ <value value="46" name="A7XX_PERF_RB_LATE_Z_ARB3_GRANT"/>
++ <value value="47" name="A7XX_PERF_RB_EARLY_Z_SKIP_GRANT"/>
++ <value value="48" name="A7XX_PERF_RB_VRS_1x1_QUADS"/>
++ <value value="49" name="A7XX_PERF_RB_VRS_2x1_QUADS"/>
++ <value value="50" name="A7XX_PERF_RB_VRS_1x2_QUADS"/>
++ <value value="51" name="A7XX_PERF_RB_VRS_2x2_QUADS"/>
++ <value value="52" name="A7XX_PERF_RB_VRS_4x2_QUADS"/>
++ <value value="53" name="A7XX_PERF_RB_VRS_4x4_QUADS"/>
++</enum>
++
++<enum name="a7xx_vsc_perfcounter_select">
++ <value value="0" name="A7XX_PERF_VSC_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_VSC_WORKING_CYCLES"/>
++ <value value="2" name="A7XX_PERF_VSC_STALL_CYCLES_UCHE"/>
++ <value value="3" name="A7XX_PERF_VSC_EOT_NUM"/>
++ <value value="4" name="A7XX_PERF_VSC_INPUT_TILES"/>
++</enum>
++
++<enum name="a7xx_ccu_perfcounter_select">
++ <value value="0" name="A7XX_PERF_CCU_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_CCU_STALL_CYCLES_RB_DEPTH_RETURN"/>
++ <value value="2" name="A7XX_PERF_CCU_STALL_CYCLES_RB_COLOR_RETURN"/>
++ <value value="3" name="A7XX_PERF_CCU_DEPTH_BLOCKS"/>
++ <value value="4" name="A7XX_PERF_CCU_COLOR_BLOCKS"/>
++ <value value="5" name="A7XX_PERF_CCU_DEPTH_BLOCK_HIT"/>
++ <value value="6" name="A7XX_PERF_CCU_COLOR_BLOCK_HIT"/>
++ <value value="7" name="A7XX_PERF_CCU_PARTIAL_BLOCK_READ"/>
++ <value value="8" name="A7XX_PERF_CCU_GMEM_READ"/>
++ <value value="9" name="A7XX_PERF_CCU_GMEM_WRITE"/>
++ <value value="10" name="A7XX_PERF_CCU_2D_RD_REQ"/>
++ <value value="11" name="A7XX_PERF_CCU_2D_WR_REQ"/>
++ <value value="12" name="A7XX_PERF_CCU_UBWC_COLOR_BLOCKS_CONCURRENT"/>
++ <value value="13" name="A7XX_PERF_CCU_UBWC_DEPTH_BLOCKS_CONCURRENT"/>
++ <value value="14" name="A7XX_PERF_CCU_COLOR_RESOLVE_DROPPED"/>
++ <value value="15" name="A7XX_PERF_CCU_DEPTH_RESOLVE_DROPPED"/>
++ <value value="16" name="A7XX_PERF_CCU_COLOR_RENDER_CONCURRENT"/>
++ <value value="17" name="A7XX_PERF_CCU_DEPTH_RENDER_CONCURRENT"/>
++ <value value="18" name="A7XX_PERF_CCU_COLOR_RESOLVE_AFTER_RENDER"/>
++ <value value="19" name="A7XX_PERF_CCU_DEPTH_RESOLVE_AFTER_RENDER"/>
++ <value value="20" name="A7XX_PERF_CCU_GMEM_EXTRA_DEPTH_READ"/>
++ <value value="21" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA"/>
++ <value value="22" name="A7XX_PERF_CCU_GMEM_COLOR_READ_4AA_FULL"/>
++</enum>
++
++<enum name="a7xx_lrz_perfcounter_select">
++ <value value="0" name="A7XX_PERF_LRZ_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_LRZ_STARVE_CYCLES_RAS"/>
++ <value value="2" name="A7XX_PERF_LRZ_STALL_CYCLES_RB"/>
++ <value value="3" name="A7XX_PERF_LRZ_STALL_CYCLES_VSC"/>
++ <value value="4" name="A7XX_PERF_LRZ_STALL_CYCLES_VPC"/>
++ <value value="5" name="A7XX_PERF_LRZ_STALL_CYCLES_FLAG_PREFETCH"/>
++ <value value="6" name="A7XX_PERF_LRZ_STALL_CYCLES_UCHE"/>
++ <value value="7" name="A7XX_PERF_LRZ_LRZ_READ"/>
++ <value value="8" name="A7XX_PERF_LRZ_LRZ_WRITE"/>
++ <value value="9" name="A7XX_PERF_LRZ_READ_LATENCY"/>
++ <value value="10" name="A7XX_PERF_LRZ_MERGE_CACHE_UPDATING"/>
++ <value value="11" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_MASKGEN"/>
++ <value value="12" name="A7XX_PERF_LRZ_PRIM_KILLED_BY_LRZ"/>
++ <value value="13" name="A7XX_PERF_LRZ_VISIBLE_PRIM_AFTER_LRZ"/>
++ <value value="14" name="A7XX_PERF_LRZ_FULL_8X8_TILES"/>
++ <value value="15" name="A7XX_PERF_LRZ_PARTIAL_8X8_TILES"/>
++ <value value="16" name="A7XX_PERF_LRZ_TILE_KILLED"/>
++ <value value="17" name="A7XX_PERF_LRZ_TOTAL_PIXEL"/>
++ <value value="18" name="A7XX_PERF_LRZ_VISIBLE_PIXEL_AFTER_LRZ"/>
++ <value value="19" name="A7XX_PERF_LRZ_FEEDBACK_ACCEPT"/>
++ <value value="20" name="A7XX_PERF_LRZ_FEEDBACK_DISCARD"/>
++ <value value="21" name="A7XX_PERF_LRZ_FEEDBACK_STALL"/>
++ <value value="22" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_ZPLANE"/>
++ <value value="23" name="A7XX_PERF_LRZ_STALL_CYCLES_RB_BPLANE"/>
++ <value value="24" name="A7XX_PERF_LRZ_RAS_MASK_TRANS"/>
++ <value value="25" name="A7XX_PERF_LRZ_STALL_CYCLES_MVC"/>
++ <value value="26" name="A7XX_PERF_LRZ_TILE_KILLED_BY_IMAGE_VRS"/>
++ <value value="27" name="A7XX_PERF_LRZ_TILE_KILLED_BY_Z"/>
++</enum>
++
++<enum name="a7xx_cmp_perfcounter_select">
++ <value value="0" name="A7XX_PERF_CMPDECMP_STALL_CYCLES_ARB"/>
++ <value value="1" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_CYCLES"/>
++ <value value="2" name="A7XX_PERF_CMPDECMP_VBIF_LATENCY_SAMPLES"/>
++ <value value="3" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_CCU"/>
++ <value value="4" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_CCU"/>
++ <value value="5" name="A7XX_PERF_CMPDECMP_VBIF_READ_REQUEST"/>
++ <value value="6" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_REQUEST"/>
++ <value value="7" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA"/>
++ <value value="8" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA"/>
++ <value value="9" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG1_COUNT"/>
++ <value value="10" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG2_COUNT"/>
++ <value value="11" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG3_COUNT"/>
++ <value value="12" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG4_COUNT"/>
++ <value value="13" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG5_COUNT"/>
++ <value value="14" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG6_COUNT"/>
++ <value value="15" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG8_COUNT"/>
++ <value value="16" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG1_COUNT"/>
++ <value value="17" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG2_COUNT"/>
++ <value value="18" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG3_COUNT"/>
++ <value value="19" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG4_COUNT"/>
++ <value value="20" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG5_COUNT"/>
++ <value value="21" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG6_COUNT"/>
++ <value value="22" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG8_COUNT"/>
++ <value value="23" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH0"/>
++ <value value="24" name="A7XX_PERF_CMPDECMP_VBIF_READ_DATA_UCHE_CH1"/>
++ <value value="25" name="A7XX_PERF_CMPDECMP_VBIF_WRITE_DATA_UCHE"/>
++ <value value="26" name="A7XX_PERF_CMPDECMP_DEPTH_WRITE_FLAG0_COUNT"/>
++ <value value="27" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAG0_COUNT"/>
++ <value value="28" name="A7XX_PERF_CMPDECMP_COLOR_WRITE_FLAGALPHA_COUNT"/>
++ <value value="29" name="A7XX_PERF_CMPDECMP_RESOLVE_EVENTS"/>
++ <value value="30" name="A7XX_PERF_CMPDECMP_CONCURRENT_RESOLVE_EVENTS"/>
++ <value value="31" name="A7XX_PERF_CMPDECMP_DROPPED_CLEAR_EVENTS"/>
++ <value value="32" name="A7XX_PERF_CMPDECMP_ST_BLOCKS_CONCURRENT"/>
++ <value value="33" name="A7XX_PERF_CMPDECMP_LRZ_ST_BLOCKS_CONCURRENT"/>
++ <value value="34" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG0_COUNT"/>
++ <value value="35" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG1_COUNT"/>
++ <value value="36" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG2_COUNT"/>
++ <value value="37" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG3_COUNT"/>
++ <value value="38" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG4_COUNT"/>
++ <value value="39" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG5_COUNT"/>
++ <value value="40" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG6_COUNT"/>
++ <value value="41" name="A7XX_PERF_CMPDECMP_DEPTH_READ_FLAG8_COUNT"/>
++ <value value="42" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG0_COUNT"/>
++ <value value="43" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG1_COUNT"/>
++ <value value="44" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG2_COUNT"/>
++ <value value="45" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG3_COUNT"/>
++ <value value="46" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG4_COUNT"/>
++ <value value="47" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG5_COUNT"/>
++ <value value="48" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG6_COUNT"/>
++ <value value="49" name="A7XX_PERF_CMPDECMP_COLOR_READ_FLAG8_COUNT"/>
++</enum>
++
++<enum name="a7xx_gbif_perfcounter_select">
++ <value value="0" name="A7XX_PERF_GBIF_RESERVED_0"/>
++ <value value="1" name="A7XX_PERF_GBIF_RESERVED_1"/>
++ <value value="2" name="A7XX_PERF_GBIF_RESERVED_2"/>
++ <value value="3" name="A7XX_PERF_GBIF_RESERVED_3"/>
++ <value value="4" name="A7XX_PERF_GBIF_RESERVED_4"/>
++ <value value="5" name="A7XX_PERF_GBIF_RESERVED_5"/>
++ <value value="6" name="A7XX_PERF_GBIF_RESERVED_6"/>
++ <value value="7" name="A7XX_PERF_GBIF_RESERVED_7"/>
++ <value value="8" name="A7XX_PERF_GBIF_RESERVED_8"/>
++ <value value="9" name="A7XX_PERF_GBIF_RESERVED_9"/>
++ <value value="10" name="A7XX_PERF_GBIF_AXI0_READ_REQUESTS_TOTAL"/>
++ <value value="11" name="A7XX_PERF_GBIF_AXI1_READ_REQUESTS_TOTAL"/>
++ <value value="12" name="A7XX_PERF_GBIF_RESERVED_12"/>
++ <value value="13" name="A7XX_PERF_GBIF_RESERVED_13"/>
++ <value value="14" name="A7XX_PERF_GBIF_RESERVED_14"/>
++ <value value="15" name="A7XX_PERF_GBIF_RESERVED_15"/>
++ <value value="16" name="A7XX_PERF_GBIF_RESERVED_16"/>
++ <value value="17" name="A7XX_PERF_GBIF_RESERVED_17"/>
++ <value value="18" name="A7XX_PERF_GBIF_RESERVED_18"/>
++ <value value="19" name="A7XX_PERF_GBIF_RESERVED_19"/>
++ <value value="20" name="A7XX_PERF_GBIF_RESERVED_20"/>
++ <value value="21" name="A7XX_PERF_GBIF_RESERVED_21"/>
++ <value value="22" name="A7XX_PERF_GBIF_AXI0_WRITE_REQUESTS_TOTAL"/>
++ <value value="23" name="A7XX_PERF_GBIF_AXI1_WRITE_REQUESTS_TOTAL"/>
++ <value value="24" name="A7XX_PERF_GBIF_RESERVED_24"/>
++ <value value="25" name="A7XX_PERF_GBIF_RESERVED_25"/>
++ <value value="26" name="A7XX_PERF_GBIF_RESERVED_26"/>
++ <value value="27" name="A7XX_PERF_GBIF_RESERVED_27"/>
++ <value value="28" name="A7XX_PERF_GBIF_RESERVED_28"/>
++ <value value="29" name="A7XX_PERF_GBIF_RESERVED_29"/>
++ <value value="30" name="A7XX_PERF_GBIF_RESERVED_30"/>
++ <value value="31" name="A7XX_PERF_GBIF_RESERVED_31"/>
++ <value value="32" name="A7XX_PERF_GBIF_RESERVED_32"/>
++ <value value="33" name="A7XX_PERF_GBIF_RESERVED_33"/>
++ <value value="34" name="A7XX_PERF_GBIF_AXI0_READ_DATA_BEATS_TOTAL"/>
++ <value value="35" name="A7XX_PERF_GBIF_AXI1_READ_DATA_BEATS_TOTAL"/>
++ <value value="36" name="A7XX_PERF_GBIF_RESERVED_36"/>
++ <value value="37" name="A7XX_PERF_GBIF_RESERVED_37"/>
++ <value value="38" name="A7XX_PERF_GBIF_RESERVED_38"/>
++ <value value="39" name="A7XX_PERF_GBIF_RESERVED_39"/>
++ <value value="40" name="A7XX_PERF_GBIF_RESERVED_40"/>
++ <value value="41" name="A7XX_PERF_GBIF_RESERVED_41"/>
++ <value value="42" name="A7XX_PERF_GBIF_RESERVED_42"/>
++ <value value="43" name="A7XX_PERF_GBIF_RESERVED_43"/>
++ <value value="44" name="A7XX_PERF_GBIF_RESERVED_44"/>
++ <value value="45" name="A7XX_PERF_GBIF_RESERVED_45"/>
++ <value value="46" name="A7XX_PERF_GBIF_AXI0_WRITE_DATA_BEATS_TOTAL"/>
++ <value value="47" name="A7XX_PERF_GBIF_AXI1_WRITE_DATA_BEATS_TOTAL"/>
++ <value value="48" name="A7XX_PERF_GBIF_RESERVED_48"/>
++ <value value="49" name="A7XX_PERF_GBIF_RESERVED_49"/>
++ <value value="50" name="A7XX_PERF_GBIF_RESERVED_50"/>
++ <value value="51" name="A7XX_PERF_GBIF_RESERVED_51"/>
++ <value value="52" name="A7XX_PERF_GBIF_RESERVED_52"/>
++ <value value="53" name="A7XX_PERF_GBIF_RESERVED_53"/>
++ <value value="54" name="A7XX_PERF_GBIF_RESERVED_54"/>
++ <value value="55" name="A7XX_PERF_GBIF_RESERVED_55"/>
++ <value value="56" name="A7XX_PERF_GBIF_RESERVED_56"/>
++ <value value="57" name="A7XX_PERF_GBIF_RESERVED_57"/>
++ <value value="58" name="A7XX_PERF_GBIF_RESERVED_58"/>
++ <value value="59" name="A7XX_PERF_GBIF_RESERVED_59"/>
++ <value value="60" name="A7XX_PERF_GBIF_RESERVED_60"/>
++ <value value="61" name="A7XX_PERF_GBIF_RESERVED_61"/>
++ <value value="62" name="A7XX_PERF_GBIF_RESERVED_62"/>
++ <value value="63" name="A7XX_PERF_GBIF_RESERVED_63"/>
++ <value value="64" name="A7XX_PERF_GBIF_RESERVED_64"/>
++ <value value="65" name="A7XX_PERF_GBIF_RESERVED_65"/>
++ <value value="66" name="A7XX_PERF_GBIF_RESERVED_66"/>
++ <value value="67" name="A7XX_PERF_GBIF_RESERVED_67"/>
++ <value value="68" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_RD_ALL"/>
++ <value value="69" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_RD_ALL"/>
++ <value value="70" name="A7XX_PERF_GBIF_CYCLES_CH0_HELD_OFF_WR_ALL"/>
++ <value value="71" name="A7XX_PERF_GBIF_CYCLES_CH1_HELD_OFF_WR_ALL"/>
++ <value value="72" name="A7XX_PERF_GBIF_AXI_CH0_REQUEST_HELD_OFF"/>
++ <value value="73" name="A7XX_PERF_GBIF_AXI_CH1_REQUEST_HELD_OFF"/>
++ <value value="74" name="A7XX_PERF_GBIF_AXI_REQUEST_HELD_OFF"/>
++ <value value="75" name="A7XX_PERF_GBIF_AXI_CH0_WRITE_DATA_HELD_OFF"/>
++ <value value="76" name="A7XX_PERF_GBIF_AXI_CH1_WRITE_DATA_HELD_OFF"/>
++ <value value="77" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_DATA_HELD_OFF"/>
++ <value value="78" name="A7XX_PERF_GBIF_AXI_ALL_READ_BEATS"/>
++ <value value="79" name="A7XX_PERF_GBIF_AXI_ALL_WRITE_BEATS"/>
++ <value value="80" name="A7XX_PERF_GBIF_AXI_ALL_BEATS"/>
++</enum>
++
++<enum name="a7xx_ufc_perfcounter_select">
++ <value value="0" name="A7XX_PERF_UFC_BUSY_CYCLES"/>
++ <value value="1" name="A7XX_PERF_UFC_READ_DATA_VBIF"/>
++ <value value="2" name="A7XX_PERF_UFC_WRITE_DATA_VBIF"/>
++ <value value="3" name="A7XX_PERF_UFC_READ_REQUEST_VBIF"/>
++ <value value="4" name="A7XX_PERF_UFC_WRITE_REQUEST_VBIF"/>
++ <value value="5" name="A7XX_PERF_UFC_LRZ_FILTER_HIT"/>
++ <value value="6" name="A7XX_PERF_UFC_LRZ_FILTER_MISS"/>
++ <value value="7" name="A7XX_PERF_UFC_CRE_FILTER_HIT"/>
++ <value value="8" name="A7XX_PERF_UFC_CRE_FILTER_MISS"/>
++ <value value="9" name="A7XX_PERF_UFC_SP_FILTER_HIT"/>
++ <value value="10" name="A7XX_PERF_UFC_SP_FILTER_MISS"/>
++ <value value="11" name="A7XX_PERF_UFC_SP_REQUESTS"/>
++ <value value="12" name="A7XX_PERF_UFC_TP_FILTER_HIT"/>
++ <value value="13" name="A7XX_PERF_UFC_TP_FILTER_MISS"/>
++ <value value="14" name="A7XX_PERF_UFC_TP_REQUESTS"/>
++ <value value="15" name="A7XX_PERF_UFC_MAIN_HIT_LRZ_PREFETCH"/>
++ <value value="16" name="A7XX_PERF_UFC_MAIN_HIT_CRE_PREFETCH"/>
++ <value value="17" name="A7XX_PERF_UFC_MAIN_HIT_SP_PREFETCH"/>
++ <value value="18" name="A7XX_PERF_UFC_MAIN_HIT_TP_PREFETCH"/>
++ <value value="19" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_READ"/>
++ <value value="20" name="A7XX_PERF_UFC_MAIN_HIT_UBWC_WRITE"/>
++ <value value="21" name="A7XX_PERF_UFC_MAIN_MISS_LRZ_PREFETCH"/>
++ <value value="22" name="A7XX_PERF_UFC_MAIN_MISS_CRE_PREFETCH"/>
++ <value value="23" name="A7XX_PERF_UFC_MAIN_MISS_SP_PREFETCH"/>
++ <value value="24" name="A7XX_PERF_UFC_MAIN_MISS_TP_PREFETCH"/>
++ <value value="25" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_READ"/>
++ <value value="26" name="A7XX_PERF_UFC_MAIN_MISS_UBWC_WRITE"/>
++ <value value="27" name="A7XX_PERF_UFC_UBWC_READ_UFC_TRANS"/>
++ <value value="28" name="A7XX_PERF_UFC_UBWC_WRITE_UFC_TRANS"/>
++ <value value="29" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_CMD"/>
++ <value value="30" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_RDATA"/>
++ <value value="31" name="A7XX_PERF_UFC_STALL_CYCLES_GBIF_WDATA"/>
++ <value value="32" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_WR_FLAG"/>
++ <value value="33" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_FLAG_RTN"/>
++ <value value="34" name="A7XX_PERF_UFC_STALL_CYCLES_UBWC_EVENT"/>
++ <value value="35" name="A7XX_PERF_UFC_LRZ_PREFETCH_STALLED_CYCLES"/>
++ <value value="36" name="A7XX_PERF_UFC_CRE_PREFETCH_STALLED_CYCLES"/>
++ <value value="37" name="A7XX_PERF_UFC_SPTP_PREFETCH_STALLED_CYCLES"/>
++ <value value="38" name="A7XX_PERF_UFC_UBWC_RD_STALLED_CYCLES"/>
++ <value value="39" name="A7XX_PERF_UFC_UBWC_WR_STALLED_CYCLES"/>
++ <value value="40" name="A7XX_PERF_UFC_PREFETCH_STALLED_CYCLES"/>
++ <value value="41" name="A7XX_PERF_UFC_EVICTION_STALLED_CYCLES"/>
++ <value value="42" name="A7XX_PERF_UFC_LOCK_STALLED_CYCLES"/>
++ <value value="43" name="A7XX_PERF_UFC_MISS_LATENCY_CYCLES"/>
++ <value value="44" name="A7XX_PERF_UFC_MISS_LATENCY_SAMPLES"/>
++ <value value="45" name="A7XX_PERF_UFC_UBWC_REQ_STALLED_CYCLES"/>
++ <value value="46" name="A7XX_PERF_UFC_TP_HINT_TAG_MISS"/>
++ <value value="47" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_RDY"/>
++ <value value="48" name="A7XX_PERF_UFC_TP_HINT_TAG_HIT_NRDY"/>
++ <value value="49" name="A7XX_PERF_UFC_TP_HINT_IS_FCLEAR"/>
++ <value value="50" name="A7XX_PERF_UFC_TP_HINT_IS_ALPHA0"/>
++ <value value="51" name="A7XX_PERF_UFC_SP_L1_FILTER_HIT"/>
++ <value value="52" name="A7XX_PERF_UFC_SP_L1_FILTER_MISS"/>
++ <value value="53" name="A7XX_PERF_UFC_SP_L1_FILTER_REQUESTS"/>
++ <value value="54" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_RDY"/>
++ <value value="55" name="A7XX_PERF_UFC_TP_L1_TAG_HIT_NRDY"/>
++ <value value="56" name="A7XX_PERF_UFC_TP_L1_TAG_MISS"/>
++ <value value="57" name="A7XX_PERF_UFC_TP_L1_FILTER_REQUESTS"/>
++</enum>
++
++</database>
+diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+index 462713401622..7abc08635495 100644
+--- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
++++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+@@ -21,9 +21,9 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="HLSQ_FLUSH" value="7" variants="A3XX-A4XX"/>
+ <value name="VIZQUERY_END" value="8" variants="A2XX"/>
+ <value name="SC_WAIT_WC" value="9" variants="A2XX"/>
+- <value name="WRITE_PRIMITIVE_COUNTS" value="9" variants="A6XX"/>
+- <value name="START_PRIMITIVE_CTRS" value="11" variants="A6XX"/>
+- <value name="STOP_PRIMITIVE_CTRS" value="12" variants="A6XX"/>
++ <value name="WRITE_PRIMITIVE_COUNTS" value="9" variants="A6XX-"/>
++ <value name="START_PRIMITIVE_CTRS" value="11" variants="A6XX-"/>
++ <value name="STOP_PRIMITIVE_CTRS" value="12" variants="A6XX-"/>
+ <!-- Not sure that these 4 events don't have the same meaning as on A5XX+ -->
+ <value name="RST_PIX_CNT" value="13" variants="A2XX-A4XX"/>
+ <value name="RST_VTX_CNT" value="14" variants="A2XX-A4XX"/>
+@@ -31,8 +31,8 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="STAT_EVENT" value="16" variants="A2XX-A4XX"/>
+ <value name="CACHE_FLUSH_AND_INV_TS_EVENT" value="20" variants="A2XX-A4XX"/>
+ <doc>
+- If A6XX_RB_SAMPLE_COUNT_CONTROL.copy is true, writes OQ Z passed
+- sample counts to RB_SAMPLE_COUNT_ADDR. This writes to main
++ If A6XX_RB_SAMPLE_COUNTER_CNTL.copy is true, writes OQ Z passed
++ sample counts to RB_SAMPLE_COUNTER_BASE. This writes to main
+ memory, skipping UCHE.
+ </doc>
+ <value name="ZPASS_DONE" value="21"/>
+@@ -97,6 +97,13 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ </doc>
+ <value name="BLIT" value="30" variants="A5XX-"/>
+
++ <doc>
++ Flip between the primary and secondary LRZ buffers. This is used
++ for concurrent binning, so that BV can write to one buffer while
++ BR reads from the other.
++ </doc>
++ <value name="LRZ_FLIP_BUFFER" value="36" variants="A7XX"/>
++
+ <doc>
+ Clears based on GRAS_LRZ_CNTL configuration, could clear
+ fast-clear buffer or LRZ direction.
+@@ -114,6 +121,7 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="BLIT_OP_FILL_2D" value="39" variants="A5XX-"/>
+ <value name="BLIT_OP_COPY_2D" value="40" variants="A5XX-A6XX"/>
+ <value name="UNK_40" value="40" variants="A7XX"/>
++ <value name="LRZ_Q_CACHE_INVALIDATE" value="41" variants="A7XX"/>
+ <value name="BLIT_OP_SCALE_2D" value="42" variants="A5XX-"/>
+ <value name="CONTEXT_DONE_2D" value="43" variants="A5XX-"/>
+ <value name="UNK_2C" value="44" variants="A5XX-"/>
+@@ -372,7 +380,7 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="CP_LOAD_STATE" value="0x30" variants="A3XX"/>
+ <value name="CP_LOAD_STATE4" value="0x30" variants="A4XX-A5XX"/>
+ <doc>Conditionally load a IB based on a flag, prefetch enabled</doc>
+- <value name="CP_COND_INDIRECT_BUFFER_PFE" value="0x3a"/>
++ <value name="CP_COND_INDIRECT_BUFFER_PFE" value="0x3a" variants="A3XX-A5XX"/>
+ <doc>Conditionally load a IB based on a flag, prefetch disabled</doc>
+ <value name="CP_COND_INDIRECT_BUFFER_PFD" value="0x32" variants="A3XX"/>
+ <doc>Load a buffer with pre-fetch enabled</doc>
+@@ -538,7 +546,7 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="CP_LOAD_STATE6_GEOM" value="0x32" variants="A6XX-"/>
+ <value name="CP_LOAD_STATE6_FRAG" value="0x34" variants="A6XX-"/>
+ <!--
+- Note: For IBO state (Image/SSBOs) which have shared state across
++ Note: For UAV state (Image/SSBOs) which have shared state across
+ shader stages, for 3d pipeline CP_LOAD_STATE6 is used. But for
+ compute shaders, CP_LOAD_STATE6_FRAG is used. Possibly they are
+ interchangable.
+@@ -567,7 +575,7 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+ <value name="IN_PREEMPT" value="0x0f" variants="A6XX-"/>
+
+ <!-- TODO do these exist on A5xx? -->
+- <value name="CP_SCRATCH_WRITE" value="0x4c" variants="A6XX"/>
++ <value name="CP_SCRATCH_WRITE" value="0x4c" variants="A6XX-"/>
+ <value name="CP_REG_TO_MEM_OFFSET_MEM" value="0x74" variants="A6XX-"/>
+ <value name="CP_REG_TO_MEM_OFFSET_REG" value="0x72" variants="A6XX-"/>
+ <value name="CP_WAIT_MEM_GTE" value="0x14" variants="A6XX"/>
+@@ -650,6 +658,11 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd">
+
+ <doc>Reset various on-chip state used for synchronization</doc>
+ <value name="CP_RESET_CONTEXT_STATE" value="0x1f" variants="A7XX-"/>
++
++ <doc>Invalidates the "CCHE" introduced on a740</doc>
++ <value name="CP_CCHE_INVALIDATE" value="0x3a" variants="A7XX-"/>
++
++ <value name="CP_SCOPE_CNTL" value="0x6c" variants="A7XX-"/>
+ </enum>
+
+
+@@ -792,14 +805,14 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ <value name="SB6_GS_SHADER" value="0xb"/>
+ <value name="SB6_FS_SHADER" value="0xc"/>
+ <value name="SB6_CS_SHADER" value="0xd"/>
+- <value name="SB6_IBO" value="0xe"/>
+- <value name="SB6_CS_IBO" value="0xf"/>
++ <value name="SB6_UAV" value="0xe"/>
++ <value name="SB6_CS_UAV" value="0xf"/>
+ </enum>
+ <enum name="a6xx_state_type">
+ <value name="ST6_SHADER" value="0"/>
+ <value name="ST6_CONSTANTS" value="1"/>
+ <value name="ST6_UBO" value="2"/>
+- <value name="ST6_IBO" value="3"/>
++ <value name="ST6_UAV" value="3"/>
+ </enum>
+ <enum name="a6xx_state_src">
+ <value name="SS6_DIRECT" value="0"/>
+@@ -1121,39 +1134,93 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ </reg32>
+ </domain>
+
++<enum name="a7xx_abs_mask_mode">
++ <value name="ABS_MASK" value="0x1"/>
++ <value name="NO_ABS_MASK" value="0x0"/>
++</enum>
++
+ <domain name="CP_SET_BIN_DATA5" width="32">
+ <reg32 offset="0" name="0">
++ <bitfield name="VSC_MASK" low="0" high="15" type="hex">
++ <doc>
++ A mask of bins, starting at VSC_N, whose
++ visibility is OR'd together. A value of 0 is
++ interpreted as 1 (i.e. just use VSC_N for
++ visbility) for backwards compatibility. Only
++ exists on a7xx.
++ </doc>
++ </bitfield>
+ <!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+ <bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+ <!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+ <bitfield name="VSC_N" low="22" high="26" type="uint"/>
++ <bitfield name="ABS_MASK" pos="28" type="a7xx_abs_mask_mode" addvariant="yes">
++ <doc>
++ If this field is 1, VSC_MASK and VSC_N are
++ ignored and instead a new ordinal immediately
++ after specifies the full 32-bit mask of bins
++ to use. The mask is "absolute" instead of
++ relative to VSC_N.
++ </doc>
++ </bitfield>
+ </reg32>
+- <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+- <reg32 offset="1" name="1">
+- <bitfield name="BIN_DATA_ADDR_LO" low="0" high="31" type="hex"/>
+- </reg32>
+- <reg32 offset="2" name="2">
+- <bitfield name="BIN_DATA_ADDR_HI" low="0" high="31" type="hex"/>
+- </reg32>
+- <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+- <reg32 offset="3" name="3">
+- <bitfield name="BIN_SIZE_ADDRESS_LO" low="0" high="31"/>
+- </reg32>
+- <reg32 offset="4" name="4">
+- <bitfield name="BIN_SIZE_ADDRESS_HI" low="0" high="31"/>
+- </reg32>
+- <!-- new on a6xx, where BIN_DATA_ADDR is the DRAW_STRM: -->
+- <reg32 offset="5" name="5">
+- <bitfield name="BIN_PRIM_STRM_LO" low="0" high="31"/>
+- </reg32>
+- <reg32 offset="6" name="6">
+- <bitfield name="BIN_PRIM_STRM_HI" low="0" high="31"/>
+- </reg32>
+- <!--
+- a7xx adds a few more addresses to the end of the pkt
+- -->
+- <reg64 offset="7" name="7"/>
+- <reg64 offset="9" name="9"/>
++ <stripe varset="a7xx_abs_mask_mode" variants="NO_ABS_MASK">
++ <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
++ <reg32 offset="1" name="1">
++ <bitfield name="BIN_DATA_ADDR_LO" low="0" high="31" type="hex"/>
++ </reg32>
++ <reg32 offset="2" name="2">
++ <bitfield name="BIN_DATA_ADDR_HI" low="0" high="31" type="hex"/>
++ </reg32>
++ <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
++ <reg32 offset="3" name="3">
++ <bitfield name="BIN_SIZE_ADDRESS_LO" low="0" high="31"/>
++ </reg32>
++ <reg32 offset="4" name="4">
++ <bitfield name="BIN_SIZE_ADDRESS_HI" low="0" high="31"/>
++ </reg32>
++ <!-- new on a6xx, where BIN_DATA_ADDR is the DRAW_STRM: -->
++ <reg32 offset="5" name="5">
++ <bitfield name="BIN_PRIM_STRM_LO" low="0" high="31"/>
++ </reg32>
++ <reg32 offset="6" name="6">
++ <bitfield name="BIN_PRIM_STRM_HI" low="0" high="31"/>
++ </reg32>
++ <!--
++ a7xx adds a few more addresses to the end of the pkt
++ -->
++ <reg64 offset="7" name="7"/>
++ <reg64 offset="9" name="9"/>
++ </stripe>
++ <stripe varset="a7xx_abs_mask_mode" variants="ABS_MASK">
++ <reg32 offset="1" name="ABS_MASK"/>
++ <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
++ <reg32 offset="2" name="2">
++ <bitfield name="BIN_DATA_ADDR_LO" low="0" high="31" type="hex"/>
++ </reg32>
++ <reg32 offset="3" name="3">
++ <bitfield name="BIN_DATA_ADDR_HI" low="0" high="31" type="hex"/>
++ </reg32>
++ <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
++ <reg32 offset="4" name="4">
++ <bitfield name="BIN_SIZE_ADDRESS_LO" low="0" high="31"/>
++ </reg32>
++ <reg32 offset="5" name="5">
++ <bitfield name="BIN_SIZE_ADDRESS_HI" low="0" high="31"/>
++ </reg32>
++ <!-- new on a6xx, where BIN_DATA_ADDR is the DRAW_STRM: -->
++ <reg32 offset="6" name="6">
++ <bitfield name="BIN_PRIM_STRM_LO" low="0" high="31"/>
++ </reg32>
++ <reg32 offset="7" name="7">
++ <bitfield name="BIN_PRIM_STRM_HI" low="0" high="31"/>
++ </reg32>
++ <!--
++ a7xx adds a few more addresses to the end of the pkt
++ -->
++ <reg64 offset="8" name="8"/>
++ <reg64 offset="10" name="10"/>
++ </stripe>
+ </domain>
+
+ <domain name="CP_SET_BIN_DATA5_OFFSET" width="32">
+@@ -1164,23 +1231,42 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ stream is recorded.
+ </doc>
+ <reg32 offset="0" name="0">
++ <bitfield name="VSC_MASK" low="0" high="15" type="hex"/>
+ <!-- equiv to PC_VSTREAM_CONTROL.SIZE on a3xx/a4xx: -->
+ <bitfield name="VSC_SIZE" low="16" high="21" type="uint"/>
+ <!-- equiv to PC_VSTREAM_CONTROL.N on a3xx/a4xx: -->
+ <bitfield name="VSC_N" low="22" high="26" type="uint"/>
++ <bitfield name="ABS_MASK" pos="28" type="a7xx_abs_mask_mode" addvariant="yes"/>
+ </reg32>
+- <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
+- <reg32 offset="1" name="1">
+- <bitfield name="BIN_DATA_OFFSET" low="0" high="31" type="uint"/>
+- </reg32>
+- <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
+- <reg32 offset="2" name="2">
+- <bitfield name="BIN_SIZE_OFFSET" low="0" high="31" type="uint"/>
+- </reg32>
+- <!-- BIN_DATA2_ADDR -> VSC_PIPE[p].DATA2_ADDRESS -->
+- <reg32 offset="3" name="3">
+- <bitfield name="BIN_DATA2_OFFSET" low="0" high="31" type="uint"/>
+- </reg32>
++ <stripe varset="a7xx_abs_mask_mode" variants="NO_ABS_MASK">
++ <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
++ <reg32 offset="1" name="1">
++ <bitfield name="BIN_DATA_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
++ <reg32 offset="2" name="2">
++ <bitfield name="BIN_SIZE_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ <!-- BIN_DATA2_ADDR -> VSC_PIPE[p].DATA2_ADDRESS -->
++ <reg32 offset="3" name="3">
++ <bitfield name="BIN_DATA2_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ </stripe>
++ <stripe varset="a7xx_abs_mask_mode" variants="ABS_MASK">
++ <reg32 offset="1" name="ABS_MASK"/>
++ <!-- BIN_DATA_ADDR -> VSC_PIPE[p].DATA_ADDRESS -->
++ <reg32 offset="2" name="2">
++ <bitfield name="BIN_DATA_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ <!-- BIN_SIZE_ADDRESS -> VSC_SIZE_ADDRESS + (p * 4)-->
++ <reg32 offset="3" name="3">
++ <bitfield name="BIN_SIZE_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ <!-- BIN_DATA2_ADDR -> VSC_PIPE[p].DATA2_ADDRESS -->
++ <reg32 offset="4" name="4">
++ <bitfield name="BIN_DATA2_OFFSET" low="0" high="31" type="uint"/>
++ </reg32>
++ </stripe>
+ </domain>
+
+ <domain name="CP_REG_RMW" width="32">
+@@ -1198,6 +1284,9 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ </doc>
+ <reg32 offset="0" name="0">
+ <bitfield name="DST_REG" low="0" high="17" type="hex"/>
++ <bitfield name="DST_SCRATCH" pos="19" type="boolean" varset="chip" variants="A7XX-"/>
++ <!-- skip implied CP_WAIT_FOR_IDLE + CP_WAIT_FOR_ME -->
++ <bitfield name="SKIP_WAIT_FOR_ME" pos="23" type="boolean" varset="chip" variants="A7XX-"/>
+ <bitfield name="ROTATE" low="24" high="28" type="uint"/>
+ <bitfield name="SRC1_ADD" pos="29" type="boolean"/>
+ <bitfield name="SRC1_IS_REG" pos="30" type="boolean"/>
+@@ -1348,6 +1437,8 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ <bitfield name="SCRATCH" low="20" high="22" type="uint"/>
+ <!-- number of registers/dwords copied is CNT + 1. -->
+ <bitfield name="CNT" low="24" high="26" type="uint"/>
++ <!-- skip implied CP_WAIT_FOR_IDLE + CP_WAIT_FOR_ME -->
++ <bitfield name="SKIP_WAIT_FOR_ME" pos="27" type="boolean" varset="chip" variants="A7XX-"/>
+ </reg32>
+ </domain>
+
+@@ -1655,8 +1746,8 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ <bitfield name="WRITE_SAMPLE_COUNT" pos="12" type="boolean"/>
+ <!-- Write sample count at (iova + 16) -->
+ <bitfield name="SAMPLE_COUNT_END_OFFSET" pos="13" type="boolean"/>
+- <!-- *(iova + 8) = *(iova + 16) - *iova -->
+- <bitfield name="WRITE_SAMPLE_COUNT_DIFF" pos="14" type="boolean"/>
++ <!-- *(iova + 8) += *(iova + 16) - *iova -->
++ <bitfield name="WRITE_ACCUM_SAMPLE_COUNT_DIFF" pos="14" type="boolean"/>
+
+ <!-- Next 4 flags are valid to set only when concurrent binning is enabled -->
+ <!-- Increment 16b BV counter. Valid only in BV pipe -->
+@@ -1670,15 +1761,11 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ <bitfield name="WRITE_DST" pos="24" type="event_write_dst" addvariant="yes"/>
+ <!-- Writes into WRITE_DST from WRITE_SRC. RB_DONE_TS requires WRITE_ENABLED. -->
+ <bitfield name="WRITE_ENABLED" pos="27" type="boolean"/>
++ <bitfield name="IRQ" pos="31" type="boolean"/>
+ </reg32>
+
+ <stripe varset="event_write_dst" variants="EV_DST_RAM">
+- <reg32 offset="1" name="1">
+- <bitfield name="ADDR_0_LO" low="0" high="31"/>
+- </reg32>
+- <reg32 offset="2" name="2">
+- <bitfield name="ADDR_0_HI" low="0" high="31"/>
+- </reg32>
++ <reg64 offset="1" name="1" type="waddress"/>
+ <reg32 offset="3" name="3">
+ <bitfield name="PAYLOAD_0" low="0" high="31"/>
+ </reg32>
+@@ -1773,13 +1860,23 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+
+ <domain name="CP_SET_MARKER" width="32" varset="chip" prefix="chip" variants="A6XX-">
+ <doc>Tell CP the current operation mode, indicates save and restore procedure</doc>
++ <enum name="set_marker_mode">
++ <value value="0" name="SET_RENDER_MODE"/>
++ <!-- IFPC - inter-frame power collapse -->
++ <value value="1" name="SET_IFPC_MODE"/>
++ </enum>
++ <enum name="a6xx_ifpc_mode">
++ <value value="0" name="IFPC_ENABLE"/>
++ <value value="1" name="IFPC_DISABLE"/>
++ </enum>
+ <enum name="a6xx_marker">
+- <value value="1" name="RM6_BYPASS"/>
+- <value value="2" name="RM6_BINNING"/>
+- <value value="4" name="RM6_GMEM"/>
+- <value value="5" name="RM6_ENDVIS"/>
+- <value value="6" name="RM6_RESOLVE"/>
+- <value value="7" name="RM6_YIELD"/>
++ <value value="1" name="RM6_DIRECT_RENDER"/>
++ <value value="2" name="RM6_BIN_VISIBILITY"/>
++ <value value="3" name="RM6_BIN_DIRECT"/>
++ <value value="4" name="RM6_BIN_RENDER_START"/>
++ <value value="5" name="RM6_BIN_END_OF_DRAWS"/>
++ <value value="6" name="RM6_BIN_RESOLVE"/>
++ <value value="7" name="RM6_BIN_RENDER_END"/>
+ <value value="8" name="RM6_COMPUTE"/>
+ <value value="0xc" name="RM6_BLIT2DSCALE"/> <!-- no-op (at least on current sqe fw) -->
+
+@@ -1789,23 +1886,40 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ -->
+ <value value="0xd" name="RM6_IB1LIST_START"/>
+ <value value="0xe" name="RM6_IB1LIST_END"/>
+- <!-- IFPC - inter-frame power collapse -->
+- <value value="0x100" name="RM6_IFPC_ENABLE"/>
+- <value value="0x101" name="RM6_IFPC_DISABLE"/>
+ </enum>
+ <reg32 offset="0" name="0">
++ <!-- if b8 is set, the low bits are interpreted differently (and b4 ignored) -->
++ <bitfield name="MARKER_MODE" pos="8" type="set_marker_mode" addvariant="yes"/>
++
++ <bitfield name="MODE" low="0" high="3" type="a6xx_marker" varset="set_marker_mode" variants="SET_RENDER_MODE"/>
++ <!-- used by preemption to determine if GMEM needs to be saved or not -->
++ <bitfield name="USES_GMEM" pos="4" type="boolean" varset="set_marker_mode" variants="SET_RENDER_MODE"/>
++
++ <bitfield name="IFPC_MODE" pos="0" type="a6xx_ifpc_mode" varset="set_marker_mode" variants="SET_IFPC_MODE"/>
++
+ <!--
+- NOTE: blob driver and some versions of freedreno/turnip set
+- b4, which is unused (at least by current sqe fw), but interferes
+- with parsing if we extend the size of the bitfield to include
+- b8 (only sent by kernel mode driver). Really, the way the
+- parsing works in the firmware, only b0-b3 are considered, but
+- if b8 is set, the low bits are interpreted differently. To
+- model this, without getting confused by spurious b4, this is
+- described as two overlapping bitfields:
+- -->
+- <bitfield name="MODE" low="0" high="8" type="a6xx_marker"/>
+- <bitfield name="MARKER" low="0" high="3" type="a6xx_marker"/>
++ CP_SET_MARKER is used with these bits to create a
++ critical section around a workaround for ray tracing.
++ The workaround happens after BVH building, and appears
++ to invalidate the RTU's BVH node cache. It makes sure
++ that only one of BR/BV/LPAC is executing the
++ workaround at a time, and no draws using RT on BV/LPAC
++ are executing while the workaround is executed on BR (or
++ vice versa, that no draws on BV/BR using RT are executed
++ while the workaround executes on LPAC), by
++ hooking subsequent CP_EVENT_WRITE/CP_DRAW_*/CP_EXEC_CS.
++ The blob usage is:
++
++ CP_SET_MARKER(RT_WA_START)
++ ... workaround here ...
++ CP_SET_MARKER(RT_WA_END)
++ ...
++ CP_SET_MARKER(SHADER_USES_RT)
++ CP_DRAW_INDX(...) or CP_EXEC_CS(...)
++ -->
++ <bitfield name="SHADER_USES_RT" pos="9" type="boolean" variants="A7XX-"/>
++ <bitfield name="RT_WA_START" pos="10" type="boolean" variants="A7XX-"/>
++ <bitfield name="RT_WA_END" pos="11" type="boolean" variants="A7XX-"/>
+ </reg32>
+ </domain>
+
+@@ -1832,9 +1946,9 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ If concurrent binning is disabled then BR also does binning so it will also
+ write the "real" registers in BR.
+ -->
+- <value value="8" name="DRAW_STRM_ADDRESS"/>
+- <value value="9" name="DRAW_STRM_SIZE_ADDRESS"/>
+- <value value="10" name="PRIM_STRM_ADDRESS"/>
++ <value value="8" name="VSC_PIPE_DATA_DRAW_BASE"/>
++ <value value="9" name="VSC_SIZE_BASE"/>
++ <value value="10" name="VSC_PIPE_DATA_PRIM_BASE"/>
+ <value value="11" name="UNK_STRM_ADDRESS"/>
+ <value value="12" name="UNK_STRM_SIZE_ADDRESS"/>
+
+@@ -1935,11 +2049,11 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ a bitmask of which modes pass the test.
+ -->
+
+- <!-- RM6_BINNING -->
++ <!-- RM6_BIN_VISIBILITY -->
+ <bitfield name="BINNING" pos="25" variants="RENDER_MODE" type="boolean"/>
+ <!-- all others -->
+ <bitfield name="GMEM" pos="26" variants="RENDER_MODE" type="boolean"/>
+- <!-- RM6_BYPASS -->
++ <!-- RM6_DIRECT_RENDER -->
+ <bitfield name="SYSMEM" pos="27" variants="RENDER_MODE" type="boolean"/>
+
+ <bitfield name="BV" pos="25" variants="THREAD_MODE" type="boolean"/>
+@@ -2014,10 +2128,10 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+
+ <domain name="CP_SET_AMBLE" width="32">
+ <doc>
+- Used by the userspace and kernel drivers to set various IB's
+- which are executed during context save/restore for handling
+- state that isn't restored by the context switch routine itself.
+- </doc>
++ Used by the userspace and kernel drivers to set various IB's
++ which are executed during context save/restore for handling
++ state that isn't restored by the context switch routine itself.
++ </doc>
+ <enum name="amble_type">
+ <value name="PREAMBLE_AMBLE_TYPE" value="0">
+ <doc>Executed unconditionally when switching back to the context.</doc>
+@@ -2087,12 +2201,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ <value name="UNK_EVENT_WRITE" value="0x4"/>
+ <doc>
+ Tracks GRAS_LRZ_CNTL::GREATER, GRAS_LRZ_CNTL::DIR, and
+- GRAS_LRZ_DEPTH_VIEW with previous values, and if one of
++ GRAS_LRZ_VIEW_INFO with previous values, and if one of
+ the following is true:
+ - GRAS_LRZ_CNTL::GREATER has changed
+ - GRAS_LRZ_CNTL::DIR has changed, the old value is not
+ CUR_DIR_GE, and the new value is not CUR_DIR_DISABLED
+- - GRAS_LRZ_DEPTH_VIEW has changed
++ - GRAS_LRZ_VIEW_INFO has changed
+ then it does a LRZ_FLUSH with GRAS_LRZ_CNTL::ENABLE
+ forced to 1.
+ Only exists in a650_sqe.fw.
+@@ -2207,7 +2321,7 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+
+ <domain name="CP_MEM_TO_SCRATCH_MEM" width="32">
+ <doc>
+- Best guess is that it is a faster way to fetch all the VSC_STATE registers
++ Best guess is that it is a faster way to fetch all the VSC_CHANNEL_VISIBILITY registers
+ and keep them in a local scratch memory instead of fetching every time
+ when skipping IBs.
+ </doc>
+@@ -2260,6 +2374,16 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ </reg32>
+ </domain>
+
++<domain name="CP_SCOPE_CNTL" width="32">
++ <enum name="cp_scope">
++ <value value="0" name="INTERRUPTS"/>
++ </enum>
++ <reg32 offset="0" name="0">
++ <bitfield name="DISABLE_PREEMPTION" pos="0" type="boolean"/>
++ <bitfield low="28" high="31" name="SCOPE" type="cp_scope"/>
++ </reg32>
++</domain>
++
+ <domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
+ <reg64 offset="0" name="IB_BASE" type="address"/>
+ <reg32 offset="2" name="2">
+--
+2.39.5
+
--- /dev/null
+From 3941da85f37cc55829f09eb94b30ed229241c310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 13:13:22 -0700
+Subject: drm/msm: use trylock for debugfs
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 0a1ff88ec5b60b41ba830c5bf08b6cd8f45ab411 ]
+
+This resolves a potential deadlock vs msm_gem_vm_close(). Otherwise for
+_NO_SHARE buffers msm_gem_describe() could be trying to acquire the
+shared vm resv, while already holding priv->obj_lock. But _vm_close()
+might drop the last reference to a GEM obj while already holding the vm
+resv, and msm_gem_free_object() needs to grab priv->obj_lock, a locking
+inversion.
+
+OTOH this is only for debugfs and it isn't critical if we undercount by
+skipping a locked obj. So just use trylock() and move along if we can't
+get the lock.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Tested-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Antonino Maniscalco <antomani103@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/661525/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem.c | 3 ++-
+ drivers/gpu/drm/msm/msm_gem.h | 6 ++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index ebc9ba66efb8..eeb3b65dd4d1 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -963,7 +963,8 @@ void msm_gem_describe(struct drm_gem_object *obj, struct seq_file *m,
+ uint64_t off = drm_vma_node_start(&obj->vma_node);
+ const char *madv;
+
+- msm_gem_lock(obj);
++ if (!msm_gem_trylock(obj))
++ return;
+
+ stats->all.count++;
+ stats->all.size += obj->size;
+diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
+index 85f0257e83da..748053f70ca7 100644
+--- a/drivers/gpu/drm/msm/msm_gem.h
++++ b/drivers/gpu/drm/msm/msm_gem.h
+@@ -188,6 +188,12 @@ msm_gem_lock(struct drm_gem_object *obj)
+ dma_resv_lock(obj->resv, NULL);
+ }
+
++static inline bool __must_check
++msm_gem_trylock(struct drm_gem_object *obj)
++{
++ return dma_resv_trylock(obj->resv);
++}
++
+ static inline int
+ msm_gem_lock_interruptible(struct drm_gem_object *obj)
+ {
+--
+2.39.5
+
--- /dev/null
+From f99cad5af8f2abe67bdd73081e36a0410c329d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 17:15:20 +0800
+Subject: drm/panel: raydium-rm67200: Move initialization from enable() to
+ prepare stage
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 691674a282bdbf8f8bce4094369a2d1e4b5645e9 ]
+
+The DSI host has different modes in prepare() and enable() functions,
+prepare() is in LP command mode and enable() is in HS video mode.
+
+>From our experience, generally the initialization sequence needs to be
+sent in the LP command mode.
+
+Move the setup init function from enable() to prepare() to fix a display
+shift on rk3568 evb.
+
+Tested on rk3568/rk3576/rk3588 EVB.
+
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250618091520.691590-1-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-raydium-rm67200.c | 22 ++++++-------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-raydium-rm67200.c b/drivers/gpu/drm/panel/panel-raydium-rm67200.c
+index 64b685dc11f6..6d4d00d4cd74 100644
+--- a/drivers/gpu/drm/panel/panel-raydium-rm67200.c
++++ b/drivers/gpu/drm/panel/panel-raydium-rm67200.c
+@@ -318,6 +318,7 @@ static void w552793baa_setup(struct mipi_dsi_multi_context *ctx)
+ static int raydium_rm67200_prepare(struct drm_panel *panel)
+ {
+ struct raydium_rm67200 *ctx = to_raydium_rm67200(panel);
++ struct mipi_dsi_multi_context mctx = { .dsi = ctx->dsi };
+ int ret;
+
+ ret = regulator_bulk_enable(ctx->num_supplies, ctx->supplies);
+@@ -328,6 +329,12 @@ static int raydium_rm67200_prepare(struct drm_panel *panel)
+
+ msleep(60);
+
++ ctx->panel_info->panel_setup(&mctx);
++ mipi_dsi_dcs_exit_sleep_mode_multi(&mctx);
++ mipi_dsi_msleep(&mctx, 120);
++ mipi_dsi_dcs_set_display_on_multi(&mctx);
++ mipi_dsi_msleep(&mctx, 30);
++
+ return 0;
+ }
+
+@@ -343,20 +350,6 @@ static int raydium_rm67200_unprepare(struct drm_panel *panel)
+ return 0;
+ }
+
+-static int raydium_rm67200_enable(struct drm_panel *panel)
+-{
+- struct raydium_rm67200 *rm67200 = to_raydium_rm67200(panel);
+- struct mipi_dsi_multi_context ctx = { .dsi = rm67200->dsi };
+-
+- rm67200->panel_info->panel_setup(&ctx);
+- mipi_dsi_dcs_exit_sleep_mode_multi(&ctx);
+- mipi_dsi_msleep(&ctx, 120);
+- mipi_dsi_dcs_set_display_on_multi(&ctx);
+- mipi_dsi_msleep(&ctx, 30);
+-
+- return ctx.accum_err;
+-}
+-
+ static int raydium_rm67200_disable(struct drm_panel *panel)
+ {
+ struct raydium_rm67200 *rm67200 = to_raydium_rm67200(panel);
+@@ -381,7 +374,6 @@ static const struct drm_panel_funcs raydium_rm67200_funcs = {
+ .prepare = raydium_rm67200_prepare,
+ .unprepare = raydium_rm67200_unprepare,
+ .get_modes = raydium_rm67200_get_modes,
+- .enable = raydium_rm67200_enable,
+ .disable = raydium_rm67200_disable,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 5c739b7052f37b6df807b5c07a2ca05e1120ec74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 23:56:22 +0100
+Subject: drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit e37a95d01d5acce211da8446fefbd8684c67f516 ]
+
+The VCLK range for Renesas RZ/G2L SoC is 5.803 MHz to 148.5 MHz. Add a
+minimum clock check in the mode_valid callback to ensure that the clock
+value does not fall below the valid range.
+
+Co-developed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250609225630.502888-2-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+index 4550c6d84796..ec8baecb9ba5 100644
+--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+@@ -584,6 +584,9 @@ rzg2l_mipi_dsi_bridge_mode_valid(struct drm_bridge *bridge,
+ if (mode->clock > 148500)
+ return MODE_CLOCK_HIGH;
+
++ if (mode->clock < 5803)
++ return MODE_CLOCK_LOW;
++
+ return MODE_OK;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b36389617f751a24fd87e806293ebf1b97bd7257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:54:06 +0200
+Subject: drm/sched: Avoid memory leaks with cancel_job() callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Stanner <phasta@kernel.org>
+
+[ Upstream commit bf8bbaefaa6ae0a07971ea57b3208df60e8ad0a4 ]
+
+Since its inception, the GPU scheduler can leak memory if the driver
+calls drm_sched_fini() while there are still jobs in flight.
+
+The simplest way to solve this in a backwards compatible manner is by
+adding a new callback, drm_sched_backend_ops.cancel_job(), which
+instructs the driver to signal the hardware fence associated with the
+job. Afterwards, the scheduler can safely use the established free_job()
+callback for freeing the job.
+
+Implement the new backend_ops callback cancel_job().
+
+Suggested-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Link: https://lore.kernel.org/dri-devel/20250418113211.69956-1-tvrtko.ursulin@igalia.com/
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Acked-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Philipp Stanner <phasta@kernel.org>
+Link: https://lore.kernel.org/r/20250710125412.128476-4-phasta@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/sched_main.c | 34 ++++++++++++++++----------
+ include/drm/gpu_scheduler.h | 18 ++++++++++++++
+ 2 files changed, 39 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
+index bfea608a7106..40eaedd433a7 100644
+--- a/drivers/gpu/drm/scheduler/sched_main.c
++++ b/drivers/gpu/drm/scheduler/sched_main.c
+@@ -1335,6 +1335,18 @@ int drm_sched_init(struct drm_gpu_scheduler *sched, const struct drm_sched_init_
+ }
+ EXPORT_SYMBOL(drm_sched_init);
+
++static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
++{
++ struct drm_sched_job *job, *tmp;
++
++ /* All other accessors are stopped. No locking necessary. */
++ list_for_each_entry_safe_reverse(job, tmp, &sched->pending_list, list) {
++ sched->ops->cancel_job(job);
++ list_del(&job->list);
++ sched->ops->free_job(job);
++ }
++}
++
+ /**
+ * drm_sched_fini - Destroy a gpu scheduler
+ *
+@@ -1342,19 +1354,11 @@ EXPORT_SYMBOL(drm_sched_init);
+ *
+ * Tears down and cleans up the scheduler.
+ *
+- * This stops submission of new jobs to the hardware through
+- * drm_sched_backend_ops.run_job(). Consequently, drm_sched_backend_ops.free_job()
+- * will not be called for all jobs still in drm_gpu_scheduler.pending_list.
+- * There is no solution for this currently. Thus, it is up to the driver to make
+- * sure that:
+- *
+- * a) drm_sched_fini() is only called after for all submitted jobs
+- * drm_sched_backend_ops.free_job() has been called or that
+- * b) the jobs for which drm_sched_backend_ops.free_job() has not been called
+- * after drm_sched_fini() ran are freed manually.
+- *
+- * FIXME: Take care of the above problem and prevent this function from leaking
+- * the jobs in drm_gpu_scheduler.pending_list under any circumstances.
++ * This stops submission of new jobs to the hardware through &struct
++ * drm_sched_backend_ops.run_job. If &struct drm_sched_backend_ops.cancel_job
++ * is implemented, all jobs will be canceled through it and afterwards cleaned
++ * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
++ * implemented, memory could leak.
+ */
+ void drm_sched_fini(struct drm_gpu_scheduler *sched)
+ {
+@@ -1384,6 +1388,10 @@ void drm_sched_fini(struct drm_gpu_scheduler *sched)
+ /* Confirm no work left behind accessing device structures */
+ cancel_delayed_work_sync(&sched->work_tdr);
+
++ /* Avoid memory leaks if supported by the driver. */
++ if (sched->ops->cancel_job)
++ drm_sched_cancel_remaining_jobs(sched);
++
+ if (sched->own_submit_wq)
+ destroy_workqueue(sched->submit_wq);
+ sched->ready = false;
+diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
+index 50928a7ae98e..b8742bd569d8 100644
+--- a/include/drm/gpu_scheduler.h
++++ b/include/drm/gpu_scheduler.h
+@@ -466,6 +466,24 @@ struct drm_sched_backend_ops {
+ * and it's time to clean it up.
+ */
+ void (*free_job)(struct drm_sched_job *sched_job);
++
++ /**
++ * @cancel_job: Used by the scheduler to guarantee remaining jobs' fences
++ * get signaled in drm_sched_fini().
++ *
++ * Used by the scheduler to cancel all jobs that have not been executed
++ * with &struct drm_sched_backend_ops.run_job by the time
++ * drm_sched_fini() gets invoked.
++ *
++ * Drivers need to signal the passed job's hardware fence with an
++ * appropriate error code (e.g., -ECANCELED) in this callback. They
++ * must not free the job.
++ *
++ * The scheduler will only call this callback once it stopped calling
++ * all other callbacks forever, with the exception of &struct
++ * drm_sched_backend_ops.free_job.
++ */
++ void (*cancel_job)(struct drm_sched_job *sched_job);
+ };
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From 2ae44631414c18ac410d4c2be623f060a2fcfb0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 12:27:49 +0100
+Subject: drm/ttm: Respect the shrinker core free target
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit eac21f8ebeb4f84d703cf41dc3f81d16fa9dc00a ]
+
+Currently the TTM shrinker aborts shrinking as soon as it frees pages from
+any of the page order pools and by doing so it can fail to respect the
+freeing target which was configured by the shrinker core.
+
+We use the wording "can fail" because the number of freed pages will
+depend on the presence of pages in the pools and the order of the pools on
+the LRU list. For example if there are no free pages in the high order
+pools the shrinker core may require multiple passes over the TTM shrinker
+before it will free the default target of 128 pages (assuming there are
+free pages in the low order pools). This inefficiency can be compounded by
+the pool LRU where multiple further calls into the TTM shrinker are
+required to end up looking at the pool with pages.
+
+Improve this by never freeing less than the shrinker core has requested.
+
+At the same time we start reporting the number of scanned pages (freed in
+this case), which prevents the core shrinker from giving up on the TTM
+shrinker too soon and moving on.
+
+v2:
+ * Simplify loop logic. (Christian)
+ * Improve commit message.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20250603112750.34997-2-tvrtko.ursulin@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_pool.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
+index c2ea865be657..c060c90b89c0 100644
+--- a/drivers/gpu/drm/ttm/ttm_pool.c
++++ b/drivers/gpu/drm/ttm/ttm_pool.c
+@@ -1132,7 +1132,6 @@ void ttm_pool_fini(struct ttm_pool *pool)
+ }
+ EXPORT_SYMBOL(ttm_pool_fini);
+
+-/* As long as pages are available make sure to release at least one */
+ static unsigned long ttm_pool_shrinker_scan(struct shrinker *shrink,
+ struct shrink_control *sc)
+ {
+@@ -1140,9 +1139,12 @@ static unsigned long ttm_pool_shrinker_scan(struct shrinker *shrink,
+
+ do
+ num_freed += ttm_pool_shrink();
+- while (!num_freed && atomic_long_read(&allocated_pages));
++ while (num_freed < sc->nr_to_scan &&
++ atomic_long_read(&allocated_pages));
+
+- return num_freed;
++ sc->nr_scanned = num_freed;
++
++ return num_freed ?: SHRINK_STOP;
+ }
+
+ /* Return the number of pages available or SHRINK_EMPTY if we have none */
+--
+2.39.5
+
--- /dev/null
+From eb563771d84a3bb55488ac5ab4462b647dd0bb35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 17:11:54 +0800
+Subject: drm/ttm: Should to return the evict error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Emily Deng <Emily.Deng@amd.com>
+
+[ Upstream commit 4e16a9a00239db5d819197b9a00f70665951bf50 ]
+
+For the evict fail case, the evict error should be returned.
+
+v2: Consider ENOENT case.
+
+v3: Abort directly when the eviction failed for some reason (except for -ENOENT)
+ and not wait for the move to finish
+
+Signed-off-by: Emily Deng <Emily.Deng@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://lore.kernel.org/r/20250603091154.3472646-1-Emily.Deng@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_resource.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_resource.c b/drivers/gpu/drm/ttm/ttm_resource.c
+index 7e5a60c55813..bb84528276cd 100644
+--- a/drivers/gpu/drm/ttm/ttm_resource.c
++++ b/drivers/gpu/drm/ttm/ttm_resource.c
+@@ -558,6 +558,9 @@ int ttm_resource_manager_evict_all(struct ttm_device *bdev,
+ cond_resched();
+ } while (!ret);
+
++ if (ret && ret != -ENOENT)
++ return ret;
++
+ spin_lock(&man->move_lock);
+ fence = dma_fence_get(man->move);
+ spin_unlock(&man->move_lock);
+--
+2.39.5
+
--- /dev/null
+From 55bc47d46ce1f52246df30bda3bace1a27ffd7fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 17:42:26 +0100
+Subject: drm/xe: Make dma-fences compliant with the safe access rules
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit 6bd90e700b4285e6a7541e00f969cab0d696adde ]
+
+Xe can free some of the data pointed to by the dma-fences it exports. Most
+notably the timeline name can get freed if userspace closes the associated
+submit queue. At the same time the fence could have been exported to a
+third party (for example a sync_fence fd) which will then cause an use-
+after-free on subsequent access.
+
+To make this safe we need to make the driver compliant with the newly
+documented dma-fence rules. Driver has to ensure a RCU grace period
+between signalling a fence and freeing any data pointed to by said fence.
+
+For the timeline name we simply make the queue be freed via kfree_rcu and
+for the shared lock associated with multiple queues we add a RCU grace
+period before freeing the per GT structure holding the lock.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Acked-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Link: https://lore.kernel.org/r/20250610164226.10817-5-tvrtko.ursulin@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 2 ++
+ drivers/gpu/drm/xe/xe_guc_submit.c | 7 ++++++-
+ drivers/gpu/drm/xe/xe_hw_fence.c | 3 +++
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
+index 4c39f01e4f52..a3f421e2adc0 100644
+--- a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
++++ b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
+@@ -20,6 +20,8 @@ struct xe_exec_queue;
+ struct xe_guc_exec_queue {
+ /** @q: Backpointer to parent xe_exec_queue */
+ struct xe_exec_queue *q;
++ /** @rcu: For safe freeing of exported dma fences */
++ struct rcu_head rcu;
+ /** @sched: GPU scheduler for this xe_exec_queue */
+ struct xe_gpu_scheduler sched;
+ /** @entity: Scheduler entity for this xe_exec_queue */
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 71ddd26ec30e..00ff6197e06f 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1282,7 +1282,11 @@ static void __guc_exec_queue_fini_async(struct work_struct *w)
+ xe_sched_entity_fini(&ge->entity);
+ xe_sched_fini(&ge->sched);
+
+- kfree(ge);
++ /*
++ * RCU free due sched being exported via DRM scheduler fences
++ * (timeline name).
++ */
++ kfree_rcu(ge, rcu);
+ xe_exec_queue_fini(q);
+ xe_pm_runtime_put(guc_to_xe(guc));
+ }
+@@ -1465,6 +1469,7 @@ static int guc_exec_queue_init(struct xe_exec_queue *q)
+
+ q->guc = ge;
+ ge->q = q;
++ init_rcu_head(&ge->rcu);
+ init_waitqueue_head(&ge->suspend_wait);
+
+ for (i = 0; i < MAX_STATIC_MSG_TYPE; ++i)
+diff --git a/drivers/gpu/drm/xe/xe_hw_fence.c b/drivers/gpu/drm/xe/xe_hw_fence.c
+index 0b4f12be3692..6e2221b60688 100644
+--- a/drivers/gpu/drm/xe/xe_hw_fence.c
++++ b/drivers/gpu/drm/xe/xe_hw_fence.c
+@@ -100,6 +100,9 @@ void xe_hw_fence_irq_finish(struct xe_hw_fence_irq *irq)
+ spin_unlock_irqrestore(&irq->lock, flags);
+ dma_fence_end_signalling(tmp);
+ }
++
++ /* Safe release of the irq->lock used in dma_fence_init. */
++ synchronize_rcu();
+ }
+
+ void xe_hw_fence_irq_run(struct xe_hw_fence_irq *irq)
+--
+2.39.5
+
--- /dev/null
+From 52326f9c6aabb3bb22277c464167ecc9be00807b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 13:13:28 -0700
+Subject: drm/xe/xe_query: Use separate iterator while filling GT list
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+[ Upstream commit d4eb4a010262ea7801e576d1033b355910f2f7d4 ]
+
+The 'id' value updated by for_each_gt() is the uapi GT ID of the GTs
+being iterated over, and may skip over values if a GT is not present on
+the device. Use a separate iterator for GT list array assignments to
+ensure that the array will be filled properly on future platforms where
+index in the GT query list may not match the uapi ID.
+
+v2:
+ - Include the missing increment of the iterator. (Jonathan)
+
+Cc: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Link: https://lore.kernel.org/r/20250701201320.2514369-16-matthew.d.roper@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_query.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c
+index 5e65830dad25..4552e9e82b99 100644
+--- a/drivers/gpu/drm/xe/xe_query.c
++++ b/drivers/gpu/drm/xe/xe_query.c
+@@ -368,6 +368,7 @@ static int query_gt_list(struct xe_device *xe, struct drm_xe_device_query *query
+ struct drm_xe_query_gt_list __user *query_ptr =
+ u64_to_user_ptr(query->data);
+ struct drm_xe_query_gt_list *gt_list;
++ int iter = 0;
+ u8 id;
+
+ if (query->size == 0) {
+@@ -385,12 +386,12 @@ static int query_gt_list(struct xe_device *xe, struct drm_xe_device_query *query
+
+ for_each_gt(gt, xe, id) {
+ if (xe_gt_is_media_type(gt))
+- gt_list->gt_list[id].type = DRM_XE_QUERY_GT_TYPE_MEDIA;
++ gt_list->gt_list[iter].type = DRM_XE_QUERY_GT_TYPE_MEDIA;
+ else
+- gt_list->gt_list[id].type = DRM_XE_QUERY_GT_TYPE_MAIN;
+- gt_list->gt_list[id].tile_id = gt_to_tile(gt)->id;
+- gt_list->gt_list[id].gt_id = gt->info.id;
+- gt_list->gt_list[id].reference_clock = gt->info.reference_clock;
++ gt_list->gt_list[iter].type = DRM_XE_QUERY_GT_TYPE_MAIN;
++ gt_list->gt_list[iter].tile_id = gt_to_tile(gt)->id;
++ gt_list->gt_list[iter].gt_id = gt->info.id;
++ gt_list->gt_list[iter].reference_clock = gt->info.reference_clock;
+ /*
+ * The mem_regions indexes in the mask below need to
+ * directly identify the struct
+@@ -406,19 +407,21 @@ static int query_gt_list(struct xe_device *xe, struct drm_xe_device_query *query
+ * assumption.
+ */
+ if (!IS_DGFX(xe))
+- gt_list->gt_list[id].near_mem_regions = 0x1;
++ gt_list->gt_list[iter].near_mem_regions = 0x1;
+ else
+- gt_list->gt_list[id].near_mem_regions =
++ gt_list->gt_list[iter].near_mem_regions =
+ BIT(gt_to_tile(gt)->id) << 1;
+- gt_list->gt_list[id].far_mem_regions = xe->info.mem_region_mask ^
+- gt_list->gt_list[id].near_mem_regions;
++ gt_list->gt_list[iter].far_mem_regions = xe->info.mem_region_mask ^
++ gt_list->gt_list[iter].near_mem_regions;
+
+- gt_list->gt_list[id].ip_ver_major =
++ gt_list->gt_list[iter].ip_ver_major =
+ REG_FIELD_GET(GMD_ID_ARCH_MASK, gt->info.gmdid);
+- gt_list->gt_list[id].ip_ver_minor =
++ gt_list->gt_list[iter].ip_ver_minor =
+ REG_FIELD_GET(GMD_ID_RELEASE_MASK, gt->info.gmdid);
+- gt_list->gt_list[id].ip_ver_rev =
++ gt_list->gt_list[iter].ip_ver_rev =
+ REG_FIELD_GET(GMD_ID_REVID, gt->info.gmdid);
++
++ iter++;
+ }
+
+ if (copy_to_user(query_ptr, gt_list, size)) {
+--
+2.39.5
+
--- /dev/null
+From fa4bdcb1df3cfb6df511715bcff7f5f3f7c4f745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Jul 2025 10:37:53 +0530
+Subject: EDAC/synopsys: Clear the ECC counters on init
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+
+[ Upstream commit b1dc7f097b78eb8d25b071ead2384b07a549692b ]
+
+Clear the ECC error and counter registers during initialization/probe to avoid
+reporting stale errors that may have occurred before EDAC registration.
+
+For that, unify the Zynq and ZynqMP ECC state reading paths and simplify the
+code.
+
+ [ bp: Massage commit message.
+ Fix an -Wsometimes-uninitialized warning as reported by
+ Reported-by: kernel test robot <lkp@intel.com>
+ Closes: https://lore.kernel.org/oe-kbuild-all/202507141048.obUv3ZUm-lkp@intel.com ]
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250713050753.7042-1-shubhrajyoti.datta@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/synopsys_edac.c | 97 +++++++++++++++++-------------------
+ 1 file changed, 46 insertions(+), 51 deletions(-)
+
+diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
+index 5ed32a3299c4..51143b3257de 100644
+--- a/drivers/edac/synopsys_edac.c
++++ b/drivers/edac/synopsys_edac.c
+@@ -332,20 +332,26 @@ struct synps_edac_priv {
+ #endif
+ };
+
++enum synps_platform_type {
++ ZYNQ,
++ ZYNQMP,
++ SYNPS,
++};
++
+ /**
+ * struct synps_platform_data - synps platform data structure.
++ * @platform: Identifies the target hardware platform
+ * @get_error_info: Get EDAC error info.
+ * @get_mtype: Get mtype.
+ * @get_dtype: Get dtype.
+- * @get_ecc_state: Get ECC state.
+ * @get_mem_info: Get EDAC memory info
+ * @quirks: To differentiate IPs.
+ */
+ struct synps_platform_data {
++ enum synps_platform_type platform;
+ int (*get_error_info)(struct synps_edac_priv *priv);
+ enum mem_type (*get_mtype)(const void __iomem *base);
+ enum dev_type (*get_dtype)(const void __iomem *base);
+- bool (*get_ecc_state)(void __iomem *base);
+ #ifdef CONFIG_EDAC_DEBUG
+ u64 (*get_mem_info)(struct synps_edac_priv *priv);
+ #endif
+@@ -720,51 +726,38 @@ static enum dev_type zynqmp_get_dtype(const void __iomem *base)
+ return dt;
+ }
+
+-/**
+- * zynq_get_ecc_state - Return the controller ECC enable/disable status.
+- * @base: DDR memory controller base address.
+- *
+- * Get the ECC enable/disable status of the controller.
+- *
+- * Return: true if enabled, otherwise false.
+- */
+-static bool zynq_get_ecc_state(void __iomem *base)
++static bool get_ecc_state(struct synps_edac_priv *priv)
+ {
++ u32 ecctype, clearval;
+ enum dev_type dt;
+- u32 ecctype;
+-
+- dt = zynq_get_dtype(base);
+- if (dt == DEV_UNKNOWN)
+- return false;
+
+- ecctype = readl(base + SCRUB_OFST) & SCRUB_MODE_MASK;
+- if ((ecctype == SCRUB_MODE_SECDED) && (dt == DEV_X2))
+- return true;
+-
+- return false;
+-}
+-
+-/**
+- * zynqmp_get_ecc_state - Return the controller ECC enable/disable status.
+- * @base: DDR memory controller base address.
+- *
+- * Get the ECC enable/disable status for the controller.
+- *
+- * Return: a ECC status boolean i.e true/false - enabled/disabled.
+- */
+-static bool zynqmp_get_ecc_state(void __iomem *base)
+-{
+- enum dev_type dt;
+- u32 ecctype;
+-
+- dt = zynqmp_get_dtype(base);
+- if (dt == DEV_UNKNOWN)
+- return false;
+-
+- ecctype = readl(base + ECC_CFG0_OFST) & SCRUB_MODE_MASK;
+- if ((ecctype == SCRUB_MODE_SECDED) &&
+- ((dt == DEV_X2) || (dt == DEV_X4) || (dt == DEV_X8)))
+- return true;
++ if (priv->p_data->platform == ZYNQ) {
++ dt = zynq_get_dtype(priv->baseaddr);
++ if (dt == DEV_UNKNOWN)
++ return false;
++
++ ecctype = readl(priv->baseaddr + SCRUB_OFST) & SCRUB_MODE_MASK;
++ if (ecctype == SCRUB_MODE_SECDED && dt == DEV_X2) {
++ clearval = ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_UE_ERR;
++ writel(clearval, priv->baseaddr + ECC_CTRL_OFST);
++ writel(0x0, priv->baseaddr + ECC_CTRL_OFST);
++ return true;
++ }
++ } else {
++ dt = zynqmp_get_dtype(priv->baseaddr);
++ if (dt == DEV_UNKNOWN)
++ return false;
++
++ ecctype = readl(priv->baseaddr + ECC_CFG0_OFST) & SCRUB_MODE_MASK;
++ if (ecctype == SCRUB_MODE_SECDED &&
++ (dt == DEV_X2 || dt == DEV_X4 || dt == DEV_X8)) {
++ clearval = readl(priv->baseaddr + ECC_CLR_OFST) |
++ ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT |
++ ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT;
++ writel(clearval, priv->baseaddr + ECC_CLR_OFST);
++ return true;
++ }
++ }
+
+ return false;
+ }
+@@ -934,18 +927,18 @@ static int setup_irq(struct mem_ctl_info *mci,
+ }
+
+ static const struct synps_platform_data zynq_edac_def = {
++ .platform = ZYNQ,
+ .get_error_info = zynq_get_error_info,
+ .get_mtype = zynq_get_mtype,
+ .get_dtype = zynq_get_dtype,
+- .get_ecc_state = zynq_get_ecc_state,
+ .quirks = 0,
+ };
+
+ static const struct synps_platform_data zynqmp_edac_def = {
++ .platform = ZYNQMP,
+ .get_error_info = zynqmp_get_error_info,
+ .get_mtype = zynqmp_get_mtype,
+ .get_dtype = zynqmp_get_dtype,
+- .get_ecc_state = zynqmp_get_ecc_state,
+ #ifdef CONFIG_EDAC_DEBUG
+ .get_mem_info = zynqmp_get_mem_info,
+ #endif
+@@ -957,10 +950,10 @@ static const struct synps_platform_data zynqmp_edac_def = {
+ };
+
+ static const struct synps_platform_data synopsys_edac_def = {
++ .platform = SYNPS,
+ .get_error_info = zynqmp_get_error_info,
+ .get_mtype = zynqmp_get_mtype,
+ .get_dtype = zynqmp_get_dtype,
+- .get_ecc_state = zynqmp_get_ecc_state,
+ .quirks = (DDR_ECC_INTR_SUPPORT | DDR_ECC_INTR_SELF_CLEAR
+ #ifdef CONFIG_EDAC_DEBUG
+ | DDR_ECC_DATA_POISON_SUPPORT
+@@ -1390,10 +1383,6 @@ static int mc_probe(struct platform_device *pdev)
+ if (!p_data)
+ return -ENODEV;
+
+- if (!p_data->get_ecc_state(baseaddr)) {
+- edac_printk(KERN_INFO, EDAC_MC, "ECC not enabled\n");
+- return -ENXIO;
+- }
+
+ layers[0].type = EDAC_MC_LAYER_CHIP_SELECT;
+ layers[0].size = SYNPS_EDAC_NR_CSROWS;
+@@ -1413,6 +1402,12 @@ static int mc_probe(struct platform_device *pdev)
+ priv = mci->pvt_info;
+ priv->baseaddr = baseaddr;
+ priv->p_data = p_data;
++ if (!get_ecc_state(priv)) {
++ edac_printk(KERN_INFO, EDAC_MC, "ECC not enabled\n");
++ rc = -ENODEV;
++ goto free_edac_mc;
++ }
++
+ spin_lock_init(&priv->reglock);
+
+ mc_init(mci, pdev);
+--
+2.39.5
+
--- /dev/null
+From ef00eed3367ee2e97cac812b4aebabfa87676bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 11:47:30 +0200
+Subject: et131x: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit d61f6cb6f6ef3c70d2ccc0d9c85c508cb8017da9 ]
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, unmap and return an error.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Acked-by: Mark Einon <mark.einon@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250716094733.28734-2-fourier.thomas@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/agere/et131x.c | 36 +++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c
+index b398adacda91..5c52bfc09210 100644
+--- a/drivers/net/ethernet/agere/et131x.c
++++ b/drivers/net/ethernet/agere/et131x.c
+@@ -2459,6 +2459,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)
+ skb->data,
+ skb_headlen(skb),
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&adapter->pdev->dev,
++ dma_addr))
++ return -ENOMEM;
++
+ desc[frag].addr_lo = lower_32_bits(dma_addr);
+ desc[frag].addr_hi = upper_32_bits(dma_addr);
+ frag++;
+@@ -2468,6 +2472,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)
+ skb->data,
+ skb_headlen(skb) / 2,
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&adapter->pdev->dev,
++ dma_addr))
++ return -ENOMEM;
++
+ desc[frag].addr_lo = lower_32_bits(dma_addr);
+ desc[frag].addr_hi = upper_32_bits(dma_addr);
+ frag++;
+@@ -2478,6 +2486,10 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)
+ skb_headlen(skb) / 2,
+ skb_headlen(skb) / 2,
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&adapter->pdev->dev,
++ dma_addr))
++ goto unmap_first_out;
++
+ desc[frag].addr_lo = lower_32_bits(dma_addr);
+ desc[frag].addr_hi = upper_32_bits(dma_addr);
+ frag++;
+@@ -2489,6 +2501,9 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)
+ 0,
+ desc[frag].len_vlan,
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&adapter->pdev->dev, dma_addr))
++ goto unmap_out;
++
+ desc[frag].addr_lo = lower_32_bits(dma_addr);
+ desc[frag].addr_hi = upper_32_bits(dma_addr);
+ frag++;
+@@ -2578,6 +2593,27 @@ static int nic_send_packet(struct et131x_adapter *adapter, struct tcb *tcb)
+ &adapter->regs->global.watchdog_timer);
+ }
+ return 0;
++
++unmap_out:
++ // Unmap the body of the packet with map_page
++ while (--i) {
++ frag--;
++ dma_addr = desc[frag].addr_lo;
++ dma_addr |= (u64)desc[frag].addr_hi << 32;
++ dma_unmap_page(&adapter->pdev->dev, dma_addr,
++ desc[frag].len_vlan, DMA_TO_DEVICE);
++ }
++
++unmap_first_out:
++ // Unmap the header with map_single
++ while (frag--) {
++ dma_addr = desc[frag].addr_lo;
++ dma_addr |= (u64)desc[frag].addr_hi << 32;
++ dma_unmap_single(&adapter->pdev->dev, dma_addr,
++ desc[frag].len_vlan, DMA_TO_DEVICE);
++ }
++
++ return -ENOMEM;
+ }
+
+ static int send_packet(struct sk_buff *skb, struct et131x_adapter *adapter)
+--
+2.39.5
+
--- /dev/null
+From c6f348d8751fea44cdfa7cd3bed52635d76e013e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 17:00:49 +0800
+Subject: exfat: add cluster chain loop check for dir
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 99f9a97dce39ad413c39b92c90393bbd6778f3fd ]
+
+An infinite loop may occur if the following conditions occur due to
+file system corruption.
+
+(1) Condition for exfat_count_dir_entries() to loop infinitely.
+ - The cluster chain includes a loop.
+ - There is no UNUSED entry in the cluster chain.
+
+(2) Condition for exfat_create_upcase_table() to loop infinitely.
+ - The cluster chain of the root directory includes a loop.
+ - There are no UNUSED entry and up-case table entry in the cluster
+ chain of the root directory.
+
+(3) Condition for exfat_load_bitmap() to loop infinitely.
+ - The cluster chain of the root directory includes a loop.
+ - There are no UNUSED entry and bitmap entry in the cluster chain
+ of the root directory.
+
+(4) Condition for exfat_find_dir_entry() to loop infinitely.
+ - The cluster chain includes a loop.
+ - The unused directory entries were exhausted by some operation.
+
+(5) Condition for exfat_check_dir_empty() to loop infinitely.
+ - The cluster chain includes a loop.
+ - The unused directory entries were exhausted by some operation.
+ - All files and sub-directories under the directory are deleted.
+
+This commit adds checks to break the above infinite loop.
+
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/dir.c | 12 ++++++++++++
+ fs/exfat/fatent.c | 10 ++++++++++
+ fs/exfat/namei.c | 5 +++++
+ fs/exfat/super.c | 32 +++++++++++++++++++++-----------
+ 4 files changed, 48 insertions(+), 11 deletions(-)
+
+diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c
+index 3103b932b674..ee060e26f51d 100644
+--- a/fs/exfat/dir.c
++++ b/fs/exfat/dir.c
+@@ -996,6 +996,7 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei,
+ struct exfat_hint_femp candi_empty;
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ int num_entries = exfat_calc_num_entries(p_uniname);
++ unsigned int clu_count = 0;
+
+ if (num_entries < 0)
+ return num_entries;
+@@ -1133,6 +1134,10 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei,
+ } else {
+ if (exfat_get_next_cluster(sb, &clu.dir))
+ return -EIO;
++
++ /* break if the cluster chain includes a loop */
++ if (unlikely(++clu_count > EXFAT_DATA_CLUSTER_COUNT(sbi)))
++ goto not_found;
+ }
+ }
+
+@@ -1195,6 +1200,7 @@ int exfat_count_dir_entries(struct super_block *sb, struct exfat_chain *p_dir)
+ int i, count = 0;
+ int dentries_per_clu;
+ unsigned int entry_type;
++ unsigned int clu_count = 0;
+ struct exfat_chain clu;
+ struct exfat_dentry *ep;
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+@@ -1227,6 +1233,12 @@ int exfat_count_dir_entries(struct super_block *sb, struct exfat_chain *p_dir)
+ } else {
+ if (exfat_get_next_cluster(sb, &(clu.dir)))
+ return -EIO;
++
++ if (unlikely(++clu_count > sbi->used_clusters)) {
++ exfat_fs_error(sb, "FAT or bitmap is corrupted");
++ return -EIO;
++ }
++
+ }
+ }
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 23065f948ae7..232cc7f8ab92 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -490,5 +490,15 @@ int exfat_count_num_clusters(struct super_block *sb,
+ }
+
+ *ret_count = count;
++
++ /*
++ * since exfat_count_used_clusters() is not called, sbi->used_clusters
++ * cannot be used here.
++ */
++ if (unlikely(i == sbi->num_clusters && clu != EXFAT_EOF_CLUSTER)) {
++ exfat_fs_error(sb, "The cluster chain has a loop");
++ return -EIO;
++ }
++
+ return 0;
+ }
+diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
+index fede0283d6e2..f5f1c4e8a29f 100644
+--- a/fs/exfat/namei.c
++++ b/fs/exfat/namei.c
+@@ -890,6 +890,7 @@ static int exfat_check_dir_empty(struct super_block *sb,
+ {
+ int i, dentries_per_clu;
+ unsigned int type;
++ unsigned int clu_count = 0;
+ struct exfat_chain clu;
+ struct exfat_dentry *ep;
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+@@ -926,6 +927,10 @@ static int exfat_check_dir_empty(struct super_block *sb,
+ } else {
+ if (exfat_get_next_cluster(sb, &(clu.dir)))
+ return -EIO;
++
++ /* break if the cluster chain includes a loop */
++ if (unlikely(++clu_count > EXFAT_DATA_CLUSTER_COUNT(sbi)))
++ break;
+ }
+ }
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 7ed858937d45..3a9ec75ab452 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -341,13 +341,12 @@ static void exfat_hash_init(struct super_block *sb)
+ INIT_HLIST_HEAD(&sbi->inode_hashtable[i]);
+ }
+
+-static int exfat_read_root(struct inode *inode)
++static int exfat_read_root(struct inode *inode, struct exfat_chain *root_clu)
+ {
+ struct super_block *sb = inode->i_sb;
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ struct exfat_inode_info *ei = EXFAT_I(inode);
+- struct exfat_chain cdir;
+- int num_subdirs, num_clu = 0;
++ int num_subdirs;
+
+ exfat_chain_set(&ei->dir, sbi->root_dir, 0, ALLOC_FAT_CHAIN);
+ ei->entry = -1;
+@@ -360,12 +359,9 @@ static int exfat_read_root(struct inode *inode)
+ ei->hint_stat.clu = sbi->root_dir;
+ ei->hint_femp.eidx = EXFAT_HINT_NONE;
+
+- exfat_chain_set(&cdir, sbi->root_dir, 0, ALLOC_FAT_CHAIN);
+- if (exfat_count_num_clusters(sb, &cdir, &num_clu))
+- return -EIO;
+- i_size_write(inode, num_clu << sbi->cluster_size_bits);
++ i_size_write(inode, EXFAT_CLU_TO_B(root_clu->size, sbi));
+
+- num_subdirs = exfat_count_dir_entries(sb, &cdir);
++ num_subdirs = exfat_count_dir_entries(sb, root_clu);
+ if (num_subdirs < 0)
+ return -EIO;
+ set_nlink(inode, num_subdirs + EXFAT_MIN_SUBDIR);
+@@ -578,7 +574,8 @@ static int exfat_verify_boot_region(struct super_block *sb)
+ }
+
+ /* mount the file system volume */
+-static int __exfat_fill_super(struct super_block *sb)
++static int __exfat_fill_super(struct super_block *sb,
++ struct exfat_chain *root_clu)
+ {
+ int ret;
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+@@ -595,6 +592,18 @@ static int __exfat_fill_super(struct super_block *sb)
+ goto free_bh;
+ }
+
++ /*
++ * Call exfat_count_num_cluster() before searching for up-case and
++ * bitmap directory entries to avoid infinite loop if they are missing
++ * and the cluster chain includes a loop.
++ */
++ exfat_chain_set(root_clu, sbi->root_dir, 0, ALLOC_FAT_CHAIN);
++ ret = exfat_count_num_clusters(sb, root_clu, &root_clu->size);
++ if (ret) {
++ exfat_err(sb, "failed to count the number of clusters in root");
++ goto free_bh;
++ }
++
+ ret = exfat_create_upcase_table(sb);
+ if (ret) {
+ exfat_err(sb, "failed to load upcase table");
+@@ -627,6 +636,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc)
+ struct exfat_sb_info *sbi = sb->s_fs_info;
+ struct exfat_mount_options *opts = &sbi->options;
+ struct inode *root_inode;
++ struct exfat_chain root_clu;
+ int err;
+
+ if (opts->allow_utime == (unsigned short)-1)
+@@ -645,7 +655,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc)
+ sb->s_time_min = EXFAT_MIN_TIMESTAMP_SECS;
+ sb->s_time_max = EXFAT_MAX_TIMESTAMP_SECS;
+
+- err = __exfat_fill_super(sb);
++ err = __exfat_fill_super(sb, &root_clu);
+ if (err) {
+ exfat_err(sb, "failed to recognize exfat type");
+ goto check_nls_io;
+@@ -680,7 +690,7 @@ static int exfat_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ root_inode->i_ino = EXFAT_ROOT_INO;
+ inode_set_iversion(root_inode, 1);
+- err = exfat_read_root(root_inode);
++ err = exfat_read_root(root_inode, &root_clu);
+ if (err) {
+ exfat_err(sb, "failed to initialize root inode");
+ goto put_inode;
+--
+2.39.5
+
--- /dev/null
+From ab7d64d1185e073f296a8b9b46d3addcb5979bde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 11:18:38 -0400
+Subject: ext2: Handle fiemap on empty files to prevent EINVAL
+
+From: Wei Gao <wegao@suse.com>
+
+[ Upstream commit a099b09a3342a0b28ea330e405501b5b4d0424b4 ]
+
+Previously, ext2_fiemap would unconditionally apply "len = min_t(u64, len,
+i_size_read(inode));", When inode->i_size was 0 (for an empty file), this
+would reduce the requested len to 0. Passing len = 0 to iomap_fiemap could
+then result in an -EINVAL error, even for valid queries on empty files.
+
+Link: https://github.com/linux-test-project/ltp/issues/1246
+Signed-off-by: Wei Gao <wegao@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20250613152402.3432135-1-wegao@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/inode.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
+index 30f8201c155f..177b1f852b63 100644
+--- a/fs/ext2/inode.c
++++ b/fs/ext2/inode.c
+@@ -895,9 +895,19 @@ int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ u64 start, u64 len)
+ {
+ int ret;
++ loff_t i_size;
+
+ inode_lock(inode);
+- len = min_t(u64, len, i_size_read(inode));
++ i_size = i_size_read(inode);
++ /*
++ * iomap_fiemap() returns EINVAL for 0 length. Make sure we don't trim
++ * length to 0 but still trim the range as much as possible since
++ * ext2_get_blocks() iterates unmapped space block by block which is
++ * slow.
++ */
++ if (i_size == 0)
++ i_size = 1;
++ len = min_t(u64, len, i_size);
+ ret = iomap_fiemap(inode, fieinfo, start, len, &ext2_iomap_ops);
+ inode_unlock(inode);
+
+--
+2.39.5
+
--- /dev/null
+From e1b2a800dc82f195b1d929501e56bd19edbd0017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 10:54:34 -0400
+Subject: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 ]
+
+A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()
+when an inode had the INLINE_DATA_FL flag set but was missing the
+system.data extended attribute.
+
+Since this can happen due to a maiciouly fuzzed file system, we
+shouldn't BUG, but rather, report it as a corrupted file system.
+
+Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii
+ext4_create_inline_data() and ext4_inline_data_truncate().
+
+Reported-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index f27d9da53fb7..372058706cce 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -303,7 +303,11 @@ static int ext4_create_inline_data(handle_t *handle,
+ if (error)
+ goto out;
+
+- BUG_ON(!is.s.not_found);
++ if (!is.s.not_found) {
++ EXT4_ERROR_INODE(inode, "unexpected inline data xattr");
++ error = -EFSCORRUPTED;
++ goto out;
++ }
+
+ error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+ if (error) {
+@@ -354,7 +358,11 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
+ if (error)
+ goto out;
+
+- BUG_ON(is.s.not_found);
++ if (is.s.not_found) {
++ EXT4_ERROR_INODE(inode, "missing inline data xattr");
++ error = -EFSCORRUPTED;
++ goto out;
++ }
+
+ len -= EXT4_MIN_INLINE_DATA_SIZE;
+ value = kzalloc(len, GFP_NOFS);
+@@ -1904,7 +1912,12 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)
+ if ((err = ext4_xattr_ibody_find(inode, &i, &is)) != 0)
+ goto out_error;
+
+- BUG_ON(is.s.not_found);
++ if (is.s.not_found) {
++ EXT4_ERROR_INODE(inode,
++ "missing inline data xattr");
++ err = -EFSCORRUPTED;
++ goto out_error;
++ }
+
+ value_len = le32_to_cpu(is.s.here->e_value_size);
+ value = kmalloc(value_len, GFP_NOFS);
+--
+2.39.5
+
--- /dev/null
+From 256b33130a8dad8db0f203a890a6ffea1b60c31c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 16:06:09 +0000
+Subject: f2fs: check the generic conditions first
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit e23ab8028de0d92df5921a570f5212c0370db3b5 ]
+
+Let's return errors caught by the generic checks. This fixes generic/494 where
+it expects to see EBUSY by setattr_prepare instead of EINVAL by f2fs for active
+swapfile.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index f2de3c886c08..72c8d8cb6fe8 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1044,6 +1044,18 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ if (unlikely(f2fs_cp_error(F2FS_I_SB(inode))))
+ return -EIO;
+
++ err = setattr_prepare(idmap, dentry, attr);
++ if (err)
++ return err;
++
++ err = fscrypt_prepare_setattr(dentry, attr);
++ if (err)
++ return err;
++
++ err = fsverity_prepare_setattr(dentry, attr);
++ if (err)
++ return err;
++
+ if (unlikely(IS_IMMUTABLE(inode)))
+ return -EPERM;
+
+@@ -1062,18 +1074,6 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ return -EINVAL;
+ }
+
+- err = setattr_prepare(idmap, dentry, attr);
+- if (err)
+- return err;
+-
+- err = fscrypt_prepare_setattr(dentry, attr);
+- if (err)
+- return err;
+-
+- err = fsverity_prepare_setattr(dentry, attr);
+- if (err)
+- return err;
+-
+ if (is_quota_modification(idmap, inode, attr)) {
+ err = f2fs_dquot_initialize(inode);
+ if (err)
+--
+2.39.5
+
--- /dev/null
+From 78aa1176e9f491cc75362ff3276af884907c3589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 17:07:04 +0800
+Subject: fbdev: fix potential buffer overflow in do_register_framebuffer()
+
+From: Yongzhen Zhang <zhangyongzhen@kylinos.cn>
+
+[ Upstream commit 523b84dc7ccea9c4d79126d6ed1cf9033cf83b05 ]
+
+The current implementation may lead to buffer overflow when:
+1. Unregistration creates NULL gaps in registered_fb[]
+2. All array slots become occupied despite num_registered_fb < FB_MAX
+3. The registration loop exceeds array bounds
+
+Add boundary check to prevent registered_fb[FB_MAX] access.
+
+Signed-off-by: Yongzhen Zhang <zhangyongzhen@kylinos.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbmem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index eca2498f2436..6a033bf17ab6 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -403,6 +403,9 @@ static int do_register_framebuffer(struct fb_info *fb_info)
+ if (!registered_fb[i])
+ break;
+
++ if (i >= FB_MAX)
++ return -ENXIO;
++
+ if (!fb_info->modelist.prev || !fb_info->modelist.next)
+ INIT_LIST_HEAD(&fb_info->modelist);
+
+--
+2.39.5
+
--- /dev/null
+From db9c888a05db88715284f9fcb020227e337716dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jul 2025 13:27:02 +0300
+Subject: firmware: arm_ffa: Change initcall level of ffa_init() to
+ rootfs_initcall
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yeoreum Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit 0e0546eabcd6c19765a8dbf5b5db3723e7b0ea75 ]
+
+The Linux IMA (Integrity Measurement Architecture) subsystem used for
+secure boot, file integrity, or remote attestation cannot be a loadable
+module for few reasons listed below:
+
+ o Boot-Time Integrity: IMA’s main role is to measure and appraise files
+ before they are used. This includes measuring critical system files during
+ early boot (e.g., init, init scripts, login binaries). If IMA were a
+ module, it would be loaded too late to cover those.
+
+ o TPM Dependency: IMA integrates tightly with the TPM to record
+ measurements into PCRs. The TPM must be initialized early (ideally before
+ init_ima()), which aligns with IMA being built-in.
+
+ o Security Model: IMA is part of a Trusted Computing Base (TCB). Making it
+ a module would weaken the security model, as a potentially compromised
+ system could delay or tamper with its initialization.
+
+IMA must be built-in to ensure it starts measuring from the earliest
+possible point in boot which inturn implies TPM must be initialised and
+ready to use before IMA.
+
+To enable integration of tpm_event_log with the IMA subsystem, the TPM
+drivers (tpm_crb and tpm_crb_ffa) also needs to be built-in. However with
+FF-A driver also being initialised at device initcall level, it can lead to
+an initialization order issue where:
+ - crb_acpi_driver_init() may run before tpm_crb_ffa_driver()_init and
+ ffa_init()
+ - As a result, probing the TPM device via CRB over FFA is deferred
+ - ima_init() (called as a late initcall) runs before deferred probe
+ completes, IMA fails to find the TPM and logs the below error:
+
+ | ima: No TPM chip found, activating TPM-bypass!
+
+Eventually it fails to generate boot_aggregate with PCR values.
+
+Because of the above stated dependency, the ffa driver needs to initialised
+before tpm_crb_ffa module to ensure IMA finds the TPM successfully when
+present.
+
+[ jarkko: reformatted some of the paragraphs because they were going past
+ the 75 character boundary. ]
+
+Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index 37eb2e6c2f9f..65bf1685350a 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -2059,7 +2059,7 @@ static int __init ffa_init(void)
+ kfree(drv_info);
+ return ret;
+ }
+-module_init(ffa_init);
++rootfs_initcall(ffa_init);
+
+ static void __exit ffa_exit(void)
+ {
+--
+2.39.5
+
--- /dev/null
+From f1d047a374c379788f237abf4a1aae6b1ae7ed52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 11:09:36 +0800
+Subject: firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set
+ early during resume
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 9a0658d3991e6c82df87584b253454842f22f965 ]
+
+Fix a race condition where a second suspend notification from another
+SCMI agent wakes the system before SCMI_SYSPOWER_IDLE is set, leading
+to ignored suspend requests. This is due to interrupts triggering early
+execution of `scmi_userspace_notifier()` before the SCMI state is updated.
+
+To resolve this, set SCMI_SYSPOWER_IDLE earlier in the device resume
+path, prior to `thaw_processes()`. This ensures the SCMI state is
+correct when the notifier runs, allowing the system to suspend again
+as expected.
+
+On some platforms using SCMI, SCP cannot distinguish between CPU idle
+and suspend since both result in cluster power-off. By explicitly setting
+the idle state early, the Linux SCMI agent can correctly re-suspend in
+response to external notifications.
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Message-Id: <20250704-scmi-pm-v2-2-9316cec2f9cc@nxp.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../firmware/arm_scmi/scmi_power_control.c | 22 ++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/scmi_power_control.c b/drivers/firmware/arm_scmi/scmi_power_control.c
+index 21f467a92942..ab0cee0d4bec 100644
+--- a/drivers/firmware/arm_scmi/scmi_power_control.c
++++ b/drivers/firmware/arm_scmi/scmi_power_control.c
+@@ -46,6 +46,7 @@
+ #include <linux/math.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
++#include <linux/pm.h>
+ #include <linux/printk.h>
+ #include <linux/reboot.h>
+ #include <linux/scmi_protocol.h>
+@@ -324,12 +325,7 @@ static int scmi_userspace_notifier(struct notifier_block *nb,
+
+ static void scmi_suspend_work_func(struct work_struct *work)
+ {
+- struct scmi_syspower_conf *sc =
+- container_of(work, struct scmi_syspower_conf, suspend_work);
+-
+ pm_suspend(PM_SUSPEND_MEM);
+-
+- sc->state = SCMI_SYSPOWER_IDLE;
+ }
+
+ static int scmi_syspower_probe(struct scmi_device *sdev)
+@@ -354,6 +350,7 @@ static int scmi_syspower_probe(struct scmi_device *sdev)
+ sc->required_transition = SCMI_SYSTEM_MAX;
+ sc->userspace_nb.notifier_call = &scmi_userspace_notifier;
+ sc->dev = &sdev->dev;
++ dev_set_drvdata(&sdev->dev, sc);
+
+ INIT_WORK(&sc->suspend_work, scmi_suspend_work_func);
+
+@@ -363,6 +360,18 @@ static int scmi_syspower_probe(struct scmi_device *sdev)
+ NULL, &sc->userspace_nb);
+ }
+
++static int scmi_system_power_resume(struct device *dev)
++{
++ struct scmi_syspower_conf *sc = dev_get_drvdata(dev);
++
++ sc->state = SCMI_SYSPOWER_IDLE;
++ return 0;
++}
++
++static const struct dev_pm_ops scmi_system_power_pmops = {
++ SET_SYSTEM_SLEEP_PM_OPS(NULL, scmi_system_power_resume)
++};
++
+ static const struct scmi_device_id scmi_id_table[] = {
+ { SCMI_PROTOCOL_SYSTEM, "syspower" },
+ { },
+@@ -370,6 +379,9 @@ static const struct scmi_device_id scmi_id_table[] = {
+ MODULE_DEVICE_TABLE(scmi, scmi_id_table);
+
+ static struct scmi_driver scmi_system_power_driver = {
++ .driver = {
++ .pm = &scmi_system_power_pmops,
++ },
+ .name = "scmi-system-power",
+ .probe = scmi_syspower_probe,
+ .id_table = scmi_id_table,
+--
+2.39.5
+
--- /dev/null
+From 16d75044821e10f74fa42821bf74d25cdd2df282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 14:12:04 +0200
+Subject: firmware: qcom: scm: initialize tzmem before marking SCM as available
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 87be3e7a2d0030cda6314d2ec96b37991f636ccd ]
+
+Now that qcom_scm_shm_bridge_enable() uses the struct device passed to
+it as argument to make the QCOM_SCM_MP_SHM_BRIDGE_ENABLE SCM call, we
+can move the TZMem initialization before the assignment of the __scm
+pointer in the SCM driver (which marks SCM as ready to users) thus
+fixing the potential race between consumer calls and the memory pool
+initialization.
+
+Reported-by: Johan Hovold <johan+linaro@kernel.org>
+Closes: https://lore.kernel.org/all/20250120151000.13870-1-johan+linaro@kernel.org/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-3-fa3851c98611@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 53 ++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index fc4d67e4c4a6..9032c8a317f9 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -2247,7 +2247,32 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- /* Paired with smp_load_acquire() in qcom_scm_is_available(). */
++ ret = of_reserved_mem_device_init(scm->dev);
++ if (ret && ret != -ENODEV)
++ return dev_err_probe(scm->dev, ret,
++ "Failed to setup the reserved memory region for TZ mem\n");
++
++ ret = qcom_tzmem_enable(scm->dev);
++ if (ret)
++ return dev_err_probe(scm->dev, ret,
++ "Failed to enable the TrustZone memory allocator\n");
++
++ memset(&pool_config, 0, sizeof(pool_config));
++ pool_config.initial_size = 0;
++ pool_config.policy = QCOM_TZMEM_POLICY_ON_DEMAND;
++ pool_config.max_size = SZ_256K;
++
++ scm->mempool = devm_qcom_tzmem_pool_new(scm->dev, &pool_config);
++ if (IS_ERR(scm->mempool))
++ return dev_err_probe(scm->dev, PTR_ERR(scm->mempool),
++ "Failed to create the SCM memory pool\n");
++
++ /*
++ * Paired with smp_load_acquire() in qcom_scm_is_available().
++ *
++ * This marks the SCM API as ready to accept user calls and can only
++ * be called after the TrustZone memory pool is initialized.
++ */
+ smp_store_release(&__scm, scm);
+
+ irq = platform_get_irq_optional(pdev, 0);
+@@ -2280,32 +2305,6 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ if (of_property_read_bool(pdev->dev.of_node, "qcom,sdi-enabled") || !download_mode)
+ qcom_scm_disable_sdi();
+
+- ret = of_reserved_mem_device_init(__scm->dev);
+- if (ret && ret != -ENODEV) {
+- dev_err_probe(__scm->dev, ret,
+- "Failed to setup the reserved memory region for TZ mem\n");
+- goto err;
+- }
+-
+- ret = qcom_tzmem_enable(__scm->dev);
+- if (ret) {
+- dev_err_probe(__scm->dev, ret,
+- "Failed to enable the TrustZone memory allocator\n");
+- goto err;
+- }
+-
+- memset(&pool_config, 0, sizeof(pool_config));
+- pool_config.initial_size = 0;
+- pool_config.policy = QCOM_TZMEM_POLICY_ON_DEMAND;
+- pool_config.max_size = SZ_256K;
+-
+- __scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config);
+- if (IS_ERR(__scm->mempool)) {
+- ret = dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),
+- "Failed to create the SCM memory pool\n");
+- goto err;
+- }
+-
+ /*
+ * Initialize the QSEECOM interface.
+ *
+--
+2.39.5
+
--- /dev/null
+From 893937d028961d4903f2c989792eb6455c4b40fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 15:31:16 +0200
+Subject: firmware: tegra: Fix IVC dependency problems
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 78eb18020a88a4eed15f5af7700ed570642ff8f1 ]
+
+The IVC code is library code that other drivers need to select if they
+need that library. However, if the symbol is user-selectable this can
+lead to conflicts.
+
+Fix this by making the symbol only selectable for COMPILE_TEST and add
+a select TEGRA_IVC to TEGRA_BPMP, which is currently the only user.
+
+Link: https://lore.kernel.org/r/20250506133118.1011777-10-thierry.reding@gmail.com
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/tegra/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/tegra/Kconfig b/drivers/firmware/tegra/Kconfig
+index cde1ab8bd9d1..91f2320c0d0f 100644
+--- a/drivers/firmware/tegra/Kconfig
++++ b/drivers/firmware/tegra/Kconfig
+@@ -2,7 +2,7 @@
+ menu "Tegra firmware driver"
+
+ config TEGRA_IVC
+- bool "Tegra IVC protocol"
++ bool "Tegra IVC protocol" if COMPILE_TEST
+ depends on ARCH_TEGRA
+ help
+ IVC (Inter-VM Communication) protocol is part of the IPC
+@@ -13,8 +13,9 @@ config TEGRA_IVC
+
+ config TEGRA_BPMP
+ bool "Tegra BPMP driver"
+- depends on ARCH_TEGRA && TEGRA_HSP_MBOX && TEGRA_IVC
++ depends on ARCH_TEGRA && TEGRA_HSP_MBOX
+ depends on !CPU_BIG_ENDIAN
++ select TEGRA_IVC
+ help
+ BPMP (Boot and Power Management Processor) is designed to off-loading
+ the PM functions which include clock/DVFS/thermal/power from the CPU.
+--
+2.39.5
+
--- /dev/null
+From 2a0d6687b0a329ff6fb94f7b37e35cb20a268be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2024 08:48:58 -0600
+Subject: fix locking in efi_secret_unlink()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 2c58d42de71f9c73e40afacc9d062892d2cc8862 ]
+
+We used to need securityfs_remove() to undo simple_pin_fs() done when
+the file had been created and to drop the second extra reference
+taken at the same time. Now that neither is needed (or done by
+securityfs_remove()), we can simply call simple_unlink() and be done
+with that - the broken games with locking had been there only for the
+sake of securityfs_remove().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/coco/efi_secret/efi_secret.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/drivers/virt/coco/efi_secret/efi_secret.c b/drivers/virt/coco/efi_secret/efi_secret.c
+index 1864f9f80617..f2da4819ec3b 100644
+--- a/drivers/virt/coco/efi_secret/efi_secret.c
++++ b/drivers/virt/coco/efi_secret/efi_secret.c
+@@ -136,15 +136,7 @@ static int efi_secret_unlink(struct inode *dir, struct dentry *dentry)
+ if (s->fs_files[i] == dentry)
+ s->fs_files[i] = NULL;
+
+- /*
+- * securityfs_remove tries to lock the directory's inode, but we reach
+- * the unlink callback when it's already locked
+- */
+- inode_unlock(dir);
+- securityfs_remove(dentry);
+- inode_lock(dir);
+-
+- return 0;
++ return simple_unlink(inode, dentry);
+ }
+
+ static const struct inode_operations efi_secret_dir_inode_operations = {
+--
+2.39.5
+
--- /dev/null
+From 1821ca693225411d6b2718d268b1b5d002e2e10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 13:16:16 +0800
+Subject: fs/ntfs3: Add sanity check for file name
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ]
+
+The length of the file name should be smaller than the directory entry size.
+
+Reported-by: syzbot+598057afa0f49e62bd23@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=598057afa0f49e62bd23
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/dir.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
+index b6da80c69ca6..600e66035c1b 100644
+--- a/fs/ntfs3/dir.c
++++ b/fs/ntfs3/dir.c
+@@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,
+ if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN))
+ return true;
+
++ if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))
++ return true;
++
+ name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name,
+ PATH_MAX);
+ if (name_len <= 0) {
+--
+2.39.5
+
--- /dev/null
+From febc7f08313ba5ce6ca49c0c7f9d183403962c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 15:35:34 +0800
+Subject: fs/ntfs3: correctly create symlink for relative path
+
+From: Rong Zhang <ulin0208@gmail.com>
+
+[ Upstream commit b1e9d89408f402858c00103f9831b25ffa0994d3 ]
+
+After applying this patch, could correctly create symlink:
+
+ln -s "relative/path/to/file" symlink
+
+Signed-off-by: Rong Zhang <ulin0208@gmail.com>
+[almaz.alexandrovich@paragon-software.com: added cpu_to_le32 macro to
+rs->Flags assignment]
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 31 ++++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 0f0d27d4644a..8214970f4594 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -1062,10 +1062,10 @@ int inode_read_data(struct inode *inode, void *data, size_t bytes)
+ * Number of bytes for REPARSE_DATA_BUFFER(IO_REPARSE_TAG_SYMLINK)
+ * for unicode string of @uni_len length.
+ */
+-static inline u32 ntfs_reparse_bytes(u32 uni_len)
++static inline u32 ntfs_reparse_bytes(u32 uni_len, bool is_absolute)
+ {
+ /* Header + unicode string + decorated unicode string. */
+- return sizeof(short) * (2 * uni_len + 4) +
++ return sizeof(short) * (2 * uni_len + (is_absolute ? 4 : 0)) +
+ offsetof(struct REPARSE_DATA_BUFFER,
+ SymbolicLinkReparseBuffer.PathBuffer);
+ }
+@@ -1078,8 +1078,11 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,
+ struct REPARSE_DATA_BUFFER *rp;
+ __le16 *rp_name;
+ typeof(rp->SymbolicLinkReparseBuffer) *rs;
++ bool is_absolute;
+
+- rp = kzalloc(ntfs_reparse_bytes(2 * size + 2), GFP_NOFS);
++ is_absolute = (strlen(symname) > 1 && symname[1] == ':');
++
++ rp = kzalloc(ntfs_reparse_bytes(2 * size + 2, is_absolute), GFP_NOFS);
+ if (!rp)
+ return ERR_PTR(-ENOMEM);
+
+@@ -1094,7 +1097,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,
+ goto out;
+
+ /* err = the length of unicode name of symlink. */
+- *nsize = ntfs_reparse_bytes(err);
++ *nsize = ntfs_reparse_bytes(err, is_absolute);
+
+ if (*nsize > sbi->reparse.max_size) {
+ err = -EFBIG;
+@@ -1114,7 +1117,7 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,
+
+ /* PrintName + SubstituteName. */
+ rs->SubstituteNameOffset = cpu_to_le16(sizeof(short) * err);
+- rs->SubstituteNameLength = cpu_to_le16(sizeof(short) * err + 8);
++ rs->SubstituteNameLength = cpu_to_le16(sizeof(short) * err + (is_absolute ? 8 : 0));
+ rs->PrintNameLength = rs->SubstituteNameOffset;
+
+ /*
+@@ -1122,16 +1125,18 @@ ntfs_create_reparse_buffer(struct ntfs_sb_info *sbi, const char *symname,
+ * parse this path.
+ * 0-absolute path 1- relative path (SYMLINK_FLAG_RELATIVE).
+ */
+- rs->Flags = 0;
++ rs->Flags = cpu_to_le32(is_absolute ? 0 : SYMLINK_FLAG_RELATIVE);
+
+- memmove(rp_name + err + 4, rp_name, sizeof(short) * err);
++ memmove(rp_name + err + (is_absolute ? 4 : 0), rp_name, sizeof(short) * err);
+
+- /* Decorate SubstituteName. */
+- rp_name += err;
+- rp_name[0] = cpu_to_le16('\\');
+- rp_name[1] = cpu_to_le16('?');
+- rp_name[2] = cpu_to_le16('?');
+- rp_name[3] = cpu_to_le16('\\');
++ if (is_absolute) {
++ /* Decorate SubstituteName. */
++ rp_name += err;
++ rp_name[0] = cpu_to_le16('\\');
++ rp_name[1] = cpu_to_le16('?');
++ rp_name[2] = cpu_to_le16('?');
++ rp_name[3] = cpu_to_le16('\\');
++ }
+
+ return rp;
+ out:
+--
+2.39.5
+
--- /dev/null
+From 3ce2876f17e43fd53842c159d4471abd16c90309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jun 2025 20:05:59 +0330
+Subject: fs/orangefs: use snprintf() instead of sprintf()
+
+From: Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com>
+
+[ Upstream commit cdfa1304657d6f23be8fd2bb0516380a3c89034e ]
+
+sprintf() is discouraged for use with bounded destination buffers
+as it does not prevent buffer overflows when the formatted output
+exceeds the destination buffer size. snprintf() is a safer
+alternative as it limits the number of bytes written and ensures
+NUL-termination.
+
+Replace sprintf() with snprintf() for copying the debug string
+into a temporary buffer, using ORANGEFS_MAX_DEBUG_STRING_LEN as
+the maximum size to ensure safe formatting and prevent memory
+corruption in edge cases.
+
+EDIT: After this patch sat on linux-next for a few days, Dan
+Carpenter saw it and suggested that I use scnprintf instead of
+snprintf. I made the change and retested.
+
+Signed-off-by: Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com>
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/orangefs-debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index e8e3badbc2ec..1c375fb65018 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -396,7 +396,7 @@ static ssize_t orangefs_debug_read(struct file *file,
+ goto out;
+
+ mutex_lock(&orangefs_debug_lock);
+- sprintf_ret = sprintf(buf, "%s", (char *)file->private_data);
++ sprintf_ret = scnprintf(buf, ORANGEFS_MAX_DEBUG_STRING_LEN, "%s", (char *)file->private_data);
+ mutex_unlock(&orangefs_debug_lock);
+
+ read_ret = simple_read_from_buffer(ubuf, count, ppos, buf, sprintf_ret);
+--
+2.39.5
+
--- /dev/null
+From ecfec668cdafc4f4e346edd5135025adf312f992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 16:21:15 +0100
+Subject: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
+
+From: Andrew Price <anprice@redhat.com>
+
+[ Upstream commit 5c8f12cf1e64e0e8e6cb80b0c935389973e8be8d ]
+
+Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to
+->writepage") that occurs in various xfstests, causing "something found
+in dmesg" failures.
+
+[ 341.136573] gfs2_meta_aops does not implement migrate_folio
+[ 341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300
+
+Signed-off-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/meta_io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
+index 9dc8885c95d0..66ee10929736 100644
+--- a/fs/gfs2/meta_io.c
++++ b/fs/gfs2/meta_io.c
+@@ -103,6 +103,7 @@ const struct address_space_operations gfs2_meta_aops = {
+ .invalidate_folio = block_invalidate_folio,
+ .writepages = gfs2_aspace_writepages,
+ .release_folio = gfs2_release_folio,
++ .migrate_folio = buffer_migrate_folio_norefs,
+ };
+
+ const struct address_space_operations gfs2_rgrp_aops = {
+@@ -110,6 +111,7 @@ const struct address_space_operations gfs2_rgrp_aops = {
+ .invalidate_folio = block_invalidate_folio,
+ .writepages = gfs2_aspace_writepages,
+ .release_folio = gfs2_release_folio,
++ .migrate_folio = buffer_migrate_folio_norefs,
+ };
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From e0360bba40110294c51946846e76904a9e53902f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 14:12:07 +0100
+Subject: gfs2: Validate i_depth for exhash directories
+
+From: Andrew Price <anprice@redhat.com>
+
+[ Upstream commit 557c024ca7250bb65ae60f16c02074106c2f197b ]
+
+A fuzzer test introduced corruption that ends up with a depth of 0 in
+dir_e_read(), causing an undefined shift by 32 at:
+
+ index = hash >> (32 - dip->i_depth);
+
+As calculated in an open-coded way in dir_make_exhash(), the minimum
+depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is
+invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.
+
+So we can avoid the undefined behaviour by checking for depth values
+lower than the minimum in gfs2_dinode_in(). Values greater than the
+maximum are already being checked for there.
+
+Also switch the calculation in dir_make_exhash() to use ilog2() to
+clarify how the depth is calculated.
+
+Tested with the syzkaller repro.c and xfstests '-g quick'.
+
+Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
+Signed-off-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/dir.c | 6 ++----
+ fs/gfs2/glops.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
+index dbf1aede744c..509e2f0d97e7 100644
+--- a/fs/gfs2/dir.c
++++ b/fs/gfs2/dir.c
+@@ -60,6 +60,7 @@
+ #include <linux/crc32.h>
+ #include <linux/vmalloc.h>
+ #include <linux/bio.h>
++#include <linux/log2.h>
+
+ #include "gfs2.h"
+ #include "incore.h"
+@@ -912,7 +913,6 @@ static int dir_make_exhash(struct inode *inode)
+ struct qstr args;
+ struct buffer_head *bh, *dibh;
+ struct gfs2_leaf *leaf;
+- int y;
+ u32 x;
+ __be64 *lp;
+ u64 bn;
+@@ -979,9 +979,7 @@ static int dir_make_exhash(struct inode *inode)
+ i_size_write(inode, sdp->sd_sb.sb_bsize / 2);
+ gfs2_add_inode_blocks(&dip->i_inode, 1);
+ dip->i_diskflags |= GFS2_DIF_EXHASH;
+-
+- for (x = sdp->sd_hash_ptrs, y = -1; x; x >>= 1, y++) ;
+- dip->i_depth = y;
++ dip->i_depth = ilog2(sdp->sd_hash_ptrs);
+
+ gfs2_dinode_out(dip, dibh->b_data);
+
+diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
+index 116efe335c32..0cf9da2ef622 100644
+--- a/fs/gfs2/glops.c
++++ b/fs/gfs2/glops.c
+@@ -11,6 +11,7 @@
+ #include <linux/bio.h>
+ #include <linux/posix_acl.h>
+ #include <linux/security.h>
++#include <linux/log2.h>
+
+ #include "gfs2.h"
+ #include "incore.h"
+@@ -450,6 +451,11 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
+ gfs2_consist_inode(ip);
+ return -EIO;
+ }
++ if ((ip->i_diskflags & GFS2_DIF_EXHASH) &&
++ depth < ilog2(sdp->sd_hash_ptrs)) {
++ gfs2_consist_inode(ip);
++ return -EIO;
++ }
+ ip->i_depth = (u8)depth;
+ ip->i_entries = be32_to_cpu(str->di_entries);
+
+--
+2.39.5
+
--- /dev/null
+From 231787f3a5dcf7b088817a30fe6d6638227f0a66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 14:45:42 +0800
+Subject: gpio: loongson-64bit: Extend GPIO irq support
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+[ Upstream commit 27cb8f702eb789f97f7a8bd5a91d76c65a937b2f ]
+
+Add the interrupt enable register offset (inten_offset) so that GPIO
+interrupts can be enabled normally on more models.
+
+According to the latest interface specifications, the definition of GPIO
+interrupts in ACPI is similar to that in FDT. The GPIO interrupts are
+listed one by one according to the GPIO number, and the corresponding
+interrupt number can be obtained directly through the GPIO number
+specified by the consumer.
+
+Signed-off-by: Xi Ruoyao <xry111@xry111.site>
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://lore.kernel.org/r/20250714064542.2276247-1-zhoubinbin@loongson.cn
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-loongson-64bit.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpio/gpio-loongson-64bit.c b/drivers/gpio/gpio-loongson-64bit.c
+index 286a3876ed0c..fd8686d8583a 100644
+--- a/drivers/gpio/gpio-loongson-64bit.c
++++ b/drivers/gpio/gpio-loongson-64bit.c
+@@ -220,6 +220,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data0 = {
+ .conf_offset = 0x0,
+ .in_offset = 0xc,
+ .out_offset = 0x8,
++ .inten_offset = 0x14,
+ };
+
+ static const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data1 = {
+@@ -228,6 +229,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data1 = {
+ .conf_offset = 0x0,
+ .in_offset = 0x20,
+ .out_offset = 0x10,
++ .inten_offset = 0x30,
+ };
+
+ static const struct loongson_gpio_chip_data loongson_gpio_ls2k2000_data2 = {
+@@ -244,6 +246,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls3a5000_data = {
+ .conf_offset = 0x0,
+ .in_offset = 0xc,
+ .out_offset = 0x8,
++ .inten_offset = 0x14,
+ };
+
+ static const struct loongson_gpio_chip_data loongson_gpio_ls7a_data = {
+@@ -252,6 +255,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls7a_data = {
+ .conf_offset = 0x800,
+ .in_offset = 0xa00,
+ .out_offset = 0x900,
++ .inten_offset = 0xb00,
+ };
+
+ /* LS7A2000 chipset GPIO */
+@@ -261,6 +265,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls7a2000_data0 = {
+ .conf_offset = 0x800,
+ .in_offset = 0xa00,
+ .out_offset = 0x900,
++ .inten_offset = 0xb00,
+ };
+
+ /* LS7A2000 ACPI GPIO */
+@@ -279,6 +284,7 @@ static const struct loongson_gpio_chip_data loongson_gpio_ls3a6000_data = {
+ .conf_offset = 0x0,
+ .in_offset = 0xc,
+ .out_offset = 0x8,
++ .inten_offset = 0x14,
+ };
+
+ static const struct of_device_id loongson_gpio_of_match[] = {
+--
+2.39.5
+
--- /dev/null
+From 67e25077e73924dd09575c395191a9e17a2e90a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 09:50:15 +0200
+Subject: gpio: tps65912: check the return value of regmap_update_bits()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit a0b2a6bbff8c26aafdecd320f38f52c341d5cafa ]
+
+regmap_update_bits() can fail, check its return value like we do
+elsewhere in the driver.
+
+Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-2-35668aaaf6d2@linaro.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-tps65912.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
+index fab771cb6a87..bac757c191c2 100644
+--- a/drivers/gpio/gpio-tps65912.c
++++ b/drivers/gpio/gpio-tps65912.c
+@@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc,
+ unsigned offset, int value)
+ {
+ struct tps65912_gpio *gpio = gpiochip_get_data(gc);
++ int ret;
+
+ /* Set the initial value */
+- regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
+- GPIO_SET_MASK, value ? GPIO_SET_MASK : 0);
++ ret = regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
++ GPIO_SET_MASK, value ? GPIO_SET_MASK : 0);
++ if (ret)
++ return ret;
+
+ return regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
+ GPIO_CFG_MASK, GPIO_CFG_MASK);
+--
+2.39.5
+
--- /dev/null
+From 95cd4e95898207b2c1d1ac148e3c20774c952eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 08:41:39 +0200
+Subject: gpio: wcd934x: check the return value of regmap_update_bits()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit ff0f0d7c6587e38c308be9905e36f86e98fb9c1f ]
+
+regmap_update_bits() can fail so check its return value in
+wcd_gpio_direction_output() for consistency with the rest of the code
+and propagate any errors.
+
+Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-2-b8950f69618d@linaro.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index 2bba27b13947..cfa7b0a50c8e 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -46,9 +46,12 @@ static int wcd_gpio_direction_output(struct gpio_chip *chip, unsigned int pin,
+ int val)
+ {
+ struct wcd_gpio_data *data = gpiochip_get_data(chip);
++ int ret;
+
+- regmap_update_bits(data->map, WCD_REG_DIR_CTL_OFFSET,
+- WCD_PIN_MASK(pin), WCD_PIN_MASK(pin));
++ ret = regmap_update_bits(data->map, WCD_REG_DIR_CTL_OFFSET,
++ WCD_PIN_MASK(pin), WCD_PIN_MASK(pin));
++ if (ret)
++ return ret;
+
+ return regmap_update_bits(data->map, WCD_REG_VAL_CTL_OFFSET,
+ WCD_PIN_MASK(pin),
+--
+2.39.5
+
--- /dev/null
+From ca56bb8459f4b5dfbb2449c42faffc7448b2af6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jun 2025 22:45:01 -0700
+Subject: gve: Return error for unknown admin queue command
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit b11344f63fdd9e8c5121148a6965b41079071dd2 ]
+
+In gve_adminq_issue_cmd(), return -EINVAL instead of 0 when an unknown
+admin queue command opcode is encountered.
+
+This prevents the function from silently succeeding on invalid input
+and prevents undefined behavior by ensuring the function fails gracefully
+when an unrecognized opcode is provided.
+
+These changes improve error handling.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250616054504.1644770-2-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_adminq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c
+index 3e8fc33cc11f..7f2334006f9f 100644
+--- a/drivers/net/ethernet/google/gve/gve_adminq.c
++++ b/drivers/net/ethernet/google/gve/gve_adminq.c
+@@ -564,6 +564,7 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
+ break;
+ default:
+ dev_err(&priv->pdev->dev, "unknown AQ command opcode %d\n", opcode);
++ return -EINVAL;
+ }
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 6760e1a8a581a52d3245fa2953879b42c39cc7df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:36:57 -0700
+Subject: hfs: fix general protection fault in hfs_find_init()
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 736a0516a16268995f4898eded49bfef077af709 ]
+
+The hfs_find_init() method can trigger the crash
+if tree pointer is NULL:
+
+[ 45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI
+[ 45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
+[ 45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full)
+[ 45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
+[ 45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230
+[ 45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc
+[ 45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202
+[ 45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09
+[ 45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8
+[ 45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000
+[ 45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004
+[ 45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000
+[ 45.760293][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000
+[ 45.761050][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0
+[ 45.762286][ T9787] Call Trace:
+[ 45.762570][ T9787] <TASK>
+[ 45.762824][ T9787] hfs_ext_read_extent+0x190/0x9d0
+[ 45.763269][ T9787] ? submit_bio_noacct_nocheck+0x2dd/0xce0
+[ 45.763766][ T9787] ? __pfx_hfs_ext_read_extent+0x10/0x10
+[ 45.764250][ T9787] hfs_get_block+0x55f/0x830
+[ 45.764646][ T9787] block_read_full_folio+0x36d/0x850
+[ 45.765105][ T9787] ? __pfx_hfs_get_block+0x10/0x10
+[ 45.765541][ T9787] ? const_folio_flags+0x5b/0x100
+[ 45.765972][ T9787] ? __pfx_hfs_read_folio+0x10/0x10
+[ 45.766415][ T9787] filemap_read_folio+0xbe/0x290
+[ 45.766840][ T9787] ? __pfx_filemap_read_folio+0x10/0x10
+[ 45.767325][ T9787] ? __filemap_get_folio+0x32b/0xbf0
+[ 45.767780][ T9787] do_read_cache_folio+0x263/0x5c0
+[ 45.768223][ T9787] ? __pfx_hfs_read_folio+0x10/0x10
+[ 45.768666][ T9787] read_cache_page+0x5b/0x160
+[ 45.769070][ T9787] hfs_btree_open+0x491/0x1740
+[ 45.769481][ T9787] hfs_mdb_get+0x15e2/0x1fb0
+[ 45.769877][ T9787] ? __pfx_hfs_mdb_get+0x10/0x10
+[ 45.770316][ T9787] ? find_held_lock+0x2b/0x80
+[ 45.770731][ T9787] ? lockdep_init_map_type+0x5c/0x280
+[ 45.771200][ T9787] ? lockdep_init_map_type+0x5c/0x280
+[ 45.771674][ T9787] hfs_fill_super+0x38e/0x720
+[ 45.772092][ T9787] ? __pfx_hfs_fill_super+0x10/0x10
+[ 45.772549][ T9787] ? snprintf+0xbe/0x100
+[ 45.772931][ T9787] ? __pfx_snprintf+0x10/0x10
+[ 45.773350][ T9787] ? do_raw_spin_lock+0x129/0x2b0
+[ 45.773796][ T9787] ? find_held_lock+0x2b/0x80
+[ 45.774215][ T9787] ? set_blocksize+0x40a/0x510
+[ 45.774636][ T9787] ? sb_set_blocksize+0x176/0x1d0
+[ 45.775087][ T9787] ? setup_bdev_super+0x369/0x730
+[ 45.775533][ T9787] get_tree_bdev_flags+0x384/0x620
+[ 45.775985][ T9787] ? __pfx_hfs_fill_super+0x10/0x10
+[ 45.776453][ T9787] ? __pfx_get_tree_bdev_flags+0x10/0x10
+[ 45.776950][ T9787] ? bpf_lsm_capable+0x9/0x10
+[ 45.777365][ T9787] ? security_capable+0x80/0x260
+[ 45.777803][ T9787] vfs_get_tree+0x8e/0x340
+[ 45.778203][ T9787] path_mount+0x13de/0x2010
+[ 45.778604][ T9787] ? kmem_cache_free+0x2b0/0x4c0
+[ 45.779052][ T9787] ? __pfx_path_mount+0x10/0x10
+[ 45.779480][ T9787] ? getname_flags.part.0+0x1c5/0x550
+[ 45.779954][ T9787] ? putname+0x154/0x1a0
+[ 45.780335][ T9787] __x64_sys_mount+0x27b/0x300
+[ 45.780758][ T9787] ? __pfx___x64_sys_mount+0x10/0x10
+[ 45.781232][ T9787] do_syscall_64+0xc9/0x480
+[ 45.781631][ T9787] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 45.782149][ T9787] RIP: 0033:0x7ffb7265b6ca
+[ 45.782539][ T9787] Code: 48 8b 0d c9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48
+[ 45.784212][ T9787] RSP: 002b:00007ffc0c10cfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
+[ 45.784935][ T9787] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffb7265b6ca
+[ 45.785626][ T9787] RDX: 0000200000000240 RSI: 0000200000000280 RDI: 00007ffc0c10d100
+[ 45.786316][ T9787] RBP: 00007ffc0c10d190 R08: 00007ffc0c10d000 R09: 0000000000000000
+[ 45.787011][ T9787] R10: 0000000000000048 R11: 0000000000000206 R12: 0000560246733250
+[ 45.787697][ T9787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 45.788393][ T9787] </TASK>
+[ 45.788665][ T9787] Modules linked in:
+[ 45.789058][ T9787] ---[ end trace 0000000000000000 ]---
+[ 45.789554][ T9787] RIP: 0010:hfs_find_init+0x86/0x230
+[ 45.790028][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc
+[ 45.792364][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202
+[ 45.793155][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09
+[ 45.794123][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8
+[ 45.795105][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000
+[ 45.796135][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004
+[ 45.797114][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000
+[ 45.798024][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000
+[ 45.799019][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 45.799822][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0
+[ 45.800747][ T9787] Kernel panic - not syncing: Fatal exception
+
+The hfs_fill_super() calls hfs_mdb_get() method that tries
+to construct Extents Tree and Catalog Tree:
+
+HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp);
+if (!HFS_SB(sb)->ext_tree) {
+ pr_err("unable to open extent tree\n");
+ goto out;
+}
+HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp);
+if (!HFS_SB(sb)->cat_tree) {
+ pr_err("unable to open catalog tree\n");
+ goto out;
+}
+
+However, hfs_btree_open() calls read_mapping_page() that
+calls hfs_get_block(). And this method calls hfs_ext_read_extent():
+
+static int hfs_ext_read_extent(struct inode *inode, u16 block)
+{
+ struct hfs_find_data fd;
+ int res;
+
+ if (block >= HFS_I(inode)->cached_start &&
+ block < HFS_I(inode)->cached_start + HFS_I(inode)->cached_blocks)
+ return 0;
+
+ res = hfs_find_init(HFS_SB(inode->i_sb)->ext_tree, &fd);
+ if (!res) {
+ res = __hfs_ext_cache_extent(&fd, inode, block);
+ hfs_find_exit(&fd);
+ }
+ return res;
+}
+
+The problem here that hfs_find_init() is trying to use
+HFS_SB(inode->i_sb)->ext_tree that is not initialized yet.
+It will be initailized when hfs_btree_open() finishes
+the execution.
+
+The patch adds checking of tree pointer in hfs_find_init()
+and it reworks the logic of hfs_btree_open() by reading
+the b-tree's header directly from the volume. The read_mapping_page()
+is exchanged on filemap_grab_folio() that grab the folio from
+mapping. Then, sb_bread() extracts the b-tree's header
+content and copy it into the folio.
+
+Reported-by: Wenzhi Wang <wenzhi.wang@uwaterloo.ca>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Link: https://lore.kernel.org/r/20250710213657.108285-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/bfind.c | 3 +++
+ fs/hfs/btree.c | 57 +++++++++++++++++++++++++++++++++++++++----------
+ fs/hfs/extent.c | 2 +-
+ fs/hfs/hfs_fs.h | 1 +
+ 4 files changed, 51 insertions(+), 12 deletions(-)
+
+diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
+index ef9498a6e88a..34e9804e0f36 100644
+--- a/fs/hfs/bfind.c
++++ b/fs/hfs/bfind.c
+@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd)
+ {
+ void *ptr;
+
++ if (!tree || !fd)
++ return -EINVAL;
++
+ fd->tree = tree;
+ fd->bnode = NULL;
+ ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);
+diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
+index 2fa4b1f8cc7f..e86e1e235658 100644
+--- a/fs/hfs/btree.c
++++ b/fs/hfs/btree.c
+@@ -21,8 +21,12 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+ struct hfs_btree *tree;
+ struct hfs_btree_header_rec *head;
+ struct address_space *mapping;
+- struct page *page;
++ struct folio *folio;
++ struct buffer_head *bh;
+ unsigned int size;
++ u16 dblock;
++ sector_t start_block;
++ loff_t offset;
+
+ tree = kzalloc(sizeof(*tree), GFP_KERNEL);
+ if (!tree)
+@@ -75,12 +79,40 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+ unlock_new_inode(tree->inode);
+
+ mapping = tree->inode->i_mapping;
+- page = read_mapping_page(mapping, 0, NULL);
+- if (IS_ERR(page))
++ folio = filemap_grab_folio(mapping, 0);
++ if (IS_ERR(folio))
+ goto free_inode;
+
++ folio_zero_range(folio, 0, folio_size(folio));
++
++ dblock = hfs_ext_find_block(HFS_I(tree->inode)->first_extents, 0);
++ start_block = HFS_SB(sb)->fs_start + (dblock * HFS_SB(sb)->fs_div);
++
++ size = folio_size(folio);
++ offset = 0;
++ while (size > 0) {
++ size_t len;
++
++ bh = sb_bread(sb, start_block);
++ if (!bh) {
++ pr_err("unable to read tree header\n");
++ goto put_folio;
++ }
++
++ len = min_t(size_t, folio_size(folio), sb->s_blocksize);
++ memcpy_to_folio(folio, offset, bh->b_data, sb->s_blocksize);
++
++ brelse(bh);
++
++ start_block++;
++ offset += len;
++ size -= len;
++ }
++
++ folio_mark_uptodate(folio);
++
+ /* Load the header */
+- head = (struct hfs_btree_header_rec *)(kmap_local_page(page) +
++ head = (struct hfs_btree_header_rec *)(kmap_local_folio(folio, 0) +
+ sizeof(struct hfs_bnode_desc));
+ tree->root = be32_to_cpu(head->root);
+ tree->leaf_count = be32_to_cpu(head->leaf_count);
+@@ -95,22 +127,22 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+
+ size = tree->node_size;
+ if (!is_power_of_2(size))
+- goto fail_page;
++ goto fail_folio;
+ if (!tree->node_count)
+- goto fail_page;
++ goto fail_folio;
+ switch (id) {
+ case HFS_EXT_CNID:
+ if (tree->max_key_len != HFS_MAX_EXT_KEYLEN) {
+ pr_err("invalid extent max_key_len %d\n",
+ tree->max_key_len);
+- goto fail_page;
++ goto fail_folio;
+ }
+ break;
+ case HFS_CAT_CNID:
+ if (tree->max_key_len != HFS_MAX_CAT_KEYLEN) {
+ pr_err("invalid catalog max_key_len %d\n",
+ tree->max_key_len);
+- goto fail_page;
++ goto fail_folio;
+ }
+ break;
+ default:
+@@ -121,12 +153,15 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+ tree->pages_per_bnode = (tree->node_size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+ kunmap_local(head);
+- put_page(page);
++ folio_unlock(folio);
++ folio_put(folio);
+ return tree;
+
+-fail_page:
++fail_folio:
+ kunmap_local(head);
+- put_page(page);
++put_folio:
++ folio_unlock(folio);
++ folio_put(folio);
+ free_inode:
+ tree->inode->i_mapping->a_ops = &hfs_aops;
+ iput(tree->inode);
+diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
+index 4a0ce131e233..580c62981dbd 100644
+--- a/fs/hfs/extent.c
++++ b/fs/hfs/extent.c
+@@ -71,7 +71,7 @@ int hfs_ext_keycmp(const btree_key *key1, const btree_key *key2)
+ *
+ * Find a block within an extent record
+ */
+-static u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off)
++u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off)
+ {
+ int i;
+ u16 count;
+diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
+index a0c7cb0f79fc..732c5c4c7545 100644
+--- a/fs/hfs/hfs_fs.h
++++ b/fs/hfs/hfs_fs.h
+@@ -190,6 +190,7 @@ extern const struct inode_operations hfs_dir_inode_operations;
+
+ /* extent.c */
+ extern int hfs_ext_keycmp(const btree_key *, const btree_key *);
++extern u16 hfs_ext_find_block(struct hfs_extent *ext, u16 off);
+ extern int hfs_free_fork(struct super_block *, struct hfs_cat_file *, int);
+ extern int hfs_ext_write_extent(struct inode *);
+ extern int hfs_extend_file(struct inode *);
+--
+2.39.5
+
--- /dev/null
+From 9af7d19fb9c6c1ddbc555e17882628e2e2001c52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 17:12:11 -0700
+Subject: hfs: fix not erasing deleted b-tree node issue
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit d3ed6d6981f4756f145766753c872482bc3b28d3 ]
+
+The generic/001 test of xfstests suite fails and corrupts
+the HFS volume:
+
+sudo ./check generic/001
+FSTYP -- hfs
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2>
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/001 32s ... _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent
+(see /home/slavad/XFSTESTS-2/xfstests-dev/results//generic/001.full for details)
+
+Ran: generic/001
+Failures: generic/001
+Failed 1 of 1 tests
+
+fsck.hfs -d -n ./test-image.bin
+** ./test-image.bin (NO WRITE)
+ Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+ Executing fsck_hfs (version 540.1-Linux).
+** Checking HFS volume.
+ The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+ Unused node is not erased (node = 2)
+ Unused node is not erased (node = 4)
+<skipped>
+ Unused node is not erased (node = 253)
+ Unused node is not erased (node = 254)
+ Unused node is not erased (node = 255)
+ Unused node is not erased (node = 256)
+** Checking catalog hierarchy.
+** Checking volume bitmap.
+** Checking volume information.
+ Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
+ CBTStat = 0x0004 CatStat = 0x00000000
+** The volume untitled was found corrupt and needs to be repaired.
+ volume type is HFS
+ primary MDB is at block 2 0x02
+ alternate MDB is at block 20971518 0x13ffffe
+ primary VHB is at block 0 0x00
+ alternate VHB is at block 0 0x00
+ sector size = 512 0x200
+ VolumeObject flags = 0x19
+ total sectors for volume = 20971520 0x1400000
+ total sectors for embedded volume = 0 0x00
+
+This patch adds logic of clearing the deleted b-tree node.
+
+sudo ./check generic/001
+FSTYP -- hfs
+PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2025
+MKFS_OPTIONS -- /dev/loop51
+MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
+
+generic/001 9s ... 32s
+Ran: generic/001
+Passed all 1 tests
+
+fsck.hfs -d -n ./test-image.bin
+** ./test-image.bin (NO WRITE)
+ Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
+ Executing fsck_hfs (version 540.1-Linux).
+** Checking HFS volume.
+ The volume name is untitled
+** Checking extents overflow file.
+** Checking catalog file.
+** Checking catalog hierarchy.
+** Checking volume bitmap.
+** Checking volume information.
+** The volume untitled appears to be OK.
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20250430001211.1912533-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/bnode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index 1dac5d9c055f..e8cd1a31f247 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -574,6 +574,7 @@ void hfs_bnode_put(struct hfs_bnode *node)
+ if (test_bit(HFS_BNODE_DELETED, &node->flags)) {
+ hfs_bnode_unhash(node);
+ spin_unlock(&tree->hash_lock);
++ hfs_bnode_clear(node, 0, tree->node_size);
+ hfs_bmap_free(node);
+ hfs_bnode_free(node);
+ return;
+--
+2.39.5
+
--- /dev/null
+From 3f10c05ba6b5a559ead01524c96827126d23bd13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 14:49:12 -0700
+Subject: hfs: fix slab-out-of-bounds in hfs_bnode_read()
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit a431930c9bac518bf99d6b1da526a7f37ddee8d8 ]
+
+This patch introduces is_bnode_offset_valid() method that checks
+the requested offset value. Also, it introduces
+check_and_correct_requested_length() method that checks and
+correct the requested length (if it is necessary). These methods
+are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(),
+hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent
+the access out of allocated memory and triggering the crash.
+
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/20250703214912.244138-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 92 insertions(+)
+
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index cb823a8a6ba9..1dac5d9c055f 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -15,6 +15,48 @@
+
+ #include "btree.h"
+
++static inline
++bool is_bnode_offset_valid(struct hfs_bnode *node, int off)
++{
++ bool is_valid = off < node->tree->node_size;
++
++ if (!is_valid) {
++ pr_err("requested invalid offset: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off);
++ }
++
++ return is_valid;
++}
++
++static inline
++int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len)
++{
++ unsigned int node_size;
++
++ if (!is_bnode_offset_valid(node, off))
++ return 0;
++
++ node_size = node->tree->node_size;
++
++ if ((off + len) > node_size) {
++ int new_len = (int)node_size - off;
++
++ pr_err("requested length has been corrected: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, "
++ "requested_len %d, corrected_len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len, new_len);
++
++ return new_len;
++ }
++
++ return len;
++}
++
+ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+ {
+ struct page *page;
+@@ -22,6 +64,20 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+ int bytes_read;
+ int bytes_to_read;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ pagenum = off >> PAGE_SHIFT;
+ off &= ~PAGE_MASK; /* compute page offset for the first page */
+@@ -80,6 +136,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
+ {
+ struct page *page;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ page = node->page[0];
+
+@@ -104,6 +174,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)
+ {
+ struct page *page;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ page = node->page[0];
+
+@@ -119,6 +203,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
+ hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len);
+ if (!len)
+ return;
++
++ len = check_and_correct_requested_length(src_node, src, len);
++ len = check_and_correct_requested_length(dst_node, dst, len);
++
+ src += src_node->page_offset;
+ dst += dst_node->page_offset;
+ src_page = src_node->page[0];
+@@ -136,6 +224,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
+ hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len);
+ if (!len)
+ return;
++
++ len = check_and_correct_requested_length(node, src, len);
++ len = check_and_correct_requested_length(node, dst, len);
++
+ src += node->page_offset;
+ dst += node->page_offset;
+ page = node->page[0];
+--
+2.39.5
+
--- /dev/null
+From 3af4c395634d6d567342295abba29ac0d7ccf225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 14:17:56 +0900
+Subject: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit c7c6363ca186747ebc2df10c8a1a51e66e0e32d9 ]
+
+When the volume header contains erroneous values that do not reflect
+the actual state of the filesystem, hfsplus_fill_super() assumes that
+the attributes file is not yet created, which later results in hitting
+BUG_ON() when hfsplus_create_attributes_file() is called. Replace this
+BUG_ON() with -EIO error with a message to suggest running fsck tool.
+
+Reported-by: syzbot <syzbot+1107451c16b9eb9d29e6@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=1107451c16b9eb9d29e6
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/7b587d24-c8a1-4413-9b9a-00a33fbd849f@I-love.SAKURA.ne.jp
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/xattr.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
+index 9a1a93e3888b..18dc3d254d21 100644
+--- a/fs/hfsplus/xattr.c
++++ b/fs/hfsplus/xattr.c
+@@ -172,7 +172,11 @@ static int hfsplus_create_attributes_file(struct super_block *sb)
+ return PTR_ERR(attr_file);
+ }
+
+- BUG_ON(i_size_read(attr_file) != 0);
++ if (i_size_read(attr_file) != 0) {
++ err = -EIO;
++ pr_err("detected inconsistent attributes file, running fsck.hfsplus is recommended.\n");
++ goto end_attr_file_creation;
++ }
+
+ hip = HFSPLUS_I(attr_file);
+
+--
+2.39.5
+
--- /dev/null
+From a29987d0d1868e39d658c42340616bcd66dd22b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 14:48:04 -0700
+Subject: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 ]
+
+The hfsplus_bnode_read() method can trigger the issue:
+
+[ 174.852007][ T9784] ==================================================================
+[ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360
+[ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784
+[ 174.854059][ T9784]
+[ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)
+[ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
+[ 174.854286][ T9784] Call Trace:
+[ 174.854289][ T9784] <TASK>
+[ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0
+[ 174.854305][ T9784] print_report+0xd0/0x660
+[ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610
+[ 174.854323][ T9784] ? __phys_addr+0xe8/0x180
+[ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360
+[ 174.854337][ T9784] kasan_report+0xc6/0x100
+[ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360
+[ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360
+[ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380
+[ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10
+[ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0
+[ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310
+[ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40
+[ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0
+[ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0
+[ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10
+[ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10
+[ 174.854436][ T9784] ? __asan_memset+0x23/0x50
+[ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320
+[ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10
+[ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0
+[ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40
+[ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0
+[ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10
+[ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0
+[ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10
+[ 174.854525][ T9784] ? down_write+0x148/0x200
+[ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10
+[ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0
+[ 174.854549][ T9784] do_unlinkat+0x490/0x670
+[ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10
+[ 174.854565][ T9784] ? __might_fault+0xbc/0x130
+[ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550
+[ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110
+[ 174.854592][ T9784] do_syscall_64+0xc9/0x480
+[ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167
+[ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08
+[ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
+[ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167
+[ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50
+[ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40
+[ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0
+[ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 174.854658][ T9784] </TASK>
+[ 174.854661][ T9784]
+[ 174.879281][ T9784] Allocated by task 9784:
+[ 174.879664][ T9784] kasan_save_stack+0x20/0x40
+[ 174.880082][ T9784] kasan_save_track+0x14/0x30
+[ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0
+[ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550
+[ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890
+[ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10
+[ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520
+[ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320
+[ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0
+[ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0
+[ 174.884004][ T9784] vfs_rmdir+0x206/0x690
+[ 174.884379][ T9784] do_rmdir+0x2b7/0x390
+[ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110
+[ 174.885167][ T9784] do_syscall_64+0xc9/0x480
+[ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 174.886083][ T9784]
+[ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600
+[ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192
+[ 174.887507][ T9784] The buggy address is located 40 bytes to the right of
+[ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698)
+[ 174.888766][ T9784]
+[ 174.888976][ T9784] The buggy address belongs to the physical page:
+[ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc
+[ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
+[ 174.890927][ T9784] page_type: f5(slab)
+[ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002
+[ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
+[ 174.892774][ T9784] page dumped because: kasan: bad access detected
+[ 174.893327][ T9784] page_owner tracks the page as allocated
+[ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1
+[ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230
+[ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30
+[ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460
+[ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550
+[ 174.897242][ T9784] new_slab+0x23b/0x340
+[ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960
+[ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0
+[ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550
+[ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0
+[ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0
+[ 174.899718][ T9784] usb_get_string+0xab/0x1a0
+[ 174.900133][ T9784] usb_string_sub+0x107/0x3c0
+[ 174.900549][ T9784] usb_string+0x307/0x670
+[ 174.900933][ T9784] usb_cache_string+0x80/0x150
+[ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0
+[ 174.901786][ T9784] register_root_hub+0x299/0x730
+[ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace:
+[ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250
+[ 174.903217][ T9784] vfree.part.0+0x12b/0xab0
+[ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0
+[ 174.904073][ T9784] process_one_work+0x9b5/0x1b80
+[ 174.904519][ T9784] worker_thread+0x630/0xe60
+[ 174.904927][ T9784] kthread+0x3a8/0x770
+[ 174.905291][ T9784] ret_from_fork+0x517/0x6e0
+[ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30
+[ 174.906128][ T9784]
+[ 174.906338][ T9784] Memory state around the buggy address:
+[ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 174.908917][ T9784] ^
+[ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 174.911401][ T9784] ==================================================================
+
+The reason of the issue that code doesn't check the correctness
+of the requested offset and length. As a result, incorrect value
+of offset or/and length could result in access out of allocated
+memory.
+
+This patch introduces is_bnode_offset_valid() method that checks
+the requested offset value. Also, it introduces
+check_and_correct_requested_length() method that checks and
+correct the requested length (if it is necessary). These methods
+are used in hfsplus_bnode_read(), hfsplus_bnode_write(),
+hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move()
+with the goal to prevent the access out of allocated memory
+and triggering the crash.
+
+Reported-by: Kun Hu <huk23@m.fudan.edu.cn>
+Reported-by: Jiaji Qin <jjtan24@m.fudan.edu.cn>
+Reported-by: Shuoran Bai <baishuoran@hrbeu.edu.cn>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/20250703214804.244077-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/bnode.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 92 insertions(+)
+
+diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
+index 079ea80534f7..14f4995588ff 100644
+--- a/fs/hfsplus/bnode.c
++++ b/fs/hfsplus/bnode.c
+@@ -18,12 +18,68 @@
+ #include "hfsplus_fs.h"
+ #include "hfsplus_raw.h"
+
++static inline
++bool is_bnode_offset_valid(struct hfs_bnode *node, int off)
++{
++ bool is_valid = off < node->tree->node_size;
++
++ if (!is_valid) {
++ pr_err("requested invalid offset: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off);
++ }
++
++ return is_valid;
++}
++
++static inline
++int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len)
++{
++ unsigned int node_size;
++
++ if (!is_bnode_offset_valid(node, off))
++ return 0;
++
++ node_size = node->tree->node_size;
++
++ if ((off + len) > node_size) {
++ int new_len = (int)node_size - off;
++
++ pr_err("requested length has been corrected: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, "
++ "requested_len %d, corrected_len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len, new_len);
++
++ return new_len;
++ }
++
++ return len;
++}
++
+ /* Copy a specified range of bytes from the raw data of a node */
+ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+ {
+ struct page **pagep;
+ int l;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ pagep = node->page + (off >> PAGE_SHIFT);
+ off &= ~PAGE_MASK;
+@@ -81,6 +137,20 @@ void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
+ struct page **pagep;
+ int l;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ pagep = node->page + (off >> PAGE_SHIFT);
+ off &= ~PAGE_MASK;
+@@ -109,6 +179,20 @@ void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)
+ struct page **pagep;
+ int l;
+
++ if (!is_bnode_offset_valid(node, off))
++ return;
++
++ if (len == 0) {
++ pr_err("requested zero length: "
++ "NODE: id %u, type %#x, height %u, "
++ "node_size %u, offset %d, len %d\n",
++ node->this, node->type, node->height,
++ node->tree->node_size, off, len);
++ return;
++ }
++
++ len = check_and_correct_requested_length(node, off, len);
++
+ off += node->page_offset;
+ pagep = node->page + (off >> PAGE_SHIFT);
+ off &= ~PAGE_MASK;
+@@ -133,6 +217,10 @@ void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
+ hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len);
+ if (!len)
+ return;
++
++ len = check_and_correct_requested_length(src_node, src, len);
++ len = check_and_correct_requested_length(dst_node, dst, len);
++
+ src += src_node->page_offset;
+ dst += dst_node->page_offset;
+ src_page = src_node->page + (src >> PAGE_SHIFT);
+@@ -187,6 +275,10 @@ void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
+ hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len);
+ if (!len)
+ return;
++
++ len = check_and_correct_requested_length(node, src, len);
++ len = check_and_correct_requested_length(node, dst, len);
++
+ src += node->page_offset;
+ dst += node->page_offset;
+ if (dst > src) {
+--
+2.39.5
+
--- /dev/null
+From e28d03b3000f5e7b075e160d154627e2c5c5796d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 16:08:30 -0700
+Subject: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
+
+From: Viacheslav Dubeyko <slava@dubeyko.com>
+
+[ Upstream commit 94458781aee6045bd3d0ad4b80b02886b9e2219b ]
+
+The hfsplus_readdir() method is capable to crash by calling
+hfsplus_uni2asc():
+
+[ 667.121659][ T9805] ==================================================================
+[ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10
+[ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805
+[ 667.124578][ T9805]
+[ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)
+[ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
+[ 667.124890][ T9805] Call Trace:
+[ 667.124893][ T9805] <TASK>
+[ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0
+[ 667.124911][ T9805] print_report+0xd0/0x660
+[ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610
+[ 667.124928][ T9805] ? __phys_addr+0xe8/0x180
+[ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10
+[ 667.124942][ T9805] kasan_report+0xc6/0x100
+[ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10
+[ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10
+[ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360
+[ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0
+[ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10
+[ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0
+[ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20
+[ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0
+[ 667.125022][ T9805] ? lock_acquire+0x30/0x80
+[ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20
+[ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0
+[ 667.125044][ T9805] ? putname+0x154/0x1a0
+[ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10
+[ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0
+[ 667.125069][ T9805] iterate_dir+0x296/0xb20
+[ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0
+[ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10
+[ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200
+[ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10
+[ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0
+[ 667.125143][ T9805] do_syscall_64+0xc9/0x480
+[ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9
+[ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48
+[ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9
+[ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9
+[ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004
+[ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110
+[ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260
+[ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 667.125207][ T9805] </TASK>
+[ 667.125210][ T9805]
+[ 667.145632][ T9805] Allocated by task 9805:
+[ 667.145991][ T9805] kasan_save_stack+0x20/0x40
+[ 667.146352][ T9805] kasan_save_track+0x14/0x30
+[ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0
+[ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550
+[ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0
+[ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0
+[ 667.148174][ T9805] iterate_dir+0x296/0xb20
+[ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0
+[ 667.148937][ T9805] do_syscall_64+0xc9/0x480
+[ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 667.149809][ T9805]
+[ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000
+[ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048
+[ 667.151282][ T9805] The buggy address is located 0 bytes to the right of
+[ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)
+[ 667.152580][ T9805]
+[ 667.152798][ T9805] The buggy address belongs to the physical page:
+[ 667.153373][ T9805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25928
+[ 667.154157][ T9805] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[ 667.154916][ T9805] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
+[ 667.155631][ T9805] page_type: f5(slab)
+[ 667.155997][ T9805] raw: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001
+[ 667.156770][ T9805] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
+[ 667.157536][ T9805] head: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001
+[ 667.158317][ T9805] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
+[ 667.159088][ T9805] head: 00fff00000000003 ffffea0000964a01 00000000ffffffff 00000000ffffffff
+[ 667.159865][ T9805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
+[ 667.160643][ T9805] page dumped because: kasan: bad access detected
+[ 667.161216][ T9805] page_owner tracks the page as allocated
+[ 667.161732][ T9805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN9
+[ 667.163566][ T9805] post_alloc_hook+0x1c0/0x230
+[ 667.164003][ T9805] get_page_from_freelist+0xdeb/0x3b30
+[ 667.164503][ T9805] __alloc_frozen_pages_noprof+0x25c/0x2460
+[ 667.165040][ T9805] alloc_pages_mpol+0x1fb/0x550
+[ 667.165489][ T9805] new_slab+0x23b/0x340
+[ 667.165872][ T9805] ___slab_alloc+0xd81/0x1960
+[ 667.166313][ T9805] __slab_alloc.isra.0+0x56/0xb0
+[ 667.166767][ T9805] __kmalloc_cache_noprof+0x255/0x3e0
+[ 667.167255][ T9805] psi_cgroup_alloc+0x52/0x2d0
+[ 667.167693][ T9805] cgroup_mkdir+0x694/0x1210
+[ 667.168118][ T9805] kernfs_iop_mkdir+0x111/0x190
+[ 667.168568][ T9805] vfs_mkdir+0x59b/0x8d0
+[ 667.168956][ T9805] do_mkdirat+0x2ed/0x3d0
+[ 667.169353][ T9805] __x64_sys_mkdir+0xef/0x140
+[ 667.169784][ T9805] do_syscall_64+0xc9/0x480
+[ 667.170195][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f
+[ 667.170730][ T9805] page last free pid 1257 tgid 1257 stack trace:
+[ 667.171304][ T9805] __free_frozen_pages+0x80c/0x1250
+[ 667.171770][ T9805] vfree.part.0+0x12b/0xab0
+[ 667.172182][ T9805] delayed_vfree_work+0x93/0xd0
+[ 667.172612][ T9805] process_one_work+0x9b5/0x1b80
+[ 667.173067][ T9805] worker_thread+0x630/0xe60
+[ 667.173486][ T9805] kthread+0x3a8/0x770
+[ 667.173857][ T9805] ret_from_fork+0x517/0x6e0
+[ 667.174278][ T9805] ret_from_fork_asm+0x1a/0x30
+[ 667.174703][ T9805]
+[ 667.174917][ T9805] Memory state around the buggy address:
+[ 667.175411][ T9805] ffff88802592f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 667.176114][ T9805] ffff88802592f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 667.176830][ T9805] >ffff88802592f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 667.177547][ T9805] ^
+[ 667.177933][ T9805] ffff88802592f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 667.178640][ T9805] ffff88802592f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 667.179350][ T9805] ==================================================================
+
+The hfsplus_uni2asc() method operates by struct hfsplus_unistr:
+
+struct hfsplus_unistr {
+ __be16 length;
+ hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN];
+} __packed;
+
+where HFSPLUS_MAX_STRLEN is 255 bytes. The issue happens if length
+of the structure instance has value bigger than 255 (for example,
+65283). In such case, pointer on unicode buffer is going beyond of
+the allocated memory.
+
+The patch fixes the issue by checking the length value of
+hfsplus_unistr instance and using 255 value in the case if length
+value is bigger than HFSPLUS_MAX_STRLEN. Potential reason of such
+situation could be a corruption of Catalog File b-tree's node.
+
+Reported-by: Wenzhi Wang <wenzhi.wang@uwaterloo.ca>
+Signed-off-by: Liu Shixin <liushixin2@huawei.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+cc: Yangtao Li <frank.li@vivo.com>
+cc: linux-fsdevel@vger.kernel.org
+Reviewed-by: Yangtao Li <frank.li@vivo.com>
+Link: https://lore.kernel.org/r/20250710230830.110500-1-slava@dubeyko.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/unicode.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
+index 73342c925a4b..36b6cf2a3abb 100644
+--- a/fs/hfsplus/unicode.c
++++ b/fs/hfsplus/unicode.c
+@@ -132,7 +132,14 @@ int hfsplus_uni2asc(struct super_block *sb,
+
+ op = astr;
+ ip = ustr->unicode;
++
+ ustrlen = be16_to_cpu(ustr->length);
++ if (ustrlen > HFSPLUS_MAX_STRLEN) {
++ ustrlen = HFSPLUS_MAX_STRLEN;
++ pr_err("invalid length %u has been corrected to %d\n",
++ be16_to_cpu(ustr->length), ustrlen);
++ }
++
+ len = *len_p;
+ ce1 = NULL;
+ compose = !test_bit(HFSPLUS_SB_NODECOMPOSE, &HFSPLUS_SB(sb)->flags);
+--
+2.39.5
+
--- /dev/null
+From 04a970862462246969003d1bf74255b0276425f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 20:02:31 +0800
+Subject: HID: rate-limit hid_warn to prevent log flooding
+
+From: Li Chen <chenl311@chinatelecom.cn>
+
+[ Upstream commit 4051ead99888f101be92c7ce90d2de09aac6fd1c ]
+
+Syzkaller can create many uhid devices that trigger
+repeated warnings like:
+
+ "hid-generic xxxx: unknown main item tag 0x0"
+
+These messages can flood the system log, especially if a crash occurs
+(e.g., with a slow UART console, leading to soft lockups). To mitigate
+this, convert `hid_warn()` to use `dev_warn_ratelimited()`.
+
+This helps reduce log noise and improves system stability under fuzzing
+or faulty device scenarios.
+
+Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 4 ++--
+ include/linux/hid.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 9ebbaf8cc131..bd4b4cc785f7 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -663,9 +663,9 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
+ default:
+ if (item->tag >= HID_MAIN_ITEM_TAG_RESERVED_MIN &&
+ item->tag <= HID_MAIN_ITEM_TAG_RESERVED_MAX)
+- hid_warn(parser->device, "reserved main item tag 0x%x\n", item->tag);
++ hid_warn_ratelimited(parser->device, "reserved main item tag 0x%x\n", item->tag);
+ else
+- hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
++ hid_warn_ratelimited(parser->device, "unknown main item tag 0x%x\n", item->tag);
+ ret = 0;
+ }
+
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index daae1d6d11a7..ada27535a195 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -1233,6 +1233,8 @@ void hid_quirks_exit(__u16 bus);
+ dev_notice(&(hid)->dev, fmt, ##__VA_ARGS__)
+ #define hid_warn(hid, fmt, ...) \
+ dev_warn(&(hid)->dev, fmt, ##__VA_ARGS__)
++#define hid_warn_ratelimited(hid, fmt, ...) \
++ dev_warn_ratelimited(&(hid)->dev, fmt, ##__VA_ARGS__)
+ #define hid_info(hid, fmt, ...) \
+ dev_info(&(hid)->dev, fmt, ##__VA_ARGS__)
+ #define hid_dbg(hid, fmt, ...) \
+--
+2.39.5
+
--- /dev/null
+From 70dcaec1b4bb8f982707a2d1da00c05318cb29c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 14:31:25 +0300
+Subject: hwmon: (emc2305) Set initial PWM minimum value during probe based on
+ thermal state
+
+From: Florin Leotescu <florin.leotescu@nxp.com>
+
+[ Upstream commit 0429415a084a15466e87d504e8c2a502488184a5 ]
+
+Prevent the PWM value from being set to minimum when thermal zone
+temperature exceeds any trip point during driver probe. Otherwise, the
+PWM fan speed will remains at minimum speed and not respond to
+temperature changes.
+
+Signed-off-by: Florin Leotescu <florin.leotescu@nxp.com>
+Link: https://lore.kernel.org/r/20250603113125.3175103-5-florin.leotescu@oss.nxp.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/emc2305.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
+index 234c54956a4b..1dbe3f26467d 100644
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -299,6 +299,12 @@ static int emc2305_set_single_tz(struct device *dev, int idx)
+ dev_err(dev, "Failed to register cooling device %s\n", emc2305_fan_name[idx]);
+ return PTR_ERR(data->cdev_data[cdev_idx].cdev);
+ }
++
++ if (data->cdev_data[cdev_idx].cur_state > 0)
++ /* Update pwm when temperature is above trips */
++ pwm = EMC2305_PWM_STATE2DUTY(data->cdev_data[cdev_idx].cur_state,
++ data->max_state, EMC2305_FAN_MAX);
++
+ /* Set minimal PWM speed. */
+ if (data->pwm_separate) {
+ ret = emc2305_set_pwm(dev, pwm, cdev_idx);
+@@ -312,10 +318,10 @@ static int emc2305_set_single_tz(struct device *dev, int idx)
+ }
+ }
+ data->cdev_data[cdev_idx].cur_state =
+- EMC2305_PWM_DUTY2STATE(data->pwm_min[cdev_idx], data->max_state,
++ EMC2305_PWM_DUTY2STATE(pwm, data->max_state,
+ EMC2305_FAN_MAX);
+ data->cdev_data[cdev_idx].last_hwmon_state =
+- EMC2305_PWM_DUTY2STATE(data->pwm_min[cdev_idx], data->max_state,
++ EMC2305_PWM_DUTY2STATE(pwm, data->max_state,
+ EMC2305_FAN_MAX);
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From d49dff2c9a1341444e75f8f7b87405c0dd0f4798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Aug 2025 07:15:54 +0800
+Subject: i2c: Force DLL0945 touchpad i2c freq to 100khz
+
+From: fangzhong.zhou <myth5@myth5.com>
+
+[ Upstream commit 0b7c9528facdb5a73ad78fea86d2e95a6c48dbc4 ]
+
+This patch fixes an issue where the touchpad cursor movement becomes
+slow on the Dell Precision 5560. Force the touchpad freq to 100khz
+as a workaround.
+
+Tested on Dell Precision 5560 with 6.14 to 6.14.6. Cursor movement
+is now smooth and responsive.
+
+Signed-off-by: fangzhong.zhou <myth5@myth5.com>
+[wsa: kept sorting and removed unnecessary parts from commit msg]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index d2499f302b50..f43067f6797e 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -370,6 +370,7 @@ static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = {
+ * the device works without issues on Windows at what is expected to be
+ * a 400KHz frequency. The root cause of the issue is not known.
+ */
++ { "DLL0945", 0 },
+ { "ELAN06FA", 0 },
+ {}
+ };
+--
+2.39.5
+
--- /dev/null
+From c81e9308fc6aa4dd034bd6f1390e44b1bdc8e633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 14:00:47 +0200
+Subject: i3c: add missing include to internal header
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 3b661ca549b9e5bb11d0bc97ada6110aac3282d2 ]
+
+LKP found a random config which failed to build because IO accessors
+were not defined:
+
+ In file included from drivers/i3c/master.c:21:
+ drivers/i3c/internals.h: In function 'i3c_writel_fifo':
+>> drivers/i3c/internals.h:35:9: error: implicit declaration of function 'writesl' [-Werror=implicit-function-declaration]
+
+Add the proper header to where the IO accessors are used.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507150208.BZDzzJ5E-lkp@intel.com/
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250717120046.9022-2-wsa+renesas@sang-engineering.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/internals.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
+index 433f6088b7ce..ce04aa4f269e 100644
+--- a/drivers/i3c/internals.h
++++ b/drivers/i3c/internals.h
+@@ -9,6 +9,7 @@
+ #define I3C_INTERNALS_H
+
+ #include <linux/i3c/master.h>
++#include <linux/io.h>
+
+ void i3c_bus_normaluse_lock(struct i3c_bus *bus);
+ void i3c_bus_normaluse_unlock(struct i3c_bus *bus);
+--
+2.39.5
+
--- /dev/null
+From 3c66117d2b94b158b638a0f4e01b4e9e9781e841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 22:44:32 +0200
+Subject: i3c: don't fail if GETHDRCAP is unsupported
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 447270cdb41b1c8c3621bb14b93a6749f942556e ]
+
+'I3C_BCR_HDR_CAP' is still spec v1.0 and has been renamed to 'advanced
+capabilities' in v1.1 onwards. The ST pressure sensor LPS22DF does not
+have HDR, but has the 'advanced cap' bit set. The core still wants to
+get additional information using the CCC 'GETHDRCAP' (or GETCAPS in v1.1
+onwards). Not all controllers support this CCC and will notify the upper
+layers about it. For instantiating the device, we can ignore this
+unsupported CCC as standard communication will work. Without this patch,
+the device will not be instantiated at all.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250704204524.6124-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
+index fd81871609d9..e53c69d24873 100644
+--- a/drivers/i3c/master.c
++++ b/drivers/i3c/master.c
+@@ -1439,7 +1439,7 @@ static int i3c_master_retrieve_dev_info(struct i3c_dev_desc *dev)
+
+ if (dev->info.bcr & I3C_BCR_HDR_CAP) {
+ ret = i3c_master_gethdrcap_locked(master, &dev->info);
+- if (ret)
++ if (ret && ret != -ENOTSUPP)
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From cd6905eacf2d0581c487f57002e1b22c38e14719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jun 2025 12:11:07 +0200
+Subject: i3c: master: Initialize ret in i3c_i2c_notifier_call()
+
+From: Jorge Marques <jorge.marques@analog.com>
+
+[ Upstream commit 290ce8b2d0745e45a3155268184523a8c75996f1 ]
+
+Set ret to -EINVAL if i3c_i2c_notifier_call() receives an invalid
+action, resolving uninitialized warning.
+
+Signed-off-by: Jorge Marques <jorge.marques@analog.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250622-i3c-master-ret-uninitialized-v1-1-aabb5625c932@analog.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
+index e53c69d24873..dfa0bad991cf 100644
+--- a/drivers/i3c/master.c
++++ b/drivers/i3c/master.c
+@@ -2467,6 +2467,8 @@ static int i3c_i2c_notifier_call(struct notifier_block *nb, unsigned long action
+ case BUS_NOTIFY_DEL_DEVICE:
+ ret = i3c_master_i2c_detach(adap, client);
+ break;
++ default:
++ ret = -EINVAL;
+ }
+ i3c_bus_maintenance_unlock(&master->bus);
+
+--
+2.39.5
+
--- /dev/null
+From 54f62552b65f9e7a3c43bfd61464af87b6ee5bdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 11:15:48 -0600
+Subject: idpf: preserve coalescing settings across resets
+
+From: Ahmed Zaki <ahmed.zaki@intel.com>
+
+[ Upstream commit e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179 ]
+
+The IRQ coalescing config currently reside only inside struct
+idpf_q_vector. However, all idpf_q_vector structs are de-allocated and
+re-allocated during resets. This leads to user-set coalesce configuration
+to be lost.
+
+Add new fields to struct idpf_vport_user_config_data to save the user
+settings and re-apply them after reset.
+
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h | 19 ++++++++++
+ .../net/ethernet/intel/idpf/idpf_ethtool.c | 36 ++++++++++++++-----
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 18 +++++++++-
+ drivers/net/ethernet/intel/idpf/idpf_main.c | 1 +
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 13 ++++---
+ 5 files changed, 74 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index 70dbf80f3bb7..a2b346d91879 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -369,10 +369,28 @@ struct idpf_rss_data {
+ u32 *cached_lut;
+ };
+
++/**
++ * struct idpf_q_coalesce - User defined coalescing configuration values for
++ * a single queue.
++ * @tx_intr_mode: Dynamic TX ITR or not
++ * @rx_intr_mode: Dynamic RX ITR or not
++ * @tx_coalesce_usecs: TX interrupt throttling rate
++ * @rx_coalesce_usecs: RX interrupt throttling rate
++ *
++ * Used to restore user coalescing configuration after a reset.
++ */
++struct idpf_q_coalesce {
++ u32 tx_intr_mode;
++ u32 rx_intr_mode;
++ u32 tx_coalesce_usecs;
++ u32 rx_coalesce_usecs;
++};
++
+ /**
+ * struct idpf_vport_user_config_data - User defined configuration values for
+ * each vport.
+ * @rss_data: See struct idpf_rss_data
++ * @q_coalesce: Array of per queue coalescing data
+ * @num_req_tx_qs: Number of user requested TX queues through ethtool
+ * @num_req_rx_qs: Number of user requested RX queues through ethtool
+ * @num_req_txq_desc: Number of user requested TX queue descriptors through
+@@ -386,6 +404,7 @@ struct idpf_rss_data {
+ */
+ struct idpf_vport_user_config_data {
+ struct idpf_rss_data rss_data;
++ struct idpf_q_coalesce *q_coalesce;
+ u16 num_req_tx_qs;
+ u16 num_req_rx_qs;
+ u32 num_req_txq_desc;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index f72420cf6821..f0f0ced0d95f 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -1089,12 +1089,14 @@ static int idpf_get_per_q_coalesce(struct net_device *netdev, u32 q_num,
+ /**
+ * __idpf_set_q_coalesce - set ITR values for specific queue
+ * @ec: ethtool structure from user to update ITR settings
++ * @q_coal: per queue coalesce settings
+ * @qv: queue vector for which itr values has to be set
+ * @is_rxq: is queue type rx
+ *
+ * Returns 0 on success, negative otherwise.
+ */
+ static int __idpf_set_q_coalesce(const struct ethtool_coalesce *ec,
++ struct idpf_q_coalesce *q_coal,
+ struct idpf_q_vector *qv, bool is_rxq)
+ {
+ u32 use_adaptive_coalesce, coalesce_usecs;
+@@ -1138,20 +1140,25 @@ static int __idpf_set_q_coalesce(const struct ethtool_coalesce *ec,
+
+ if (is_rxq) {
+ qv->rx_itr_value = coalesce_usecs;
++ q_coal->rx_coalesce_usecs = coalesce_usecs;
+ if (use_adaptive_coalesce) {
+ qv->rx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_coal->rx_intr_mode = IDPF_ITR_DYNAMIC;
+ } else {
+ qv->rx_intr_mode = !IDPF_ITR_DYNAMIC;
+- idpf_vport_intr_write_itr(qv, qv->rx_itr_value,
+- false);
++ q_coal->rx_intr_mode = !IDPF_ITR_DYNAMIC;
++ idpf_vport_intr_write_itr(qv, coalesce_usecs, false);
+ }
+ } else {
+ qv->tx_itr_value = coalesce_usecs;
++ q_coal->tx_coalesce_usecs = coalesce_usecs;
+ if (use_adaptive_coalesce) {
+ qv->tx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_coal->tx_intr_mode = IDPF_ITR_DYNAMIC;
+ } else {
+ qv->tx_intr_mode = !IDPF_ITR_DYNAMIC;
+- idpf_vport_intr_write_itr(qv, qv->tx_itr_value, true);
++ q_coal->tx_intr_mode = !IDPF_ITR_DYNAMIC;
++ idpf_vport_intr_write_itr(qv, coalesce_usecs, true);
+ }
+ }
+
+@@ -1164,6 +1171,7 @@ static int __idpf_set_q_coalesce(const struct ethtool_coalesce *ec,
+ /**
+ * idpf_set_q_coalesce - set ITR values for specific queue
+ * @vport: vport associated to the queue that need updating
++ * @q_coal: per queue coalesce settings
+ * @ec: coalesce settings to program the device with
+ * @q_num: update ITR/INTRL (coalesce) settings for this queue number/index
+ * @is_rxq: is queue type rx
+@@ -1171,6 +1179,7 @@ static int __idpf_set_q_coalesce(const struct ethtool_coalesce *ec,
+ * Return 0 on success, and negative on failure
+ */
+ static int idpf_set_q_coalesce(const struct idpf_vport *vport,
++ struct idpf_q_coalesce *q_coal,
+ const struct ethtool_coalesce *ec,
+ int q_num, bool is_rxq)
+ {
+@@ -1179,7 +1188,7 @@ static int idpf_set_q_coalesce(const struct idpf_vport *vport,
+ qv = is_rxq ? idpf_find_rxq_vec(vport, q_num) :
+ idpf_find_txq_vec(vport, q_num);
+
+- if (qv && __idpf_set_q_coalesce(ec, qv, is_rxq))
++ if (qv && __idpf_set_q_coalesce(ec, q_coal, qv, is_rxq))
+ return -EINVAL;
+
+ return 0;
+@@ -1200,9 +1209,13 @@ static int idpf_set_coalesce(struct net_device *netdev,
+ struct netlink_ext_ack *extack)
+ {
+ struct idpf_netdev_priv *np = netdev_priv(netdev);
++ struct idpf_vport_user_config_data *user_config;
++ struct idpf_q_coalesce *q_coal;
+ struct idpf_vport *vport;
+ int i, err = 0;
+
++ user_config = &np->adapter->vport_config[np->vport_idx]->user_config;
++
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+
+@@ -1210,13 +1223,15 @@ static int idpf_set_coalesce(struct net_device *netdev,
+ goto unlock_mutex;
+
+ for (i = 0; i < vport->num_txq; i++) {
+- err = idpf_set_q_coalesce(vport, ec, i, false);
++ q_coal = &user_config->q_coalesce[i];
++ err = idpf_set_q_coalesce(vport, q_coal, ec, i, false);
+ if (err)
+ goto unlock_mutex;
+ }
+
+ for (i = 0; i < vport->num_rxq; i++) {
+- err = idpf_set_q_coalesce(vport, ec, i, true);
++ q_coal = &user_config->q_coalesce[i];
++ err = idpf_set_q_coalesce(vport, q_coal, ec, i, true);
+ if (err)
+ goto unlock_mutex;
+ }
+@@ -1238,20 +1253,25 @@ static int idpf_set_coalesce(struct net_device *netdev,
+ static int idpf_set_per_q_coalesce(struct net_device *netdev, u32 q_num,
+ struct ethtool_coalesce *ec)
+ {
++ struct idpf_netdev_priv *np = netdev_priv(netdev);
++ struct idpf_vport_user_config_data *user_config;
++ struct idpf_q_coalesce *q_coal;
+ struct idpf_vport *vport;
+ int err;
+
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
++ user_config = &np->adapter->vport_config[np->vport_idx]->user_config;
++ q_coal = &user_config->q_coalesce[q_num];
+
+- err = idpf_set_q_coalesce(vport, ec, q_num, false);
++ err = idpf_set_q_coalesce(vport, q_coal, ec, q_num, false);
+ if (err) {
+ idpf_vport_ctrl_unlock(netdev);
+
+ return err;
+ }
+
+- err = idpf_set_q_coalesce(vport, ec, q_num, true);
++ err = idpf_set_q_coalesce(vport, q_coal, ec, q_num, true);
+
+ idpf_vport_ctrl_unlock(netdev);
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index fe96e2057366..72454fb34695 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1094,8 +1094,10 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+ if (!vport)
+ return vport;
+
++ num_max_q = max(max_q->max_txq, max_q->max_rxq);
+ if (!adapter->vport_config[idx]) {
+ struct idpf_vport_config *vport_config;
++ struct idpf_q_coalesce *q_coal;
+
+ vport_config = kzalloc(sizeof(*vport_config), GFP_KERNEL);
+ if (!vport_config) {
+@@ -1104,6 +1106,21 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+ return NULL;
+ }
+
++ q_coal = kcalloc(num_max_q, sizeof(*q_coal), GFP_KERNEL);
++ if (!q_coal) {
++ kfree(vport_config);
++ kfree(vport);
++
++ return NULL;
++ }
++ for (int i = 0; i < num_max_q; i++) {
++ q_coal[i].tx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_coal[i].tx_coalesce_usecs = IDPF_ITR_TX_DEF;
++ q_coal[i].rx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_coal[i].rx_coalesce_usecs = IDPF_ITR_RX_DEF;
++ }
++ vport_config->user_config.q_coalesce = q_coal;
++
+ adapter->vport_config[idx] = vport_config;
+ }
+
+@@ -1113,7 +1130,6 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+ vport->default_vport = adapter->num_alloc_vports <
+ idpf_get_default_vports(adapter);
+
+- num_max_q = max(max_q->max_txq, max_q->max_rxq);
+ vport->q_vector_idxs = kcalloc(num_max_q, sizeof(u16), GFP_KERNEL);
+ if (!vport->q_vector_idxs)
+ goto free_vport;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_main.c b/drivers/net/ethernet/intel/idpf/idpf_main.c
+index b35713036a54..8b3298e8e4f1 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_main.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_main.c
+@@ -62,6 +62,7 @@ static void idpf_remove(struct pci_dev *pdev)
+ destroy_workqueue(adapter->vc_event_wq);
+
+ for (i = 0; i < adapter->max_vports; i++) {
++ kfree(adapter->vport_config[i]->user_config.q_coalesce);
+ kfree(adapter->vport_config[i]);
+ adapter->vport_config[i] = NULL;
+ }
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index aa16e4c1edbb..59fe0ca17eec 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -4194,9 +4194,13 @@ static void idpf_vport_intr_napi_add_all(struct idpf_vport *vport)
+ int idpf_vport_intr_alloc(struct idpf_vport *vport)
+ {
+ u16 txqs_per_vector, rxqs_per_vector, bufqs_per_vector;
++ struct idpf_vport_user_config_data *user_config;
+ struct idpf_q_vector *q_vector;
++ struct idpf_q_coalesce *q_coal;
+ u32 complqs_per_vector, v_idx;
++ u16 idx = vport->idx;
+
++ user_config = &vport->adapter->vport_config[idx]->user_config;
+ vport->q_vectors = kcalloc(vport->num_q_vectors,
+ sizeof(struct idpf_q_vector), GFP_KERNEL);
+ if (!vport->q_vectors)
+@@ -4214,14 +4218,15 @@ int idpf_vport_intr_alloc(struct idpf_vport *vport)
+
+ for (v_idx = 0; v_idx < vport->num_q_vectors; v_idx++) {
+ q_vector = &vport->q_vectors[v_idx];
++ q_coal = &user_config->q_coalesce[v_idx];
+ q_vector->vport = vport;
+
+- q_vector->tx_itr_value = IDPF_ITR_TX_DEF;
+- q_vector->tx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_vector->tx_itr_value = q_coal->tx_coalesce_usecs;
++ q_vector->tx_intr_mode = q_coal->tx_intr_mode;
+ q_vector->tx_itr_idx = VIRTCHNL2_ITR_IDX_1;
+
+- q_vector->rx_itr_value = IDPF_ITR_RX_DEF;
+- q_vector->rx_intr_mode = IDPF_ITR_DYNAMIC;
++ q_vector->rx_itr_value = q_coal->rx_coalesce_usecs;
++ q_vector->rx_intr_mode = q_coal->rx_intr_mode;
+ q_vector->rx_itr_idx = VIRTCHNL2_ITR_IDX_0;
+
+ q_vector->tx = kcalloc(txqs_per_vector, sizeof(*q_vector->tx),
+--
+2.39.5
+
--- /dev/null
+From 2adf97ffe5d5179a7227cbe09be13846bf2f9b5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jun 2025 16:35:21 -0300
+Subject: iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Santos <Jonathan.Santos@analog.com>
+
+[ Upstream commit 7e54d932873d91a55d1b89b7389876d78aeeab32 ]
+
+The SYNC_IN pulse width must be at least 1.5 x Tmclk, corresponding to
+~2.5 µs at the lowest supported MCLK frequency. Add a 3 µs delay to
+ensure reliable synchronization timing even for the worst-case scenario.
+
+Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/d3ee92a533cd1207cf5c5cc4d7bdbb5c6c267f68.1749063024.git.Jonathan.Santos@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7768-1.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
+index 5e0be36af0c5..32063f54f364 100644
+--- a/drivers/iio/adc/ad7768-1.c
++++ b/drivers/iio/adc/ad7768-1.c
+@@ -202,6 +202,24 @@ static int ad7768_spi_reg_write(struct ad7768_state *st,
+ return spi_write(st->spi, st->data.d8, 2);
+ }
+
++static int ad7768_send_sync_pulse(struct ad7768_state *st)
++{
++ /*
++ * The datasheet specifies a minimum SYNC_IN pulse width of 1.5 × Tmclk,
++ * where Tmclk is the MCLK period. The supported MCLK frequencies range
++ * from 0.6 MHz to 17 MHz, which corresponds to a minimum SYNC_IN pulse
++ * width of approximately 2.5 µs in the worst-case scenario (0.6 MHz).
++ *
++ * Add a delay to ensure the pulse width is always sufficient to
++ * trigger synchronization.
++ */
++ gpiod_set_value_cansleep(st->gpio_sync_in, 1);
++ fsleep(3);
++ gpiod_set_value_cansleep(st->gpio_sync_in, 0);
++
++ return 0;
++}
++
+ static int ad7768_set_mode(struct ad7768_state *st,
+ enum ad7768_conv_mode mode)
+ {
+@@ -289,10 +307,7 @@ static int ad7768_set_dig_fil(struct ad7768_state *st,
+ return ret;
+
+ /* A sync-in pulse is required every time the filter dec rate changes */
+- gpiod_set_value(st->gpio_sync_in, 1);
+- gpiod_set_value(st->gpio_sync_in, 0);
+-
+- return 0;
++ return ad7768_send_sync_pulse(st);
+ }
+
+ static int ad7768_set_freq(struct ad7768_state *st,
+--
+2.39.5
+
--- /dev/null
+From 95a7ce335eb4db255842b4e4645e31209d4d9d0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 16:37:49 -0500
+Subject: iio: adc: ad_sigma_delta: don't overallocate scan buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 5a2f15c5a8e017d0951e6dc62aa7b5b634f56881 ]
+
+Fix overallocating the size of the scan buffer by converting bits to
+bytes. The size is meant to be in bytes, so scanbits needs to be
+divided by 8.
+
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-1-42abb83e3dac@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad_sigma_delta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
+index 4c5f8d29a559..6b3ef7ef403e 100644
+--- a/drivers/iio/adc/ad_sigma_delta.c
++++ b/drivers/iio/adc/ad_sigma_delta.c
+@@ -489,7 +489,7 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)
+ return ret;
+ }
+
+- samples_buf_size = ALIGN(slot * indio_dev->channels[0].scan_type.storagebits, 8);
++ samples_buf_size = ALIGN(slot * indio_dev->channels[0].scan_type.storagebits / 8, 8);
+ samples_buf_size += sizeof(int64_t);
+ samples_buf = devm_krealloc(&sigma_delta->spi->dev, sigma_delta->samples_buf,
+ samples_buf_size, GFP_KERNEL);
+--
+2.39.5
+
--- /dev/null
+From 35787d98af7d05b1ef8dda21e8f6a7a26805fdcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 11:26:55 +0200
+Subject: imx8m-blk-ctrl: set ISI panic write hurry level
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Hałasa <khalasa@piap.pl>
+
+[ Upstream commit c01fba0b4869cada5403fffff416cd1675dba078 ]
+
+Apparently, ISI needs cache settings similar to LCDIF.
+Otherwise we get artefacts in the image.
+Tested on i.MX8MP.
+
+Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
+Link: https://lore.kernel.org/r/m3ldr69lsw.fsf@t19.piap.pl
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/imx/imx8m-blk-ctrl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pmdomain/imx/imx8m-blk-ctrl.c b/drivers/pmdomain/imx/imx8m-blk-ctrl.c
+index 912802b5215b..5c83e5599f1e 100644
+--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c
++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c
+@@ -665,6 +665,11 @@ static const struct imx8m_blk_ctrl_data imx8mn_disp_blk_ctl_dev_data = {
+ #define LCDIF_1_RD_HURRY GENMASK(15, 13)
+ #define LCDIF_0_RD_HURRY GENMASK(12, 10)
+
++#define ISI_CACHE_CTRL 0x50
++#define ISI_V_WR_HURRY GENMASK(28, 26)
++#define ISI_U_WR_HURRY GENMASK(25, 23)
++#define ISI_Y_WR_HURRY GENMASK(22, 20)
++
+ static int imx8mp_media_power_notifier(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+@@ -694,6 +699,11 @@ static int imx8mp_media_power_notifier(struct notifier_block *nb,
+ regmap_set_bits(bc->regmap, LCDIF_ARCACHE_CTRL,
+ FIELD_PREP(LCDIF_1_RD_HURRY, 7) |
+ FIELD_PREP(LCDIF_0_RD_HURRY, 7));
++ /* Same here for ISI */
++ regmap_set_bits(bc->regmap, ISI_CACHE_CTRL,
++ FIELD_PREP(ISI_V_WR_HURRY, 7) |
++ FIELD_PREP(ISI_U_WR_HURRY, 7) |
++ FIELD_PREP(ISI_Y_WR_HURRY, 7));
+ }
+
+ return NOTIFY_OK;
+--
+2.39.5
+
--- /dev/null
+From a8defd3958541e396b791d33e20de5e747248271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 14:46:43 -0700
+Subject: ionic: clean dbpage in de-init
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit c9080abea1e69b8b1408ec7dec0acdfdc577a3e2 ]
+
+Since the kern_dbpage gets set up in ionic_lif_init() and that
+function's error path will clean it if needed, the kern_dbpage
+on teardown should be cleaned in ionic_lif_deinit(), not in
+ionic_lif_free(). As it is currently we get a double call
+to iounmap() on kern_dbpage if the PCI ionic fails setting up
+the lif. One example of this is when firmware isn't responding
+to AdminQ requests and ionic's first AdminQ call fails to
+setup the NotifyQ.
+
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Joe Damato <joe@dama.to>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 7707a9e53c43..48cb5d30b5f6 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -3526,10 +3526,6 @@ void ionic_lif_free(struct ionic_lif *lif)
+ lif->info = NULL;
+ lif->info_pa = 0;
+
+- /* unmap doorbell page */
+- ionic_bus_unmap_dbpage(lif->ionic, lif->kern_dbpage);
+- lif->kern_dbpage = NULL;
+-
+ mutex_destroy(&lif->config_lock);
+ mutex_destroy(&lif->queue_lock);
+
+@@ -3555,6 +3551,9 @@ void ionic_lif_deinit(struct ionic_lif *lif)
+ ionic_lif_qcq_deinit(lif, lif->notifyqcq);
+ ionic_lif_qcq_deinit(lif, lif->adminqcq);
+
++ ionic_bus_unmap_dbpage(lif->ionic, lif->kern_dbpage);
++ lif->kern_dbpage = NULL;
++
+ ionic_lif_reset(lif);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 6759a026b5bd0a9243027fdbd31d8cb65c105a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 19:06:26 -0500
+Subject: ipmi: Fix strcpy source and destination the same
+
+From: Corey Minyard <corey@minyard.net>
+
+[ Upstream commit 8ffcb7560b4a15faf821df95e3ab532b2b020f8c ]
+
+The source and destination of some strcpy operations was the same.
+Split out the part of the operations that needed to be done for those
+particular calls so the unnecessary copy wasn't done.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506140756.EFXXvIP4-lkp@intel.com/
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_watchdog.c | 59 ++++++++++++++++++++++---------
+ 1 file changed, 42 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
+index f1875b2bebbc..f798d4cbf8a7 100644
+--- a/drivers/char/ipmi/ipmi_watchdog.c
++++ b/drivers/char/ipmi/ipmi_watchdog.c
+@@ -1186,14 +1186,8 @@ static struct ipmi_smi_watcher smi_watcher = {
+ .smi_gone = ipmi_smi_gone
+ };
+
+-static int action_op(const char *inval, char *outval)
++static int action_op_set_val(const char *inval)
+ {
+- if (outval)
+- strcpy(outval, action);
+-
+- if (!inval)
+- return 0;
+-
+ if (strcmp(inval, "reset") == 0)
+ action_val = WDOG_TIMEOUT_RESET;
+ else if (strcmp(inval, "none") == 0)
+@@ -1204,18 +1198,26 @@ static int action_op(const char *inval, char *outval)
+ action_val = WDOG_TIMEOUT_POWER_DOWN;
+ else
+ return -EINVAL;
+- strcpy(action, inval);
+ return 0;
+ }
+
+-static int preaction_op(const char *inval, char *outval)
++static int action_op(const char *inval, char *outval)
+ {
++ int rv;
++
+ if (outval)
+- strcpy(outval, preaction);
++ strcpy(outval, action);
+
+ if (!inval)
+ return 0;
++ rv = action_op_set_val(inval);
++ if (!rv)
++ strcpy(action, inval);
++ return rv;
++}
+
++static int preaction_op_set_val(const char *inval)
++{
+ if (strcmp(inval, "pre_none") == 0)
+ preaction_val = WDOG_PRETIMEOUT_NONE;
+ else if (strcmp(inval, "pre_smi") == 0)
+@@ -1228,18 +1230,26 @@ static int preaction_op(const char *inval, char *outval)
+ preaction_val = WDOG_PRETIMEOUT_MSG_INT;
+ else
+ return -EINVAL;
+- strcpy(preaction, inval);
+ return 0;
+ }
+
+-static int preop_op(const char *inval, char *outval)
++static int preaction_op(const char *inval, char *outval)
+ {
++ int rv;
++
+ if (outval)
+- strcpy(outval, preop);
++ strcpy(outval, preaction);
+
+ if (!inval)
+ return 0;
++ rv = preaction_op_set_val(inval);
++ if (!rv)
++ strcpy(preaction, inval);
++ return 0;
++}
+
++static int preop_op_set_val(const char *inval)
++{
+ if (strcmp(inval, "preop_none") == 0)
+ preop_val = WDOG_PREOP_NONE;
+ else if (strcmp(inval, "preop_panic") == 0)
+@@ -1248,7 +1258,22 @@ static int preop_op(const char *inval, char *outval)
+ preop_val = WDOG_PREOP_GIVE_DATA;
+ else
+ return -EINVAL;
+- strcpy(preop, inval);
++ return 0;
++}
++
++static int preop_op(const char *inval, char *outval)
++{
++ int rv;
++
++ if (outval)
++ strcpy(outval, preop);
++
++ if (!inval)
++ return 0;
++
++ rv = preop_op_set_val(inval);
++ if (!rv)
++ strcpy(preop, inval);
+ return 0;
+ }
+
+@@ -1285,18 +1310,18 @@ static int __init ipmi_wdog_init(void)
+ {
+ int rv;
+
+- if (action_op(action, NULL)) {
++ if (action_op_set_val(action)) {
+ action_op("reset", NULL);
+ pr_info("Unknown action '%s', defaulting to reset\n", action);
+ }
+
+- if (preaction_op(preaction, NULL)) {
++ if (preaction_op_set_val(preaction)) {
+ preaction_op("pre_none", NULL);
+ pr_info("Unknown preaction '%s', defaulting to none\n",
+ preaction);
+ }
+
+- if (preop_op(preop, NULL)) {
++ if (preop_op_set_val(preop)) {
+ preop_op("preop_none", NULL);
+ pr_info("Unknown preop '%s', defaulting to none\n", preop);
+ }
+--
+2.39.5
+
--- /dev/null
+From 93c5b95879e9d4a43a54fb69aa8248380c2ee71b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 05:57:26 -0700
+Subject: ipmi: Use dev_warn_ratelimited() for incorrect message warnings
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit ec50ec378e3fd83bde9b3d622ceac3509a60b6b5 ]
+
+During BMC firmware upgrades on live systems, the ipmi_msghandler
+generates excessive "BMC returned incorrect response" warnings
+while the BMC is temporarily offline. This can flood system logs
+in large deployments.
+
+Replace dev_warn() with dev_warn_ratelimited() to throttle these
+warnings and prevent log spam during BMC maintenance operations.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Message-ID: <20250710-ipmi_ratelimit-v1-1-6d417015ebe9@debian.org>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 6047c9600e03..808d0d213509 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -4615,10 +4615,10 @@ static int handle_one_recv_msg(struct ipmi_smi *intf,
+ * The NetFN and Command in the response is not even
+ * marginally correct.
+ */
+- dev_warn(intf->si_dev,
+- "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
+- (msg->data[0] >> 2) | 1, msg->data[1],
+- msg->rsp[0] >> 2, msg->rsp[1]);
++ dev_warn_ratelimited(intf->si_dev,
++ "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
++ (msg->data[0] >> 2) | 1, msg->data[1],
++ msg->rsp[0] >> 2, msg->rsp[1]);
+
+ goto return_unspecified;
+ }
+--
+2.39.5
+
--- /dev/null
+From 1af615e8ad56850b74297a2d1b50a41869df669e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 16:01:20 -0700
+Subject: ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
+ __ipv6_dev_mc_inc().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit dbd40f318cf2f59759bd170c401adc20ba360a3e ]
+
+Since commit 63ed8de4be81 ("mld: add mc_lock for protecting
+per-interface mld data"), every multicast resource is protected
+by inet6_dev->mc_lock.
+
+RTNL is unnecessary in terms of protection but still needed for
+synchronisation between addrconf_ifdown() and __ipv6_dev_mc_inc().
+
+Once we removed RTNL, there would be a race below, where we could
+add a multicast address to a dead inet6_dev.
+
+ CPU1 CPU2
+ ==== ====
+ addrconf_ifdown() __ipv6_dev_mc_inc()
+ if (idev->dead) <-- false
+ dead = true return -ENODEV;
+ ipv6_mc_destroy_dev() / ipv6_mc_down()
+ mutex_lock(&idev->mc_lock)
+ ...
+ mutex_unlock(&idev->mc_lock)
+ mutex_lock(&idev->mc_lock)
+ ...
+ mutex_unlock(&idev->mc_lock)
+
+The race window can be easily closed by checking inet6_dev->dead
+under inet6_dev->mc_lock in __ipv6_dev_mc_inc() as addrconf_ifdown()
+will acquire it after marking inet6_dev dead.
+
+Let's check inet6_dev->dead under mc_lock in __ipv6_dev_mc_inc().
+
+Note that now __ipv6_dev_mc_inc() no longer depends on RTNL and
+we can remove ASSERT_RTNL() there and the RTNL comment above
+addrconf_join_solict().
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250702230210.3115355-4-kuni1840@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 7 +++----
+ net/ipv6/mcast.c | 11 +++++------
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4ef3a3c166c6..7881637f6518 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2229,13 +2229,12 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
+ in6_ifa_put(ifp);
+ }
+
+-/* Join to solicited addr multicast group.
+- * caller must hold RTNL */
++/* Join to solicited addr multicast group. */
+ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
+ {
+ struct in6_addr maddr;
+
+- if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
++ if (READ_ONCE(dev->flags) & (IFF_LOOPBACK | IFF_NOARP))
+ return;
+
+ addrconf_addr_solict_mult(addr, &maddr);
+@@ -3860,7 +3859,7 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
+ * Do not dev_put!
+ */
+ if (unregister) {
+- idev->dead = 1;
++ WRITE_ONCE(idev->dead, 1);
+
+ /* protected by rtnl_lock */
+ RCU_INIT_POINTER(dev->ip6_ptr, NULL);
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 616bf4c0c8fd..b91538e90c54 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -945,23 +945,22 @@ static void inet6_ifmcaddr_notify(struct net_device *dev,
+ static int __ipv6_dev_mc_inc(struct net_device *dev,
+ const struct in6_addr *addr, unsigned int mode)
+ {
+- struct ifmcaddr6 *mc;
+ struct inet6_dev *idev;
+-
+- ASSERT_RTNL();
++ struct ifmcaddr6 *mc;
+
+ /* we need to take a reference on idev */
+ idev = in6_dev_get(dev);
+-
+ if (!idev)
+ return -EINVAL;
+
+- if (idev->dead) {
++ mutex_lock(&idev->mc_lock);
++
++ if (READ_ONCE(idev->dead)) {
++ mutex_unlock(&idev->mc_lock);
+ in6_dev_put(idev);
+ return -ENODEV;
+ }
+
+- mutex_lock(&idev->mc_lock);
+ for_each_mc_mclock(idev, mc) {
+ if (ipv6_addr_equal(&mc->mca_addr, addr)) {
+ mc->mca_users++;
+--
+2.39.5
+
--- /dev/null
+From 51d96a331a54e982b4e33e136747570432be8c24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jun 2025 01:49:51 -0400
+Subject: irqchip/mips-gic: Allow forced affinity
+
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+
+[ Upstream commit 2250db8628a0d8293ad2e0671138b848a185fba1 ]
+
+Devices of the Realtek MIPS Otto platform use the official rtl-otto-timer
+as clock event generator and CPU clocksource. It is registered for each CPU
+startup via cpuhp_setup_state() and forces the affinity of the clockevent
+interrupts to the appropriate CPU via irq_force_affinity().
+
+On the "smaller" devices with a vendor specific interrupt controller
+(supported by irq-realtek-rtl) the registration works fine. The "larger"
+RTL931x series is based on a MIPS interAptiv dual core with a MIPS GIC
+controller. Interrupt routing setup is cancelled because gic_set_affinity()
+does not accept the current (not yet online) CPU as a target.
+
+Relax the checks by evaluating the force parameter that is provided for
+exactly this purpose like in other drivers. With this the affinity can be
+set as follows:
+
+ - force = false: allow to set affinity to any online cpu
+ - force = true: allow to set affinity to any cpu
+
+Co-developed-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250621054952.380374-1-markus.stockhausen@gmx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mips-gic.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index bca8053864b2..1c2284297354 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -375,9 +375,13 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
+ /*
+ * The GIC specifies that we can only route an interrupt to one VP(E),
+ * ie. CPU in Linux parlance, at a time. Therefore we always route to
+- * the first online CPU in the mask.
++ * the first forced or online CPU in the mask.
+ */
+- cpu = cpumask_first_and(cpumask, cpu_online_mask);
++ if (force)
++ cpu = cpumask_first(cpumask);
++ else
++ cpu = cpumask_first_and(cpumask, cpu_online_mask);
++
+ if (cpu >= NR_CPUS)
+ return -EINVAL;
+
+--
+2.39.5
+
--- /dev/null
+From ccd64ed6cccc044184c6b9e8816d9ebea9bb5947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 11:59:21 +0100
+Subject: irqchip/renesas-rzv2h: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit de2942828e7670526289f098df7e50b112e8ff1e ]
+
+The interrupt controller found on RZ/G3E doesn't provide any facility to
+configure the wakeup sources. That's the reason why the driver lacks the
+irq_set_wake() callback for the interrupt chip.
+
+But this prevent to properly enter power management states like "suspend to
+idle".
+
+Enable the flags IRQCHIP_SKIP_SET_WAKE and IRQCHIP_MASK_ON_SUSPEND so the
+interrupt suspend logic can handle the chip correctly.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/all/20250701105923.52151-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-renesas-rzv2h.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-renesas-rzv2h.c b/drivers/irqchip/irq-renesas-rzv2h.c
+index 0f0fd7d4dfdf..f1f7869b49cb 100644
+--- a/drivers/irqchip/irq-renesas-rzv2h.c
++++ b/drivers/irqchip/irq-renesas-rzv2h.c
+@@ -394,7 +394,9 @@ static const struct irq_chip rzv2h_icu_chip = {
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_set_type = rzv2h_icu_set_type,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+- .flags = IRQCHIP_SET_TYPE_MASKED,
++ .flags = IRQCHIP_MASK_ON_SUSPEND |
++ IRQCHIP_SET_TYPE_MASKED |
++ IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ static int rzv2h_icu_alloc(struct irq_domain *domain, unsigned int virq, unsigned int nr_irqs,
+--
+2.39.5
+
--- /dev/null
+From e4356ce31b3b5d7460dedb8859ef8a5d9c4546c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jun 2025 14:48:43 +0800
+Subject: jfs: Regular file corruption check
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 2d04df8116426b6c7b9f8b9b371250f666a2a2fb ]
+
+The reproducer builds a corrupted file on disk with a negative i_size value.
+Add a check when opening this file to avoid subsequent operation failures.
+
+Reported-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=630f6d40b3ccabc8e96e
+Tested-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/file.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jfs/file.c b/fs/jfs/file.c
+index 01b6912e60f8..742cadd1f37e 100644
+--- a/fs/jfs/file.c
++++ b/fs/jfs/file.c
+@@ -44,6 +44,9 @@ static int jfs_open(struct inode *inode, struct file *file)
+ {
+ int rc;
+
++ if (S_ISREG(inode->i_mode) && inode->i_size < 0)
++ return -EIO;
++
+ if ((rc = dquot_file_open(inode, file)))
+ return rc;
+
+--
+2.39.5
+
--- /dev/null
+From c4c338f2b7dc420b5bbf3d74dc38210d850d3417 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 11:05:34 +0800
+Subject: jfs: truncate good inode pages when hard link is 0
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 2d91b3765cd05016335cd5df5e5c6a29708ec058 ]
+
+The fileset value of the inode copy from the disk by the reproducer is
+AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its
+inode pages are not truncated. This causes the bugon to be triggered when
+executing clear_inode() because nrpages is greater than 0.
+
+Reported-by: syzbot+6e516bb515d93230bc7b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6e516bb515d93230bc7b
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 60fc92dee24d..81e6b18e81e1 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -145,9 +145,9 @@ void jfs_evict_inode(struct inode *inode)
+ if (!inode->i_nlink && !is_bad_inode(inode)) {
+ dquot_initialize(inode);
+
++ truncate_inode_pages_final(&inode->i_data);
+ if (JFS_IP(inode)->fileset == FILESYSTEM_I) {
+ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap;
+- truncate_inode_pages_final(&inode->i_data);
+
+ if (test_cflag(COMMIT_Freewmap, inode))
+ jfs_free_zero_link(inode);
+--
+2.39.5
+
--- /dev/null
+From acc02aecb00645dfc1eb1d09586afb9fe5c24e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 00:13:51 +0200
+Subject: jfs: upper bound check of tree index in dbAllocAG
+
+From: Arnaud Lecomte <contact@arnaud-lcm.com>
+
+[ Upstream commit c214006856ff52a8ff17ed8da52d50601d54f9ce ]
+
+When computing the tree index in dbAllocAG, we never check if we are
+out of bounds realative to the size of the stree.
+This could happen in a scenario where the filesystem metadata are
+corrupted.
+
+Reported-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e
+Tested-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
+Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 5a877261c3fe..cdfa699cd7c8 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -1389,6 +1389,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
+ (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
+ ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
+
++ if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) {
++ jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");
++ release_metapage(mp);
++ return -EIO;
++ }
++
+ /* dmap control page trees fan-out by 4 and a single allocation
+ * group may be described by 1 or 2 subtrees within the ag level
+ * dmap control page, depending upon the ag size. examine the ag's
+--
+2.39.5
+
--- /dev/null
+From 19c869dc0c62f95d3d6ebeb6dfc94c923e73c766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 00:05:20 +0900
+Subject: kconfig: gconf: avoid hardcoding model2 in
+ on_treeview2_cursor_changed()
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit cae9cdbcd9af044810bcceeb43a87accca47c71d ]
+
+The on_treeview2_cursor_changed() handler is connected to both the left
+and right tree views, but it hardcodes model2 (the GtkTreeModel of the
+right tree view). This is incorrect. Get the associated model from the
+view.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/gconf.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c
+index c0f46f189060..abe4cfe66b14 100644
+--- a/scripts/kconfig/gconf.c
++++ b/scripts/kconfig/gconf.c
+@@ -942,13 +942,14 @@ on_treeview2_key_press_event(GtkWidget * widget,
+ void
+ on_treeview2_cursor_changed(GtkTreeView * treeview, gpointer user_data)
+ {
++ GtkTreeModel *model = gtk_tree_view_get_model(treeview);
+ GtkTreeSelection *selection;
+ GtkTreeIter iter;
+ struct menu *menu;
+
+ selection = gtk_tree_view_get_selection(treeview);
+- if (gtk_tree_selection_get_selected(selection, &model2, &iter)) {
+- gtk_tree_model_get(model2, &iter, COL_MENU, &menu, -1);
++ if (gtk_tree_selection_get_selected(selection, &model, &iter)) {
++ gtk_tree_model_get(model, &iter, COL_MENU, &menu, -1);
+ text_insert_help(menu);
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From f228c7981395bcb17b4217a7fc2f13bf3c278e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 00:04:55 +0900
+Subject: kconfig: gconf: fix potential memory leak in renderer_edited()
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit f72ed4c6a375e52a3f4b75615e4a89d29d8acea7 ]
+
+If gtk_tree_model_get_iter() fails, gtk_tree_path_free() is not called.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/gconf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c
+index abe4cfe66b14..0caf0ced13df 100644
+--- a/scripts/kconfig/gconf.c
++++ b/scripts/kconfig/gconf.c
+@@ -748,7 +748,7 @@ static void renderer_edited(GtkCellRendererText * cell,
+ struct symbol *sym;
+
+ if (!gtk_tree_model_get_iter(model2, &iter, path))
+- return;
++ goto free;
+
+ gtk_tree_model_get(model2, &iter, COL_MENU, &menu, -1);
+ sym = menu->sym;
+@@ -760,6 +760,7 @@ static void renderer_edited(GtkCellRendererText * cell,
+
+ update_tree(&rootmenu, NULL);
+
++free:
+ gtk_tree_path_free(path);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From ce5e59f2dbc7099d442a0cee3cbf702a892faeac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2013 00:53:32 +0100
+Subject: kconfig: lxdialog: fix 'space' to (de)select options
+
+From: Yann E. MORIN <yann.morin.1998@free.fr>
+
+[ Upstream commit 694174f94ebeeb5ec5cc0e9de9b40c82057e1d95 ]
+
+In case a menu has comment without letters/numbers (eg. characters
+matching the regexp '^[^[:alpha:][:digit:]]+$', for example - or *),
+hitting space will cycle through those comments, rather than
+selecting/deselecting the currently-highlighted option.
+
+This is the behaviour of hitting any letter/digit: jump to the next
+option which prompt starts with that letter. The only letters that
+do not behave as such are 'y' 'm' and 'n'. Prompts that start with
+one of those three letters are instead matched on the first letter
+that is not 'y', 'm' or 'n'.
+
+Fix that by treating 'space' as we treat y/m/n, ie. as an action key,
+not as shortcut to jump to prompt.
+
+Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+Signed-off-by: Cherniaev Andrei <dungeonlords789@naver.com>
+[masahiro: took from Buildroot, adjusted the commit subject]
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/lxdialog/menubox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/lxdialog/menubox.c b/scripts/kconfig/lxdialog/menubox.c
+index 6e6244df0c56..d4c19b7beebb 100644
+--- a/scripts/kconfig/lxdialog/menubox.c
++++ b/scripts/kconfig/lxdialog/menubox.c
+@@ -264,7 +264,7 @@ int dialog_menu(const char *title, const char *prompt,
+ if (key < 256 && isalpha(key))
+ key = tolower(key);
+
+- if (strchr("ynmh", key))
++ if (strchr("ynmh ", key))
+ i = max_choice;
+ else {
+ for (i = choice + 1; i < max_choice; i++) {
+--
+2.39.5
+
--- /dev/null
+From e236d712311847531e2ff64e14015a48aa68b63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 22:14:33 +0530
+Subject: kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
+
+From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+
+[ Upstream commit 5ac726653a1029a2eccba93bbe59e01fc9725828 ]
+
+strcpy() performs no bounds checking and can lead to buffer overflows if
+the input string exceeds the destination buffer size. This patch replaces
+it with strncpy(), and null terminates the input string.
+
+Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Reviewed-by: Nicolas Schier <nicolas.schier@linux.dev>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/lxdialog/inputbox.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c
+index 3c6e24b20f5b..5e4a131724f2 100644
+--- a/scripts/kconfig/lxdialog/inputbox.c
++++ b/scripts/kconfig/lxdialog/inputbox.c
+@@ -39,8 +39,10 @@ int dialog_inputbox(const char *title, const char *prompt, int height, int width
+
+ if (!init)
+ instr[0] = '\0';
+- else
+- strcpy(instr, init);
++ else {
++ strncpy(instr, init, sizeof(dialog_input_result) - 1);
++ instr[sizeof(dialog_input_result) - 1] = '\0';
++ }
+
+ do_resize:
+ if (getmaxy(stdscr) <= (height - INPUTBOX_HEIGHT_MIN))
+--
+2.39.5
+
--- /dev/null
+From f28ebde689f996b0599d2a05974d8528375e1fa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 00:36:54 +0530
+Subject: kconfig: nconf: Ensure null termination where strncpy is used
+
+From: Shankari Anand <shankari.ak0208@gmail.com>
+
+[ Upstream commit f468992936894c9ce3b1659cf38c230d33b77a16 ]
+
+strncpy() does not guarantee null-termination if the source string is
+longer than the destination buffer.
+
+Ensure the buffer is explicitly null-terminated to prevent potential
+string overflows or undefined behavior.
+
+Signed-off-by: Shankari Anand <shankari.ak0208@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Nicolas Schier <n.schier@avm.de>
+Acked-by: Nicolas Schier <n.schier@avm.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/nconf.c | 2 ++
+ scripts/kconfig/nconf.gui.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
+index c0b2dabf6c89..ae1fe5f60327 100644
+--- a/scripts/kconfig/nconf.c
++++ b/scripts/kconfig/nconf.c
+@@ -593,6 +593,8 @@ static void item_add_str(const char *fmt, ...)
+ tmp_str,
+ sizeof(k_menu_items[index].str));
+
++ k_menu_items[index].str[sizeof(k_menu_items[index].str) - 1] = '\0';
++
+ free_item(curses_menu_items[index]);
+ curses_menu_items[index] = new_item(
+ k_menu_items[index].str,
+diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
+index 4bfdf8ac2a9a..7206437e784a 100644
+--- a/scripts/kconfig/nconf.gui.c
++++ b/scripts/kconfig/nconf.gui.c
+@@ -359,6 +359,7 @@ int dialog_inputbox(WINDOW *main_window,
+ x = (columns-win_cols)/2;
+
+ strncpy(result, init, *result_len);
++ result[*result_len - 1] = '\0';
+
+ /* create the windows */
+ win = newwin(win_lines, win_cols, y, x);
+--
+2.39.5
+
--- /dev/null
+From 0fae731f7cb58e840bff27e0466daa57d4731d44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 01:59:55 +0900
+Subject: kheaders: rebuild kheaders_data.tar.xz when a file is modified within
+ a minute
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 626c54af35764b0b8a4ed5c446458ba6ddfe9cc8 ]
+
+When a header file is changed, kernel/gen_kheaders.sh may fail to update
+kernel/kheaders_data.tar.xz.
+
+[steps to reproduce]
+
+[1] Build kernel/kheaders_data.tar.xz
+
+ $ make -j$(nproc) kernel/kheaders.o
+ DESCEND objtool
+ INSTALL libsubcmd_headers
+ CALL scripts/checksyscalls.sh
+ CHK kernel/kheaders_data.tar.xz
+ GEN kernel/kheaders_data.tar.xz
+ CC kernel/kheaders.o
+
+[2] Modify a header without changing the file size
+
+ $ sed -i s/0xdeadbeef/0xfeedbeef/ include/linux/elfnote.h
+
+[3] Rebuild kernel/kheaders_data.tar.xz
+
+ $ make -j$(nproc) kernel/kheaders.o
+ DESCEND objtool
+ INSTALL libsubcmd_headers
+ CALL scripts/checksyscalls.sh
+ CHK kernel/kheaders_data.tar.xz
+
+kernel/kheaders_data.tar.xz is not updated if steps [1] - [3] are run
+within the same minute.
+
+The headers_md5 variable stores the MD5 hash of the 'ls -l' output
+for all header files. This hash value is used to determine whether
+kheaders_data.tar.xz needs to be rebuilt. However, 'ls -l' prints the
+modification times with minute-level granularity. If a file is modified
+within the same minute and its size remains the same, the MD5 hash does
+not change.
+
+To reliably detect file modifications, this commit rewrites
+kernel/gen_kheaders.sh to output header dependencies to
+kernel/.kheaders_data.tar.xz.cmd. Then, Make compares the timestamps
+and reruns kernel/gen_kheaders.sh when necessary. This is the standard
+mechanism used by Make and Kbuild.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/.gitignore | 2 +
+ kernel/Makefile | 47 ++++++++++++++++++---
+ kernel/gen_kheaders.sh | 94 ++++++++++--------------------------------
+ 3 files changed, 66 insertions(+), 77 deletions(-)
+
+diff --git a/kernel/.gitignore b/kernel/.gitignore
+index c6b299a6b786..a501bfc80694 100644
+--- a/kernel/.gitignore
++++ b/kernel/.gitignore
+@@ -1,3 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ /config_data
+ /kheaders.md5
++/kheaders-objlist
++/kheaders-srclist
+diff --git a/kernel/Makefile b/kernel/Makefile
+index 434929de17ef..96a8798c9c64 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -156,11 +156,48 @@ filechk_cat = cat $<
+ $(obj)/config_data: $(KCONFIG_CONFIG) FORCE
+ $(call filechk,cat)
+
++# kheaders_data.tar.xz
+ $(obj)/kheaders.o: $(obj)/kheaders_data.tar.xz
+
+-quiet_cmd_genikh = CHK $(obj)/kheaders_data.tar.xz
+- cmd_genikh = $(CONFIG_SHELL) $(srctree)/kernel/gen_kheaders.sh $@
+-$(obj)/kheaders_data.tar.xz: FORCE
+- $(call cmd,genikh)
++quiet_cmd_kheaders_data = GEN $@
++ cmd_kheaders_data = "$<" "$@" "$(obj)/kheaders-srclist" "$(obj)/kheaders-objlist"
++ cmd_kheaders_data_dep = cat $(depfile) >> $(dot-target).cmd; rm -f $(depfile)
+
+-clean-files := kheaders_data.tar.xz kheaders.md5
++define rule_kheaders_data
++ $(call cmd_and_savecmd,kheaders_data)
++ $(call cmd,kheaders_data_dep)
++endef
++
++targets += kheaders_data.tar.xz
++$(obj)/kheaders_data.tar.xz: $(src)/gen_kheaders.sh $(obj)/kheaders-srclist $(obj)/kheaders-objlist $(obj)/kheaders.md5 FORCE
++ $(call if_changed_rule,kheaders_data)
++
++# generated headers in objtree
++#
++# include/generated/utsversion.h is ignored because it is generated
++# after gen_kheaders.sh is executed. (utsversion.h is unneeded for kheaders)
++filechk_kheaders_objlist = \
++ for d in include "arch/$(SRCARCH)/include"; do \
++ find "$${d}/generated" ! -path "include/generated/utsversion.h" -a -name "*.h" -print; \
++ done
++
++$(obj)/kheaders-objlist: FORCE
++ $(call filechk,kheaders_objlist)
++
++# non-generated headers in srctree
++filechk_kheaders_srclist = \
++ for d in include "arch/$(SRCARCH)/include"; do \
++ find "$(srctree)/$${d}" -path "$(srctree)/$${d}/generated" -prune -o -name "*.h" -print; \
++ done
++
++$(obj)/kheaders-srclist: FORCE
++ $(call filechk,kheaders_srclist)
++
++# Some files are symlinks. If symlinks are changed, kheaders_data.tar.xz should
++# be rebuilt.
++filechk_kheaders_md5sum = xargs -r -a $< stat -c %N | md5sum
++
++$(obj)/kheaders.md5: $(obj)/kheaders-srclist FORCE
++ $(call filechk,kheaders_md5sum)
++
++clean-files := kheaders.md5 kheaders-srclist kheaders-objlist
+diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
+index c9e5dc068e85..0ff7beabb21a 100755
+--- a/kernel/gen_kheaders.sh
++++ b/kernel/gen_kheaders.sh
+@@ -4,79 +4,33 @@
+ # This script generates an archive consisting of kernel headers
+ # for CONFIG_IKHEADERS.
+ set -e
+-sfile="$(readlink -f "$0")"
+-outdir="$(pwd)"
+ tarfile=$1
+-tmpdir=$outdir/${tarfile%/*}/.tmp_dir
+-
+-dir_list="
+-include/
+-arch/$SRCARCH/include/
+-"
+-
+-# Support incremental builds by skipping archive generation
+-# if timestamps of files being archived are not changed.
+-
+-# This block is useful for debugging the incremental builds.
+-# Uncomment it for debugging.
+-# if [ ! -f /tmp/iter ]; then iter=1; echo 1 > /tmp/iter;
+-# else iter=$(($(cat /tmp/iter) + 1)); echo $iter > /tmp/iter; fi
+-# find $all_dirs -name "*.h" | xargs ls -l > /tmp/ls-$iter
+-
+-all_dirs=
+-if [ "$building_out_of_srctree" ]; then
+- for d in $dir_list; do
+- all_dirs="$all_dirs $srctree/$d"
+- done
+-fi
+-all_dirs="$all_dirs $dir_list"
+-
+-# include/generated/utsversion.h is ignored because it is generated after this
+-# script is executed. (utsversion.h is unneeded for kheaders)
+-#
+-# When Kconfig regenerates include/generated/autoconf.h, its timestamp is
+-# updated, but the contents might be still the same. When any CONFIG option is
+-# changed, Kconfig touches the corresponding timestamp file include/config/*.
+-# Hence, the md5sum detects the configuration change anyway. We do not need to
+-# check include/generated/autoconf.h explicitly.
+-#
+-# Ignore them for md5 calculation to avoid pointless regeneration.
+-headers_md5="$(find $all_dirs -name "*.h" -a \
+- ! -path include/generated/utsversion.h -a \
+- ! -path include/generated/autoconf.h |
+- xargs ls -l | md5sum | cut -d ' ' -f1)"
+-
+-# Any changes to this script will also cause a rebuild of the archive.
+-this_file_md5="$(ls -l $sfile | md5sum | cut -d ' ' -f1)"
+-if [ -f $tarfile ]; then tarfile_md5="$(md5sum $tarfile | cut -d ' ' -f1)"; fi
+-if [ -f kernel/kheaders.md5 ] &&
+- [ "$(head -n 1 kernel/kheaders.md5)" = "$headers_md5" ] &&
+- [ "$(head -n 2 kernel/kheaders.md5 | tail -n 1)" = "$this_file_md5" ] &&
+- [ "$(tail -n 1 kernel/kheaders.md5)" = "$tarfile_md5" ]; then
+- exit
+-fi
+-
+-echo " GEN $tarfile"
++srclist=$2
++objlist=$3
++
++dir=$(dirname "${tarfile}")
++tmpdir=${dir}/.tmp_dir
++depfile=${dir}/.$(basename "${tarfile}").d
++
++# generate dependency list.
++{
++ echo
++ echo "deps_${tarfile} := \\"
++ sed 's:\(.*\): \1 \\:' "${srclist}"
++ sed -n '/^include\/generated\/autoconf\.h$/!s:\(.*\): \1 \\:p' "${objlist}"
++ echo
++ echo "${tarfile}: \$(deps_${tarfile})"
++ echo
++ echo "\$(deps_${tarfile}):"
++
++} > "${depfile}"
+
+ rm -rf "${tmpdir}"
+ mkdir "${tmpdir}"
+
+-if [ "$building_out_of_srctree" ]; then
+- (
+- cd $srctree
+- for f in $dir_list
+- do find "$f" -name "*.h";
+- done | tar -c -f - -T - | tar -xf - -C "${tmpdir}"
+- )
+-fi
+-
+-for f in $dir_list;
+- do find "$f" -name "*.h";
+-done | tar -c -f - -T - | tar -xf - -C "${tmpdir}"
+-
+-# Always exclude include/generated/utsversion.h
+-# Otherwise, the contents of the tarball may vary depending on the build steps.
+-rm -f "${tmpdir}/include/generated/utsversion.h"
++# shellcheck disable=SC2154 # srctree is passed as an env variable
++sed "s:^${srctree}/::" "${srclist}" | tar -c -f - -C "${srctree}" -T - | tar -xf - -C "${tmpdir}"
++tar -c -f - -T "${objlist}" | tar -xf - -C "${tmpdir}"
+
+ # Remove comments except SDPX lines
+ # Use a temporary file to store directory contents to prevent find/xargs from
+@@ -92,8 +46,4 @@ tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
+ --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \
+ -I $XZ -cf $tarfile -C "${tmpdir}/" . > /dev/null
+
+-echo $headers_md5 > kernel/kheaders.md5
+-echo "$this_file_md5" >> kernel/kheaders.md5
+-echo "$(md5sum $tarfile | cut -d ' ' -f1)" >> kernel/kheaders.md5
+-
+ rm -rf "${tmpdir}"
+--
+2.39.5
+
--- /dev/null
+From 8cdfdd8be175e8ae16adab85952e03874d9eb398 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 16:25:33 +0100
+Subject: kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 9e8ebfe677f9101bbfe1f75d548a5aec581e8213 ]
+
+Since f916dd32a943 ("arm64/fpsimd: ptrace: Mandate SVE payload for
+streaming-mode state") we reject attempts to write to the streaming mode
+regset even if there is no register data supplied, causing the tests for
+setting vector lengths and setting SVE_VL_INHERIT in sve-ptrace to
+spuriously fail. Set the flag to avoid the issue, we still support not
+supplying register data.
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20250609-kselftest-arm64-ssve-fixups-v2-3-998fcfa6f240@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/fp/sve-ptrace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+index c499d5789dd5..16320aeaff85 100644
+--- a/tools/testing/selftests/arm64/fp/sve-ptrace.c
++++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+@@ -170,7 +170,7 @@ static void ptrace_set_get_inherit(pid_t child, const struct vec_type *type)
+ memset(&sve, 0, sizeof(sve));
+ sve.size = sizeof(sve);
+ sve.vl = sve_vl_from_vq(SVE_VQ_MIN);
+- sve.flags = SVE_PT_VL_INHERIT;
++ sve.flags = SVE_PT_VL_INHERIT | SVE_PT_REGS_SVE;
+ ret = set_sve(child, type, &sve);
+ if (ret != 0) {
+ ksft_test_result_fail("Failed to set %s SVE_PT_VL_INHERIT\n",
+@@ -235,6 +235,7 @@ static void ptrace_set_get_vl(pid_t child, const struct vec_type *type,
+ /* Set the VL by doing a set with no register payload */
+ memset(&sve, 0, sizeof(sve));
+ sve.size = sizeof(sve);
++ sve.flags = SVE_PT_REGS_SVE;
+ sve.vl = vl;
+ ret = set_sve(child, type, &sve);
+ if (ret != 0) {
+--
+2.39.5
+
--- /dev/null
+From a93347c8eff2cd9520252bc45e8902b0f151d9a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 16:18:44 -0400
+Subject: ktest.pl: Prevent recursion of default variable options
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+[ Upstream commit 61f7e318e99d3b398670518dd3f4f8510d1800fc ]
+
+If a default variable contains itself, do not recurse on it.
+
+For example:
+
+ ADD_CONFIG := ${CONFIG_DIR}/temp_config
+ DEFAULTS
+ ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG}
+
+The above works because the temp variable ADD_CONFIG (is a temp because it
+is created with ":=") is already defined, it will be substituted in the
+variable option. But if it gets commented out:
+
+ # ADD_CONFIG := ${CONFIG_DIR}/temp_config
+ DEFAULTS
+ ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG}
+
+Then the above will go into a recursive loop where ${ADD_CONFIG} will
+get replaced with the current definition of ADD_CONFIG which contains the
+${ADD_CONFIG} and that will also try to get converted. ktest.pl will error
+after 100 attempts of recursion and fail.
+
+When replacing a variable with the default variable, if the default
+variable contains itself, do not replace it.
+
+Cc: "John Warthog9 Hawley" <warthog9@kernel.org>
+Cc: Dhaval Giani <dhaval.giani@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/20250718202053.732189428@kernel.org
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/ktest/ktest.pl | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index a5f7fdd0c1fb..e1d31e2aa948 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -1371,7 +1371,10 @@ sub __eval_option {
+ # If a variable contains itself, use the default var
+ if (($var eq $name) && defined($opt{$var})) {
+ $o = $opt{$var};
+- $retval = "$retval$o";
++ # Only append if the default doesn't contain itself
++ if ($o !~ m/\$\{$var\}/) {
++ $retval = "$retval$o";
++ }
+ } elsif (defined($opt{$o})) {
+ $o = $opt{$o};
+ $retval = "$retval$o";
+--
+2.39.5
+
--- /dev/null
+From daac9d52bdfd5ffde3f43d5fd71ebe9b1324edc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 May 2025 22:39:51 -0400
+Subject: landlock: opened file never has a negative dentry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit d1832e648d2be564e4b5e357f94d0f33156590dc ]
+
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Acked-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/landlock/syscalls.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c
+index 33eafb71e4f3..0116e9f93ffe 100644
+--- a/security/landlock/syscalls.c
++++ b/security/landlock/syscalls.c
+@@ -303,7 +303,6 @@ static int get_path_from_fd(const s32 fd, struct path *const path)
+ if ((fd_file(f)->f_op == &ruleset_fops) ||
+ (fd_file(f)->f_path.mnt->mnt_flags & MNT_INTERNAL) ||
+ (fd_file(f)->f_path.dentry->d_sb->s_flags & SB_NOUSER) ||
+- d_is_negative(fd_file(f)->f_path.dentry) ||
+ IS_PRIVATE(d_backing_inode(fd_file(f)->f_path.dentry)))
+ return -EBADFD;
+
+--
+2.39.5
+
--- /dev/null
+From 3b09af4df16ea8cb4d495c1ce6a5ca09395c435d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jun 2025 12:23:54 +0200
+Subject: leds: leds-lp50xx: Handle reg to get correct multi_index
+
+From: Johan Adolfsson <johan.adolfsson@axis.com>
+
+[ Upstream commit 2e84a5e5374232e6f356ce5c079a5658d7e4af2c ]
+
+mc_subled used for multi_index needs well defined array indexes,
+to guarantee the desired result, use reg for that.
+
+If devicetree child nodes is processed in random or reverse order
+you may end up with multi_index "blue green red" instead of the expected
+"red green blue".
+If user space apps uses multi_index to deduce how to control the leds
+they would most likely be broken without this patch if devicetree
+processing is reversed (which it appears to be).
+
+arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-fuji.dts has reg set
+but I don't see how it can have worked without this change.
+
+If reg is not set, an error is returned,
+If reg is out of range, an error is returned.
+reg within led child nodes starts with 0, to map to the iout in each bank.
+
+Signed-off-by: Johan Adolfsson <johan.adolfsson@axis.com>
+Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Link: https://lore.kernel.org/r/20250617-led-fix-v7-1-cdbe8efc88fa@axis.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp50xx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
+index 02cb1565a9fb..94f8ef6b482c 100644
+--- a/drivers/leds/leds-lp50xx.c
++++ b/drivers/leds/leds-lp50xx.c
+@@ -476,6 +476,7 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
+ return -ENOMEM;
+
+ fwnode_for_each_child_node(child, led_node) {
++ int multi_index;
+ ret = fwnode_property_read_u32(led_node, "color",
+ &color_id);
+ if (ret) {
+@@ -483,8 +484,16 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
+ dev_err(priv->dev, "Cannot read color\n");
+ return ret;
+ }
++ ret = fwnode_property_read_u32(led_node, "reg", &multi_index);
++ if (ret != 0) {
++ dev_err(priv->dev, "reg must be set\n");
++ return -EINVAL;
++ } else if (multi_index >= LP50XX_LEDS_PER_MODULE) {
++ dev_err(priv->dev, "reg %i out of range\n", multi_index);
++ return -EINVAL;
++ }
+
+- mc_led_info[num_colors].color_index = color_id;
++ mc_led_info[multi_index].color_index = color_id;
+ num_colors++;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b5a0ef14bf45bca26ac078bab62d384cdd2092ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 08:50:44 -0500
+Subject: lib: packing: Include necessary headers
+
+From: Nathan Lynch <nathan.lynch@amd.com>
+
+[ Upstream commit 8bd0af3154b2206ce19f8b1410339f7a2a56d0c3 ]
+
+packing.h uses ARRAY_SIZE(), BUILD_BUG_ON_MSG(), min(), max(), and
+sizeof_field() without including the headers where they are defined,
+potentially causing build failures.
+
+Fix this in packing.h and sort the result.
+
+Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250624-packing-includes-v1-1-c23c81fab508@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/packing.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/packing.h b/include/linux/packing.h
+index 0589d70bbe04..20ae4d452c7b 100644
+--- a/include/linux/packing.h
++++ b/include/linux/packing.h
+@@ -5,8 +5,12 @@
+ #ifndef _LINUX_PACKING_H
+ #define _LINUX_PACKING_H
+
+-#include <linux/types.h>
++#include <linux/array_size.h>
+ #include <linux/bitops.h>
++#include <linux/build_bug.h>
++#include <linux/minmax.h>
++#include <linux/stddef.h>
++#include <linux/types.h>
+
+ #define GEN_PACKED_FIELD_STRUCT(__type) \
+ struct packed_field_ ## __type { \
+--
+2.39.5
+
--- /dev/null
+From dcaa0330819503dd0a5b743956e3865a76671d00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 11:24:12 +0800
+Subject: lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 42e6c6ce03fd3e41e39a0f93f9b1a1d9fa664338 ]
+
+Currently elevators will record internal 'async_depth' to throttle
+asynchronous requests, and they both calculate shallow_dpeth based on
+sb->shift, with the respect that sb->shift is the available tags in one
+word.
+
+However, sb->shift is not the availbale tags in the last word, see
+__map_depth:
+
+if (index == sb->map_nr - 1)
+ return sb->depth - (index << sb->shift);
+
+For consequence, if the last word is used, more tags can be get than
+expected, for example, assume nr_requests=256 and there are four words,
+in the worst case if user set nr_requests=32, then the first word is
+the last word, and still use bits per word, which is 64, to calculate
+async_depth is wrong.
+
+One the ohter hand, due to cgroup qos, bfq can allow only one request
+to be allocated, and set shallow_dpeth=1 will still allow the number
+of words request to be allocated.
+
+Fix this problems by using shallow_depth to the whole sbitmap instead
+of per word, also change kyber, mq-deadline and bfq to follow this,
+a new helper __map_depth_with_shallow() is introduced to calculate
+available bits in each word.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250807032413.1469456-2-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 35 ++++++++++++--------------
+ block/bfq-iosched.h | 3 +--
+ block/kyber-iosched.c | 9 ++-----
+ block/mq-deadline.c | 16 +-----------
+ include/linux/sbitmap.h | 6 ++---
+ lib/sbitmap.c | 56 +++++++++++++++++++++--------------------
+ 6 files changed, 52 insertions(+), 73 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index abd80dc13562..67c42d276e8a 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -701,17 +701,13 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ {
+ struct bfq_data *bfqd = data->q->elevator->elevator_data;
+ struct bfq_io_cq *bic = bfq_bic_lookup(data->q);
+- int depth;
+- unsigned limit = data->q->nr_requests;
+- unsigned int act_idx;
++ unsigned int limit, act_idx;
+
+ /* Sync reads have full depth available */
+- if (op_is_sync(opf) && !op_is_write(opf)) {
+- depth = 0;
+- } else {
+- depth = bfqd->word_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)];
+- limit = (limit * depth) >> bfqd->full_depth_shift;
+- }
++ if (op_is_sync(opf) && !op_is_write(opf))
++ limit = data->q->nr_requests;
++ else
++ limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)];
+
+ for (act_idx = 0; bic && act_idx < bfqd->num_actuators; act_idx++) {
+ /* Fast path to check if bfqq is already allocated. */
+@@ -725,14 +721,16 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ * available requests and thus starve other entities.
+ */
+ if (bfqq_request_over_limit(bfqd, bic, opf, act_idx, limit)) {
+- depth = 1;
++ limit = 1;
+ break;
+ }
+ }
++
+ bfq_log(bfqd, "[%s] wr_busy %d sync %d depth %u",
+- __func__, bfqd->wr_busy_queues, op_is_sync(opf), depth);
+- if (depth)
+- data->shallow_depth = depth;
++ __func__, bfqd->wr_busy_queues, op_is_sync(opf), limit);
++
++ if (limit < data->q->nr_requests)
++ data->shallow_depth = limit;
+ }
+
+ static struct bfq_queue *
+@@ -7128,9 +7126,8 @@ void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
+ */
+ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+ {
+- unsigned int depth = 1U << bt->sb.shift;
++ unsigned int nr_requests = bfqd->queue->nr_requests;
+
+- bfqd->full_depth_shift = bt->sb.shift;
+ /*
+ * In-word depths if no bfq_queue is being weight-raised:
+ * leaving 25% of tags only for sync reads.
+@@ -7142,13 +7139,13 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+ * limit 'something'.
+ */
+ /* no more than 50% of tags for async I/O */
+- bfqd->word_depths[0][0] = max(depth >> 1, 1U);
++ bfqd->async_depths[0][0] = max(nr_requests >> 1, 1U);
+ /*
+ * no more than 75% of tags for sync writes (25% extra tags
+ * w.r.t. async I/O, to prevent async I/O from starving sync
+ * writes)
+ */
+- bfqd->word_depths[0][1] = max((depth * 3) >> 2, 1U);
++ bfqd->async_depths[0][1] = max((nr_requests * 3) >> 2, 1U);
+
+ /*
+ * In-word depths in case some bfq_queue is being weight-
+@@ -7158,9 +7155,9 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+ * shortage.
+ */
+ /* no more than ~18% of tags for async I/O */
+- bfqd->word_depths[1][0] = max((depth * 3) >> 4, 1U);
++ bfqd->async_depths[1][0] = max((nr_requests * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+- bfqd->word_depths[1][1] = max((depth * 6) >> 4, 1U);
++ bfqd->async_depths[1][1] = max((nr_requests * 6) >> 4, 1U);
+ }
+
+ static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index 687a3a7ba784..31217f196f4f 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -813,8 +813,7 @@ struct bfq_data {
+ * Depth limits used in bfq_limit_depth (see comments on the
+ * function)
+ */
+- unsigned int word_depths[2][2];
+- unsigned int full_depth_shift;
++ unsigned int async_depths[2][2];
+
+ /*
+ * Number of independent actuators. This is equal to 1 in
+diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
+index 0f0f8452609a..d9ef304d1ba9 100644
+--- a/block/kyber-iosched.c
++++ b/block/kyber-iosched.c
+@@ -157,10 +157,7 @@ struct kyber_queue_data {
+ */
+ struct sbitmap_queue domain_tokens[KYBER_NUM_DOMAINS];
+
+- /*
+- * Async request percentage, converted to per-word depth for
+- * sbitmap_get_shallow().
+- */
++ /* Number of allowed async requests. */
+ unsigned int async_depth;
+
+ struct kyber_cpu_latency __percpu *cpu_latency;
+@@ -454,10 +451,8 @@ static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx)
+ {
+ struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data;
+ struct blk_mq_tags *tags = hctx->sched_tags;
+- unsigned int shift = tags->bitmap_tags.sb.shift;
+-
+- kqd->async_depth = (1U << shift) * KYBER_ASYNC_PERCENT / 100U;
+
++ kqd->async_depth = hctx->queue->nr_requests * KYBER_ASYNC_PERCENT / 100U;
+ sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth);
+ }
+
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 754f6b7415cd..ed0e0f70fb83 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -487,20 +487,6 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ return rq;
+ }
+
+-/*
+- * 'depth' is a number in the range 1..INT_MAX representing a number of
+- * requests. Scale it with a factor (1 << bt->sb.shift) / q->nr_requests since
+- * 1..(1 << bt->sb.shift) is the range expected by sbitmap_get_shallow().
+- * Values larger than q->nr_requests have the same effect as q->nr_requests.
+- */
+-static int dd_to_word_depth(struct blk_mq_hw_ctx *hctx, unsigned int qdepth)
+-{
+- struct sbitmap_queue *bt = &hctx->sched_tags->bitmap_tags;
+- const unsigned int nrr = hctx->queue->nr_requests;
+-
+- return ((qdepth << bt->sb.shift) + nrr - 1) / nrr;
+-}
+-
+ /*
+ * Called by __blk_mq_alloc_request(). The shallow_depth value set by this
+ * function is used by __blk_mq_get_tag().
+@@ -517,7 +503,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ * Throttle asynchronous requests and writes such that these requests
+ * do not block the allocation of synchronous requests.
+ */
+- data->shallow_depth = dd_to_word_depth(data->hctx, dd->async_depth);
++ data->shallow_depth = dd->async_depth;
+ }
+
+ /* Called by blk_mq_update_nr_requests(). */
+diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h
+index 189140bf11fc..4adf4b364fcd 100644
+--- a/include/linux/sbitmap.h
++++ b/include/linux/sbitmap.h
+@@ -213,12 +213,12 @@ int sbitmap_get(struct sbitmap *sb);
+ * sbitmap_get_shallow() - Try to allocate a free bit from a &struct sbitmap,
+ * limiting the depth used from each word.
+ * @sb: Bitmap to allocate from.
+- * @shallow_depth: The maximum number of bits to allocate from a single word.
++ * @shallow_depth: The maximum number of bits to allocate from the bitmap.
+ *
+ * This rather specific operation allows for having multiple users with
+ * different allocation limits. E.g., there can be a high-priority class that
+ * uses sbitmap_get() and a low-priority class that uses sbitmap_get_shallow()
+- * with a @shallow_depth of (1 << (@sb->shift - 1)). Then, the low-priority
++ * with a @shallow_depth of (sb->depth >> 1). Then, the low-priority
+ * class can only allocate half of the total bits in the bitmap, preventing it
+ * from starving out the high-priority class.
+ *
+@@ -478,7 +478,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags,
+ * sbitmap_queue, limiting the depth used from each word, with preemption
+ * already disabled.
+ * @sbq: Bitmap queue to allocate from.
+- * @shallow_depth: The maximum number of bits to allocate from a single word.
++ * @shallow_depth: The maximum number of bits to allocate from the queue.
+ * See sbitmap_get_shallow().
+ *
+ * If you call this, make sure to call sbitmap_queue_min_shallow_depth() after
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index d3412984170c..c07e3cd82e29 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -208,8 +208,28 @@ static int sbitmap_find_bit_in_word(struct sbitmap_word *map,
+ return nr;
+ }
+
++static unsigned int __map_depth_with_shallow(const struct sbitmap *sb,
++ int index,
++ unsigned int shallow_depth)
++{
++ u64 shallow_word_depth;
++ unsigned int word_depth, reminder;
++
++ word_depth = __map_depth(sb, index);
++ if (shallow_depth >= sb->depth)
++ return word_depth;
++
++ shallow_word_depth = word_depth * shallow_depth;
++ reminder = do_div(shallow_word_depth, sb->depth);
++
++ if (reminder >= (index + 1) * word_depth)
++ shallow_word_depth++;
++
++ return (unsigned int)shallow_word_depth;
++}
++
+ static int sbitmap_find_bit(struct sbitmap *sb,
+- unsigned int depth,
++ unsigned int shallow_depth,
+ unsigned int index,
+ unsigned int alloc_hint,
+ bool wrap)
+@@ -218,12 +238,12 @@ static int sbitmap_find_bit(struct sbitmap *sb,
+ int nr = -1;
+
+ for (i = 0; i < sb->map_nr; i++) {
+- nr = sbitmap_find_bit_in_word(&sb->map[index],
+- min_t(unsigned int,
+- __map_depth(sb, index),
+- depth),
+- alloc_hint, wrap);
++ unsigned int depth = __map_depth_with_shallow(sb, index,
++ shallow_depth);
+
++ if (depth)
++ nr = sbitmap_find_bit_in_word(&sb->map[index], depth,
++ alloc_hint, wrap);
+ if (nr != -1) {
+ nr += index << sb->shift;
+ break;
+@@ -406,27 +426,9 @@ EXPORT_SYMBOL_GPL(sbitmap_bitmap_show);
+ static unsigned int sbq_calc_wake_batch(struct sbitmap_queue *sbq,
+ unsigned int depth)
+ {
+- unsigned int wake_batch;
+- unsigned int shallow_depth;
+-
+- /*
+- * Each full word of the bitmap has bits_per_word bits, and there might
+- * be a partial word. There are depth / bits_per_word full words and
+- * depth % bits_per_word bits left over. In bitwise arithmetic:
+- *
+- * bits_per_word = 1 << shift
+- * depth / bits_per_word = depth >> shift
+- * depth % bits_per_word = depth & ((1 << shift) - 1)
+- *
+- * Each word can be limited to sbq->min_shallow_depth bits.
+- */
+- shallow_depth = min(1U << sbq->sb.shift, sbq->min_shallow_depth);
+- depth = ((depth >> sbq->sb.shift) * shallow_depth +
+- min(depth & ((1U << sbq->sb.shift) - 1), shallow_depth));
+- wake_batch = clamp_t(unsigned int, depth / SBQ_WAIT_QUEUES, 1,
+- SBQ_WAKE_BATCH);
+-
+- return wake_batch;
++ return clamp_t(unsigned int,
++ min(depth, sbq->min_shallow_depth) / SBQ_WAIT_QUEUES,
++ 1, SBQ_WAKE_BATCH);
+ }
+
+ int sbitmap_queue_init_node(struct sbitmap_queue *sbq, unsigned int depth,
+--
+2.39.5
+
--- /dev/null
+From 41341d2d407e5e44e8dcbe8fcf101a1bbdc7cde2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 22:03:37 +0200
+Subject: libbpf: Fix warning in calloc() usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matteo Croce <teknoraver@meta.com>
+
+[ Upstream commit 0ee30d937c147fc14c4b49535181d437cd2fde7a ]
+
+When compiling libbpf with some compilers, this warning is triggered:
+
+libbpf.c: In function ‘bpf_object__gen_loader’:
+libbpf.c:9209:28: error: ‘calloc’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Werror=calloc-transposed-args]
+ 9209 | gen = calloc(sizeof(*gen), 1);
+ | ^
+libbpf.c:9209:28: note: earlier argument should specify number of elements, later size of each element
+
+Fix this by inverting the calloc() arguments.
+
+Signed-off-by: Matteo Croce <teknoraver@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/bpf/20250717200337.49168-1-technoboy85@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 7e532fbfd684..faa4ca04986c 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -9221,7 +9221,7 @@ int bpf_object__gen_loader(struct bpf_object *obj, struct gen_loader_opts *opts)
+ return libbpf_err(-EFAULT);
+ if (!OPTS_VALID(opts, gen_loader_opts))
+ return libbpf_err(-EINVAL);
+- gen = calloc(sizeof(*gen), 1);
++ gen = calloc(1, sizeof(*gen));
+ if (!gen)
+ return libbpf_err(-ENOMEM);
+ gen->opts = opts;
+--
+2.39.5
+
--- /dev/null
+From 10092fdc56d4a7ba24f0f2a8678e1bca1a57394a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 15:20:59 -0700
+Subject: libbpf: Verify that arena map exists when adding arena relocations
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+[ Upstream commit 42be23e8f2dcb100cb9944b2b54b6bf41aff943d ]
+
+Fuzzer reported a memory access error in bpf_program__record_reloc()
+that happens when:
+- ".addr_space.1" section exists
+- there is a relocation referencing this section
+- there are no arena maps defined in BTF.
+
+Sanity checks for maps existence are already present in
+bpf_program__record_reloc(), hence this commit adds another one.
+
+[1] https://github.com/libbpf/libbpf/actions/runs/16375110681/job/46272998064
+
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250718222059.281526-1-eddyz87@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index c8e29c52d28c..7e532fbfd684 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4582,6 +4582,11 @@ static int bpf_program__record_reloc(struct bpf_program *prog,
+
+ /* arena data relocation */
+ if (shdr_idx == obj->efile.arena_data_shndx) {
++ if (obj->arena_map_idx < 0) {
++ pr_warn("prog '%s': bad arena data relocation at insn %u, no arena maps defined\n",
++ prog->name, insn_idx);
++ return -LIBBPF_ERRNO__RELOC;
++ }
+ reloc_desc->type = RELO_DATA;
+ reloc_desc->insn_idx = insn_idx;
+ reloc_desc->map_idx = obj->arena_map_idx;
+--
+2.39.5
+
--- /dev/null
+From 7b0459865e601feb3e3542e9bb74cb26a7b83c30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 18:32:03 +0200
+Subject: loop: Avoid updating block size under exclusive owner
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 7e49538288e523427beedd26993d446afef1a6fb ]
+
+Syzbot came up with a reproducer where a loop device block size is
+changed underneath a mounted filesystem. This causes a mismatch between
+the block device block size and the block size stored in the superblock
+causing confusion in various places such as fs/buffer.c. The particular
+issue triggered by syzbot was a warning in __getblk_slow() due to
+requested buffer size not matching block device block size.
+
+Fix the problem by getting exclusive hold of the loop device to change
+its block size. This fails if somebody (such as filesystem) has already
+an exclusive ownership of the block device and thus prevents modifying
+the loop device under some exclusive owner which doesn't expect it.
+
+Reported-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Tested-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 38 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 399905687757..8220521b9984 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1432,17 +1432,34 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg)
+ return 0;
+ }
+
+-static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
++static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode,
++ struct block_device *bdev, unsigned long arg)
+ {
+ struct queue_limits lim;
+ unsigned int memflags;
+ int err = 0;
+
+- if (lo->lo_state != Lo_bound)
+- return -ENXIO;
++ /*
++ * If we don't hold exclusive handle for the device, upgrade to it
++ * here to avoid changing device under exclusive owner.
++ */
++ if (!(mode & BLK_OPEN_EXCL)) {
++ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL);
++ if (err)
++ return err;
++ }
++
++ err = mutex_lock_killable(&lo->lo_mutex);
++ if (err)
++ goto abort_claim;
++
++ if (lo->lo_state != Lo_bound) {
++ err = -ENXIO;
++ goto unlock;
++ }
+
+ if (lo->lo_queue->limits.logical_block_size == arg)
+- return 0;
++ goto unlock;
+
+ sync_blockdev(lo->lo_device);
+ invalidate_bdev(lo->lo_device);
+@@ -1455,6 +1472,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue, memflags);
+
++unlock:
++ mutex_unlock(&lo->lo_mutex);
++abort_claim:
++ if (!(mode & BLK_OPEN_EXCL))
++ bd_abort_claiming(bdev, loop_set_block_size);
+ return err;
+ }
+
+@@ -1473,9 +1495,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd,
+ case LOOP_SET_DIRECT_IO:
+ err = loop_set_dio(lo, arg);
+ break;
+- case LOOP_SET_BLOCK_SIZE:
+- err = loop_set_block_size(lo, arg);
+- break;
+ default:
+ err = -EINVAL;
+ }
+@@ -1530,9 +1549,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,
+ break;
+ case LOOP_GET_STATUS64:
+ return loop_get_status64(lo, argp);
++ case LOOP_SET_BLOCK_SIZE:
++ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++ return loop_set_block_size(lo, mode, bdev, arg);
+ case LOOP_SET_CAPACITY:
+ case LOOP_SET_DIRECT_IO:
+- case LOOP_SET_BLOCK_SIZE:
+ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ fallthrough;
+--
+2.39.5
+
--- /dev/null
+From b47c5676ac28d0b0ce7e97be53bba3c761ab7552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 15:31:06 +0800
+Subject: md: call del_gendisk in control path
+
+From: Xiao Ni <xni@redhat.com>
+
+[ Upstream commit 9e59d609763f70a992a8f3808dabcce60f14eb5c ]
+
+Now del_gendisk and put_disk are called asynchronously in workqueue work.
+The asynchronous way has a problem that the device node can still exist
+after mdadm --stop command returns in a short window. So udev rule can
+open this device node and create the struct mddev in kernel again. So put
+del_gendisk in control path and still leave put_disk in md_kobj_release
+to avoid uaf of gendisk.
+
+Function del_gendisk can't be called with reconfig_mutex. If it's called
+with reconfig mutex, a deadlock can happen. del_gendisk waits all sysfs
+files access to finish and sysfs file access waits reconfig mutex. So
+put del_gendisk after releasing reconfig mutex.
+
+But there is still a window that sysfs can be accessed between mddev_unlock
+and del_gendisk. So some actions (add disk, change level, .e.g) can happen
+which lead unexpected results. MD_DELETED is used to resolve this problem.
+MD_DELETED is set before releasing reconfig mutex and it should be checked
+for these sysfs access which need reconfig mutex. For sysfs access which
+don't need reconfig mutex, del_gendisk will wait them to finish.
+
+But it doesn't need to do this in function mddev_lock_nointr. There are
+ten places that call it.
+* Five of them are in dm raid which we don't need to care. MD_DELETED is
+only used for md raid.
+* stop_sync_thread, md_do_sync and md_start_sync are related sync request,
+and it needs to wait sync thread to finish before stopping an array.
+* md_ioctl: md_open is called before md_ioctl, so ->openers is added. It
+will fail to stop the array. So it doesn't need to check MD_DELETED here
+* md_set_readonly:
+It needs to call mddev_set_closing_and_sync_blockdev when setting readonly
+or read_auto. So it will fail to stop the array too because MD_CLOSING is
+already set.
+
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Link: https://lore.kernel.org/linux-raid/20250611073108.25463-2-xni@redhat.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 33 +++++++++++++++++++++++----------
+ drivers/md/md.h | 26 ++++++++++++++++++++++++--
+ 2 files changed, 47 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 47f3253c4757..aa053bb818bc 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -613,9 +613,6 @@ static void __mddev_put(struct mddev *mddev)
+ mddev->ctime || mddev->hold_active)
+ return;
+
+- /* Array is not configured at all, and not held active, so destroy it */
+- set_bit(MD_DELETED, &mddev->flags);
+-
+ /*
+ * Call queue_work inside the spinlock so that flush_workqueue() after
+ * mddev_find will succeed in waiting for the work to be done.
+@@ -850,6 +847,16 @@ void mddev_unlock(struct mddev *mddev)
+ kobject_del(&rdev->kobj);
+ export_rdev(rdev, mddev);
+ }
++
++ /* Call del_gendisk after release reconfig_mutex to avoid
++ * deadlock (e.g. call del_gendisk under the lock and an
++ * access to sysfs files waits the lock)
++ * And MD_DELETED is only used for md raid which is set in
++ * do_md_stop. dm raid only uses md_stop to stop. So dm raid
++ * doesn't need to check MD_DELETED when getting reconfig lock
++ */
++ if (test_bit(MD_DELETED, &mddev->flags))
++ del_gendisk(mddev->gendisk);
+ }
+ EXPORT_SYMBOL_GPL(mddev_unlock);
+
+@@ -5721,19 +5728,30 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
+ struct md_sysfs_entry *entry = container_of(attr, struct md_sysfs_entry, attr);
+ struct mddev *mddev = container_of(kobj, struct mddev, kobj);
+ ssize_t rv;
++ struct kernfs_node *kn = NULL;
+
+ if (!entry->store)
+ return -EIO;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
++
++ if (entry->store == array_state_store && cmd_match(page, "clear"))
++ kn = sysfs_break_active_protection(kobj, attr);
++
+ spin_lock(&all_mddevs_lock);
+ if (!mddev_get(mddev)) {
+ spin_unlock(&all_mddevs_lock);
++ if (kn)
++ sysfs_unbreak_active_protection(kn);
+ return -EBUSY;
+ }
+ spin_unlock(&all_mddevs_lock);
+ rv = entry->store(mddev, page, length);
+ mddev_put(mddev);
++
++ if (kn)
++ sysfs_unbreak_active_protection(kn);
++
+ return rv;
+ }
+
+@@ -5741,12 +5759,6 @@ static void md_kobj_release(struct kobject *ko)
+ {
+ struct mddev *mddev = container_of(ko, struct mddev, kobj);
+
+- if (mddev->sysfs_state)
+- sysfs_put(mddev->sysfs_state);
+- if (mddev->sysfs_level)
+- sysfs_put(mddev->sysfs_level);
+-
+- del_gendisk(mddev->gendisk);
+ put_disk(mddev->gendisk);
+ }
+
+@@ -6593,8 +6605,9 @@ static int do_md_stop(struct mddev *mddev, int mode)
+ mddev->bitmap_info.offset = 0;
+
+ export_array(mddev);
+-
+ md_clean(mddev);
++ set_bit(MD_DELETED, &mddev->flags);
++
+ if (mddev->hold_active == UNTIL_STOP)
+ mddev->hold_active = 0;
+ }
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 1cf00a04bcdd..b851fc0dc085 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -697,11 +697,26 @@ static inline bool reshape_interrupted(struct mddev *mddev)
+
+ static inline int __must_check mddev_lock(struct mddev *mddev)
+ {
+- return mutex_lock_interruptible(&mddev->reconfig_mutex);
++ int ret;
++
++ ret = mutex_lock_interruptible(&mddev->reconfig_mutex);
++
++ /* MD_DELETED is set in do_md_stop with reconfig_mutex.
++ * So check it here.
++ */
++ if (!ret && test_bit(MD_DELETED, &mddev->flags)) {
++ ret = -ENODEV;
++ mutex_unlock(&mddev->reconfig_mutex);
++ }
++
++ return ret;
+ }
+
+ /* Sometimes we need to take the lock in a situation where
+ * failure due to interrupts is not acceptable.
++ * It doesn't need to check MD_DELETED here, the owner which
++ * holds the lock here can't be stopped. And all paths can't
++ * call this function after do_md_stop.
+ */
+ static inline void mddev_lock_nointr(struct mddev *mddev)
+ {
+@@ -710,7 +725,14 @@ static inline void mddev_lock_nointr(struct mddev *mddev)
+
+ static inline int mddev_trylock(struct mddev *mddev)
+ {
+- return mutex_trylock(&mddev->reconfig_mutex);
++ int ret;
++
++ ret = mutex_trylock(&mddev->reconfig_mutex);
++ if (!ret && test_bit(MD_DELETED, &mddev->flags)) {
++ ret = -ENODEV;
++ mutex_unlock(&mddev->reconfig_mutex);
++ }
++ return ret;
+ }
+ extern void mddev_unlock(struct mddev *mddev);
+
+--
+2.39.5
+
--- /dev/null
+From b2a19d84452ddaa7afed7547ab111263ff6464e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 13:11:57 +0530
+Subject: md: dm-zoned-target: Initialize return variable r to avoid
+ uninitialized use
+
+From: Purva Yeshi <purvayeshi550@gmail.com>
+
+[ Upstream commit 487767bff572d46f7c37ad846c4078f6d6c9cc55 ]
+
+Fix Smatch-detected error:
+drivers/md/dm-zoned-target.c:1073 dmz_iterate_devices()
+error: uninitialized symbol 'r'.
+
+Smatch detects a possible use of the uninitialized variable 'r' in
+dmz_iterate_devices() because if dmz->nr_ddevs is zero, the loop is
+skipped and 'r' is returned without being set, leading to undefined
+behavior.
+
+Initialize 'r' to 0 before the loop. This ensures that if there are no
+devices to iterate over, the function still returns a defined value.
+
+Signed-off-by: Purva Yeshi <purvayeshi550@gmail.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-zoned-target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 6141fc25d842..c38bd6e4c273 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -1061,7 +1061,7 @@ static int dmz_iterate_devices(struct dm_target *ti,
+ struct dmz_target *dmz = ti->private;
+ unsigned int zone_nr_sectors = dmz_zone_nr_sectors(dmz->metadata);
+ sector_t capacity;
+- int i, r;
++ int i, r = 0;
+
+ for (i = 0; i < dmz->nr_ddevs; i++) {
+ capacity = dmz->dev[i].capacity & ~(zone_nr_sectors - 1);
+--
+2.39.5
+
--- /dev/null
+From 5f84794f063aaab62d86317011de7cc392c66111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 15:31:07 +0800
+Subject: md: Don't clear MD_CLOSING until mddev is freed
+
+From: Xiao Ni <xni@redhat.com>
+
+[ Upstream commit 5f286f33553d600e6c2fb5a23dd6afcf99b3ebac ]
+
+UNTIL_STOP is used to avoid mddev is freed on the last close before adding
+disks to mddev. And it should be cleared when stopping an array which is
+mentioned in commit efeb53c0e572 ("md: Allow md devices to be created by
+name."). So reset ->hold_active to 0 in md_clean.
+
+And MD_CLOSING should be kept until mddev is freed to avoid reopen.
+
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Link: https://lore.kernel.org/linux-raid/20250611073108.25463-3-xni@redhat.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index aa053bb818bc..13a6287e7415 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6372,15 +6372,10 @@ static void md_clean(struct mddev *mddev)
+ mddev->persistent = 0;
+ mddev->level = LEVEL_NONE;
+ mddev->clevel[0] = 0;
+- /*
+- * Don't clear MD_CLOSING, or mddev can be opened again.
+- * 'hold_active != 0' means mddev is still in the creation
+- * process and will be used later.
+- */
+- if (mddev->hold_active)
+- mddev->flags = 0;
+- else
+- mddev->flags &= BIT_ULL_MASK(MD_CLOSING);
++ /* if UNTIL_STOP is set, it's cleared here */
++ mddev->hold_active = 0;
++ /* Don't clear MD_CLOSING, or mddev can be opened again. */
++ mddev->flags &= BIT_ULL_MASK(MD_CLOSING);
+ mddev->sb_flags = 0;
+ mddev->ro = MD_RDWR;
+ mddev->metadata_type[0] = 0;
+@@ -6607,9 +6602,6 @@ static int do_md_stop(struct mddev *mddev, int mode)
+ export_array(mddev);
+ md_clean(mddev);
+ set_bit(MD_DELETED, &mddev->flags);
+-
+- if (mddev->hold_active == UNTIL_STOP)
+- mddev->hold_active = 0;
+ }
+ md_new_event();
+ sysfs_notify_dirent_safe(mddev->sysfs_state);
+--
+2.39.5
+
--- /dev/null
+From c251527fe86f38227aca2c94139270d417ad977b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 10:52:56 +0000
+Subject: md/raid10: set chunk_sectors limit
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit 7ef50c4c6a9c36fa3ea6f1681a80c0bf9a797345 ]
+
+Same as done for raid0, set chunk_sectors limit to appropriately set the
+atomic write size limit.
+
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Link: https://lore.kernel.org/r/20250711105258.3135198-5-john.g.garry@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 6a55374a6ba3..e946abe62084 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4019,6 +4019,7 @@ static int raid10_set_queue_limits(struct mddev *mddev)
+ md_init_stacking_limits(&lim);
+ lim.max_write_zeroes_sectors = 0;
+ lim.io_min = mddev->chunk_sectors << 9;
++ lim.chunk_sectors = mddev->chunk_sectors;
+ lim.io_opt = lim.io_min * raid10_nr_stripes(conf);
+ lim.features |= BLK_FEAT_ATOMIC_WRITES;
+ err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY);
+--
+2.39.5
+
--- /dev/null
+From 19ea9be5c983b4517a4bf6f631301c3afdf6650c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jun 2025 21:32:31 -0400
+Subject: media: dvb-frontends: dib7090p: fix null-ptr-deref in
+ dib7090p_rw_on_apb()
+
+From: Alex Guo <alexguo1023@gmail.com>
+
+[ Upstream commit ce5cac69b2edac3e3246fee03e8f4c2a1075238b ]
+
+In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and
+msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing
+msg[0].buf[2] without sanity check, null pointer deref would happen. We add
+check on msg[0].len to prevent crash. Similar issue occurs when access
+msg[1].buf[0] and msg[1].buf[1].
+
+Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
+
+Signed-off-by: Alex Guo <alexguo1023@gmail.com>
+Link: https://lore.kernel.org/r/20250616013231.730221-1-alexguo1023@gmail.com
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index c5582d4fa5be..24f13a866735 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2256,8 +2256,12 @@ static int dib7090p_rw_on_apb(struct i2c_adapter *i2c_adap,
+ u16 word;
+
+ if (num == 1) { /* write */
++ if (msg[0].len < 3)
++ return -EOPNOTSUPP;
+ dib7000p_write_word(state, apb_address, ((msg[0].buf[1] << 8) | (msg[0].buf[2])));
+ } else {
++ if (msg[1].len < 2)
++ return -EOPNOTSUPP;
+ word = dib7000p_read_word(state, apb_address);
+ msg[1].buf[0] = (word >> 8) & 0xff;
+ msg[1].buf[1] = (word) & 0xff;
+--
+2.39.5
+
--- /dev/null
+From 24dc222617d0ce7812a38c6a688c51bfca0c4739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jun 2025 21:33:53 -0400
+Subject: media: dvb-frontends: w7090p: fix null-ptr-deref in
+ w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
+
+From: Alex Guo <alexguo1023@gmail.com>
+
+[ Upstream commit ed0234c8458b3149f15e496b48a1c9874dd24a1b ]
+
+In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
+check on msg[0].len to prevent crash.
+
+Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
+
+Signed-off-by: Alex Guo <alexguo1023@gmail.com>
+Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index 24f13a866735..40c5b1dc7d91 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2193,6 +2193,8 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1;
+ u16 i = 1000;
++ if (msg[0].len < 3)
++ return -EOPNOTSUPP;
+ u16 serpar_num = msg[0].buf[0];
+
+ while (n_overflow == 1 && i) {
+@@ -2212,6 +2214,8 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1, n_empty = 1;
+ u16 i = 1000;
++ if (msg[0].len < 1 || msg[1].len < 2)
++ return -EOPNOTSUPP;
+ u16 serpar_num = msg[0].buf[0];
+ u16 read_word;
+
+--
+2.39.5
+
--- /dev/null
+From c5d0b22dc622208e5369003d1e0fc86466617027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 May 2025 21:05:33 +0200
+Subject: media: hi556: Fix reset GPIO timings
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 99f2211a9d89fe34b3fa847fd7a4475171406cd0 ]
+
+probe() requests the reset GPIO to be set to high when getting it.
+Immeditately after this hi556_resume() is called and sets the GPIO low.
+
+If the GPIO was low before requesting it this will result in the GPIO
+only very briefly spiking high and the sensor not being properly reset.
+The same problem also happens on back to back runtime suspend + resume.
+
+Fix this by adding a sleep of 2 ms in hi556_resume() before setting
+the GPIO low (if there is a reset GPIO).
+
+The final sleep is kept unconditional, because if there is e.g. no reset
+GPIO but a controllable clock then the sensor also needs some time after
+enabling the clock.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/hi556.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/hi556.c b/drivers/media/i2c/hi556.c
+index aed258211b8a..d3cc65b67855 100644
+--- a/drivers/media/i2c/hi556.c
++++ b/drivers/media/i2c/hi556.c
+@@ -1321,7 +1321,12 @@ static int hi556_resume(struct device *dev)
+ return ret;
+ }
+
+- gpiod_set_value_cansleep(hi556->reset_gpio, 0);
++ if (hi556->reset_gpio) {
++ /* Assert reset for at least 2ms on back to back off-on */
++ usleep_range(2000, 2200);
++ gpiod_set_value_cansleep(hi556->reset_gpio, 0);
++ }
++
+ usleep_range(5000, 5500);
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From df3cf248c29d66d8303b44ed3b18f0b04d520f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 May 2025 14:17:46 +0100
+Subject: media: ipu-bridge: Add _HID for OV5670
+
+From: Daniel Scally <dan.scally@ideasonboard.com>
+
+[ Upstream commit 484f8bec3ddb453321ef0b8621c25de6ce3d0302 ]
+
+The OV5670 is found on Dell 7212 tablets paired with an IPU3 ISP
+and needs to be connected by the ipu-bridge. Add it to the list
+of supported devices.
+
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu-bridge.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c
+index 1cb745855600..a081e44d786e 100644
+--- a/drivers/media/pci/intel/ipu-bridge.c
++++ b/drivers/media/pci/intel/ipu-bridge.c
+@@ -60,6 +60,8 @@ static const struct ipu_sensor_config ipu_supported_sensors[] = {
+ IPU_SENSOR_CONFIG("INT33BE", 1, 419200000),
+ /* Omnivision OV2740 */
+ IPU_SENSOR_CONFIG("INT3474", 1, 180000000),
++ /* Omnivision OV5670 */
++ IPU_SENSOR_CONFIG("INT3479", 1, 422400000),
+ /* Omnivision OV8865 */
+ IPU_SENSOR_CONFIG("INT347A", 1, 360000000),
+ /* Omnivision OV7251 */
+--
+2.39.5
+
--- /dev/null
+From bf9850030554119a4b0d0adb422f1128fd5e0230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 14:09:03 +0530
+Subject: media: iris: Add handling for corrupt and drop frames
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+[ Upstream commit b791dcfcba3a0c46fb3e2decab31d2340c5dc313 ]
+
+Firmware attach DATACORRUPT/DROP buffer flags for the frames which
+needs to be dropped, handle it by setting VB2_BUF_STATE_ERROR for these
+buffers before calling buf_done.
+
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # on sa8775p-ride
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/iris/iris_buffer.c | 11 ++++++++---
+ .../media/platform/qcom/iris/iris_hfi_gen1_defines.h | 2 ++
+ .../media/platform/qcom/iris/iris_hfi_gen1_response.c | 6 ++++++
+ 3 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
+index e5c5a564fcb8..7dd5730a867a 100644
+--- a/drivers/media/platform/qcom/iris/iris_buffer.c
++++ b/drivers/media/platform/qcom/iris/iris_buffer.c
+@@ -593,10 +593,13 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
+
+ vb2 = &vbuf->vb2_buf;
+
+- if (buf->flags & V4L2_BUF_FLAG_ERROR)
++ if (buf->flags & V4L2_BUF_FLAG_ERROR) {
+ state = VB2_BUF_STATE_ERROR;
+- else
+- state = VB2_BUF_STATE_DONE;
++ vb2_set_plane_payload(vb2, 0, 0);
++ vb2->timestamp = 0;
++ v4l2_m2m_buf_done(vbuf, state);
++ return 0;
++ }
+
+ vbuf->flags |= buf->flags;
+
+@@ -616,6 +619,8 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
+ v4l2_m2m_mark_stopped(m2m_ctx);
+ }
+ }
++
++ state = VB2_BUF_STATE_DONE;
+ vb2->timestamp = buf->timestamp;
+ v4l2_m2m_buf_done(vbuf, state);
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h b/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h
+index 9f246816a286..93b5f838c290 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h
+@@ -117,6 +117,8 @@
+ #define HFI_FRAME_NOTCODED 0x7f002000
+ #define HFI_FRAME_YUV 0x7f004000
+ #define HFI_UNUSED_PICT 0x10000000
++#define HFI_BUFFERFLAG_DATACORRUPT 0x00000008
++#define HFI_BUFFERFLAG_DROP_FRAME 0x20000000
+
+ struct hfi_pkt_hdr {
+ u32 size;
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+index b72d503dd740..91d95eed68aa 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+@@ -481,6 +481,12 @@ static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet)
+ buf->attr |= BUF_ATTR_DEQUEUED;
+ buf->attr |= BUF_ATTR_BUFFER_DONE;
+
++ if (hfi_flags & HFI_BUFFERFLAG_DATACORRUPT)
++ flags |= V4L2_BUF_FLAG_ERROR;
++
++ if (hfi_flags & HFI_BUFFERFLAG_DROP_FRAME)
++ flags |= V4L2_BUF_FLAG_ERROR;
++
+ buf->flags |= flags;
+
+ iris_vb2_buffer_done(inst, buf);
+--
+2.39.5
+
--- /dev/null
+From 17a0397335166cea0f4f00a46c04f57c0c0b764b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 14:47:05 +0200
+Subject: media: raspberrypi: cfe: Fix min_reqbufs_allocation
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 57b5a302b5d529db96ddc52fbccec005092ebb3d ]
+
+The driver checks if "vq->max_num_buffers + *nbuffers < 3", but
+vq->max_num_buffers is (by default) 32, so the check is never true. Nor
+does the check make sense.
+
+The original code in the BSP kernel was "vq->num_buffers + *nbuffers <
+3", but got mangled along the way to upstream. The intention was to make
+sure that at least 3 buffers are allocated.
+
+Fix this by removing the bad lines and setting q->min_reqbufs_allocation
+to three.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/raspberrypi/rp1-cfe/cfe.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
+index 69a5f23e7954..9af9efc0d7e7 100644
+--- a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
++++ b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
+@@ -1025,9 +1025,6 @@ static int cfe_queue_setup(struct vb2_queue *vq, unsigned int *nbuffers,
+ cfe_dbg(cfe, "%s: [%s] type:%u\n", __func__, node_desc[node->id].name,
+ node->buffer_queue.type);
+
+- if (vq->max_num_buffers + *nbuffers < 3)
+- *nbuffers = 3 - vq->max_num_buffers;
+-
+ if (*nplanes) {
+ if (sizes[0] < size) {
+ cfe_err(cfe, "sizes[0] %i < size %u\n", sizes[0], size);
+@@ -1999,6 +1996,7 @@ static int cfe_register_node(struct cfe_device *cfe, int id)
+ q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+ q->lock = &node->lock;
+ q->min_queued_buffers = 1;
++ q->min_reqbufs_allocation = 3;
+ q->dev = &cfe->pdev->dev;
+
+ ret = vb2_queue_init(q);
+--
+2.39.5
+
--- /dev/null
+From b8e768425a3836a7ec9b4f40425d68d6a8ea30cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 19:37:15 +0100
+Subject: media: tc358743: Check I2C succeeded during probe
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 303d81635e1d9c949b370215cc94526ed81f2e3d ]
+
+The probe for the TC358743 reads the CHIPID register from
+the device and compares it to the expected value of 0.
+If the I2C request fails then that also returns 0, so
+the driver loads thinking that the device is there.
+
+Generally I2C communications are reliable so there is
+limited need to check the return value on every transfer,
+therefore only amend the one read during probe to check
+for I2C errors.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index dcef93e1a3bc..bffff5d0ce40 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -114,7 +114,7 @@ static inline struct tc358743_state *to_state(struct v4l2_subdev *sd)
+
+ /* --------------- I2C --------------- */
+
+-static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
++static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+ {
+ struct tc358743_state *state = to_state(sd);
+ struct i2c_client *client = state->i2c_client;
+@@ -140,6 +140,7 @@ static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+ v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed: %d\n",
+ __func__, reg, client->addr, err);
+ }
++ return err != ARRAY_SIZE(msgs);
+ }
+
+ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+@@ -196,15 +197,24 @@ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+ }
+ }
+
+-static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
++ int *err)
+ {
++ int error;
+ __le32 val = 0;
+
+- i2c_rd(sd, reg, (u8 __force *)&val, n);
++ error = i2c_rd(sd, reg, (u8 __force *)&val, n);
++ if (err)
++ *err = error;
+
+ return le32_to_cpu(val);
+ }
+
++static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
++{
++ return i2c_rdreg_err(sd, reg, n, NULL);
++}
++
+ static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
+ {
+ __le32 raw = cpu_to_le32(val);
+@@ -233,6 +243,13 @@ static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
+ return i2c_rdreg(sd, reg, 2);
+ }
+
++static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
++{
++ int err;
++ *value = i2c_rdreg_err(sd, reg, 2, &err);
++ return err;
++}
++
+ static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
+ {
+ i2c_wrreg(sd, reg, val, 2);
+@@ -2061,6 +2078,7 @@ static int tc358743_probe(struct i2c_client *client)
+ struct tc358743_platform_data *pdata = client->dev.platform_data;
+ struct v4l2_subdev *sd;
+ u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
++ u16 chipid;
+ int err;
+
+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+@@ -2092,7 +2110,8 @@ static int tc358743_probe(struct i2c_client *client)
+ sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+
+ /* i2c access */
+- if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
++ if (i2c_rd16_err(sd, CHIPID, &chipid) ||
++ (chipid & MASK_CHIPID) != 0) {
+ v4l2_info(sd, "not a TC358743 on address 0x%x\n",
+ client->addr << 1);
+ return -ENODEV;
+--
+2.39.5
+
--- /dev/null
+From b372dccd428e48141cad08be3a7236a77cd46439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 19:37:14 +0100
+Subject: media: tc358743: Increase FIFO trigger level to 374
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 86addd25314a1e77dbdcfddfeed0bab2f27da0e2 ]
+
+The existing fixed value of 16 worked for UYVY 720P60 over
+2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
+1080P60 needs 6 lanes at 594MHz).
+It doesn't allow for lower resolutions to work as the FIFO
+underflows.
+
+374 is required for 1080P24 or 1080P30 UYVY over 2 lanes @
+972Mbit/s, but >374 means that the FIFO underflows on 1080P50
+UYVY over 2 lanes @ 972Mbit/s.
+
+Whilst it would be nice to compute it, the required information
+isn't published by Toshiba.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index d4700d45c113..2c56832e0065 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1979,8 +1979,19 @@ static int tc358743_probe_of(struct tc358743_state *state)
+ state->pdata.refclk_hz = clk_get_rate(refclk);
+ state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
+ state->pdata.enable_hdcp = false;
+- /* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
+- state->pdata.fifo_level = 16;
++ /*
++ * Ideally the FIFO trigger level should be set based on the input and
++ * output data rates, but the calculations required are buried in
++ * Toshiba's register settings spreadsheet.
++ * A value of 16 works with a 594Mbps data rate for 720p60 (using 2
++ * lanes) and 1080p60 (using 4 lanes), but fails when the data rate
++ * is increased, or a lower pixel clock is used that result in CSI
++ * reading out faster than the data is arriving.
++ *
++ * A value of 374 works with both those modes at 594Mbps, and with most
++ * modes on 972Mbps.
++ */
++ state->pdata.fifo_level = 374;
+ /*
+ * The PLL input clock is obtained by dividing refclk by pll_prd.
+ * It must be between 6 MHz and 40 MHz, lower frequency is better.
+--
+2.39.5
+
--- /dev/null
+From 1033537467ca9e8112a99a8f6ecf23d472239b4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 19:37:16 +0100
+Subject: media: tc358743: Return an appropriate colorspace from
+ tc358743_set_fmt
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 377cc006a364dfdab2f3f221cfad63a9265200b8 ]
+
+When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
+to choose a valid format. However that sets the colorspace
+based on information read back from the chip, not the colour
+format requested.
+
+The result was that if you called try or set format for UYVY
+when the current format was RGB3 then you would get told SRGB,
+and try RGB3 when current was UYVY and you would get told
+SMPTE170M.
+
+The value programmed in the VI_REP register for the colorspace
+is always set by this driver, therefore there is no need to read
+back the value, and never set to REC709.
+Return the colorspace based on the format set/tried instead.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 44 ++++++++++++++----------------------
+ 1 file changed, 17 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index bffff5d0ce40..d4700d45c113 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1708,12 +1708,23 @@ static int tc358743_enum_mbus_code(struct v4l2_subdev *sd,
+ return 0;
+ }
+
++static u32 tc358743_g_colorspace(u32 code)
++{
++ switch (code) {
++ case MEDIA_BUS_FMT_RGB888_1X24:
++ return V4L2_COLORSPACE_SRGB;
++ case MEDIA_BUS_FMT_UYVY8_1X16:
++ return V4L2_COLORSPACE_SMPTE170M;
++ default:
++ return 0;
++ }
++}
++
+ static int tc358743_get_fmt(struct v4l2_subdev *sd,
+ struct v4l2_subdev_state *sd_state,
+ struct v4l2_subdev_format *format)
+ {
+ struct tc358743_state *state = to_state(sd);
+- u8 vi_rep = i2c_rd8(sd, VI_REP);
+
+ if (format->pad != 0)
+ return -EINVAL;
+@@ -1723,23 +1734,7 @@ static int tc358743_get_fmt(struct v4l2_subdev *sd,
+ format->format.height = state->timings.bt.height;
+ format->format.field = V4L2_FIELD_NONE;
+
+- switch (vi_rep & MASK_VOUT_COLOR_SEL) {
+- case MASK_VOUT_COLOR_RGB_FULL:
+- case MASK_VOUT_COLOR_RGB_LIMITED:
+- format->format.colorspace = V4L2_COLORSPACE_SRGB;
+- break;
+- case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
+- case MASK_VOUT_COLOR_601_YCBCR_FULL:
+- format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
+- break;
+- case MASK_VOUT_COLOR_709_YCBCR_FULL:
+- case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
+- format->format.colorspace = V4L2_COLORSPACE_REC709;
+- break;
+- default:
+- format->format.colorspace = 0;
+- break;
+- }
++ format->format.colorspace = tc358743_g_colorspace(format->format.code);
+
+ return 0;
+ }
+@@ -1753,19 +1748,14 @@ static int tc358743_set_fmt(struct v4l2_subdev *sd,
+ u32 code = format->format.code; /* is overwritten by get_fmt */
+ int ret = tc358743_get_fmt(sd, sd_state, format);
+
+- format->format.code = code;
++ if (code == MEDIA_BUS_FMT_RGB888_1X24 ||
++ code == MEDIA_BUS_FMT_UYVY8_1X16)
++ format->format.code = code;
++ format->format.colorspace = tc358743_g_colorspace(format->format.code);
+
+ if (ret)
+ return ret;
+
+- switch (code) {
+- case MEDIA_BUS_FMT_RGB888_1X24:
+- case MEDIA_BUS_FMT_UYVY8_1X16:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+ if (format->which == V4L2_SUBDEV_FORMAT_TRY)
+ return 0;
+
+--
+2.39.5
+
--- /dev/null
+From 51fb51d1368c8ea72b13da2953ffee468f7ab8f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 10:09:54 +0200
+Subject: media: usb: hdpvr: disable zero-length read messages
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit b5ae5a79825ba8037b0be3ef677a24de8c063abf ]
+
+This driver passes the length of an i2c_msg directly to
+usb_control_msg(). If the message is now a read and of length 0, it
+violates the USB protocol and a warning will be printed. Enable the
+I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length
+read messages altogether.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/hdpvr/hdpvr-i2c.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-i2c.c b/drivers/media/usb/hdpvr/hdpvr-i2c.c
+index 070559b01b01..54956a8ff15e 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-i2c.c
++++ b/drivers/media/usb/hdpvr/hdpvr-i2c.c
+@@ -165,10 +165,16 @@ static const struct i2c_algorithm hdpvr_algo = {
+ .functionality = hdpvr_functionality,
+ };
+
++/* prevent invalid 0-length usb_control_msg */
++static const struct i2c_adapter_quirks hdpvr_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN_READ,
++};
++
+ static const struct i2c_adapter hdpvr_i2c_adapter_template = {
+ .name = "Hauppauge HD PVR I2C",
+ .owner = THIS_MODULE,
+ .algo = &hdpvr_algo,
++ .quirks = &hdpvr_quirks,
+ };
+
+ static int hdpvr_activate_ir(struct hdpvr_device *dev)
+--
+2.39.5
+
--- /dev/null
+From 5f46a04f921445991607e36ebd7f453e7ab60c6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jun 2025 18:21:57 +0000
+Subject: media: uvcvideo: Add quirk for HP Webcam HD 2300
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 53b0b80e5240fec7c5a420bffb310edc83faf4fd ]
+
+HP Webcam HD 2300 does not seem to flip the FID bit according to spec.
+
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 2.00
+ bDeviceClass 239 Miscellaneous Device
+ bDeviceSubClass 2 [unknown]
+ bDeviceProtocol 1 Interface Association
+ bMaxPacketSize0 64
+ idVendor 0x03f0 HP, Inc
+ idProduct 0xe207 HP Webcam HD 2300
+ bcdDevice 10.20
+ iManufacturer 3 Hewlett Packard
+ iProduct 1 HP Webcam HD 2300
+ iSerial 0
+ bNumConfigurations 1
+
+Reported-by: Michaël Melchiore <rohel01@gmail.com>
+Closes: https://lore.kernel.org/linux-media/CA+q66aRvTigH15cUyfvzPJ2mfsDFMt=CjuYNwvAZb29w8b1KDA@mail.gmail.com
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250602-uvc-hp-quirk-v1-1-7047d94d679f@chromium.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 25e9aea81196..2f0865c1e6e7 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -2511,6 +2511,15 @@ static const struct uvc_device_info uvc_quirk_force_y8 = {
+ * Sort these by vendor/product ID.
+ */
+ static const struct usb_device_id uvc_ids[] = {
++ /* HP Webcam HD 2300 */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x03f0,
++ .idProduct = 0xe207,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = (kernel_ulong_t)&uvc_quirk_stream_no_fid },
+ /* Quanta ACER HD User Facing */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_INT_INFO,
+--
+2.39.5
+
--- /dev/null
+From 76631b9d5e1d0c8f2f3547cf974262945dfe336b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 14:18:03 +0800
+Subject: media: uvcvideo: Fix bandwidth issue for Alcor camera
+
+From: chenchangcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 9764401bf6f8a20eb11c2e78470f20fee91a9ea7 ]
+
+Some broken device return wrong dwMaxPayloadTransferSize fields as
+follows:
+
+[ 218.632537] uvcvideo: Device requested 2752512 B/frame bandwidth.
+[ 218.632598] uvcvideo: No fast enough alt setting for requested bandwidth.
+
+When dwMaxPayloadTransferSize is greater than maxpsize, it will prevent
+the camera from starting. So use the bandwidth of maxpsize.
+
+Signed-off-by: chenchangcheng <chenchangcheng@kylinos.cn>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250510061803.811433-1-ccc194101@163.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index e3567aeb0007..11769a1832d2 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -262,6 +262,15 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
+
+ ctrl->dwMaxPayloadTransferSize = bandwidth;
+ }
++
++ if (stream->intf->num_altsetting > 1 &&
++ ctrl->dwMaxPayloadTransferSize > stream->maxpsize) {
++ dev_warn_ratelimited(&stream->intf->dev,
++ "UVC non compliance: the max payload transmission size (%u) exceeds the size of the ep max packet (%u). Using the max size.\n",
++ ctrl->dwMaxPayloadTransferSize,
++ stream->maxpsize);
++ ctrl->dwMaxPayloadTransferSize = stream->maxpsize;
++ }
+ }
+
+ static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
+--
+2.39.5
+
--- /dev/null
+From 588330af59c0debb3265f2af0c2f53467a493c65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 May 2025 07:48:28 +0000
+Subject: media: uvcvideo: Set V4L2_CTRL_FLAG_DISABLED during queryctrl errors
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 649c033711d7fd6e1d5d69e4cfc3fceca7de2867 ]
+
+To implement VIDIOC_QUERYCTRL, we need to know the minimum, maximum,
+step and flags of the control. For some of the controls, this involves
+querying the actual hardware.
+
+Some non-compliant cameras produce errors when we query them. These
+error can be triggered every time, sometimes, or when other controls do
+not have the "right value". Right now, we populate that error to userspace.
+When an error happens, the v4l2 framework does not copy the v4l2_queryctrl
+struct to userspace. Also, userspace apps are not ready to handle any
+other error than -EINVAL.
+
+One of the main usecases of VIDIOC_QUERYCTRL is enumerating the controls
+of a device. This is done using the V4L2_CTRL_FLAG_NEXT_CTRL flag. In
+that usecase, a non-compliant control will make it almost impossible to
+enumerate all controls of the device.
+
+A control with an invalid max/min/step/flags is better than non being
+able to enumerate the rest of the controls.
+
+This patch:
+- Retries for an extra attempt to read the control, to avoid spurious
+ errors. More attempts do not seem to produce better results in the
+ tested hardware.
+- Makes VIDIOC_QUERYCTRL return 0 for -EIO errors.
+- Introduces a warning in dmesg so we can have a trace of what has happened
+ and sets the V4L2_CTRL_FLAG_DISABLED.
+- Makes sure we keep returning V4L2_CTRL_FLAG_DISABLED for all the next
+ attempts to query that control (other operations have the same
+ functionality as now).
+
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://lore.kernel.org/r/20250502-uvc-eaccess-v8-1-0b8b58ac1142@chromium.org
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 55 +++++++++++++++++++++++++++-----
+ drivers/media/usb/uvc/uvcvideo.h | 2 ++
+ 2 files changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 44b6513c5264..f24272d483a2 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1483,14 +1483,28 @@ static u32 uvc_get_ctrl_bitmap(struct uvc_control *ctrl,
+ return ~0;
+ }
+
++/*
++ * Maximum retry count to avoid spurious errors with controls. Increasing this
++ * value does no seem to produce better results in the tested hardware.
++ */
++#define MAX_QUERY_RETRIES 2
++
+ static int __uvc_queryctrl_boundaries(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl,
+ struct uvc_control_mapping *mapping,
+ struct v4l2_query_ext_ctrl *v4l2_ctrl)
+ {
+ if (!ctrl->cached) {
+- int ret = uvc_ctrl_populate_cache(chain, ctrl);
+- if (ret < 0)
++ unsigned int retries;
++ int ret;
++
++ for (retries = 0; retries < MAX_QUERY_RETRIES; retries++) {
++ ret = uvc_ctrl_populate_cache(chain, ctrl);
++ if (ret != -EIO)
++ break;
++ }
++
++ if (ret)
+ return ret;
+ }
+
+@@ -1567,6 +1581,7 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+ {
+ struct uvc_control_mapping *master_map = NULL;
+ struct uvc_control *master_ctrl = NULL;
++ int ret;
+
+ memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl));
+ v4l2_ctrl->id = mapping->id;
+@@ -1587,18 +1602,31 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+ __uvc_find_control(ctrl->entity, mapping->master_id,
+ &master_map, &master_ctrl, 0, 0);
+ if (master_ctrl && (master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) {
++ unsigned int retries;
+ s32 val;
+ int ret;
+
+ if (WARN_ON(uvc_ctrl_mapping_is_compound(master_map)))
+ return -EIO;
+
+- ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
+- if (ret < 0)
+- return ret;
++ for (retries = 0; retries < MAX_QUERY_RETRIES; retries++) {
++ ret = __uvc_ctrl_get(chain, master_ctrl, master_map,
++ &val);
++ if (!ret)
++ break;
++ if (ret < 0 && ret != -EIO)
++ return ret;
++ }
+
+- if (val != mapping->master_manual)
+- v4l2_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
++ if (ret == -EIO) {
++ dev_warn_ratelimited(&chain->dev->udev->dev,
++ "UVC non compliance: Error %d querying master control %x (%s)\n",
++ ret, master_map->id,
++ uvc_map_get_name(master_map));
++ } else {
++ if (val != mapping->master_manual)
++ v4l2_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
++ }
+ }
+
+ v4l2_ctrl->elem_size = uvc_mapping_v4l2_size(mapping);
+@@ -1613,7 +1641,18 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+ return 0;
+ }
+
+- return __uvc_queryctrl_boundaries(chain, ctrl, mapping, v4l2_ctrl);
++ ret = __uvc_queryctrl_boundaries(chain, ctrl, mapping, v4l2_ctrl);
++ if (ret && !mapping->disabled) {
++ dev_warn(&chain->dev->udev->dev,
++ "UVC non compliance: permanently disabling control %x (%s), due to error %d\n",
++ mapping->id, uvc_map_get_name(mapping), ret);
++ mapping->disabled = true;
++ }
++
++ if (mapping->disabled)
++ v4l2_ctrl->flags |= V4L2_CTRL_FLAG_DISABLED;
++
++ return 0;
+ }
+
+ int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index b9f8eb62ba1d..11d6e3c2ebdf 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -134,6 +134,8 @@ struct uvc_control_mapping {
+ s32 master_manual;
+ u32 slave_ids[2];
+
++ bool disabled;
++
+ const struct uvc_control_mapping *(*filter_mapping)
+ (struct uvc_video_chain *chain,
+ struct uvc_control *ctrl);
+--
+2.39.5
+
--- /dev/null
+From 18f125cfbf2f13a395be9950936e1b5c11a9bb1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 10:37:45 +0200
+Subject: media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
+ control
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 5a0abb8909b9dcf347fce1d201ac6686ac33fd64 ]
+
+When operating a pipeline with a missing V4L2_CID_LINK_FREQ control this
+two line warning is printed each time the pipeline is started. Reduce
+this excessive logging by only warning once for the missing control.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-common.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c
+index e4b2de3833ee..841cd9e196c3 100644
+--- a/drivers/media/v4l2-core/v4l2-common.c
++++ b/drivers/media/v4l2-core/v4l2-common.c
+@@ -494,10 +494,10 @@ s64 __v4l2_get_link_freq_ctrl(struct v4l2_ctrl_handler *handler,
+
+ freq = div_u64(v4l2_ctrl_g_ctrl_int64(ctrl) * mul, div);
+
+- pr_warn("%s: Link frequency estimated using pixel rate: result might be inaccurate\n",
+- __func__);
+- pr_warn("%s: Consider implementing support for V4L2_CID_LINK_FREQ in the transmitter driver\n",
+- __func__);
++ pr_warn_once("%s: Link frequency estimated using pixel rate: result might be inaccurate\n",
++ __func__);
++ pr_warn_once("%s: Consider implementing support for V4L2_CID_LINK_FREQ in the transmitter driver\n",
++ __func__);
+ }
+
+ return freq > 0 ? freq : -EINVAL;
+--
+2.39.5
+
--- /dev/null
+From f85b41396a5806cb3eb759e2160a62c6a3463ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 10:50:52 +0200
+Subject: mei: bus: Check for still connected devices in
+ mei_cl_bus_dev_release()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]
+
+mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
+belonging to the device being released.
+
+If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
+the mei-client being freed might still be part of the mei_device's
+file_list and iterating over this list after the freeing will then trigger
+a use-afer-free bug.
+
+Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
+mei-client is not on the mei_device's file_list.
+
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250623085052.12347-11-hansg@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/bus.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index 67176caf5416..1958c043ac14 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -1301,10 +1301,16 @@ static void mei_dev_bus_put(struct mei_device *bus)
+ static void mei_cl_bus_dev_release(struct device *dev)
+ {
+ struct mei_cl_device *cldev = to_mei_cl_device(dev);
++ struct mei_device *mdev = cldev->cl->dev;
++ struct mei_cl *cl;
+
+ mei_cl_flush_queues(cldev->cl, NULL);
+ mei_me_cl_put(cldev->me_cl);
+ mei_dev_bus_put(cldev->bus);
++
++ list_for_each_entry(cl, &mdev->file_list, link)
++ WARN_ON(cl == cldev->cl);
++
+ kfree(cldev->cl);
+ kfree(cldev);
+ }
+--
+2.39.5
+
--- /dev/null
+From 445c7367478deb37d50492c29edd32e4b15b078e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 01:32:07 +0800
+Subject: mfd: axp20x: Set explicit ID for AXP313 regulator
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 88828c7e940dd45d139ad4a39d702b23840a37c5 ]
+
+On newer boards featuring the A523 SoC, the AXP323 (related to the
+AXP313) is paired with the AXP717 and serves as a secondary PMIC
+providing additional regulator outputs. However the MFD cells are all
+registered with PLATFORM_DEVID_NONE, which causes the regulator cells
+to conflict with each other.
+
+Commit e37ec3218870 ("mfd: axp20x: Allow multiple regulators") attempted
+to fix this by switching to PLATFORM_DEVID_AUTO so that the device names
+would all be different, however that broke IIO channel mapping, which is
+also tied to the device names. As a result the change was later reverted.
+
+Instead, here we attempt to make sure the AXP313/AXP323 regulator cell
+does not conflict by explicitly giving it an ID number. This was
+previously done for the AXP809+AXP806 pair used with the A80 SoC.
+
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20250619173207.3367126-1-wens@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index e9914e8a29a3..25c639b348cd 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -1053,7 +1053,8 @@ static const struct mfd_cell axp152_cells[] = {
+ };
+
+ static struct mfd_cell axp313a_cells[] = {
+- MFD_CELL_NAME("axp20x-regulator"),
++ /* AXP323 is sometimes paired with AXP717 as sub-PMIC */
++ MFD_CELL_BASIC("axp20x-regulator", NULL, NULL, 0, 1),
+ MFD_CELL_RES("axp313a-pek", axp313a_pek_resources),
+ };
+
+--
+2.39.5
+
--- /dev/null
+From a056de92ec4ceadab673eb297a7eea618b19d8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 13:45:12 +0200
+Subject: mfd: tps6594: Add TI TPS652G1 support
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit 626bb0a45584d544d84eab909795ccb355062bcc ]
+
+The TPS652G1 is a stripped down version of the TPS65224. From a software
+point of view, it lacks any voltage monitoring, the watchdog, the ESM
+and the ADC.
+
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Link: https://lore.kernel.org/r/20250613114518.1772109-2-mwalle@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tps6594-core.c | 88 ++++++++++++++++++++++++++++++++++---
+ drivers/mfd/tps6594-i2c.c | 10 ++++-
+ drivers/mfd/tps6594-spi.c | 10 ++++-
+ include/linux/mfd/tps6594.h | 1 +
+ 4 files changed, 99 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mfd/tps6594-core.c b/drivers/mfd/tps6594-core.c
+index a7223e873cd1..c16c37e36617 100644
+--- a/drivers/mfd/tps6594-core.c
++++ b/drivers/mfd/tps6594-core.c
+@@ -1,6 +1,11 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * Core functions for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs
++ * Core functions for following TI PMICs:
++ * - LP8764
++ * - TPS65224
++ * - TPS652G1
++ * - TPS6593
++ * - TPS6594
+ *
+ * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/
+ */
+@@ -414,6 +419,61 @@ static const unsigned int tps65224_irq_reg[] = {
+ TPS6594_REG_INT_FSM_ERR,
+ };
+
++/* TPS652G1 Resources */
++
++static const struct mfd_cell tps652g1_common_cells[] = {
++ MFD_CELL_RES("tps6594-pfsm", tps65224_pfsm_resources),
++ MFD_CELL_RES("tps6594-pinctrl", tps65224_pinctrl_resources),
++ MFD_CELL_NAME("tps6594-regulator"),
++};
++
++static const struct regmap_irq tps652g1_irqs[] = {
++ /* INT_GPIO register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO1, 2, TPS65224_BIT_GPIO1_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO2, 2, TPS65224_BIT_GPIO2_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO3, 2, TPS65224_BIT_GPIO3_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO4, 2, TPS65224_BIT_GPIO4_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO5, 2, TPS65224_BIT_GPIO5_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_GPIO6, 2, TPS65224_BIT_GPIO6_INT),
++
++ /* INT_STARTUP register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_VSENSE, 3, TPS65224_BIT_VSENSE_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_ENABLE, 3, TPS6594_BIT_ENABLE_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_PB_SHORT, 3, TPS65224_BIT_PB_SHORT_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_FSD, 3, TPS6594_BIT_FSD_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_SOFT_REBOOT, 3, TPS6594_BIT_SOFT_REBOOT_INT),
++
++ /* INT_MISC register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_BIST_PASS, 4, TPS6594_BIT_BIST_PASS_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_EXT_CLK, 4, TPS6594_BIT_EXT_CLK_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_REG_UNLOCK, 4, TPS65224_BIT_REG_UNLOCK_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_TWARN, 4, TPS6594_BIT_TWARN_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_PB_LONG, 4, TPS65224_BIT_PB_LONG_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_PB_FALL, 4, TPS65224_BIT_PB_FALL_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_PB_RISE, 4, TPS65224_BIT_PB_RISE_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_ADC_CONV_READY, 4, TPS65224_BIT_ADC_CONV_READY_INT),
++
++ /* INT_MODERATE_ERR register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_TSD_ORD, 5, TPS6594_BIT_TSD_ORD_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_BIST_FAIL, 5, TPS6594_BIT_BIST_FAIL_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_REG_CRC_ERR, 5, TPS6594_BIT_REG_CRC_ERR_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_RECOV_CNT, 5, TPS6594_BIT_RECOV_CNT_INT),
++
++ /* INT_SEVERE_ERR register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_TSD_IMM, 6, TPS6594_BIT_TSD_IMM_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_VCCA_OVP, 6, TPS6594_BIT_VCCA_OVP_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_PFSM_ERR, 6, TPS6594_BIT_PFSM_ERR_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_BG_XMON, 6, TPS65224_BIT_BG_XMON_INT),
++
++ /* INT_FSM_ERR register */
++ REGMAP_IRQ_REG(TPS65224_IRQ_IMM_SHUTDOWN, 7, TPS6594_BIT_IMM_SHUTDOWN_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_ORD_SHUTDOWN, 7, TPS6594_BIT_ORD_SHUTDOWN_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_MCU_PWR_ERR, 7, TPS6594_BIT_MCU_PWR_ERR_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_SOC_PWR_ERR, 7, TPS6594_BIT_SOC_PWR_ERR_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_COMM_ERR, 7, TPS6594_BIT_COMM_ERR_INT),
++ REGMAP_IRQ_REG(TPS65224_IRQ_I2C2_ERR, 7, TPS65224_BIT_I2C2_ERR_INT),
++};
++
+ static inline unsigned int tps6594_get_irq_reg(struct regmap_irq_chip_data *data,
+ unsigned int base, int index)
+ {
+@@ -443,7 +503,7 @@ static int tps6594_handle_post_irq(void *irq_drv_data)
+ * a new interrupt.
+ */
+ if (tps->use_crc) {
+- if (tps->chip_id == TPS65224) {
++ if (tps->chip_id == TPS65224 || tps->chip_id == TPS652G1) {
+ regmap_reg = TPS6594_REG_INT_FSM_ERR;
+ mask_val = TPS6594_BIT_COMM_ERR_INT;
+ } else {
+@@ -481,6 +541,18 @@ static struct regmap_irq_chip tps65224_irq_chip = {
+ .handle_post_irq = tps6594_handle_post_irq,
+ };
+
++static struct regmap_irq_chip tps652g1_irq_chip = {
++ .ack_base = TPS6594_REG_INT_BUCK,
++ .ack_invert = 1,
++ .clear_ack = 1,
++ .init_ack_masked = 1,
++ .num_regs = ARRAY_SIZE(tps65224_irq_reg),
++ .irqs = tps652g1_irqs,
++ .num_irqs = ARRAY_SIZE(tps652g1_irqs),
++ .get_irq_reg = tps65224_get_irq_reg,
++ .handle_post_irq = tps6594_handle_post_irq,
++};
++
+ static const struct regmap_range tps6594_volatile_ranges[] = {
+ regmap_reg_range(TPS6594_REG_INT_TOP, TPS6594_REG_STAT_READBACK_ERR),
+ regmap_reg_range(TPS6594_REG_RTC_STATUS, TPS6594_REG_RTC_STATUS),
+@@ -507,7 +579,7 @@ static int tps6594_check_crc_mode(struct tps6594 *tps, bool primary_pmic)
+ int ret;
+ unsigned int regmap_reg, mask_val;
+
+- if (tps->chip_id == TPS65224) {
++ if (tps->chip_id == TPS65224 || tps->chip_id == TPS652G1) {
+ regmap_reg = TPS6594_REG_CONFIG_2;
+ mask_val = TPS65224_BIT_I2C1_SPI_CRC_EN;
+ } else {
+@@ -537,7 +609,7 @@ static int tps6594_set_crc_feature(struct tps6594 *tps)
+ int ret;
+ unsigned int regmap_reg, mask_val;
+
+- if (tps->chip_id == TPS65224) {
++ if (tps->chip_id == TPS65224 || tps->chip_id == TPS652G1) {
+ regmap_reg = TPS6594_REG_CONFIG_2;
+ mask_val = TPS65224_BIT_I2C1_SPI_CRC_EN;
+ } else {
+@@ -628,6 +700,10 @@ int tps6594_device_init(struct tps6594 *tps, bool enable_crc)
+ irq_chip = &tps65224_irq_chip;
+ n_cells = ARRAY_SIZE(tps65224_common_cells);
+ cells = tps65224_common_cells;
++ } else if (tps->chip_id == TPS652G1) {
++ irq_chip = &tps652g1_irq_chip;
++ n_cells = ARRAY_SIZE(tps652g1_common_cells);
++ cells = tps652g1_common_cells;
+ } else {
+ irq_chip = &tps6594_irq_chip;
+ n_cells = ARRAY_SIZE(tps6594_common_cells);
+@@ -651,8 +727,8 @@ int tps6594_device_init(struct tps6594 *tps, bool enable_crc)
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to add common child devices\n");
+
+- /* No RTC for LP8764 and TPS65224 */
+- if (tps->chip_id != LP8764 && tps->chip_id != TPS65224) {
++ /* No RTC for LP8764, TPS65224 and TPS652G1 */
++ if (tps->chip_id != LP8764 && tps->chip_id != TPS65224 && tps->chip_id != TPS652G1) {
+ ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_AUTO, tps6594_rtc_cells,
+ ARRAY_SIZE(tps6594_rtc_cells), NULL, 0,
+ regmap_irq_get_domain(tps->irq_data));
+diff --git a/drivers/mfd/tps6594-i2c.c b/drivers/mfd/tps6594-i2c.c
+index 4ab91c34d9fb..7ff7516286fd 100644
+--- a/drivers/mfd/tps6594-i2c.c
++++ b/drivers/mfd/tps6594-i2c.c
+@@ -1,6 +1,11 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * I2C access driver for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs
++ * I2C access driver for the following TI PMICs:
++ * - LP8764
++ * - TPS65224
++ * - TPS652G1
++ * - TPS6593
++ * - TPS6594
+ *
+ * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/
+ */
+@@ -197,6 +202,7 @@ static const struct of_device_id tps6594_i2c_of_match_table[] = {
+ { .compatible = "ti,tps6593-q1", .data = (void *)TPS6593, },
+ { .compatible = "ti,lp8764-q1", .data = (void *)LP8764, },
+ { .compatible = "ti,tps65224-q1", .data = (void *)TPS65224, },
++ { .compatible = "ti,tps652g1", .data = (void *)TPS652G1, },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, tps6594_i2c_of_match_table);
+@@ -222,7 +228,7 @@ static int tps6594_i2c_probe(struct i2c_client *client)
+ return dev_err_probe(dev, -EINVAL, "Failed to find matching chip ID\n");
+ tps->chip_id = (unsigned long)match->data;
+
+- if (tps->chip_id == TPS65224)
++ if (tps->chip_id == TPS65224 || tps->chip_id == TPS652G1)
+ tps6594_i2c_regmap_config.volatile_table = &tps65224_volatile_table;
+
+ tps->regmap = devm_regmap_init(dev, NULL, client, &tps6594_i2c_regmap_config);
+diff --git a/drivers/mfd/tps6594-spi.c b/drivers/mfd/tps6594-spi.c
+index 6ebccb79f0cc..944b7313a1d9 100644
+--- a/drivers/mfd/tps6594-spi.c
++++ b/drivers/mfd/tps6594-spi.c
+@@ -1,6 +1,11 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * SPI access driver for TI TPS65224/TPS6594/TPS6593/LP8764 PMICs
++ * SPI access driver for the following TI PMICs:
++ * - LP8764
++ * - TPS65224
++ * - TPS652G1
++ * - TPS6593
++ * - TPS6594
+ *
+ * Copyright (C) 2023 BayLibre Incorporated - https://www.baylibre.com/
+ */
+@@ -82,6 +87,7 @@ static const struct of_device_id tps6594_spi_of_match_table[] = {
+ { .compatible = "ti,tps6593-q1", .data = (void *)TPS6593, },
+ { .compatible = "ti,lp8764-q1", .data = (void *)LP8764, },
+ { .compatible = "ti,tps65224-q1", .data = (void *)TPS65224, },
++ { .compatible = "ti,tps652g1", .data = (void *)TPS652G1, },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, tps6594_spi_of_match_table);
+@@ -107,7 +113,7 @@ static int tps6594_spi_probe(struct spi_device *spi)
+ return dev_err_probe(dev, -EINVAL, "Failed to find matching chip ID\n");
+ tps->chip_id = (unsigned long)match->data;
+
+- if (tps->chip_id == TPS65224)
++ if (tps->chip_id == TPS65224 || tps->chip_id == TPS652G1)
+ tps6594_spi_regmap_config.volatile_table = &tps65224_volatile_table;
+
+ tps->regmap = devm_regmap_init(dev, NULL, spi, &tps6594_spi_regmap_config);
+diff --git a/include/linux/mfd/tps6594.h b/include/linux/mfd/tps6594.h
+index 16543fd4d83e..021db8875963 100644
+--- a/include/linux/mfd/tps6594.h
++++ b/include/linux/mfd/tps6594.h
+@@ -19,6 +19,7 @@ enum pmic_id {
+ TPS6593,
+ LP8764,
+ TPS65224,
++ TPS652G1,
+ };
+
+ /* Macro to get page index from register address */
+--
+2.39.5
+
--- /dev/null
+From e378f42f16bdf3985f0e947c0d79c662fd20117c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 13:28:26 +0200
+Subject: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit e9f4a6b3421e936c3ee9d74710243897d74dbaa2 ]
+
+Not all tasks have an ABI associated or vDSO mapped,
+for example kthreads never do.
+If such a task ever ends up calling stack_top(), it will derefence the
+NULL ABI pointer and crash.
+
+This can for example happen when using kunit:
+
+ mips_stack_top+0x28/0xc0
+ arch_pick_mmap_layout+0x190/0x220
+ kunit_vm_mmap_init+0xf8/0x138
+ __kunit_add_resource+0x40/0xa8
+ kunit_vm_mmap+0x88/0xd8
+ usercopy_test_init+0xb8/0x240
+ kunit_try_run_case+0x5c/0x1a8
+ kunit_generic_run_threadfn_adapter+0x28/0x50
+ kthread+0x118/0x240
+ ret_from_kernel_thread+0x14/0x1c
+
+Only dereference the ABI point if it is set.
+
+The GIC page is also included as it is specific to the vDSO.
+Also move the randomization adjustment into the same conditional.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: David Gow <davidgow@google.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/process.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index b630604c577f..02aa6a04a21d 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -690,18 +690,20 @@ unsigned long mips_stack_top(void)
+ }
+
+ /* Space for the VDSO, data page & GIC user page */
+- top -= PAGE_ALIGN(current->thread.abi->vdso->size);
+- top -= PAGE_SIZE;
+- top -= mips_gic_present() ? PAGE_SIZE : 0;
++ if (current->thread.abi) {
++ top -= PAGE_ALIGN(current->thread.abi->vdso->size);
++ top -= PAGE_SIZE;
++ top -= mips_gic_present() ? PAGE_SIZE : 0;
++
++ /* Space to randomize the VDSO base */
++ if (current->flags & PF_RANDOMIZE)
++ top -= VDSO_RANDOMIZE_SIZE;
++ }
+
+ /* Space for cache colour alignment */
+ if (cpu_has_dc_aliases)
+ top -= shm_align_mask + 1;
+
+- /* Space to randomize the VDSO base */
+- if (current->flags & PF_RANDOMIZE)
+- top -= VDSO_RANDOMIZE_SIZE;
+-
+ return top;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 65904ffc05379582807af663845c6b4dc100617f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 22:53:23 +0800
+Subject: MIPS: lantiq: falcon: sysctrl: fix request memory check logic
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 9c9a7ff9882fc6ba7d2f4050697e8bb80383e8dc ]
+
+request_mem_region() will return NULL instead of error code
+when the memory request fails. Therefore, we should check if
+the return value is non-zero instead of less than zero. In
+this way, this patch also fixes the build warnings:
+
+arch/mips/lantiq/falcon/sysctrl.c:214:50: error: ordered comparison of pointer with integer zero [-Werror=extra]
+ 214 | res_status.name) < 0) ||
+ | ^
+arch/mips/lantiq/falcon/sysctrl.c:216:47: error: ordered comparison of pointer with integer zero [-Werror=extra]
+ 216 | res_ebu.name) < 0) ||
+ | ^
+arch/mips/lantiq/falcon/sysctrl.c:219:50: error: ordered comparison of pointer with integer zero [-Werror=extra]
+ 219 | res_sys[0].name) < 0) ||
+ | ^
+arch/mips/lantiq/falcon/sysctrl.c:222:50: error: ordered comparison of pointer with integer zero [-Werror=extra]
+ 222 | res_sys[1].name) < 0) ||
+ | ^
+arch/mips/lantiq/falcon/sysctrl.c:225:50: error: ordered comparison of pointer with integer zero [-Werror=extra]
+ 225 | res_sys[2].name) < 0))
+ |
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/falcon/sysctrl.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sysctrl.c
+index 1187729d8cbb..357543996ee6 100644
+--- a/arch/mips/lantiq/falcon/sysctrl.c
++++ b/arch/mips/lantiq/falcon/sysctrl.c
+@@ -214,19 +214,16 @@ void __init ltq_soc_init(void)
+ of_node_put(np_syseth);
+ of_node_put(np_sysgpe);
+
+- if ((request_mem_region(res_status.start, resource_size(&res_status),
+- res_status.name) < 0) ||
+- (request_mem_region(res_ebu.start, resource_size(&res_ebu),
+- res_ebu.name) < 0) ||
+- (request_mem_region(res_sys[0].start,
+- resource_size(&res_sys[0]),
+- res_sys[0].name) < 0) ||
+- (request_mem_region(res_sys[1].start,
+- resource_size(&res_sys[1]),
+- res_sys[1].name) < 0) ||
+- (request_mem_region(res_sys[2].start,
+- resource_size(&res_sys[2]),
+- res_sys[2].name) < 0))
++ if ((!request_mem_region(res_status.start, resource_size(&res_status),
++ res_status.name)) ||
++ (!request_mem_region(res_ebu.start, resource_size(&res_ebu),
++ res_ebu.name)) ||
++ (!request_mem_region(res_sys[0].start, resource_size(&res_sys[0]),
++ res_sys[0].name)) ||
++ (!request_mem_region(res_sys[1].start, resource_size(&res_sys[1]),
++ res_sys[1].name)) ||
++ (!request_mem_region(res_sys[2].start, resource_size(&res_sys[2]),
++ res_sys[2].name)))
+ pr_err("Failed to request core resources");
+
+ status_membase = ioremap(res_status.start,
+--
+2.39.5
+
--- /dev/null
+From 8ca9e2763700b311c288cb2bb806dbfc5231a8dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 21:06:32 +0800
+Subject: MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 844615dd0f2d95c018ec66b943e08af22b62aff3 ]
+
+These functions are exported but their prototypes are not defined.
+This patch adds the missing function prototypes to fix the following
+compilation warnings:
+
+arch/mips/kernel/vpe-mt.c:180:7: error: no previous prototype for 'vpe_alloc' [-Werror=missing-prototypes]
+ 180 | void *vpe_alloc(void)
+ | ^~~~~~~~~
+arch/mips/kernel/vpe-mt.c:198:5: error: no previous prototype for 'vpe_start' [-Werror=missing-prototypes]
+ 198 | int vpe_start(void *vpe, unsigned long start)
+ | ^~~~~~~~~
+arch/mips/kernel/vpe-mt.c:208:5: error: no previous prototype for 'vpe_stop' [-Werror=missing-prototypes]
+ 208 | int vpe_stop(void *vpe)
+ | ^~~~~~~~
+arch/mips/kernel/vpe-mt.c:229:5: error: no previous prototype for 'vpe_free' [-Werror=missing-prototypes]
+ 229 | int vpe_free(void *vpe)
+ | ^~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/vpe.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/mips/include/asm/vpe.h b/arch/mips/include/asm/vpe.h
+index 61fd4d0aeda4..c0769dc4b853 100644
+--- a/arch/mips/include/asm/vpe.h
++++ b/arch/mips/include/asm/vpe.h
+@@ -119,4 +119,12 @@ void cleanup_tc(struct tc *tc);
+
+ int __init vpe_module_init(void);
+ void __exit vpe_module_exit(void);
++
++#ifdef CONFIG_MIPS_VPE_LOADER_MT
++void *vpe_alloc(void);
++int vpe_start(void *vpe, unsigned long start);
++int vpe_stop(void *vpe);
++int vpe_free(void *vpe);
++#endif /* CONFIG_MIPS_VPE_LOADER_MT */
++
+ #endif /* _ASM_VPE_H */
+--
+2.39.5
+
--- /dev/null
+From 776148797ab30dc5927abf13f4ce5c8c60553b5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 13:16:23 +0200
+Subject: mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 47a255f7d2eabee06cfbf5b1c2379749442fd01d ]
+
+In the error path of sd_set_power_mode() we don't update host->power_mode,
+which could lead to an imbalance of the runtime PM usage count. Fix this by
+always updating host->power_mode.
+
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Ricky Wu <ricky_wu@realtek.com>
+Link: https://lore.kernel.org/r/20250610111633.504366-2-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/rtsx_usb_sdmmc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
+index d229c2b83ea9..8c35cb85a9c0 100644
+--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
+@@ -1029,9 +1029,7 @@ static int sd_set_power_mode(struct rtsx_usb_sdmmc *host,
+ err = sd_power_on(host);
+ }
+
+- if (!err)
+- host->power_mode = power_mode;
+-
++ host->power_mode = power_mode;
+ return err;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 7587c0b0550446ac4bbcf35b1a9c5e8946ee8d3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 15:36:59 +0530
+Subject: mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
+
+From: Sarthak Garg <quic_sartgarg@quicinc.com>
+
+[ Upstream commit db58532188ebf51d52b1d7693d9e94c76b926e9f ]
+
+Many mobile phones feature multi-card tray designs, where the same
+tray is used for both SD and SIM cards. If the SD card is placed
+at the outermost location in the tray, the SIM card may come in
+contact with SD card power-supply while removing the tray, possibly
+resulting in SIM damage.
+
+To prevent that, make sure the SD card is really inserted by reading
+the Card Detect pin state. If it's not, turn off the power in
+sdhci_msm_check_power_status() and also set the BUS_FAIL power state
+on the controller as part of pwr_irq handling for BUS_ON request.
+
+Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250701100659.3310386-1-quic_sartgarg@quicinc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 57bd49eea777..20cee9f44b4c 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1564,6 +1564,7 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type)
+ {
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
++ struct mmc_host *mmc = host->mmc;
+ bool done = false;
+ u32 val = SWITCHABLE_SIGNALING_VOLTAGE;
+ const struct sdhci_msm_offset *msm_offset =
+@@ -1621,6 +1622,12 @@ static void sdhci_msm_check_power_status(struct sdhci_host *host, u32 req_type)
+ "%s: pwr_irq for req: (%d) timed out\n",
+ mmc_hostname(host->mmc), req_type);
+ }
++
++ if ((req_type & REQ_BUS_ON) && mmc->card && !mmc->ops->get_cd(mmc)) {
++ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
++ host->pwr = 0;
++ }
++
+ pr_debug("%s: %s: request %d done\n", mmc_hostname(host->mmc),
+ __func__, req_type);
+ }
+@@ -1679,6 +1686,13 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq)
+ udelay(10);
+ }
+
++ if ((irq_status & CORE_PWRCTL_BUS_ON) && mmc->card &&
++ !mmc->ops->get_cd(mmc)) {
++ msm_host_writel(msm_host, CORE_PWRCTL_BUS_FAIL, host,
++ msm_offset->core_pwrctl_ctl);
++ return;
++ }
++
+ /* Handle BUS ON/OFF*/
+ if (irq_status & CORE_PWRCTL_BUS_ON) {
+ pwr_state = REQ_BUS_ON;
+--
+2.39.5
+
--- /dev/null
+From fa32c1a337a36b8f8fd6c808f514757a5ac08ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 16:32:32 +0200
+Subject: module: Prevent silent truncation of module name in delete_module(2)
+
+From: Petr Pavlu <petr.pavlu@suse.com>
+
+[ Upstream commit a6323bd4e611567913e23df5b58f2d4e4da06789 ]
+
+Passing a module name longer than MODULE_NAME_LEN to the delete_module
+syscall results in its silent truncation. This really isn't much of
+a problem in practice, but it could theoretically lead to the removal of an
+incorrect module. It is more sensible to return ENAMETOOLONG or ENOENT in
+such a case.
+
+Update the syscall to return ENOENT, as documented in the delete_module(2)
+man page to mean "No module by that name exists." This is appropriate
+because a module with a name longer than MODULE_NAME_LEN cannot be loaded
+in the first place.
+
+Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
+Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
+Link: https://lore.kernel.org/r/20250630143535.267745-2-petr.pavlu@suse.com
+Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module/main.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/module/main.c b/kernel/module/main.c
+index 05da78b6a6c1..4e4e0fd11dde 100644
+--- a/kernel/module/main.c
++++ b/kernel/module/main.c
+@@ -727,14 +727,16 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+ struct module *mod;
+ char name[MODULE_NAME_LEN];
+ char buf[MODULE_FLAGS_BUF_SIZE];
+- int ret, forced = 0;
++ int ret, len, forced = 0;
+
+ if (!capable(CAP_SYS_MODULE) || modules_disabled)
+ return -EPERM;
+
+- if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0)
+- return -EFAULT;
+- name[MODULE_NAME_LEN-1] = '\0';
++ len = strncpy_from_user(name, name_user, MODULE_NAME_LEN);
++ if (len == 0 || len == MODULE_NAME_LEN)
++ return -ENOENT;
++ if (len < 0)
++ return len;
+
+ audit_log_kern_module(name);
+
+--
+2.39.5
+
--- /dev/null
+From 2fe98665c540c7e1dd85b0845f785b7e208caa5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 11:57:25 +0200
+Subject: net: ag71xx: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 96a1e15e60216b52da0e6da5336b6d7f5b0188b0 ]
+
+The DMA map functions can fail and should be tested for errors.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250716095733.37452-3-fourier.thomas@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/ag71xx.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 67b654889cae..d1be8928b985 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -1213,6 +1213,11 @@ static bool ag71xx_fill_rx_buf(struct ag71xx *ag, struct ag71xx_buf *buf,
+ buf->rx.rx_buf = data;
+ buf->rx.dma_addr = dma_map_single(&ag->pdev->dev, data, ag->rx_buf_size,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&ag->pdev->dev, buf->rx.dma_addr)) {
++ skb_free_frag(data);
++ buf->rx.rx_buf = NULL;
++ return false;
++ }
+ desc->data = (u32)buf->rx.dma_addr + offset;
+ return true;
+ }
+@@ -1511,6 +1516,10 @@ static netdev_tx_t ag71xx_hard_start_xmit(struct sk_buff *skb,
+
+ dma_addr = dma_map_single(&ag->pdev->dev, skb->data, skb->len,
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&ag->pdev->dev, dma_addr)) {
++ netif_dbg(ag, tx_err, ndev, "DMA mapping error\n");
++ goto err_drop;
++ }
+
+ i = ring->curr & ring_mask;
+ desc = ag71xx_ring_desc(ring, i);
+--
+2.39.5
+
--- /dev/null
+From 8c69665883810a4e1b503cefca7265a1f7325350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jun 2025 22:15:28 -0700
+Subject: net: atlantic: add set_power to fw_ops for atl2 to fix wol
+
+From: Eric Work <work.eric@gmail.com>
+
+[ Upstream commit fad9cf216597a71936ac87143d1618fbbcf97cbe ]
+
+Aquantia AQC113(C) using ATL2FW doesn't properly prepare the NIC for
+enabling wake-on-lan. The FW operation `set_power` was only implemented
+for `hw_atl` and not `hw_atl2`. Implement the `set_power` functionality
+for `hw_atl2`.
+
+Tested with both AQC113 and AQC113C devices. Confirmed you can shutdown
+the system and wake from S5 using magic packets. NIC was previously
+powered off when entering S5. If the NIC was configured for WOL by the
+Windows driver, loading the atlantic driver would disable WOL.
+
+Partially cherry-picks changes from commit,
+https://github.com/Aquantia/AQtion/commit/37bd5cc
+
+Attributing original authors from Marvell for the referenced commit.
+
+Closes: https://github.com/Aquantia/AQtion/issues/70
+Co-developed-by: Igor Russkikh <irusskikh@marvell.com>
+Co-developed-by: Mark Starovoitov <mstarovoitov@marvell.com>
+Co-developed-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Co-developed-by: Pavel Belous <pbelous@marvell.com>
+Co-developed-by: Nikita Danilov <ndanilov@marvell.com>
+Signed-off-by: Eric Work <work.eric@gmail.com>
+Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
+Link: https://patch.msgid.link/20250629051535.5172-1-work.eric@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/aquantia/atlantic/aq_hw.h | 2 +
+ .../atlantic/hw_atl2/hw_atl2_utils_fw.c | 39 +++++++++++++++++++
+ 2 files changed, 41 insertions(+)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+index 42c0efc1b455..4e66fd9b2ab1 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+@@ -113,6 +113,8 @@ struct aq_stats_s {
+ #define AQ_HW_POWER_STATE_D0 0U
+ #define AQ_HW_POWER_STATE_D3 3U
+
++#define AQ_FW_WAKE_ON_LINK_RTPM BIT(10)
++
+ #define AQ_HW_FLAG_STARTED 0x00000004U
+ #define AQ_HW_FLAG_STOPPING 0x00000008U
+ #define AQ_HW_FLAG_RESETTING 0x00000010U
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c
+index 52e2070a4a2f..7370e3f76b62 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2_utils_fw.c
+@@ -462,6 +462,44 @@ static int aq_a2_fw_get_mac_temp(struct aq_hw_s *self, int *temp)
+ return aq_a2_fw_get_phy_temp(self, temp);
+ }
+
++static int aq_a2_fw_set_wol_params(struct aq_hw_s *self, const u8 *mac, u32 wol)
++{
++ struct mac_address_aligned_s mac_address;
++ struct link_control_s link_control;
++ struct wake_on_lan_s wake_on_lan;
++
++ memcpy(mac_address.aligned.mac_address, mac, ETH_ALEN);
++ hw_atl2_shared_buffer_write(self, mac_address, mac_address);
++
++ memset(&wake_on_lan, 0, sizeof(wake_on_lan));
++
++ if (wol & WAKE_MAGIC)
++ wake_on_lan.wake_on_magic_packet = 1U;
++
++ if (wol & (WAKE_PHY | AQ_FW_WAKE_ON_LINK_RTPM))
++ wake_on_lan.wake_on_link_up = 1U;
++
++ hw_atl2_shared_buffer_write(self, sleep_proxy, wake_on_lan);
++
++ hw_atl2_shared_buffer_get(self, link_control, link_control);
++ link_control.mode = AQ_HOST_MODE_SLEEP_PROXY;
++ hw_atl2_shared_buffer_write(self, link_control, link_control);
++
++ return hw_atl2_shared_buffer_finish_ack(self);
++}
++
++static int aq_a2_fw_set_power(struct aq_hw_s *self, unsigned int power_state,
++ const u8 *mac)
++{
++ u32 wol = self->aq_nic_cfg->wol;
++ int err = 0;
++
++ if (wol)
++ err = aq_a2_fw_set_wol_params(self, mac, wol);
++
++ return err;
++}
++
+ static int aq_a2_fw_set_eee_rate(struct aq_hw_s *self, u32 speed)
+ {
+ struct link_options_s link_options;
+@@ -605,6 +643,7 @@ const struct aq_fw_ops aq_a2_fw_ops = {
+ .set_state = aq_a2_fw_set_state,
+ .update_link_status = aq_a2_fw_update_link_status,
+ .update_stats = aq_a2_fw_update_stats,
++ .set_power = aq_a2_fw_set_power,
+ .get_mac_temp = aq_a2_fw_get_mac_temp,
+ .get_phy_temp = aq_a2_fw_get_phy_temp,
+ .set_eee_rate = aq_a2_fw_set_eee_rate,
+--
+2.39.5
+
--- /dev/null
+From a417a37c0027a51106056fc6d6f968a88847217d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 10:00:00 +0200
+Subject: net: dsa: b53: ensure BCM5325 PHYs are enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 966a83df36c6f27476ac3501771422e7852098bc ]
+
+According to the datasheet, BCM5325 uses B53_PD_MODE_CTRL_25 register to
+disable clocking to individual PHYs.
+Only ports 1-4 can be enabled or disabled and the datasheet is explicit
+about not toggling BIT(0) since it disables the PLL power and the switch.
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20250614080000.1884236-15-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 13 +++++++++++++
+ drivers/net/dsa/b53/b53_regs.h | 5 ++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index dc2f4adac9bc..184946e8cee9 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -615,6 +615,19 @@ int b53_setup_port(struct dsa_switch *ds, int port)
+ if (dsa_is_user_port(ds, port))
+ b53_set_eap_mode(dev, port, EAP_MODE_SIMPLIFIED);
+
++ if (is5325(dev) &&
++ in_range(port, 1, 4)) {
++ u8 reg;
++
++ b53_read8(dev, B53_CTRL_PAGE, B53_PD_MODE_CTRL_25, ®);
++ reg &= ~PD_MODE_POWER_DOWN_PORT(0);
++ if (dsa_is_unused_port(ds, port))
++ reg |= PD_MODE_POWER_DOWN_PORT(port);
++ else
++ reg &= ~PD_MODE_POWER_DOWN_PORT(port);
++ b53_write8(dev, B53_CTRL_PAGE, B53_PD_MODE_CTRL_25, reg);
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL(b53_setup_port);
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index 1fbc5a204bc7..d31c8ad9a9b6 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -101,8 +101,11 @@
+ #define PORT_OVERRIDE_SPEED_2000M BIT(6) /* BCM5301X only, requires setting 1000M */
+ #define PORT_OVERRIDE_EN BIT(7) /* Use the register contents */
+
+-/* Power-down mode control */
++/* Power-down mode control (8 bit) */
+ #define B53_PD_MODE_CTRL_25 0x0f
++#define PD_MODE_PORT_MASK 0x1f
++/* Bit 0 also powers down the switch. */
++#define PD_MODE_POWER_DOWN_PORT(i) BIT(i)
+
+ /* IP Multicast control (8 bit) */
+ #define B53_IP_MULTICAST_CTRL 0x21
+--
+2.39.5
+
--- /dev/null
+From 5945cdac9e0d0dc25aba157b3def5ba527a9f5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 09:59:59 +0200
+Subject: net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit c00df1018791185ea398f78af415a2a0aaa0c79c ]
+
+CPU port should be B53_CPU_PORT instead of B53_CPU_PORT_25 for
+B53_PVLAN_PORT_MASK register.
+
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://patch.msgid.link/20250614080000.1884236-14-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 184946e8cee9..55e1844a5e9c 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -529,6 +529,10 @@ void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port)
+ unsigned int i;
+ u16 pvlan;
+
++ /* BCM5325 CPU port is at 8 */
++ if ((is5325(dev) || is5365(dev)) && cpu_port == B53_CPU_PORT_25)
++ cpu_port = B53_CPU_PORT;
++
+ /* Enable the IMP port to be in the same VLAN as the other ports
+ * on a per-port basis such that we only have Port i and IMP in
+ * the same VLAN.
+--
+2.39.5
+
--- /dev/null
+From da2af7d93725191a482e5d361e6f21d85d22bfd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 09:59:54 +0200
+Subject: net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 044d5ce2788b165798bfd173548e61bf7b6baf4d ]
+
+BCM5325 doesn't implement B53_UC_FWD_EN, B53_MC_FWD_EN or B53_IPMC_FWD_EN.
+
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://patch.msgid.link/20250614080000.1884236-9-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 18 +++++++++++-------
+ drivers/net/dsa/b53/b53_regs.h | 1 +
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index bb0a5fd6a372..d15d912690c4 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -366,14 +366,18 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
+ b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, &mgmt);
+ mgmt |= B53_MII_DUMB_FWDG_EN;
+ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
+- }
+
+- /* Look at B53_UC_FWD_EN and B53_MC_FWD_EN to decide whether
+- * frames should be flooded or not.
+- */
+- b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
+- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN;
+- b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
++ /* Look at B53_UC_FWD_EN and B53_MC_FWD_EN to decide whether
++ * frames should be flooded or not.
++ */
++ b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
++ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN;
++ b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
++ } else {
++ b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
++ mgmt |= B53_IP_MCAST_25;
++ b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
++ }
+ }
+
+ static void b53_enable_vlan(struct b53_device *dev, int port, bool enable,
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index 25d25bd1071f..f2caf8fe5699 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -110,6 +110,7 @@
+
+ /* IP Multicast control (8 bit) */
+ #define B53_IP_MULTICAST_CTRL 0x21
++#define B53_IP_MCAST_25 BIT(0)
+ #define B53_IPMC_FWD_EN BIT(1)
+ #define B53_UC_FWD_EN BIT(6)
+ #define B53_MC_FWD_EN BIT(7)
+--
+2.39.5
+
--- /dev/null
+From 66e1f846054e1da8bb926911f8769095829100c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 09:59:55 +0200
+Subject: net: dsa: b53: prevent DIS_LEARNING access on BCM5325
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 800728abd9f83bda4de62a30ce62a8b41c242020 ]
+
+BCM5325 doesn't implement DIS_LEARNING register so we should avoid reading
+or writing it.
+
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://patch.msgid.link/20250614080000.1884236-10-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 8abbcc588267..990d21fad939 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -583,6 +583,9 @@ static void b53_port_set_learning(struct b53_device *dev, int port,
+ {
+ u16 reg;
+
++ if (is5325(dev))
++ return;
++
+ b53_read16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, ®);
+ if (learning)
+ reg &= ~BIT(port);
+@@ -2195,7 +2198,13 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port,
+ struct switchdev_brport_flags flags,
+ struct netlink_ext_ack *extack)
+ {
+- if (flags.mask & ~(BR_FLOOD | BR_MCAST_FLOOD | BR_LEARNING))
++ struct b53_device *dev = ds->priv;
++ unsigned long mask = (BR_FLOOD | BR_MCAST_FLOOD);
++
++ if (!is5325(dev))
++ mask |= BR_LEARNING;
++
++ if (flags.mask & ~mask)
+ return -EINVAL;
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 7a112bf567ed43343da081d8324428b9d03f6037 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 09:59:57 +0200
+Subject: net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 37883bbc45a8555d6eca88d3a9730504d2dac86c ]
+
+BCM5325 doesn't implement GMII_PORT_OVERRIDE_CTRL register so we should
+avoid reading or writing it.
+PORT_OVERRIDE_RX_FLOW and PORT_OVERRIDE_TX_FLOW aren't defined on BCM5325
+and we should use PORT_OVERRIDE_LP_FLOW_25 instead.
+
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://patch.msgid.link/20250614080000.1884236-12-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 21 +++++++++++++++++----
+ drivers/net/dsa/b53/b53_regs.h | 1 +
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 55e1844a5e9c..8abbcc588267 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1274,6 +1274,8 @@ static void b53_force_link(struct b53_device *dev, int port, int link)
+ if (port == dev->imp_port) {
+ off = B53_PORT_OVERRIDE_CTRL;
+ val = PORT_OVERRIDE_EN;
++ } else if (is5325(dev)) {
++ return;
+ } else {
+ off = B53_GMII_PORT_OVERRIDE_CTRL(port);
+ val = GMII_PO_EN;
+@@ -1298,6 +1300,8 @@ static void b53_force_port_config(struct b53_device *dev, int port,
+ if (port == dev->imp_port) {
+ off = B53_PORT_OVERRIDE_CTRL;
+ val = PORT_OVERRIDE_EN;
++ } else if (is5325(dev)) {
++ return;
+ } else {
+ off = B53_GMII_PORT_OVERRIDE_CTRL(port);
+ val = GMII_PO_EN;
+@@ -1328,10 +1332,19 @@ static void b53_force_port_config(struct b53_device *dev, int port,
+ return;
+ }
+
+- if (rx_pause)
+- reg |= PORT_OVERRIDE_RX_FLOW;
+- if (tx_pause)
+- reg |= PORT_OVERRIDE_TX_FLOW;
++ if (rx_pause) {
++ if (is5325(dev))
++ reg |= PORT_OVERRIDE_LP_FLOW_25;
++ else
++ reg |= PORT_OVERRIDE_RX_FLOW;
++ }
++
++ if (tx_pause) {
++ if (is5325(dev))
++ reg |= PORT_OVERRIDE_LP_FLOW_25;
++ else
++ reg |= PORT_OVERRIDE_TX_FLOW;
++ }
+
+ b53_write8(dev, B53_CTRL_PAGE, off, reg);
+ }
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index d31c8ad9a9b6..25d25bd1071f 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -95,6 +95,7 @@
+ #define PORT_OVERRIDE_SPEED_10M (0 << PORT_OVERRIDE_SPEED_S)
+ #define PORT_OVERRIDE_SPEED_100M (1 << PORT_OVERRIDE_SPEED_S)
+ #define PORT_OVERRIDE_SPEED_1000M (2 << PORT_OVERRIDE_SPEED_S)
++#define PORT_OVERRIDE_LP_FLOW_25 BIT(3) /* BCM5325 only */
+ #define PORT_OVERRIDE_RV_MII_25 BIT(4) /* BCM5325 only */
+ #define PORT_OVERRIDE_RX_FLOW BIT(4)
+ #define PORT_OVERRIDE_TX_FLOW BIT(5)
+--
+2.39.5
+
--- /dev/null
+From 24547affb270ee6743c25bf3fd8976fdfc6c5726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 09:59:53 +0200
+Subject: net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit 22ccaaca43440e90a3b68d2183045b42247dc4be ]
+
+BCM5325 doesn't implement SWITCH_CTRL register so we should avoid reading
+or writing it.
+
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Link: https://patch.msgid.link/20250614080000.1884236-8-noltari@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 990d21fad939..bb0a5fd6a372 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -361,11 +361,12 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
+
+ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+
+- /* Include IMP port in dumb forwarding mode
+- */
+- b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, &mgmt);
+- mgmt |= B53_MII_DUMB_FWDG_EN;
+- b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
++ if (!is5325(dev)) {
++ /* Include IMP port in dumb forwarding mode */
++ b53_read8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, &mgmt);
++ mgmt |= B53_MII_DUMB_FWDG_EN;
++ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
++ }
+
+ /* Look at B53_UC_FWD_EN and B53_MC_FWD_EN to decide whether
+ * frames should be flooded or not.
+--
+2.39.5
+
--- /dev/null
+From d32f3cd472b4a6e0bbee6bc63518a35e1e69dff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 15:44:02 +0200
+Subject: net: fec: allow disable coalescing
+
+From: Jonas Rebmann <jre@pengutronix.de>
+
+[ Upstream commit b7ad21258f9e9a7f58b19595d5ceed2cde3bed68 ]
+
+In the current implementation, IP coalescing is always enabled and
+cannot be disabled.
+
+As setting maximum frames to 0 or 1, or setting delay to zero implies
+immediate delivery of single packets/IRQs, disable coalescing in
+hardware in these cases.
+
+This also guarantees that coalescing is never enabled with ICFT or ICTT
+set to zero, a configuration that could lead to unpredictable behaviour
+according to i.MX8MP reference manual.
+
+Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
+Reviewed-by: Wei Fang <wei.fang@nxp.com>
+Link: https://patch.msgid.link/20250626-fec_deactivate_coalescing-v2-1-0b217f2e80da@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 34 +++++++++++------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 17e9bddb9ddd..651b73163b6e 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3124,27 +3124,25 @@ static int fec_enet_us_to_itr_clock(struct net_device *ndev, int us)
+ static void fec_enet_itr_coal_set(struct net_device *ndev)
+ {
+ struct fec_enet_private *fep = netdev_priv(ndev);
+- int rx_itr, tx_itr;
++ u32 rx_itr = 0, tx_itr = 0;
++ int rx_ictt, tx_ictt;
+
+- /* Must be greater than zero to avoid unpredictable behavior */
+- if (!fep->rx_time_itr || !fep->rx_pkts_itr ||
+- !fep->tx_time_itr || !fep->tx_pkts_itr)
+- return;
+-
+- /* Select enet system clock as Interrupt Coalescing
+- * timer Clock Source
+- */
+- rx_itr = FEC_ITR_CLK_SEL;
+- tx_itr = FEC_ITR_CLK_SEL;
++ rx_ictt = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr);
++ tx_ictt = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr);
+
+- /* set ICFT and ICTT */
+- rx_itr |= FEC_ITR_ICFT(fep->rx_pkts_itr);
+- rx_itr |= FEC_ITR_ICTT(fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr));
+- tx_itr |= FEC_ITR_ICFT(fep->tx_pkts_itr);
+- tx_itr |= FEC_ITR_ICTT(fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr));
++ if (rx_ictt > 0 && fep->rx_pkts_itr > 1) {
++ /* Enable with enet system clock as Interrupt Coalescing timer Clock Source */
++ rx_itr = FEC_ITR_EN | FEC_ITR_CLK_SEL;
++ rx_itr |= FEC_ITR_ICFT(fep->rx_pkts_itr);
++ rx_itr |= FEC_ITR_ICTT(rx_ictt);
++ }
+
+- rx_itr |= FEC_ITR_EN;
+- tx_itr |= FEC_ITR_EN;
++ if (tx_ictt > 0 && fep->tx_pkts_itr > 1) {
++ /* Enable with enet system clock as Interrupt Coalescing timer Clock Source */
++ tx_itr = FEC_ITR_EN | FEC_ITR_CLK_SEL;
++ tx_itr |= FEC_ITR_ICFT(fep->tx_pkts_itr);
++ tx_itr |= FEC_ITR_ICTT(tx_ictt);
++ }
+
+ writel(tx_itr, fep->hwp + FEC_TXIC0);
+ writel(rx_itr, fep->hwp + FEC_RXIC0);
+--
+2.39.5
+
--- /dev/null
+From 91e502d3a96866b089daf8a4ab3a5865b3089115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 22:59:07 +0200
+Subject: net: ieee8021q: fix insufficient table-size assertion
+
+From: RubenKelevra <rubenkelevra@gmail.com>
+
+[ Upstream commit 21deb2d966920f0d4dd098ca6c3a55efbc0b2f23 ]
+
+_Static_assert(ARRAY_SIZE(map) != IEEE8021Q_TT_MAX - 1) rejects only a
+length of 7 and allows any other mismatch. Replace it with a strict
+equality test via a helper macro so that every mapping table must have
+exactly IEEE8021Q_TT_MAX (8) entries.
+
+Signed-off-by: RubenKelevra <rubenkelevra@gmail.com>
+Link: https://patch.msgid.link/20250626205907.1566384-1-rubenkelevra@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/ieee8021q_helpers.c | 44 +++++++++++-------------------------
+ 1 file changed, 13 insertions(+), 31 deletions(-)
+
+diff --git a/net/core/ieee8021q_helpers.c b/net/core/ieee8021q_helpers.c
+index 759a9b9f3f89..669b357b73b2 100644
+--- a/net/core/ieee8021q_helpers.c
++++ b/net/core/ieee8021q_helpers.c
+@@ -7,6 +7,11 @@
+ #include <net/dscp.h>
+ #include <net/ieee8021q.h>
+
++/* verify that table covers all 8 traffic types */
++#define TT_MAP_SIZE_OK(tbl) \
++ compiletime_assert(ARRAY_SIZE(tbl) == IEEE8021Q_TT_MAX, \
++ #tbl " size mismatch")
++
+ /* The following arrays map Traffic Types (TT) to traffic classes (TC) for
+ * different number of queues as shown in the example provided by
+ * IEEE 802.1Q-2022 in Annex I "I.3 Traffic type to traffic class mapping" and
+@@ -101,51 +106,28 @@ int ieee8021q_tt_to_tc(enum ieee8021q_traffic_type tt, unsigned int num_queues)
+
+ switch (num_queues) {
+ case 8:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_8queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_8queue_tt_tc_map != max - 1");
++ TT_MAP_SIZE_OK(ieee8021q_8queue_tt_tc_map);
+ return ieee8021q_8queue_tt_tc_map[tt];
+ case 7:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_7queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_7queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_7queue_tt_tc_map);
+ return ieee8021q_7queue_tt_tc_map[tt];
+ case 6:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_6queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_6queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_6queue_tt_tc_map);
+ return ieee8021q_6queue_tt_tc_map[tt];
+ case 5:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_5queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_5queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_5queue_tt_tc_map);
+ return ieee8021q_5queue_tt_tc_map[tt];
+ case 4:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_4queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_4queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_4queue_tt_tc_map);
+ return ieee8021q_4queue_tt_tc_map[tt];
+ case 3:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_3queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_3queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_3queue_tt_tc_map);
+ return ieee8021q_3queue_tt_tc_map[tt];
+ case 2:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_2queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_2queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_2queue_tt_tc_map);
+ return ieee8021q_2queue_tt_tc_map[tt];
+ case 1:
+- compiletime_assert(ARRAY_SIZE(ieee8021q_1queue_tt_tc_map) !=
+- IEEE8021Q_TT_MAX - 1,
+- "ieee8021q_1queue_tt_tc_map != max - 1");
+-
++ TT_MAP_SIZE_OK(ieee8021q_1queue_tt_tc_map);
+ return ieee8021q_1queue_tt_tc_map[tt];
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 2d884d80057fe30bb897cea8d93e66c0bcd63421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 16:27:13 +0200
+Subject: net: ipv4: fix incorrect MTU in broadcast routes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oscar Maes <oscmaes92@gmail.com>
+
+[ Upstream commit 9e30ecf23b1b8f091f7d08b27968dea83aae7908 ]
+
+Currently, __mkroute_output overrules the MTU value configured for
+broadcast routes.
+
+This buggy behaviour can be reproduced with:
+
+ip link set dev eth1 mtu 9000
+ip route del broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2
+ip route add broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2 mtu 1500
+
+The maximum packet size should be 1500, but it is actually 8000:
+
+ping -b 192.168.0.255 -s 8000
+
+Fix __mkroute_output to allow MTU values to be configured for
+for broadcast routes (to support a mixed-MTU local-area-network).
+
+Signed-off-by: Oscar Maes <oscmaes92@gmail.com>
+Link: https://patch.msgid.link/20250710142714.12986-1-oscmaes92@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index e686f088bc67..50b3d270f606 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2578,7 +2578,6 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
+ do_cache = true;
+ if (type == RTN_BROADCAST) {
+ flags |= RTCF_BROADCAST | RTCF_LOCAL;
+- fi = NULL;
+ } else if (type == RTN_MULTICAST) {
+ flags |= RTCF_MULTICAST | RTCF_LOCAL;
+ if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
+--
+2.39.5
+
--- /dev/null
+From 4145fc6593449a8cd7a0ee7d165fb4cc28f164c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 16:55:55 +0800
+Subject: net: mctp: Prevent duplicate binds
+
+From: Matt Johnston <matt@codeconstruct.com.au>
+
+[ Upstream commit 3954502377ec05a1b37e2dc9bef0bacd4bbd71b2 ]
+
+Disallow bind() calls that have the same arguments as existing bound
+sockets. Previously multiple sockets could bind() to the same
+type/local address, with an arbitrary socket receiving matched messages.
+
+This is only a partial fix, a future commit will define precedence order
+for MCTP_ADDR_ANY versus specific EID bind(), which are allowed to exist
+together.
+
+Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
+Link: https://patch.msgid.link/20250710-mctp-bind-v4-2-8ec2f6460c56@codeconstruct.com.au
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mctp/af_mctp.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
+index 9b12ca97f412..9d5db3feedec 100644
+--- a/net/mctp/af_mctp.c
++++ b/net/mctp/af_mctp.c
+@@ -73,7 +73,6 @@ static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
+
+ lock_sock(sk);
+
+- /* TODO: allow rebind */
+ if (sk_hashed(sk)) {
+ rc = -EADDRINUSE;
+ goto out_release;
+@@ -629,15 +628,36 @@ static void mctp_sk_close(struct sock *sk, long timeout)
+ static int mctp_sk_hash(struct sock *sk)
+ {
+ struct net *net = sock_net(sk);
++ struct sock *existing;
++ struct mctp_sock *msk;
++ int rc;
++
++ msk = container_of(sk, struct mctp_sock, sk);
+
+ /* Bind lookup runs under RCU, remain live during that. */
+ sock_set_flag(sk, SOCK_RCU_FREE);
+
+ mutex_lock(&net->mctp.bind_lock);
++
++ /* Prevent duplicate binds. */
++ sk_for_each(existing, &net->mctp.binds) {
++ struct mctp_sock *mex =
++ container_of(existing, struct mctp_sock, sk);
++
++ if (mex->bind_type == msk->bind_type &&
++ mex->bind_addr == msk->bind_addr &&
++ mex->bind_net == msk->bind_net) {
++ rc = -EADDRINUSE;
++ goto out;
++ }
++ }
++
+ sk_add_node_rcu(sk, &net->mctp.binds);
+- mutex_unlock(&net->mctp.bind_lock);
++ rc = 0;
+
+- return 0;
++out:
++ mutex_unlock(&net->mctp.bind_lock);
++ return rc;
+ }
+
+ static void mctp_sk_unhash(struct sock *sk)
+--
+2.39.5
+
--- /dev/null
+From 832bd3ec98525249481d95648f6f4fa3fc6a9bf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 17:17:49 +0300
+Subject: net/mlx5e: Properly access RCU protected qdisc_sleeping variable
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 2a601b2d35623065d31ebaf697b07502d54878c9 ]
+
+qdisc_sleeping variable is declared as "struct Qdisc __rcu" and
+as such needs proper annotation while accessing it.
+
+Without rtnl_dereference(), the following error is generated by sparse:
+
+drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: warning:
+ incorrect type in initializer (different address spaces)
+drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: expected
+ struct Qdisc *qdisc
+drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: got struct
+ Qdisc [noderef] __rcu *qdisc_sleeping
+
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/1752675472-201445-4-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+index f0744a45db92..4e461cb03b83 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+@@ -374,7 +374,7 @@ void mlx5e_reactivate_qos_sq(struct mlx5e_priv *priv, u16 qid, struct netdev_que
+ void mlx5e_reset_qdisc(struct net_device *dev, u16 qid)
+ {
+ struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, qid);
+- struct Qdisc *qdisc = dev_queue->qdisc_sleeping;
++ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);
+
+ if (!qdisc)
+ return;
+--
+2.39.5
+
--- /dev/null
+From 44b9fa172ffe64d3f1b30446c1a666f5b1a76b6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 12:33:38 -0700
+Subject: net: ncsi: Fix buffer overflow in fetching version id
+
+From: Hari Kalavakunta <kalavakunta.hari.prasad@gmail.com>
+
+[ Upstream commit 8e16170ae972c7fed132bc928914a2ffb94690fc ]
+
+In NC-SI spec v1.2 section 8.4.44.2, the firmware name doesn't
+need to be null terminated while its size occupies the full size
+of the field. Fix the buffer overflow issue by adding one
+additional byte for null terminator.
+
+Signed-off-by: Hari Kalavakunta <kalavakunta.hari.prasad@gmail.com>
+Reviewed-by: Paul Fertser <fercerpav@gmail.com>
+Link: https://patch.msgid.link/20250610193338.1368-1-kalavakunta.hari.prasad@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/internal.h | 2 +-
+ net/ncsi/ncsi-rsp.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
+index 2c260f33b55c..ad1f671ffc37 100644
+--- a/net/ncsi/internal.h
++++ b/net/ncsi/internal.h
+@@ -110,7 +110,7 @@ struct ncsi_channel_version {
+ u8 update; /* NCSI version update */
+ char alpha1; /* NCSI version alpha1 */
+ char alpha2; /* NCSI version alpha2 */
+- u8 fw_name[12]; /* Firmware name string */
++ u8 fw_name[12 + 1]; /* Firmware name string */
+ u32 fw_version; /* Firmware version */
+ u16 pci_ids[4]; /* PCI identification */
+ u32 mf_id; /* Manufacture ID */
+diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
+index 8668888c5a2f..d5ed80731e89 100644
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -775,6 +775,7 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
+ ncv->alpha1 = rsp->alpha1;
+ ncv->alpha2 = rsp->alpha2;
+ memcpy(ncv->fw_name, rsp->fw_name, 12);
++ ncv->fw_name[12] = '\0';
+ ncv->fw_version = ntohl(rsp->fw_version);
+ for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++)
+ ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]);
+--
+2.39.5
+
--- /dev/null
+From cbed7f11dd27a405465a7c71a1d240d999384caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 11:03:49 +0800
+Subject: net: pcs: xpcs: mask readl() return value to 16 bits
+
+From: Jack Ping CHNG <jchng@maxlinear.com>
+
+[ Upstream commit 2b0ba7b5b010455c4e43ab557860f8b1089e7424 ]
+
+readl() returns 32-bit value but Clause 22/45 registers are 16-bit wide.
+Masking with 0xFFFF avoids using garbage upper bits.
+
+Signed-off-by: Jack Ping CHNG <jchng@maxlinear.com>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://patch.msgid.link/20250716030349.3796806-1-jchng@maxlinear.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/pcs/pcs-xpcs-plat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/pcs/pcs-xpcs-plat.c b/drivers/net/pcs/pcs-xpcs-plat.c
+index 629315f1e57c..9dcaf7a66113 100644
+--- a/drivers/net/pcs/pcs-xpcs-plat.c
++++ b/drivers/net/pcs/pcs-xpcs-plat.c
+@@ -66,7 +66,7 @@ static int xpcs_mmio_read_reg_indirect(struct dw_xpcs_plat *pxpcs,
+ switch (pxpcs->reg_width) {
+ case 4:
+ writel(page, pxpcs->reg_base + (DW_VR_CSR_VIEWPORT << 2));
+- ret = readl(pxpcs->reg_base + (ofs << 2));
++ ret = readl(pxpcs->reg_base + (ofs << 2)) & 0xffff;
+ break;
+ default:
+ writew(page, pxpcs->reg_base + (DW_VR_CSR_VIEWPORT << 1));
+@@ -124,7 +124,7 @@ static int xpcs_mmio_read_reg_direct(struct dw_xpcs_plat *pxpcs,
+
+ switch (pxpcs->reg_width) {
+ case 4:
+- ret = readl(pxpcs->reg_base + (csr << 2));
++ ret = readl(pxpcs->reg_base + (csr << 2)) & 0xffff;
+ break;
+ default:
+ ret = readw(pxpcs->reg_base + (csr << 1));
+--
+2.39.5
+
--- /dev/null
+From ef08830e83387d90cc9f2caa1eecbd13d6926709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 11:01:40 +0200
+Subject: net: phy: bcm54811: PHY initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kamil Horák - 2N <kamilh@axis.com>
+
+[ Upstream commit 3117a11fff5af9e74f4946f07cb3ca083cbbdf4b ]
+
+Reset the bit 12 in PHY's LRE Control register upon initialization.
+According to the datasheet, this bit must be written to zero after
+every device reset.
+
+Signed-off-by: Kamil Horák - 2N <kamilh@axis.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20250708090140.61355-5-kamilh@axis.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 9b1de54fd483..f871f11d1921 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -655,7 +655,7 @@ static int bcm5481x_read_abilities(struct phy_device *phydev)
+ {
+ struct device_node *np = phydev->mdio.dev.of_node;
+ struct bcm54xx_phy_priv *priv = phydev->priv;
+- int i, val, err;
++ int i, val, err, aneg;
+
+ for (i = 0; i < ARRAY_SIZE(bcm54811_linkmodes); i++)
+ linkmode_clear_bit(bcm54811_linkmodes[i], phydev->supported);
+@@ -676,9 +676,19 @@ static int bcm5481x_read_abilities(struct phy_device *phydev)
+ if (val < 0)
+ return val;
+
++ /* BCM54811 is not capable of LDS but the corresponding bit
++ * in LRESR is set to 1 and marked "Ignore" in the datasheet.
++ * So we must read the bcm54811 as unable to auto-negotiate
++ * in BroadR-Reach mode.
++ */
++ if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54811)
++ aneg = 0;
++ else
++ aneg = val & LRESR_LDSABILITY;
++
+ linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+ phydev->supported,
+- val & LRESR_LDSABILITY);
++ aneg);
+ linkmode_mod_bit(ETHTOOL_LINK_MODE_100baseT1_Full_BIT,
+ phydev->supported,
+ val & LRESR_100_1PAIR);
+@@ -735,8 +745,15 @@ static int bcm54811_config_aneg(struct phy_device *phydev)
+
+ /* Aneg firstly. */
+ if (priv->brr_mode) {
+- /* BCM54811 is only capable of autonegotiation in IEEE mode */
+- phydev->autoneg = 0;
++ /* BCM54811 is only capable of autonegotiation in IEEE mode.
++ * In BroadR-Reach mode, disable the Long Distance Signaling,
++ * the BRR mode autoneg as supported in other Broadcom PHYs.
++ * This bit is marked as "Reserved" and "Default 1, must be
++ * written to 0 after every device reset" in the datasheet.
++ */
++ ret = phy_modify(phydev, MII_BCM54XX_LRECR, LRECR_LDSEN, 0);
++ if (ret < 0)
++ return ret;
+ ret = bcm_config_lre_aneg(phydev, false);
+ } else {
+ ret = genphy_config_aneg(phydev);
+--
+2.39.5
+
--- /dev/null
+From aa2708780feb24a9ca5dcf3d787580d0a4de5221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 06:40:21 +0100
+Subject: net: phy: micrel: Add ksz9131_resume()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit f25a7eaa897f21396e99f90809af82ca553c9d14 ]
+
+The Renesas RZ/G3E SMARC EVK uses KSZ9131RNXC phy. On deep power state,
+PHY loses the power and on wakeup the rgmii delays are not reconfigured
+causing it to fail.
+
+Replace the callback kszphy_resume()->ksz9131_resume() for reconfiguring
+the rgmii_delay when it exits from PM suspend state.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250711054029.48536-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 4eead5addc6b..d2498b31aab6 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -5410,6 +5410,14 @@ static int lan8841_suspend(struct phy_device *phydev)
+ return kszphy_generic_suspend(phydev);
+ }
+
++static int ksz9131_resume(struct phy_device *phydev)
++{
++ if (phydev->suspended && phy_interface_is_rgmii(phydev))
++ ksz9131_config_rgmii_delay(phydev);
++
++ return kszphy_resume(phydev);
++}
++
+ static struct phy_driver ksphy_driver[] = {
+ {
+ .phy_id = PHY_ID_KS8737,
+@@ -5656,7 +5664,7 @@ static struct phy_driver ksphy_driver[] = {
+ .get_strings = kszphy_get_strings,
+ .get_stats = kszphy_get_stats,
+ .suspend = kszphy_suspend,
+- .resume = kszphy_resume,
++ .resume = ksz9131_resume,
+ .cable_test_start = ksz9x31_cable_test_start,
+ .cable_test_get_status = ksz9x31_cable_test_get_status,
+ .get_features = ksz9477_get_features,
+--
+2.39.5
+
--- /dev/null
+From 3276fc674e5269a5cd91a7f04eaf1ae0322f50ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 17:29:16 +0200
+Subject: net: phy: smsc: add proper reset flags for LAN8710A
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Buday Csaba <buday.csaba@prolan.hu>
+
+[ Upstream commit 57ec5a8735dc5dccd1ee68afdb1114956a3fce0d ]
+
+According to the LAN8710A datasheet (Rev. B, section 3.8.5.1), a hardware
+reset is required after power-on, and the reference clock (REF_CLK) must be
+established before asserting reset.
+
+Signed-off-by: Buday Csaba <buday.csaba@prolan.hu>
+Cc: Csókás Bence <csokas.bence@prolan.hu>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250728152916.46249-2-csokas.bence@prolan.hu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/smsc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
+index b6489da5cfcd..48487149c225 100644
+--- a/drivers/net/phy/smsc.c
++++ b/drivers/net/phy/smsc.c
+@@ -785,6 +785,7 @@ static struct phy_driver smsc_phy_driver[] = {
+
+ /* PHY_BASIC_FEATURES */
+
++ .flags = PHY_RST_AFTER_CLK_EN,
+ .probe = smsc_phy_probe,
+
+ /* basic functions */
+--
+2.39.5
+
--- /dev/null
+From fc3a3a82e3b5091b6d3255d1161fd843379b05d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jun 2025 17:38:13 +0800
+Subject: net: thunderbolt: Enable end-to-end flow control also in transmit
+
+From: zhangjianrong <zhangjianrong5@huawei.com>
+
+[ Upstream commit a8065af3346ebd7c76ebc113451fb3ba94cf7769 ]
+
+According to USB4 specification, if E2E flow control is disabled for
+the Transmit Descriptor Ring, the Host Interface Adapter Layer shall
+not require any credits to be available before transmitting a Tunneled
+Packet from this Transmit Descriptor Ring, so e2e flow control should
+be enabled in both directions.
+
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://lore.kernel.org/20250624153805.GC2824380@black.fi.intel.com
+Signed-off-by: zhangjianrong <zhangjianrong5@huawei.com>
+Link: https://patch.msgid.link/20250628093813.647005-1-zhangjianrong5@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/thunderbolt/main.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/thunderbolt/main.c b/drivers/net/thunderbolt/main.c
+index 0a53ec293d04..643cf67840b5 100644
+--- a/drivers/net/thunderbolt/main.c
++++ b/drivers/net/thunderbolt/main.c
+@@ -924,8 +924,12 @@ static int tbnet_open(struct net_device *dev)
+
+ netif_carrier_off(dev);
+
+- ring = tb_ring_alloc_tx(xd->tb->nhi, -1, TBNET_RING_SIZE,
+- RING_FLAG_FRAME);
++ flags = RING_FLAG_FRAME;
++ /* Only enable full E2E if the other end supports it too */
++ if (tbnet_e2e && net->svc->prtcstns & TBNET_E2E)
++ flags |= RING_FLAG_E2E;
++
++ ring = tb_ring_alloc_tx(xd->tb->nhi, -1, TBNET_RING_SIZE, flags);
+ if (!ring) {
+ netdev_err(dev, "failed to allocate Tx ring\n");
+ return -ENOMEM;
+@@ -944,11 +948,6 @@ static int tbnet_open(struct net_device *dev)
+ sof_mask = BIT(TBIP_PDF_FRAME_START);
+ eof_mask = BIT(TBIP_PDF_FRAME_END);
+
+- flags = RING_FLAG_FRAME;
+- /* Only enable full E2E if the other end supports it too */
+- if (tbnet_e2e && net->svc->prtcstns & TBNET_E2E)
+- flags |= RING_FLAG_E2E;
+-
+ ring = tb_ring_alloc_rx(xd->tb->nhi, -1, TBNET_RING_SIZE, flags,
+ net->tx_ring.ring->hop, sof_mask,
+ eof_mask, tbnet_start_poll, net);
+--
+2.39.5
+
--- /dev/null
+From 600f178cf75c7adcf5aec631e61b9d8ce6041b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jun 2025 17:49:20 +0800
+Subject: net: thunderbolt: Fix the parameter passing of
+ tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
+
+From: zhangjianrong <zhangjianrong5@huawei.com>
+
+[ Upstream commit 8ec31cb17cd355cea25cdb8496d9b3fbf1321647 ]
+
+According to the description of tb_xdomain_enable_paths(), the third
+parameter represents the transmit ring and the fifth parameter represents
+the receive ring. tb_xdomain_disable_paths() is the same case.
+
+[Jakub] Mika says: it works now because both rings ->hop is the same
+
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://lore.kernel.org/20250625051149.GD2824380@black.fi.intel.com
+Signed-off-by: zhangjianrong <zhangjianrong5@huawei.com>
+Link: https://patch.msgid.link/20250628094920.656658-1-zhangjianrong5@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/thunderbolt/main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/thunderbolt/main.c b/drivers/net/thunderbolt/main.c
+index 643cf67840b5..dcaa62377808 100644
+--- a/drivers/net/thunderbolt/main.c
++++ b/drivers/net/thunderbolt/main.c
+@@ -396,9 +396,9 @@ static void tbnet_tear_down(struct tbnet *net, bool send_logout)
+
+ ret = tb_xdomain_disable_paths(net->xd,
+ net->local_transmit_path,
+- net->rx_ring.ring->hop,
++ net->tx_ring.ring->hop,
+ net->remote_transmit_path,
+- net->tx_ring.ring->hop);
++ net->rx_ring.ring->hop);
+ if (ret)
+ netdev_warn(net->dev, "failed to disable DMA paths\n");
+
+@@ -662,9 +662,9 @@ static void tbnet_connected_work(struct work_struct *work)
+ goto err_free_rx_buffers;
+
+ ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path,
+- net->rx_ring.ring->hop,
++ net->tx_ring.ring->hop,
+ net->remote_transmit_path,
+- net->tx_ring.ring->hop);
++ net->rx_ring.ring->hop);
+ if (ret) {
+ netdev_err(net->dev, "failed to enable DMA paths\n");
+ goto err_free_tx_buffers;
+--
+2.39.5
+
--- /dev/null
+From 5de037cfcc2ef145534bad16d8daa5bf016153e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 07:05:30 -0700
+Subject: net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 53d20606c40678d425cc03f0978c614dca51f25e ]
+
+The buffer bgx_sel used in snprintf() was too small to safely hold
+the formatted string "BGX%d" for all valid bgx_id values. This caused
+a -Wformat-truncation warning with `Werror` enabled during build.
+
+Increase the buffer size from 5 to 7 and use `sizeof(bgx_sel)` in
+snprintf() to ensure safety and suppress the warning.
+
+Build warning:
+ CC drivers/net/ethernet/cavium/thunder/thunder_bgx.o
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function
+‘bgx_acpi_match_id’:
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:27: error: ‘%d’
+directive output may be truncated writing between 1 and 3 bytes into a
+region of size 2 [-Werror=format-truncation=]
+ snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
+ ^~
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:23: note:
+directive argument in the range [0, 255]
+ snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
+ ^~~~~~~
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:2: note:
+‘snprintf’ output between 5 and 7 bytes into a destination of size 5
+ snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
+
+compiler warning due to insufficient snprintf buffer size.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250711140532.2463602-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+index 608cc6af5af1..aa80c3702232 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -1429,9 +1429,9 @@ static acpi_status bgx_acpi_match_id(acpi_handle handle, u32 lvl,
+ {
+ struct acpi_buffer string = { ACPI_ALLOCATE_BUFFER, NULL };
+ struct bgx *bgx = context;
+- char bgx_sel[5];
++ char bgx_sel[7];
+
+- snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id);
++ snprintf(bgx_sel, sizeof(bgx_sel), "BGX%d", bgx->bgx_id);
+ if (ACPI_FAILURE(acpi_get_name(handle, ACPI_SINGLE_NAME, &string))) {
+ pr_warn("Invalid link device\n");
+ return AE_OK;
+--
+2.39.5
+
--- /dev/null
+From e37d903a54d8f067dc31c2a92fc0ba0bd262da39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 14:06:17 +0200
+Subject: net: usb: cdc-ncm: check for filtering capability
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit 61c3e8940f2d8b5bfeaeec4bedc2f3e7d873abb3 ]
+
+If the decice does not support filtering, filtering
+must not be used and all packets delivered for the
+upper layers to sort.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://patch.msgid.link/20250717120649.2090929-1-oneukum@suse.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/cdc_ncm.c | 20 ++++++++++++++++----
+ include/linux/usb/cdc_ncm.h | 1 +
+ 2 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 34e82f1e37d9..ea0e5e276cd6 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -892,6 +892,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ }
+ }
+
++ if (ctx->func_desc)
++ ctx->filtering_supported = !!(ctx->func_desc->bmNetworkCapabilities
++ & USB_CDC_NCM_NCAP_ETH_FILTER);
++
+ iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
+
+ /* Device-specific flags */
+@@ -1898,6 +1902,14 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+ }
+ }
+
++static void cdc_ncm_update_filter(struct usbnet *dev)
++{
++ struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
++
++ if (ctx->filtering_supported)
++ usbnet_cdc_update_filter(dev);
++}
++
+ static const struct driver_info cdc_ncm_info = {
+ .description = "CDC NCM (NO ZLP)",
+ .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+@@ -1908,7 +1920,7 @@ static const struct driver_info cdc_ncm_info = {
+ .status = cdc_ncm_status,
+ .rx_fixup = cdc_ncm_rx_fixup,
+ .tx_fixup = cdc_ncm_tx_fixup,
+- .set_rx_mode = usbnet_cdc_update_filter,
++ .set_rx_mode = cdc_ncm_update_filter,
+ };
+
+ /* Same as cdc_ncm_info, but with FLAG_SEND_ZLP */
+@@ -1922,7 +1934,7 @@ static const struct driver_info cdc_ncm_zlp_info = {
+ .status = cdc_ncm_status,
+ .rx_fixup = cdc_ncm_rx_fixup,
+ .tx_fixup = cdc_ncm_tx_fixup,
+- .set_rx_mode = usbnet_cdc_update_filter,
++ .set_rx_mode = cdc_ncm_update_filter,
+ };
+
+ /* Same as cdc_ncm_info, but with FLAG_SEND_ZLP */
+@@ -1964,7 +1976,7 @@ static const struct driver_info wwan_info = {
+ .status = cdc_ncm_status,
+ .rx_fixup = cdc_ncm_rx_fixup,
+ .tx_fixup = cdc_ncm_tx_fixup,
+- .set_rx_mode = usbnet_cdc_update_filter,
++ .set_rx_mode = cdc_ncm_update_filter,
+ };
+
+ /* Same as wwan_info, but with FLAG_NOARP */
+@@ -1978,7 +1990,7 @@ static const struct driver_info wwan_noarp_info = {
+ .status = cdc_ncm_status,
+ .rx_fixup = cdc_ncm_rx_fixup,
+ .tx_fixup = cdc_ncm_tx_fixup,
+- .set_rx_mode = usbnet_cdc_update_filter,
++ .set_rx_mode = cdc_ncm_update_filter,
+ };
+
+ static const struct usb_device_id cdc_devs[] = {
+diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
+index 2d207cb4837d..4ac082a63173 100644
+--- a/include/linux/usb/cdc_ncm.h
++++ b/include/linux/usb/cdc_ncm.h
+@@ -119,6 +119,7 @@ struct cdc_ncm_ctx {
+ u32 timer_interval;
+ u32 max_ndp_size;
+ u8 is_ndp16;
++ u8 filtering_supported;
+ union {
+ struct usb_cdc_ncm_ndp16 *delayed_ndp16;
+ struct usb_cdc_ncm_ndp32 *delayed_ndp32;
+--
+2.39.5
+
--- /dev/null
+From 223625c9b1f8a4f0f19f76b51c2c6ca321fa3430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 16:26:24 +0300
+Subject: net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 2de1ba0887e5d3bf02d7c212f380039b34e10aa3 ]
+
+Add a stub implementation of is_vlan_dev() that returns false when
+VLAN support is not compiled in (CONFIG_VLAN_8021Q=n).
+
+This allows us to compile-out VLAN-dependent dead code when it is not
+needed.
+
+This also resolves the following compilation error when:
+* CONFIG_VLAN_8021Q=n
+* CONFIG_OBJTOOL=y
+* CONFIG_OBJTOOL_WERROR=y
+
+drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.o: error: objtool: parse_mirred.isra.0+0x370: mlx5e_tc_act_vlan_add_push_action() missing __noreturn in .c/.h or NORETURN() in noreturns.h
+
+The error occurs because objtool cannot determine that unreachable BUG()
+(which doesn't return) calls in VLAN code paths are actually dead code
+when VLAN support is disabled.
+
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Link: https://patch.msgid.link/20250616132626.1749331-2-gal@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/if_vlan.h | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 38456b42cdb5..618a973ff8ee 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -79,11 +79,6 @@ static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb)
+ /* found in socket.c */
+ extern void vlan_ioctl_set(int (*hook)(struct net *, void __user *));
+
+-static inline bool is_vlan_dev(const struct net_device *dev)
+-{
+- return dev->priv_flags & IFF_802_1Q_VLAN;
+-}
+-
+ #define skb_vlan_tag_present(__skb) (!!(__skb)->vlan_all)
+ #define skb_vlan_tag_get(__skb) ((__skb)->vlan_tci)
+ #define skb_vlan_tag_get_id(__skb) ((__skb)->vlan_tci & VLAN_VID_MASK)
+@@ -200,6 +195,11 @@ struct vlan_dev_priv {
+ #endif
+ };
+
++static inline bool is_vlan_dev(const struct net_device *dev)
++{
++ return dev->priv_flags & IFF_802_1Q_VLAN;
++}
++
+ static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev)
+ {
+ return netdev_priv(dev);
+@@ -237,6 +237,11 @@ extern void vlan_vids_del_by_dev(struct net_device *dev,
+ extern bool vlan_uses_dev(const struct net_device *dev);
+
+ #else
++static inline bool is_vlan_dev(const struct net_device *dev)
++{
++ return false;
++}
++
+ static inline struct net_device *
+ __vlan_find_dev_deep_rcu(struct net_device *real_dev,
+ __be16 vlan_proto, u16 vlan_id)
+--
+2.39.5
+
--- /dev/null
+From 8257287f94556cf3881f39bbbb0f23ed3dc400d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 16:26:25 +0300
+Subject: net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 60a8b1a5d0824afda869f18dc0ecfe72f8dfda42 ]
+
+When CONFIG_VLAN_8021Q=n, a set of stub helpers are used, three of these
+helpers use BUG() unconditionally.
+
+This code should not be reached, as callers of these functions should
+always check for is_vlan_dev() first, but the usage of BUG() is not
+recommended, replace it with WARN_ON() instead.
+
+Reviewed-by: Alex Lazar <alazar@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Link: https://patch.msgid.link/20250616132626.1749331-3-gal@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/if_vlan.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 618a973ff8ee..b9f699799cf6 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -259,19 +259,19 @@ vlan_for_each(struct net_device *dev,
+
+ static inline struct net_device *vlan_dev_real_dev(const struct net_device *dev)
+ {
+- BUG();
++ WARN_ON_ONCE(1);
+ return NULL;
+ }
+
+ static inline u16 vlan_dev_vlan_id(const struct net_device *dev)
+ {
+- BUG();
++ WARN_ON_ONCE(1);
+ return 0;
+ }
+
+ static inline __be16 vlan_dev_vlan_proto(const struct net_device *dev)
+ {
+- BUG();
++ WARN_ON_ONCE(1);
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 919eb86939918ee3453dc077339b4972c1c1ef8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 19:05:16 +0200
+Subject: netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 897eefee2eb73ec6c119a0ca357d7b4a3e92c5ef ]
+
+The scratchmap size depends on the number of elements in the set.
+For huge sets, each scratch map can easily require very large
+allocations, e.g. for 100k entries each scratch map will require
+close to 64kbyte of memory.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index c5855069bdab..9e4e25f2458f 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -1219,7 +1219,7 @@ static void pipapo_free_scratch(const struct nft_pipapo_match *m, unsigned int c
+
+ mem = s;
+ mem -= s->align_off;
+- kfree(mem);
++ kvfree(mem);
+ }
+
+ /**
+@@ -1240,10 +1240,9 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone,
+ void *scratch_aligned;
+ u32 align_off;
+ #endif
+- scratch = kzalloc_node(struct_size(scratch, map,
+- bsize_max * 2) +
+- NFT_PIPAPO_ALIGN_HEADROOM,
+- GFP_KERNEL_ACCOUNT, cpu_to_node(i));
++ scratch = kvzalloc_node(struct_size(scratch, map, bsize_max * 2) +
++ NFT_PIPAPO_ALIGN_HEADROOM,
++ GFP_KERNEL_ACCOUNT, cpu_to_node(i));
+ if (!scratch) {
+ /* On failure, there's no need to undo previous
+ * allocations: this means that some scratch maps have
+--
+2.39.5
+
--- /dev/null
+From ed03d21d6efbaa400e7d8cf995977f0296d1f886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jun 2025 17:52:38 +0000
+Subject: netmem: fix skb_frag_address_safe with unreadable skbs
+
+From: Mina Almasry <almasrymina@google.com>
+
+[ Upstream commit 4672aec56d2e8edabcb74c3e2320301d106a377e ]
+
+skb_frag_address_safe() needs a check that the
+skb_frag_page exists check similar to skb_frag_address().
+
+Cc: ap420073@gmail.com
+
+Signed-off-by: Mina Almasry <almasrymina@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250619175239.3039329-1-almasrymina@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/skbuff.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index fad2fc972d23..2c768882191f 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3687,7 +3687,13 @@ static inline void *skb_frag_address(const skb_frag_t *frag)
+ */
+ static inline void *skb_frag_address_safe(const skb_frag_t *frag)
+ {
+- void *ptr = page_address(skb_frag_page(frag));
++ struct page *page = skb_frag_page(frag);
++ void *ptr;
++
++ if (!page)
++ return NULL;
++
++ ptr = page_address(page);
+ if (unlikely(!ptr))
+ return NULL;
+
+--
+2.39.5
+
--- /dev/null
+From 7fa3bb7927991b77caec5e3547c949ab4762c586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 12:16:27 -0700
+Subject: nvme-pci: try function level reset on init failure
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 5b2c214a95942f7997d1916a4c44017becbc3cac ]
+
+NVMe devices from multiple vendors appear to get stuck in a reset state
+that we can't get out of with an NVMe level Controller Reset. The kernel
+would report these with messages that look like:
+
+ Device not ready; aborting reset, CSTS=0x1
+
+These have historically required a power cycle to make them usable
+again, but in many cases, a PCIe FLR is sufficient to restart operation
+without a power cycle. Try it if the initial controller reset fails
+during any nvme reset attempt.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 776c867fb64d..5396282015a2 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1888,8 +1888,28 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)
+ * might be pointing at!
+ */
+ result = nvme_disable_ctrl(&dev->ctrl, false);
+- if (result < 0)
+- return result;
++ if (result < 0) {
++ struct pci_dev *pdev = to_pci_dev(dev->dev);
++
++ /*
++ * The NVMe Controller Reset method did not get an expected
++ * CSTS.RDY transition, so something with the device appears to
++ * be stuck. Use the lower level and bigger hammer PCIe
++ * Function Level Reset to attempt restoring the device to its
++ * initial state, and try again.
++ */
++ result = pcie_reset_flr(pdev, false);
++ if (result < 0)
++ return result;
++
++ pci_restore_state(pdev);
++ result = nvme_disable_ctrl(&dev->ctrl, false);
++ if (result < 0)
++ return result;
++
++ dev_info(dev->ctrl.device,
++ "controller reset completed after pcie flr\n");
++ }
+
+ result = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH);
+ if (result)
+--
+2.39.5
+
--- /dev/null
+From c9b9a1ec30145d31021abeafd7a8d7733b5ccbc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 16:06:29 +0200
+Subject: nvme-tcp: log TLS handshake failures at error level
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 5a58ac9bfc412a58c3cf26c6a7e54d4308e9d109 ]
+
+Update the nvme_tcp_start_tls() function to use dev_err() instead of
+dev_dbg() when a TLS error is detected. This ensures that handshake
+failures are visible by default, aiding in debugging.
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index b882ee6ef40f..d0ee9e2a3294 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1776,9 +1776,14 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl,
+ qid, ret);
+ tls_handshake_cancel(queue->sock->sk);
+ } else {
+- dev_dbg(nctrl->device,
+- "queue %d: TLS handshake complete, error %d\n",
+- qid, queue->tls_err);
++ if (queue->tls_err) {
++ dev_err(nctrl->device,
++ "queue %d: TLS handshake complete, error %d\n",
++ qid, queue->tls_err);
++ } else {
++ dev_dbg(nctrl->device,
++ "queue %d: TLS handshake complete\n", qid);
++ }
+ ret = queue->tls_err;
+ }
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From ba7397d0371825d63f2e97798bc3984229551980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 15:08:13 +0100
+Subject: perf/arm: Add missing .suppress_bind_attrs
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 860a831de138a7ad6bc86019adaf10eb84c02655 ]
+
+PMU drivers should set .suppress_bind_attrs so that userspace is denied
+the opportunity to pull the driver out from underneath an in-use PMU
+(with predictably unpleasant consequences). Somehow both the CMN and NI
+drivers have managed to miss this; put that right.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Link: https://lore.kernel.org/r/acd48c341b33b96804a3969ee00b355d40c546e2.1751465293.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 1 +
+ drivers/perf/arm-ni.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 403850b1040d..e4bf181842fa 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -2662,6 +2662,7 @@ static struct platform_driver arm_cmn_driver = {
+ .name = "arm-cmn",
+ .of_match_table = of_match_ptr(arm_cmn_of_match),
+ .acpi_match_table = ACPI_PTR(arm_cmn_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = arm_cmn_probe,
+ .remove = arm_cmn_remove,
+diff --git a/drivers/perf/arm-ni.c b/drivers/perf/arm-ni.c
+index 9396d243415f..c30a67fe2ae3 100644
+--- a/drivers/perf/arm-ni.c
++++ b/drivers/perf/arm-ni.c
+@@ -709,6 +709,7 @@ static struct platform_driver arm_ni_driver = {
+ .name = "arm-ni",
+ .of_match_table = of_match_ptr(arm_ni_of_match),
+ .acpi_match_table = ACPI_PTR(arm_ni_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = arm_ni_probe,
+ .remove = arm_ni_remove,
+--
+2.39.5
+
--- /dev/null
+From b45211425b5232bb2b59bc6ab3d1547659429aee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 12:43:39 -0700
+Subject: perf/cxlpmu: Remove unintended newline from IRQ name format string
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 3e870815ccf5bc75274158f0b5e234fce6f93229 ]
+
+The IRQ name format string used in devm_kasprintf() mistakenly included
+a newline character "\n".
+This could lead to confusing log output or misformatted names in sysfs
+or debug messages.
+
+This fix removes the newline to ensure proper IRQ naming.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Link: https://lore.kernel.org/r/20250624194350.109790-3-alok.a.tiwari@oracle.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/cxl_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
+index d6693519eaee..948e7c067dd2 100644
+--- a/drivers/perf/cxl_pmu.c
++++ b/drivers/perf/cxl_pmu.c
+@@ -873,7 +873,7 @@ static int cxl_pmu_probe(struct device *dev)
+ return rc;
+ irq = rc;
+
+- irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_overflow\n", dev_name);
++ irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_overflow", dev_name);
+ if (!irq_name)
+ return -ENOMEM;
+
+--
+2.39.5
+
--- /dev/null
+From b2a745fc60700c7bf816acbec22f390d0b37a1b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 19:25:14 -0300
+Subject: phy: rockchip-pcie: Enable all four lanes if required
+
+From: Valmantas Paliksa <walmis@gmail.com>
+
+[ Upstream commit c3fe7071e196e25789ecf90dbc9e8491a98884d7 ]
+
+Current code enables only Lane 0 because pwr_cnt will be incremented on
+first call to the function. Let's reorder the enablement code to enable
+all 4 lanes through GRF.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+
+Signed-off-by: Valmantas Paliksa <walmis@gmail.com>
+Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/16b610aab34e069fd31d9f57260c10df2a968f80.1751322015.git.geraldogabriel@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-pcie.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-pcie.c b/drivers/phy/rockchip/phy-rockchip-pcie.c
+index 63e88abc66c6..4e2dfd01adf2 100644
+--- a/drivers/phy/rockchip/phy-rockchip-pcie.c
++++ b/drivers/phy/rockchip/phy-rockchip-pcie.c
+@@ -159,6 +159,12 @@ static int rockchip_pcie_phy_power_on(struct phy *phy)
+
+ guard(mutex)(&rk_phy->pcie_mutex);
+
++ regmap_write(rk_phy->reg_base,
++ rk_phy->phy_data->pcie_laneoff,
++ HIWORD_UPDATE(!PHY_LANE_IDLE_OFF,
++ PHY_LANE_IDLE_MASK,
++ PHY_LANE_IDLE_A_SHIFT + inst->index));
++
+ if (rk_phy->pwr_cnt++) {
+ return 0;
+ }
+@@ -175,12 +181,6 @@ static int rockchip_pcie_phy_power_on(struct phy *phy)
+ PHY_CFG_ADDR_MASK,
+ PHY_CFG_ADDR_SHIFT));
+
+- regmap_write(rk_phy->reg_base,
+- rk_phy->phy_data->pcie_laneoff,
+- HIWORD_UPDATE(!PHY_LANE_IDLE_OFF,
+- PHY_LANE_IDLE_MASK,
+- PHY_LANE_IDLE_A_SHIFT + inst->index));
+-
+ /*
+ * No documented timeout value for phy operation below,
+ * so we make it large enough here. And we use loop-break
+--
+2.39.5
+
--- /dev/null
+From d779a06aaa4d7f5ab4becd4c9dcc8d5744719e84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 19:25:28 -0300
+Subject: phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
+
+From: Geraldo Nascimento <geraldogabriel@gmail.com>
+
+[ Upstream commit 25facbabc3fc33c794ad09d73f73268c0f8cbc7d ]
+
+pcie_conf is used to touch TEST_WRITE strobe signal. This signal should
+be enabled, a little time waited, and then disabled. Current code clearly
+was copy-pasted and never disables the strobe signal. Adjust the define.
+While at it, remove PHY_CFG_RD_MASK which has been unused since
+64cdc0360811 ("phy: rockchip-pcie: remove unused phy_rd_cfg function").
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
+Link: https://lore.kernel.org/r/d514d5d5627680caafa8b7548cbdfee4307f5440.1751322015.git.geraldogabriel@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-pcie.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-pcie.c b/drivers/phy/rockchip/phy-rockchip-pcie.c
+index bd44af36c67a..63e88abc66c6 100644
+--- a/drivers/phy/rockchip/phy-rockchip-pcie.c
++++ b/drivers/phy/rockchip/phy-rockchip-pcie.c
+@@ -30,9 +30,8 @@
+ #define PHY_CFG_ADDR_SHIFT 1
+ #define PHY_CFG_DATA_MASK 0xf
+ #define PHY_CFG_ADDR_MASK 0x3f
+-#define PHY_CFG_RD_MASK 0x3ff
+ #define PHY_CFG_WR_ENABLE 1
+-#define PHY_CFG_WR_DISABLE 1
++#define PHY_CFG_WR_DISABLE 0
+ #define PHY_CFG_WR_SHIFT 0
+ #define PHY_CFG_WR_MASK 1
+ #define PHY_CFG_PLL_LOCK 0x10
+--
+2.39.5
+
--- /dev/null
+From 99bc554dc177f0860587eff8ed77f89a8d98ae0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 22:53:35 +0200
+Subject: pidfs: raise SB_I_NODEV and SB_I_NOEXEC
+
+From: Christian Brauner <brauner@kernel.org>
+
+[ Upstream commit 1a1ad73aa1a66787f05f7f10f686b74bab77be72 ]
+
+Similar to commit 1ed95281c0c7 ("anon_inode: raise SB_I_NODEV and SB_I_NOEXEC"):
+it shouldn't be possible to execute pidfds via
+execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH)
+so raise SB_I_NOEXEC so that no one gets any creative ideas.
+
+Also raise SB_I_NODEV as we don't expect or support any devices on pidfs.
+
+Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-1-98f3456fd552@kernel.org
+Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pidfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/pidfs.c b/fs/pidfs.c
+index 005976025ce9..b8fe3495ccbf 100644
+--- a/fs/pidfs.c
++++ b/fs/pidfs.c
+@@ -854,6 +854,8 @@ static int pidfs_init_fs_context(struct fs_context *fc)
+ if (!ctx)
+ return -ENOMEM;
+
++ fc->s_iflags |= SB_I_NOEXEC;
++ fc->s_iflags |= SB_I_NODEV;
+ ctx->ops = &pidfs_sops;
+ ctx->eops = &pidfs_export_operations;
+ ctx->dops = &pidfs_dentry_operations;
+--
+2.39.5
+
--- /dev/null
+From f4aee54819fcb23b6bc2722153bcbda639d6368a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:30:39 +0200
+Subject: pinctrl: stm32: Manage irq affinity settings
+
+From: Cheick Traore <cheick.traore@foss.st.com>
+
+[ Upstream commit 4c5cc2f65386e22166ce006efe515c667aa075e4 ]
+
+Trying to set the affinity of the interrupts associated to stm32
+pinctrl results in a write error.
+
+Fill struct irq_chip::irq_set_affinity to use the default helper
+function.
+
+Signed-off-by: Cheick Traore <cheick.traore@foss.st.com>
+Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
+Link: https://lore.kernel.org/20250610143042.295376-3-antonio.borneo@foss.st.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index cc0b4d1d7cff..ba9dbb21b497 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -408,6 +408,7 @@ static struct irq_chip stm32_gpio_irq_chip = {
+ .irq_set_wake = irq_chip_set_wake_parent,
+ .irq_request_resources = stm32_gpio_irq_request_resources,
+ .irq_release_resources = stm32_gpio_irq_release_resources,
++ .irq_set_affinity = IS_ENABLED(CONFIG_SMP) ? irq_chip_set_affinity_parent : NULL,
+ };
+
+ static int stm32_gpio_domain_translate(struct irq_domain *d,
+--
+2.39.5
+
--- /dev/null
+From 5cedfc4275e6df2e5f3117b553d92e0b1089c373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 14:05:18 -0700
+Subject: platform/chrome: cros_ec_sensorhub: Retries when a sensor is not
+ ready
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit 981d7f91aeda17424b29f033249f4fa7cd2a7556 ]
+
+When the EC/ISH starts, it can take a while for all the sensors to be up
+and running or declared broken.
+
+If the sensor stack return -EBUSY when checking for sensor information,
+retry up to 50 times.
+It has been observed 100ms wait time is enough to have valid sensors
+ready. It can take more time in case a sensor is really broken and is
+not coming up.
+
+Signed-off-by: Gwendal Grignou <gwendal@google.com>
+Link: https://lore.kernel.org/r/20250623210518.306740-1-gwendal@google.com
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_sensorhub.c | 23 +++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_sensorhub.c b/drivers/platform/chrome/cros_ec_sensorhub.c
+index 50cdae67fa32..9bad8f72680e 100644
+--- a/drivers/platform/chrome/cros_ec_sensorhub.c
++++ b/drivers/platform/chrome/cros_ec_sensorhub.c
+@@ -8,6 +8,7 @@
+
+ #include <linux/init.h>
+ #include <linux/device.h>
++#include <linux/delay.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+ #include <linux/platform_data/cros_ec_commands.h>
+@@ -18,6 +19,7 @@
+ #include <linux/types.h>
+
+ #define DRV_NAME "cros-ec-sensorhub"
++#define CROS_EC_CMD_INFO_RETRIES 50
+
+ static void cros_ec_sensorhub_free_sensor(void *arg)
+ {
+@@ -53,7 +55,7 @@ static int cros_ec_sensorhub_register(struct device *dev,
+ int sensor_type[MOTIONSENSE_TYPE_MAX] = { 0 };
+ struct cros_ec_command *msg = sensorhub->msg;
+ struct cros_ec_dev *ec = sensorhub->ec;
+- int ret, i;
++ int ret, i, retries;
+ char *name;
+
+
+@@ -65,12 +67,25 @@ static int cros_ec_sensorhub_register(struct device *dev,
+ sensorhub->params->cmd = MOTIONSENSE_CMD_INFO;
+ sensorhub->params->info.sensor_num = i;
+
+- ret = cros_ec_cmd_xfer_status(ec->ec_dev, msg);
++ retries = CROS_EC_CMD_INFO_RETRIES;
++ do {
++ ret = cros_ec_cmd_xfer_status(ec->ec_dev, msg);
++ if (ret == -EBUSY) {
++ /* The EC is still busy initializing sensors. */
++ usleep_range(5000, 6000);
++ retries--;
++ }
++ } while (ret == -EBUSY && retries);
++
+ if (ret < 0) {
+- dev_warn(dev, "no info for EC sensor %d : %d/%d\n",
+- i, ret, msg->result);
++ dev_err(dev, "no info for EC sensor %d : %d/%d\n",
++ i, ret, msg->result);
+ continue;
+ }
++ if (retries < CROS_EC_CMD_INFO_RETRIES) {
++ dev_warn(dev, "%d retries needed to bring up sensor %d\n",
++ CROS_EC_CMD_INFO_RETRIES - retries, i);
++ }
+
+ switch (sensorhub->resp->info.type) {
+ case MOTIONSENSE_TYPE_ACCEL:
+--
+2.39.5
+
--- /dev/null
+From 08b2c99dc0d15a0cb4d02e533a5d26340e691d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 17:37:47 +0200
+Subject: platform/chrome: cros_ec_typec: Defer probe on missing EC parent
+
+From: Tomasz Michalec <tmichalec@google.com>
+
+[ Upstream commit 8866f4e557eba43e991f99711515217a95f62d2e ]
+
+If cros_typec_probe is called before EC device is registered,
+cros_typec_probe will fail. It may happen when cros-ec-typec.ko is
+loaded before EC bus layer module (e.g. cros_ec_lpcs.ko,
+cros_ec_spi.ko).
+
+Return -EPROBE_DEFER when cros_typec_probe doesn't get EC device, so
+the probe function can be called again after EC device is registered.
+
+Signed-off-by: Tomasz Michalec <tmichalec@google.com>
+Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Link: https://lore.kernel.org/r/20250610153748.1858519-1-tmichalec@google.com
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_typec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
+index 7678e3d05fd3..f437b594055c 100644
+--- a/drivers/platform/chrome/cros_ec_typec.c
++++ b/drivers/platform/chrome/cros_ec_typec.c
+@@ -1272,8 +1272,8 @@ static int cros_typec_probe(struct platform_device *pdev)
+
+ typec->ec = dev_get_drvdata(pdev->dev.parent);
+ if (!typec->ec) {
+- dev_err(dev, "couldn't find parent EC device\n");
+- return -ENODEV;
++ dev_warn(dev, "couldn't find parent EC device\n");
++ return -EPROBE_DEFER;
+ }
+
+ platform_set_drvdata(pdev, typec);
+--
+2.39.5
+
--- /dev/null
+From 10317fcef84a0b05f2f0bab015a45e732b694128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 12:23:05 -0500
+Subject: platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 4ff3aeb664f7dfe824ba91ffb0b203397a8d431e ]
+
+The Lenovo Yoga 6 13ACL6 82ND has a similar BIOS problem as other Lenovo
+laptops from that vintage that causes a rather long resume from suspend.
+
+Add it to the quirk list that manipulates the scratch register to avoid
+the issue.
+
+Reported-by: Adam Berglund <adam.f.berglund@hotmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4434
+Tested-by: Adam Berglund <adam.f.berglund@hotmail.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Link: https://lore.kernel.org/r/20250718172307.1928744-1-superm1@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 7ed12c1d3b34..04686ae1e976 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -189,6 +189,15 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "82XQ"),
+ }
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4434 */
++ {
++ .ident = "Lenovo Yoga 6 13ALC6",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "82ND"),
++ }
++ },
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */
+ {
+ .ident = "HP Laptop 15s-eq2xxx",
+--
+2.39.5
+
--- /dev/null
+From 9a89b2ce20206cc38dc96148624dbcc7f0fbc4fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 May 2025 11:18:37 -0700
+Subject: platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit 6418a8504187dc7f5b6f9d0649c03e362cb0664b ]
+
+When KCOV is enabled all functions get instrumented, unless the
+__no_sanitize_coverage attribute is used. To prepare for
+__no_sanitize_coverage being applied to __init functions[1], we have
+to handle differences in how GCC's inline optimizations get resolved.
+For thinkpad_acpi routines, this means forcing two functions to be
+inline with __always_inline.
+
+Link: https://lore.kernel.org/lkml/20250523043935.2009972-11-kees@kernel.org/ [1]
+Signed-off-by: Kees Cook <kees@kernel.org>
+Link: https://lore.kernel.org/r/20250529181831.work.439-kees@kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 657625dd60a0..dc1fc069fed9 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -558,12 +558,12 @@ static unsigned long __init tpacpi_check_quirks(
+ return 0;
+ }
+
+-static inline bool __pure __init tpacpi_is_lenovo(void)
++static __always_inline bool __pure __init tpacpi_is_lenovo(void)
+ {
+ return thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO;
+ }
+
+-static inline bool __pure __init tpacpi_is_ibm(void)
++static __always_inline bool __pure __init tpacpi_is_ibm(void)
+ {
+ return thinkpad_id.vendor == PCI_VENDOR_ID_IBM;
+ }
+--
+2.39.5
+
--- /dev/null
+From 6d0211edb3aa71ee64c2e3ecb1c98afb6dd2b2a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 17:53:54 +0530
+Subject: pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in
+ mperf_stop()
+
+From: Gautham R. Shenoy <gautham.shenoy@amd.com>
+
+[ Upstream commit cda7ac8ce7de84cf32a3871ba5f318aa3b79381e ]
+
+In the function mperf_start(), mperf_monitor snapshots the time, tsc
+and finally the aperf,mperf MSRs. However, this order of snapshotting
+in is reversed in mperf_stop(). As a result, the C0 residency (which
+is computed as delta_mperf * 100 / delta_tsc) is under-reported on
+CPUs that is 100% busy.
+
+Fix this by snapshotting time, tsc and then aperf,mperf in
+mperf_stop() in the same order as in mperf_start().
+
+Link: https://lore.kernel.org/r/20250612122355.19629-2-gautham.shenoy@amd.com
+Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/utils/idle_monitor/mperf_monitor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+index 73b6b10cbdd2..5ae02c3d5b64 100644
+--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+@@ -240,9 +240,9 @@ static int mperf_stop(void)
+ int cpu;
+
+ for (cpu = 0; cpu < cpu_count; cpu++) {
+- mperf_measure_stats(cpu);
+- mperf_get_tsc(&tsc_at_measure_end[cpu]);
+ clock_gettime(CLOCK_REALTIME, &time_end[cpu]);
++ mperf_get_tsc(&tsc_at_measure_end[cpu]);
++ mperf_measure_stats(cpu);
+ }
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From e514ef96d7dc9c18be6939ddcb136afff7fcd705 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 11:00:17 +0800
+Subject: PM / devfreq: governor: Replace sscanf() with kstrtoul() in
+ set_freq_store()
+
+From: Lifeng Zheng <zhenglifeng1@huawei.com>
+
+[ Upstream commit 914cc799b28f17d369d5b4db3b941957d18157e8 ]
+
+Replace sscanf() with kstrtoul() in set_freq_store() and check the result
+to avoid invalid input.
+
+Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
+Link: https://lore.kernel.org/lkml/20250421030020.3108405-2-zhenglifeng1@huawei.com/
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/governor_userspace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/governor_userspace.c b/drivers/devfreq/governor_userspace.c
+index d1aa6806b683..175de0c0b50e 100644
+--- a/drivers/devfreq/governor_userspace.c
++++ b/drivers/devfreq/governor_userspace.c
+@@ -9,6 +9,7 @@
+ #include <linux/slab.h>
+ #include <linux/device.h>
+ #include <linux/devfreq.h>
++#include <linux/kstrtox.h>
+ #include <linux/pm.h>
+ #include <linux/mutex.h>
+ #include <linux/module.h>
+@@ -39,10 +40,13 @@ static ssize_t set_freq_store(struct device *dev, struct device_attribute *attr,
+ unsigned long wanted;
+ int err = 0;
+
++ err = kstrtoul(buf, 0, &wanted);
++ if (err)
++ return err;
++
+ mutex_lock(&devfreq->lock);
+ data = devfreq->governor_data;
+
+- sscanf(buf, "%lu", &wanted);
+ data->user_frequency = wanted;
+ data->valid = true;
+ err = update_devfreq(devfreq);
+--
+2.39.5
+
--- /dev/null
+From bede6e5ae737c8f739e81974630c9e74550728c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 21:16:05 +0200
+Subject: PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 89d9cec3b1e9c49bae9375a2db6dc49bc7468af0 ]
+
+Clear power.needs_force_resume in pm_runtime_reinit() in case it has
+been set by pm_runtime_force_suspend() invoked from a driver remove
+callback.
+
+Suggested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/9495163.CDJkKcVGEf@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/runtime.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index c55a7c70bc1a..1ef26216f971 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1854,6 +1854,11 @@ void pm_runtime_reinit(struct device *dev)
+ pm_runtime_put(dev->parent);
+ }
+ }
++ /*
++ * Clear power.needs_force_resume in case it has been set by
++ * pm_runtime_force_suspend() invoked from a driver remove callback.
++ */
++ dev->power.needs_force_resume = false;
+ }
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From 5cd30fa6c10f1f4b7a09aceb86e17aed14f21530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 11:23:45 +0800
+Subject: PM: sleep: console: Fix the black screen issue
+
+From: tuhaowen <tuhaowen@uniontech.com>
+
+[ Upstream commit 4266e8fa56d3d982bf451d382a410b9db432015c ]
+
+When the computer enters sleep status without a monitor
+connected, the system switches the console to the virtual
+terminal tty63(SUSPEND_CONSOLE).
+
+If a monitor is subsequently connected before waking up,
+the system skips the required VT restoration process
+during wake-up, leaving the console on tty63 instead of
+switching back to tty1.
+
+To fix this issue, a global flag vt_switch_done is introduced
+to record whether the system has successfully switched to
+the suspend console via vt_move_to_console() during suspend.
+
+If the switch was completed, vt_switch_done is set to 1.
+Later during resume, this flag is checked to ensure that
+the original console is restored properly by calling
+vt_move_to_console(orig_fgconsole, 0).
+
+This prevents scenarios where the resume logic skips console
+restoration due to incorrect detection of the console state,
+especially when a monitor is reconnected before waking up.
+
+Signed-off-by: tuhaowen <tuhaowen@uniontech.com>
+Link: https://patch.msgid.link/20250611032345.29962-1-tuhaowen@uniontech.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/console.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/power/console.c b/kernel/power/console.c
+index fcdf0e14a47d..19c48aa5355d 100644
+--- a/kernel/power/console.c
++++ b/kernel/power/console.c
+@@ -16,6 +16,7 @@
+ #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
+
+ static int orig_fgconsole, orig_kmsg;
++static bool vt_switch_done;
+
+ static DEFINE_MUTEX(vt_switch_mutex);
+
+@@ -136,17 +137,21 @@ void pm_prepare_console(void)
+ if (orig_fgconsole < 0)
+ return;
+
++ vt_switch_done = true;
++
+ orig_kmsg = vt_kmsg_redirect(SUSPEND_CONSOLE);
+ return;
+ }
+
+ void pm_restore_console(void)
+ {
+- if (!pm_vt_switch())
++ if (!pm_vt_switch() && !vt_switch_done)
+ return;
+
+ if (orig_fgconsole >= 0) {
+ vt_move_to_console(orig_fgconsole, 0);
+ vt_kmsg_redirect(orig_kmsg);
+ }
++
++ vt_switch_done = false;
+ }
+--
+2.39.5
+
--- /dev/null
+From c534a0f4bcdcca0f2b451dcc6a4ea321f04c0f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 10:50:08 +0200
+Subject: pmdomain: ti: Select PM_GENERIC_DOMAINS
+
+From: Guillaume La Roque <glaroque@baylibre.com>
+
+[ Upstream commit fcddcb7e8f38a40db99f87a962c5d0a153a76566 ]
+
+Select PM_GENERIC_DOMAINS instead of depending on it to ensure
+it is always enabled when TI_SCI_PM_DOMAINS is selected.
+Since PM_GENERIC_DOMAINS is an implicit symbol, it can only be enabled
+through 'select' and cannot be explicitly enabled in configuration.
+This simplifies the dependency chain and prevents build issues
+
+Signed-off-by: Guillaume La Roque <glaroque@baylibre.com>
+Reviewed-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20250715-depspmdomain-v2-1-6f0eda3ce824@baylibre.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/ti/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pmdomain/ti/Kconfig b/drivers/pmdomain/ti/Kconfig
+index 67c608bf7ed0..5386b362a7ab 100644
+--- a/drivers/pmdomain/ti/Kconfig
++++ b/drivers/pmdomain/ti/Kconfig
+@@ -10,7 +10,7 @@ if SOC_TI
+ config TI_SCI_PM_DOMAINS
+ tristate "TI SCI PM Domains Driver"
+ depends on TI_SCI_PROTOCOL
+- depends on PM_GENERIC_DOMAINS
++ select PM_GENERIC_DOMAINS if PM
+ help
+ Generic power domain implementation for TI device implementing
+ the TI SCI protocol.
+--
+2.39.5
+
--- /dev/null
+From 31a958b7c6359394f79af906713e30b5e3050db5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 16:32:21 +0300
+Subject: pNFS: Fix disk addr range check in block/scsi layout
+
+From: Sergey Bashirov <sergeybashirov@gmail.com>
+
+[ Upstream commit 7db6e66663681abda54f81d5916db3a3b8b1a13d ]
+
+At the end of the isect translation, disc_addr represents the physical
+disk offset. Thus, end calculated from disk_addr is also a physical disk
+offset. Therefore, range checking should be done using map->disk_offset,
+not map->start.
+
+Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250702133226.212537-1-sergeybashirov@gmail.com
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/blocklayout.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 47189476b553..5d6edafbed20 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -149,8 +149,8 @@ do_add_page_to_bio(struct bio *bio, int npg, enum req_op op, sector_t isect,
+
+ /* limit length to what the device mapping allows */
+ end = disk_addr + *len;
+- if (end >= map->start + map->len)
+- *len = map->start + map->len - disk_addr;
++ if (end >= map->disk_offset + map->len)
++ *len = map->disk_offset + map->len - disk_addr;
+
+ retry:
+ if (!bio) {
+--
+2.39.5
+
--- /dev/null
+From 4deb8c43a7c4573b473c82c7880ff23ccac54e8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 15:21:48 +0300
+Subject: pNFS: Fix stripe mapping in block/scsi layout
+
+From: Sergey Bashirov <sergeybashirov@gmail.com>
+
+[ Upstream commit 81438498a285759f31e843ac4800f82a5ce6521f ]
+
+Because of integer division, we need to carefully calculate the
+disk offset. Consider the example below for a stripe of 6 volumes,
+a chunk size of 4096, and an offset of 70000.
+
+chunk = div_u64(offset, dev->chunk_size) = 70000 / 4096 = 17
+offset = chunk * dev->chunk_size = 17 * 4096 = 69632
+disk_offset_wrong = div_u64(offset, dev->nr_children) = 69632 / 6 = 11605
+disk_chunk = div_u64(chunk, dev->nr_children) = 17 / 6 = 2
+disk_offset = disk_chunk * dev->chunk_size = 2 * 4096 = 8192
+
+Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250701122341.199112-1-sergeybashirov@gmail.com
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/dev.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
+index cab8809f0e0f..44306ac22353 100644
+--- a/fs/nfs/blocklayout/dev.c
++++ b/fs/nfs/blocklayout/dev.c
+@@ -257,10 +257,11 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset,
+ struct pnfs_block_dev *child;
+ u64 chunk;
+ u32 chunk_idx;
++ u64 disk_chunk;
+ u64 disk_offset;
+
+ chunk = div_u64(offset, dev->chunk_size);
+- div_u64_rem(chunk, dev->nr_children, &chunk_idx);
++ disk_chunk = div_u64_rem(chunk, dev->nr_children, &chunk_idx);
+
+ if (chunk_idx >= dev->nr_children) {
+ dprintk("%s: invalid chunk idx %d (%lld/%lld)\n",
+@@ -273,7 +274,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset,
+ offset = chunk * dev->chunk_size;
+
+ /* disk offset of the stripe */
+- disk_offset = div_u64(offset, dev->nr_children);
++ disk_offset = disk_chunk * dev->chunk_size;
+
+ child = &dev->children[chunk_idx];
+ child->map(child, disk_offset, map);
+--
+2.39.5
+
--- /dev/null
+From 142d1ac2940abdfc34af0d745435898aba9b3a9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 21:35:26 +0300
+Subject: pNFS: Fix uninited ptr deref in block/scsi layout
+
+From: Sergey Bashirov <sergeybashirov@gmail.com>
+
+[ Upstream commit 9768797c219326699778fba9cd3b607b2f1e7950 ]
+
+The error occurs on the third attempt to encode extents. When function
+ext_tree_prepare_commit() reallocates a larger buffer to retry encoding
+extents, the "layoutupdate_pages" page array is initialized only after the
+retry loop. But ext_tree_free_commitdata() is called on every iteration
+and tries to put pages in the array, thus dereferencing uninitialized
+pointers.
+
+An additional problem is that there is no limit on the maximum possible
+buffer_size. When there are too many extents, the client may create a
+layoutcommit that is larger than the maximum possible RPC size accepted
+by the server.
+
+During testing, we observed two typical scenarios. First, one memory page
+for extents is enough when we work with small files, append data to the
+end of the file, or preallocate extents before writing. But when we fill
+a new large file without preallocating, the number of extents can be huge,
+and counting the number of written extents in ext_tree_encode_commit()
+does not help much. Since this number increases even more between
+unlocking and locking of ext_tree, the reallocated buffer may not be
+large enough again and again.
+
+Co-developed-by: Konstantin Evtushenko <koevtushenko@yandex.com>
+Signed-off-by: Konstantin Evtushenko <koevtushenko@yandex.com>
+Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250630183537.196479-2-sergeybashirov@gmail.com
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/extent_tree.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/extent_tree.c b/fs/nfs/blocklayout/extent_tree.c
+index 8f7cff7a4293..0add0f329816 100644
+--- a/fs/nfs/blocklayout/extent_tree.c
++++ b/fs/nfs/blocklayout/extent_tree.c
+@@ -552,6 +552,15 @@ static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
+ return ret;
+ }
+
++/**
++ * ext_tree_prepare_commit - encode extents that need to be committed
++ * @arg: layout commit data
++ *
++ * Return values:
++ * %0: Success, all required extents are encoded
++ * %-ENOSPC: Some extents are encoded, but not all, due to RPC size limit
++ * %-ENOMEM: Out of memory, extents not encoded
++ */
+ int
+ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
+ {
+@@ -568,12 +577,12 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
+ start_p = page_address(arg->layoutupdate_page);
+ arg->layoutupdate_pages = &arg->layoutupdate_page;
+
+-retry:
+- ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count, &arg->lastbytewritten);
++ ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size,
++ &count, &arg->lastbytewritten);
+ if (unlikely(ret)) {
+ ext_tree_free_commitdata(arg, buffer_size);
+
+- buffer_size = ext_tree_layoutupdate_size(bl, count);
++ buffer_size = NFS_SERVER(arg->inode)->wsize;
+ count = 0;
+
+ arg->layoutupdate_pages =
+@@ -588,7 +597,8 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
+ return -ENOMEM;
+ }
+
+- goto retry;
++ ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size,
++ &count, &arg->lastbytewritten);
+ }
+
+ *start_p = cpu_to_be32(count);
+@@ -608,7 +618,7 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
+ }
+
+ dprintk("%s found %zu ranges\n", __func__, count);
+- return 0;
++ return ret;
+ }
+
+ void
+--
+2.39.5
+
--- /dev/null
+From 4b480f34d8a67e854d0c5b63b75e220ac8b432b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 21:35:29 +0300
+Subject: pNFS: Handle RPC size limit for layoutcommits
+
+From: Sergey Bashirov <sergeybashirov@gmail.com>
+
+[ Upstream commit d897d81671bc4615c80f4f3bd5e6b218f59df50c ]
+
+When there are too many block extents for a layoutcommit, they may not
+all fit into the maximum-sized RPC. This patch allows the generic pnfs
+code to properly handle -ENOSPC returned by the block/scsi layout driver
+and trigger additional layoutcommits if necessary.
+
+Co-developed-by: Konstantin Evtushenko <koevtushenko@yandex.com>
+Signed-off-by: Konstantin Evtushenko <koevtushenko@yandex.com>
+Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250630183537.196479-5-sergeybashirov@gmail.com
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 1a7ec68bde15..3fd0971bf16f 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -3340,6 +3340,7 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
+ struct nfs_inode *nfsi = NFS_I(inode);
+ loff_t end_pos;
+ int status;
++ bool mark_as_dirty = false;
+
+ if (!pnfs_layoutcommit_outstanding(inode))
+ return 0;
+@@ -3391,19 +3392,23 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
+ if (ld->prepare_layoutcommit) {
+ status = ld->prepare_layoutcommit(&data->args);
+ if (status) {
+- put_cred(data->cred);
++ if (status != -ENOSPC)
++ put_cred(data->cred);
+ spin_lock(&inode->i_lock);
+ set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags);
+ if (end_pos > nfsi->layout->plh_lwb)
+ nfsi->layout->plh_lwb = end_pos;
+- goto out_unlock;
++ if (status != -ENOSPC)
++ goto out_unlock;
++ spin_unlock(&inode->i_lock);
++ mark_as_dirty = true;
+ }
+ }
+
+
+ status = nfs4_proc_layoutcommit(data, sync);
+ out:
+- if (status)
++ if (status || mark_as_dirty)
+ mark_inode_dirty_sync(inode);
+ dprintk("<-- %s status %d\n", __func__, status);
+ return status;
+--
+2.39.5
+
--- /dev/null
+From 8fdf997ba2c04bb5a5b064e209ad635abda7ab96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 May 2025 13:14:22 +0300
+Subject: power: supply: qcom_battmgr: Add lithium-polymer entry
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 202ac22b8e2e015e6c196fd8113f3d2a62dd1afc ]
+
+On some Dell XPS 13 (9345) variants, the battery used is lithium-polymer
+based. Currently, this is reported as unknown technology due to the entry
+missing.
+
+[ 4083.135325] Unknown battery technology 'LIP'
+
+Add another check for lithium-polymer in the technology parsing callback
+and return that instead of unknown.
+
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250523-psy-qcom-battmgr-add-lipo-entry-v1-1-938c20a43a25@linaro.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/qcom_battmgr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
+index fe27676fbc7c..2d50830610e9 100644
+--- a/drivers/power/supply/qcom_battmgr.c
++++ b/drivers/power/supply/qcom_battmgr.c
+@@ -981,6 +981,8 @@ static unsigned int qcom_battmgr_sc8280xp_parse_technology(const char *chemistry
+ {
+ if (!strncmp(chemistry, "LIO", BATTMGR_CHEMISTRY_LEN))
+ return POWER_SUPPLY_TECHNOLOGY_LION;
++ if (!strncmp(chemistry, "LIP", BATTMGR_CHEMISTRY_LEN))
++ return POWER_SUPPLY_TECHNOLOGY_LIPO;
+
+ pr_err("Unknown battery technology '%s'\n", chemistry);
+ return POWER_SUPPLY_TECHNOLOGY_UNKNOWN;
+--
+2.39.5
+
--- /dev/null
+From 9abc5a296cc7d8274b18ef7f15b534f06068b5af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:29:11 +0200
+Subject: (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized
+ pointer
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 760b9b4f6de9a33ca56a05f950cabe82138d25bd ]
+
+If the device configuration fails (if `dma_dev->device_config()`),
+`sg_dma_address(&sg)` is not initialized and the jump to `err_dma_prep`
+leads to calling `dma_unmap_single()` on `sg_dma_address(&sg)`.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250610142918.169540-2-fourier.thomas@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/512x/mpc512x_lpbfifo.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+index 9668b052cd4b..f251e0f68262 100644
+--- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
++++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+@@ -240,10 +240,8 @@ static int mpc512x_lpbfifo_kick(void)
+ dma_conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+
+ /* Make DMA channel work with LPB FIFO data register */
+- if (dma_dev->device_config(lpbfifo.chan, &dma_conf)) {
+- ret = -EINVAL;
+- goto err_dma_prep;
+- }
++ if (dma_dev->device_config(lpbfifo.chan, &dma_conf))
++ return -EINVAL;
+
+ sg_init_table(&sg, 1);
+
+--
+2.39.5
+
--- /dev/null
+From 0b3b8d161a00b9e4c1d6f6ae604c2ef7926e45b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 09:55:55 +0200
+Subject: powerpc: floppy: Add missing checks after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit cf183c1730f2634245da35e9b5d53381b787d112 ]
+
+The DMA map functions can fail and should be tested for errors.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250620075602.12575-1-fourier.thomas@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/floppy.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/floppy.h b/arch/powerpc/include/asm/floppy.h
+index f8ce178b43b7..34abf8bea2cc 100644
+--- a/arch/powerpc/include/asm/floppy.h
++++ b/arch/powerpc/include/asm/floppy.h
+@@ -144,9 +144,12 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io)
+ bus_addr = 0;
+ }
+
+- if (!bus_addr) /* need to map it */
++ if (!bus_addr) { /* need to map it */
+ bus_addr = dma_map_single(&isa_bridge_pcidev->dev, addr, size,
+ dir);
++ if (dma_mapping_error(&isa_bridge_pcidev->dev, bus_addr))
++ return -ENOMEM;
++ }
+
+ /* remember this one as prev */
+ prev_addr = addr;
+--
+2.39.5
+
--- /dev/null
+From 2ca4dfea5a9d5f9366ea8f00fb9d6e795d114e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 10:12:59 -0400
+Subject: powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+[ Upstream commit 43cf0e05089afe23dac74fa6e1e109d49f2903c4 ]
+
+The events hugepage_set_pmd, hugepage_set_pud, hugepage_update_pmd and
+hugepage_update_pud are only called when CONFIG_PPC_BOOK3S_64 is defined.
+As each event can take up to 5K regardless if they are used or not, it's
+best not to define them when they are not used. Add #ifdef around these
+events when they are not used.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/20250612101259.0ad43e48@batman.local.home
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/thp.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/trace/events/thp.h b/include/trace/events/thp.h
+index f50048af5fcc..c8fe879d5828 100644
+--- a/include/trace/events/thp.h
++++ b/include/trace/events/thp.h
+@@ -8,6 +8,7 @@
+ #include <linux/types.h>
+ #include <linux/tracepoint.h>
+
++#ifdef CONFIG_PPC_BOOK3S_64
+ DECLARE_EVENT_CLASS(hugepage_set,
+
+ TP_PROTO(unsigned long addr, unsigned long pte),
+@@ -66,6 +67,7 @@ DEFINE_EVENT(hugepage_update, hugepage_update_pud,
+ TP_PROTO(unsigned long addr, unsigned long pud, unsigned long clr, unsigned long set),
+ TP_ARGS(addr, pud, clr, set)
+ );
++#endif /* CONFIG_PPC_BOOK3S_64 */
+
+ DECLARE_EVENT_CLASS(migration_pmd,
+
+--
+2.39.5
+
--- /dev/null
+From be886a11ced6a57e334f4ec246f98b73b601a1a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 May 2025 05:33:55 +0000
+Subject: pps: clients: gpio: fix interrupt handling order in remove path
+
+From: Eliav Farber <farbere@amazon.com>
+
+[ Upstream commit 6bca1e955830808dc90e0506b2951b4256b81bbb ]
+
+The interrupt handler in pps_gpio_probe() is registered after calling
+pps_register_source() using devm_request_irq(). However, in the
+corresponding remove function, pps_unregister_source() is called before
+the IRQ is freed, since devm-managed resources are released after the
+remove function completes.
+
+This creates a potential race condition where an interrupt may occur
+after the PPS source is unregistered but before the handler is removed,
+possibly leading to a kernel panic.
+
+To prevent this, switch from devm-managed IRQ registration to manual
+management by using request_irq() and calling free_irq() explicitly in
+the remove path before unregistering the PPS source. This ensures the
+interrupt handler is safely removed before deactivating the PPS source.
+
+Signed-off-by: Eliav Farber <farbere@amazon.com>
+Link: https://lore.kernel.org/r/20250527053355.37185-1-farbere@amazon.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/clients/pps-gpio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
+index 374ceefd6f2a..2866636b0554 100644
+--- a/drivers/pps/clients/pps-gpio.c
++++ b/drivers/pps/clients/pps-gpio.c
+@@ -210,8 +210,8 @@ static int pps_gpio_probe(struct platform_device *pdev)
+ }
+
+ /* register IRQ interrupt handler */
+- ret = devm_request_irq(dev, data->irq, pps_gpio_irq_handler,
+- get_irqf_trigger_flags(data), data->info.name, data);
++ ret = request_irq(data->irq, pps_gpio_irq_handler,
++ get_irqf_trigger_flags(data), data->info.name, data);
+ if (ret) {
+ pps_unregister_source(data->pps);
+ dev_err(dev, "failed to acquire IRQ %d\n", data->irq);
+@@ -228,6 +228,7 @@ static void pps_gpio_remove(struct platform_device *pdev)
+ {
+ struct pps_gpio_device_data *data = platform_get_drvdata(pdev);
+
++ free_irq(data->irq, data);
+ pps_unregister_source(data->pps);
+ timer_delete_sync(&data->echo_timer);
+ /* reset echo pin in any case */
+--
+2.39.5
+
--- /dev/null
+From c90e8ed65abecc5af298a38a8b32a5d775249a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 21:01:49 +0206
+Subject: printk: nbcon: Allow reacquire during panic
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 571c1ea91a73db56bd94054fabecd0f070dc90db ]
+
+If a console printer is interrupted during panic, it will never
+be able to reacquire ownership in order to perform and cleanup.
+That in itself is not a problem, since the non-panic CPU will
+simply quiesce in an endless loop within nbcon_reacquire_nobuf().
+
+However, in this state, platforms that do not support a true NMI
+to interrupt the quiesced CPU will not be able to shutdown that
+CPU from within panic(). This then causes problems for such as
+being unable to load and run a kdump kernel.
+
+Fix this by allowing non-panic CPUs to reacquire ownership using
+a direct acquire. Then the non-panic CPUs can successfullyl exit
+the nbcon_reacquire_nobuf() loop and the console driver can
+perform any necessary cleanup. But more importantly, the CPU is
+no longer quiesced and is free to process any interrupts
+necessary for panic() to shutdown the CPU.
+
+All other forms of acquire are still not allowed for non-panic
+CPUs since it is safer to have them avoid gaining console
+ownership that is not strictly necessary.
+
+Reported-by: Michael Kelley <mhklinux@outlook.com>
+Closes: https://lore.kernel.org/r/SN6PR02MB4157A4C5E8CB219A75263A17D46DA@SN6PR02MB4157.namprd02.prod.outlook.com
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Tested-by: Michael Kelley <mhklinux@outlook.com>
+Link: https://patch.msgid.link/20250606185549.900611-1-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/nbcon.c | 63 ++++++++++++++++++++++++++++---------------
+ 1 file changed, 41 insertions(+), 22 deletions(-)
+
+diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
+index fd12efcc4aed..e7a3af81b173 100644
+--- a/kernel/printk/nbcon.c
++++ b/kernel/printk/nbcon.c
+@@ -214,8 +214,9 @@ static void nbcon_seq_try_update(struct nbcon_context *ctxt, u64 new_seq)
+
+ /**
+ * nbcon_context_try_acquire_direct - Try to acquire directly
+- * @ctxt: The context of the caller
+- * @cur: The current console state
++ * @ctxt: The context of the caller
++ * @cur: The current console state
++ * @is_reacquire: This acquire is a reacquire
+ *
+ * Acquire the console when it is released. Also acquire the console when
+ * the current owner has a lower priority and the console is in a safe state.
+@@ -225,17 +226,17 @@ static void nbcon_seq_try_update(struct nbcon_context *ctxt, u64 new_seq)
+ *
+ * Errors:
+ *
+- * -EPERM: A panic is in progress and this is not the panic CPU.
+- * Or the current owner or waiter has the same or higher
+- * priority. No acquire method can be successful in
+- * this case.
++ * -EPERM: A panic is in progress and this is neither the panic
++ * CPU nor is this a reacquire. Or the current owner or
++ * waiter has the same or higher priority. No acquire
++ * method can be successful in these cases.
+ *
+ * -EBUSY: The current owner has a lower priority but the console
+ * in an unsafe state. The caller should try using
+ * the handover acquire method.
+ */
+ static int nbcon_context_try_acquire_direct(struct nbcon_context *ctxt,
+- struct nbcon_state *cur)
++ struct nbcon_state *cur, bool is_reacquire)
+ {
+ unsigned int cpu = smp_processor_id();
+ struct console *con = ctxt->console;
+@@ -243,14 +244,20 @@ static int nbcon_context_try_acquire_direct(struct nbcon_context *ctxt,
+
+ do {
+ /*
+- * Panic does not imply that the console is owned. However, it
+- * is critical that non-panic CPUs during panic are unable to
+- * acquire ownership in order to satisfy the assumptions of
+- * nbcon_waiter_matches(). In particular, the assumption that
+- * lower priorities are ignored during panic.
++ * Panic does not imply that the console is owned. However,
++ * since all non-panic CPUs are stopped during panic(), it
++ * is safer to have them avoid gaining console ownership.
++ *
++ * If this acquire is a reacquire (and an unsafe takeover
++ * has not previously occurred) then it is allowed to attempt
++ * a direct acquire in panic. This gives console drivers an
++ * opportunity to perform any necessary cleanup if they were
++ * interrupted by the panic CPU while printing.
+ */
+- if (other_cpu_in_panic())
++ if (other_cpu_in_panic() &&
++ (!is_reacquire || cur->unsafe_takeover)) {
+ return -EPERM;
++ }
+
+ if (ctxt->prio <= cur->prio || ctxt->prio <= cur->req_prio)
+ return -EPERM;
+@@ -301,8 +308,9 @@ static bool nbcon_waiter_matches(struct nbcon_state *cur, int expected_prio)
+ * Event #1 implies this context is EMERGENCY.
+ * Event #2 implies the new context is PANIC.
+ * Event #3 occurs when panic() has flushed the console.
+- * Events #4 and #5 are not possible due to the other_cpu_in_panic()
+- * check in nbcon_context_try_acquire_direct().
++ * Event #4 occurs when a non-panic CPU reacquires.
++ * Event #5 is not possible due to the other_cpu_in_panic() check
++ * in nbcon_context_try_acquire_handover().
+ */
+
+ return (cur->req_prio == expected_prio);
+@@ -431,6 +439,16 @@ static int nbcon_context_try_acquire_handover(struct nbcon_context *ctxt,
+ WARN_ON_ONCE(ctxt->prio <= cur->prio || ctxt->prio <= cur->req_prio);
+ WARN_ON_ONCE(!cur->unsafe);
+
++ /*
++ * Panic does not imply that the console is owned. However, it
++ * is critical that non-panic CPUs during panic are unable to
++ * wait for a handover in order to satisfy the assumptions of
++ * nbcon_waiter_matches(). In particular, the assumption that
++ * lower priorities are ignored during panic.
++ */
++ if (other_cpu_in_panic())
++ return -EPERM;
++
+ /* Handover is not possible on the same CPU. */
+ if (cur->cpu == cpu)
+ return -EBUSY;
+@@ -558,7 +576,8 @@ static struct printk_buffers panic_nbcon_pbufs;
+
+ /**
+ * nbcon_context_try_acquire - Try to acquire nbcon console
+- * @ctxt: The context of the caller
++ * @ctxt: The context of the caller
++ * @is_reacquire: This acquire is a reacquire
+ *
+ * Context: Under @ctxt->con->device_lock() or local_irq_save().
+ * Return: True if the console was acquired. False otherwise.
+@@ -568,7 +587,7 @@ static struct printk_buffers panic_nbcon_pbufs;
+ * in an unsafe state. Otherwise, on success the caller may assume
+ * the console is not in an unsafe state.
+ */
+-static bool nbcon_context_try_acquire(struct nbcon_context *ctxt)
++static bool nbcon_context_try_acquire(struct nbcon_context *ctxt, bool is_reacquire)
+ {
+ unsigned int cpu = smp_processor_id();
+ struct console *con = ctxt->console;
+@@ -577,7 +596,7 @@ static bool nbcon_context_try_acquire(struct nbcon_context *ctxt)
+
+ nbcon_state_read(con, &cur);
+ try_again:
+- err = nbcon_context_try_acquire_direct(ctxt, &cur);
++ err = nbcon_context_try_acquire_direct(ctxt, &cur, is_reacquire);
+ if (err != -EBUSY)
+ goto out;
+
+@@ -913,7 +932,7 @@ void nbcon_reacquire_nobuf(struct nbcon_write_context *wctxt)
+ {
+ struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
+
+- while (!nbcon_context_try_acquire(ctxt))
++ while (!nbcon_context_try_acquire(ctxt, true))
+ cpu_relax();
+
+ nbcon_write_context_set_buf(wctxt, NULL, 0);
+@@ -1101,7 +1120,7 @@ static bool nbcon_emit_one(struct nbcon_write_context *wctxt, bool use_atomic)
+ cant_migrate();
+ }
+
+- if (!nbcon_context_try_acquire(ctxt))
++ if (!nbcon_context_try_acquire(ctxt, false))
+ goto out;
+
+ /*
+@@ -1486,7 +1505,7 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq,
+ ctxt->prio = nbcon_get_default_prio();
+ ctxt->allow_unsafe_takeover = allow_unsafe_takeover;
+
+- if (!nbcon_context_try_acquire(ctxt))
++ if (!nbcon_context_try_acquire(ctxt, false))
+ return -EPERM;
+
+ while (nbcon_seq_read(con) < stop_seq) {
+@@ -1762,7 +1781,7 @@ bool nbcon_device_try_acquire(struct console *con)
+ ctxt->console = con;
+ ctxt->prio = NBCON_PRIO_NORMAL;
+
+- if (!nbcon_context_try_acquire(ctxt))
++ if (!nbcon_context_try_acquire(ctxt, false))
+ return false;
+
+ if (!nbcon_context_enter_unsafe(ctxt))
+--
+2.39.5
+
--- /dev/null
+From 910706bdfa67ca9f89d6119a259892747365daa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 10:15:46 -0700
+Subject: ptp: Use ratelimite for freerun error message
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit e9a7795e75b78b56997fb0070c18d6e1057b6462 ]
+
+Replace pr_err() with pr_err_ratelimited() in ptp_clock_settime() to
+prevent log flooding when the physical clock is free running, which
+happens on some of my hosts. This ensures error messages are
+rate-limited and improves kernel log readability.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250613-ptp-v1-1-ee44260ce9e2@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 36f57d7b4a66..1cc06b7cb17e 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -96,7 +96,7 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
+
+ if (ptp_clock_freerun(ptp)) {
+- pr_err("ptp: physical clock is free running\n");
++ pr_err_ratelimited("ptp: physical clock is free running\n");
+ return -EBUSY;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b470811317fc361d62a81474197be9faf9fdc6bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 10:22:19 -0400
+Subject: rcu: Fix rcu_read_unlock() deadloop due to IRQ work
+
+From: Joel Fernandes <joelagnelf@nvidia.com>
+
+[ Upstream commit b41642c87716bbd09797b1e4ea7d904f06c39b7b ]
+
+During rcu_read_unlock_special(), if this happens during irq_exit(), we
+can lockup if an IPI is issued. This is because the IPI itself triggers
+the irq_exit() path causing a recursive lock up.
+
+This is precisely what Xiongfeng found when invoking a BPF program on
+the trace_tick_stop() tracepoint As shown in the trace below. Fix by
+managing the irq_work state correctly.
+
+irq_exit()
+ __irq_exit_rcu()
+ /* in_hardirq() returns false after this */
+ preempt_count_sub(HARDIRQ_OFFSET)
+ tick_irq_exit()
+ tick_nohz_irq_exit()
+ tick_nohz_stop_sched_tick()
+ trace_tick_stop() /* a bpf prog is hooked on this trace point */
+ __bpf_trace_tick_stop()
+ bpf_trace_run2()
+ rcu_read_unlock_special()
+ /* will send a IPI to itself */
+ irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);
+
+A simple reproducer can also be obtained by doing the following in
+tick_irq_exit(). It will hang on boot without the patch:
+
+ static inline void tick_irq_exit(void)
+ {
+ + rcu_read_lock();
+ + WRITE_ONCE(current->rcu_read_unlock_special.b.need_qs, true);
+ + rcu_read_unlock();
+ +
+
+Reported-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Closes: https://lore.kernel.org/all/9acd5f9f-6732-7701-6880-4b51190aa070@huawei.com/
+Tested-by: Qi Xi <xiqi2@huawei.com>
+Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
+Reviewed-by: "Paul E. McKenney" <paulmck@kernel.org>
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]
+Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.h | 13 ++++++++++++-
+ kernel/rcu/tree_plugin.h | 37 ++++++++++++++++++++++++++-----------
+ 2 files changed, 38 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
+index 1bba2225e744..f99677bf97ca 100644
+--- a/kernel/rcu/tree.h
++++ b/kernel/rcu/tree.h
+@@ -174,6 +174,17 @@ struct rcu_snap_record {
+ unsigned long jiffies; /* Track jiffies value */
+ };
+
++/*
++ * An IRQ work (deferred_qs_iw) is used by RCU to get the scheduler's attention.
++ * to report quiescent states at the soonest possible time.
++ * The request can be in one of the following states:
++ * - DEFER_QS_IDLE: An IRQ work is yet to be scheduled.
++ * - DEFER_QS_PENDING: An IRQ work was scheduled but either not yet run, or it
++ * ran and we still haven't reported a quiescent state.
++ */
++#define DEFER_QS_IDLE 0
++#define DEFER_QS_PENDING 1
++
+ /* Per-CPU data for read-copy update. */
+ struct rcu_data {
+ /* 1) quiescent-state and grace-period handling : */
+@@ -191,7 +202,7 @@ struct rcu_data {
+ /* during and after the last grace */
+ /* period it is aware of. */
+ struct irq_work defer_qs_iw; /* Obtain later scheduler attention. */
+- bool defer_qs_iw_pending; /* Scheduler attention pending? */
++ int defer_qs_iw_pending; /* Scheduler attention pending? */
+ struct work_struct strict_work; /* Schedule readers for strict GPs. */
+
+ /* 2) batch handling */
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index 003e549f6514..1164173c3d9d 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -486,13 +486,16 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
+ struct rcu_node *rnp;
+ union rcu_special special;
+
++ rdp = this_cpu_ptr(&rcu_data);
++ if (rdp->defer_qs_iw_pending == DEFER_QS_PENDING)
++ rdp->defer_qs_iw_pending = DEFER_QS_IDLE;
++
+ /*
+ * If RCU core is waiting for this CPU to exit its critical section,
+ * report the fact that it has exited. Because irqs are disabled,
+ * t->rcu_read_unlock_special cannot change.
+ */
+ special = t->rcu_read_unlock_special;
+- rdp = this_cpu_ptr(&rcu_data);
+ if (!special.s && !rdp->cpu_no_qs.b.exp) {
+ local_irq_restore(flags);
+ return;
+@@ -629,7 +632,23 @@ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp)
+
+ rdp = container_of(iwp, struct rcu_data, defer_qs_iw);
+ local_irq_save(flags);
+- rdp->defer_qs_iw_pending = false;
++
++ /*
++ * If the IRQ work handler happens to run in the middle of RCU read-side
++ * critical section, it could be ineffective in getting the scheduler's
++ * attention to report a deferred quiescent state (the whole point of the
++ * IRQ work). For this reason, requeue the IRQ work.
++ *
++ * Basically, we want to avoid following situation:
++ * 1. rcu_read_unlock() queues IRQ work (state -> DEFER_QS_PENDING)
++ * 2. CPU enters new rcu_read_lock()
++ * 3. IRQ work runs but cannot report QS due to rcu_preempt_depth() > 0
++ * 4. rcu_read_unlock() does not re-queue work (state still PENDING)
++ * 5. Deferred QS reporting does not happen.
++ */
++ if (rcu_preempt_depth() > 0)
++ WRITE_ONCE(rdp->defer_qs_iw_pending, DEFER_QS_IDLE);
++
+ local_irq_restore(flags);
+ }
+
+@@ -676,17 +695,13 @@ static void rcu_read_unlock_special(struct task_struct *t)
+ set_tsk_need_resched(current);
+ set_preempt_need_resched();
+ if (IS_ENABLED(CONFIG_IRQ_WORK) && irqs_were_disabled &&
+- expboost && !rdp->defer_qs_iw_pending && cpu_online(rdp->cpu)) {
++ expboost && rdp->defer_qs_iw_pending != DEFER_QS_PENDING &&
++ cpu_online(rdp->cpu)) {
+ // Get scheduler to re-evaluate and call hooks.
+ // If !IRQ_WORK, FQS scan will eventually IPI.
+- if (IS_ENABLED(CONFIG_RCU_STRICT_GRACE_PERIOD) &&
+- IS_ENABLED(CONFIG_PREEMPT_RT))
+- rdp->defer_qs_iw = IRQ_WORK_INIT_HARD(
+- rcu_preempt_deferred_qs_handler);
+- else
+- init_irq_work(&rdp->defer_qs_iw,
+- rcu_preempt_deferred_qs_handler);
+- rdp->defer_qs_iw_pending = true;
++ rdp->defer_qs_iw =
++ IRQ_WORK_INIT_HARD(rcu_preempt_deferred_qs_handler);
++ rdp->defer_qs_iw_pending = DEFER_QS_PENDING;
+ irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 35ed741faffe085105a28340bfe8b17af58ef5c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 19:26:05 +0800
+Subject: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
+
+From: Zqiang <qiang.zhang1211@gmail.com>
+
+[ Upstream commit 1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1 ]
+
+In the preparation stage of CPU online, if the corresponding
+the rdp's->nocb_cb_kthread does not exist, will be created,
+there is a situation where the rdp's rcuop kthreads creation fails,
+and then de-offload this CPU's rdp, does not assign this CPU's
+rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and
+rdp's->rdp_gp->nocb_gp_kthread is still valid.
+
+This will cause the subsequent re-offload operation of this offline
+CPU, which will pass the conditional check and the kthread_unpark()
+will access invalid rdp's->nocb_cb_kthread pointer.
+
+This commit therefore use rdp's->nocb_gp_kthread instead of
+rdp_gp's->nocb_gp_kthread for safety check.
+
+Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_nocb.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/tree_nocb.h b/kernel/rcu/tree_nocb.h
+index 6b3118a4dde3..2083d2343bd4 100644
+--- a/kernel/rcu/tree_nocb.h
++++ b/kernel/rcu/tree_nocb.h
+@@ -1152,7 +1152,6 @@ static bool rcu_nocb_rdp_offload_wait_cond(struct rcu_data *rdp)
+ static int rcu_nocb_rdp_offload(struct rcu_data *rdp)
+ {
+ int wake_gp;
+- struct rcu_data *rdp_gp = rdp->nocb_gp_rdp;
+
+ WARN_ON_ONCE(cpu_online(rdp->cpu));
+ /*
+@@ -1162,7 +1161,7 @@ static int rcu_nocb_rdp_offload(struct rcu_data *rdp)
+ if (!rdp->nocb_gp_rdp)
+ return -EINVAL;
+
+- if (WARN_ON_ONCE(!rdp_gp->nocb_gp_kthread))
++ if (WARN_ON_ONCE(!rdp->nocb_gp_kthread))
+ return -EINVAL;
+
+ pr_info("Offloading %d\n", rdp->cpu);
+@@ -1172,7 +1171,7 @@ static int rcu_nocb_rdp_offload(struct rcu_data *rdp)
+
+ wake_gp = rcu_nocb_queue_toggle_rdp(rdp);
+ if (wake_gp)
+- wake_up_process(rdp_gp->nocb_gp_kthread);
++ wake_up_process(rdp->nocb_gp_kthread);
+
+ swait_event_exclusive(rdp->nocb_state_wq,
+ rcu_nocb_rdp_offload_wait_cond(rdp));
+--
+2.39.5
+
--- /dev/null
+From 8211ad3bb9b4d1f9da61ebbe2fa10c96bb95aea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 16:49:53 -0700
+Subject: rcu: Protect ->defer_qs_iw_pending from data race
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 90c09d57caeca94e6f3f87c49e96a91edd40cbfd ]
+
+On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is
+invoked within an interrupts-disabled region of code [1], it will invoke
+rcu_read_unlock_special(), which uses an irq-work handler to force the
+system to notice when the RCU read-side critical section actually ends.
+That end won't happen until interrupts are enabled at the soonest.
+
+In some kernels, such as those booted with rcutree.use_softirq=y, the
+irq-work handler is used unconditionally.
+
+The per-CPU rcu_data structure's ->defer_qs_iw_pending field is
+updated by the irq-work handler and is both read and updated by
+rcu_read_unlock_special(). This resulted in the following KCSAN splat:
+
+------------------------------------------------------------------------
+
+BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special
+
+read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:
+ rcu_read_unlock_special+0x175/0x260
+ __rcu_read_unlock+0x92/0xa0
+ rt_spin_unlock+0x9b/0xc0
+ __local_bh_enable+0x10d/0x170
+ __local_bh_enable_ip+0xfb/0x150
+ rcu_do_batch+0x595/0xc40
+ rcu_cpu_kthread+0x4e9/0x830
+ smpboot_thread_fn+0x24d/0x3b0
+ kthread+0x3bd/0x410
+ ret_from_fork+0x35/0x40
+ ret_from_fork_asm+0x1a/0x30
+
+write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:
+ rcu_preempt_deferred_qs_handler+0x1e/0x30
+ irq_work_single+0xaf/0x160
+ run_irq_workd+0x91/0xc0
+ smpboot_thread_fn+0x24d/0x3b0
+ kthread+0x3bd/0x410
+ ret_from_fork+0x35/0x40
+ ret_from_fork_asm+0x1a/0x30
+
+no locks held by irq_work/8/88.
+irq event stamp: 200272
+hardirqs last enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320
+hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70
+softirqs last enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0
+softirqs last disabled at (0): [<0000000000000000>] 0x0
+
+------------------------------------------------------------------------
+
+The problem is that irq-work handlers run with interrupts enabled, which
+means that rcu_preempt_deferred_qs_handler() could be interrupted,
+and that interrupt handler might contain an RCU read-side critical
+section, which might invoke rcu_read_unlock_special(). In the strict
+KCSAN mode of operation used by RCU, this constitutes a data race on
+the ->defer_qs_iw_pending field.
+
+This commit therefore disables interrupts across the portion of the
+rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending
+field. This suffices because this handler is not a fast path.
+
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_plugin.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index 3c0bbbbb686f..003e549f6514 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -624,10 +624,13 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t)
+ */
+ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp)
+ {
++ unsigned long flags;
+ struct rcu_data *rdp;
+
+ rdp = container_of(iwp, struct rcu_data, defer_qs_iw);
++ local_irq_save(flags);
+ rdp->defer_qs_iw_pending = false;
++ local_irq_restore(flags);
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From c6f2c4cf75f8b4f3a41862eea53ffef914bfddd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 May 2025 19:26:03 +0800
+Subject: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels
+
+From: Zqiang <qiang.zhang1211@gmail.com>
+
+[ Upstream commit 8d71351d88e478d3c4e945e3218e97ec677fd807 ]
+
+For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture
+tests resulted in the following splat:
+
+[ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0
+[ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture]
+[ 68.797601] Call Trace:
+[ 68.797602] <TASK>
+[ 68.797619] ? lockdep_softirqs_off+0xa5/0x160
+[ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]
+[ 68.797646] ? local_clock+0x19/0x40
+[ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]
+[ 68.797678] ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]
+[ 68.797804] ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]
+[ 68.797815] rcu-torture: rcu_torture_reader task started
+[ 68.797824] rcu-torture: Creating rcu_torture_reader task
+[ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]
+[ 68.797836] ? kvm_sched_clock_read+0x15/0x30
+
+Disable BH does not change the SOFTIRQ corresponding bits in
+preempt_count() for RT kernels, this commit therefore use
+softirq_count() to check the if BH is disabled.
+
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
+Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
+Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcutorture.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
+index 4fa7772be183..a6202cbef9c5 100644
+--- a/kernel/rcu/rcutorture.c
++++ b/kernel/rcu/rcutorture.c
+@@ -458,7 +458,7 @@ rcu_read_delay(struct torture_random_state *rrsp, struct rt_read_seg *rtrsp)
+ !(torture_random(rrsp) % (nrealreaders * 2000 * longdelay_ms))) {
+ started = cur_ops->get_gp_seq();
+ ts = rcu_trace_clock_local();
+- if (preempt_count() & (SOFTIRQ_MASK | HARDIRQ_MASK))
++ if ((preempt_count() & HARDIRQ_MASK) || softirq_count())
+ longdelay_ms = 5; /* Avoid triggering BH limits. */
+ mdelay(longdelay_ms);
+ rtrsp->rt_delay_ms = longdelay_ms;
+@@ -1922,7 +1922,7 @@ static void rcutorture_one_extend_check(char *s, int curstate, int new, int old,
+ return;
+
+ WARN_ONCE((curstate & (RCUTORTURE_RDR_BH | RCUTORTURE_RDR_RBH)) &&
+- !(preempt_count() & SOFTIRQ_MASK), ROEC_ARGS);
++ !softirq_count(), ROEC_ARGS);
+ WARN_ONCE((curstate & (RCUTORTURE_RDR_PREEMPT | RCUTORTURE_RDR_SCHED)) &&
+ !(preempt_count() & PREEMPT_MASK), ROEC_ARGS);
+ WARN_ONCE(cur_ops->readlock_nesting &&
+@@ -1936,7 +1936,7 @@ static void rcutorture_one_extend_check(char *s, int curstate, int new, int old,
+
+ WARN_ONCE(cur_ops->extendables &&
+ !(curstate & (RCUTORTURE_RDR_BH | RCUTORTURE_RDR_RBH)) &&
+- (preempt_count() & SOFTIRQ_MASK), ROEC_ARGS);
++ softirq_count(), ROEC_ARGS);
+
+ /*
+ * non-preemptible RCU in a preemptible kernel uses preempt_disable()
+@@ -1957,6 +1957,9 @@ static void rcutorture_one_extend_check(char *s, int curstate, int new, int old,
+ if (!IS_ENABLED(CONFIG_PREEMPT_RCU))
+ mask |= RCUTORTURE_RDR_PREEMPT | RCUTORTURE_RDR_SCHED;
+
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && softirq_count())
++ mask |= RCUTORTURE_RDR_BH | RCUTORTURE_RDR_RBH;
++
+ WARN_ONCE(cur_ops->readlock_nesting && !(curstate & mask) &&
+ cur_ops->readlock_nesting() > 0, ROEC_ARGS);
+ }
+--
+2.39.5
+
--- /dev/null
+From 293b2a5c92aa858945262545c7c91cdf1d669d3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 10:08:55 +0530
+Subject: RDMA/bnxt_re: Fix size of uverbs_copy_to() in
+ BNXT_RE_METHOD_GET_TOGGLE_MEM
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 09d231ab569ca97478445ccc1ad44ab026de39b1 ]
+
+Since both "length" and "offset" are of type u32, there is
+no functional issue here.
+
+Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Signed-off-by: Shravya KN <shravya.k-n@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Link: https://patch.msgid.link/20250704043857.19158-2-kalesh-anakkur.purayil@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 063801384b2b..3a627acb82ce 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -4738,7 +4738,7 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD_GET_TOGGLE_MEM)(struct uverbs_attr_bund
+ return err;
+
+ err = uverbs_copy_to(attrs, BNXT_RE_TOGGLE_MEM_MMAP_OFFSET,
+- &offset, sizeof(length));
++ &offset, sizeof(offset));
+ if (err)
+ return err;
+
+--
+2.39.5
+
--- /dev/null
+From 0afc17c0d345fcb987145a687779e00ed6460eb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 13:33:26 +0200
+Subject: RDMA/core: reduce stack using in nldev_stat_get_doit()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 43163f4c30f94d2103c948a247cdf2cda5068ca7 ]
+
+In the s390 defconfig, gcc-10 and earlier end up inlining three functions
+into nldev_stat_get_doit(), and each of them uses some 600 bytes of stack.
+
+The result is a function with an overly large stack frame and a warning:
+
+drivers/infiniband/core/nldev.c:2466:1: error: the frame size of 1720 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Mark the three functions noinline_for_stack to prevent this, ensuring
+that only one copy of the nlattr array is on the stack of each function.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://patch.msgid.link/20250620113335.3776965-1-arnd@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/nldev.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index a872643e8039..e9b7a6419291 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -1469,10 +1469,11 @@ static const struct nldev_fill_res_entry fill_entries[RDMA_RESTRACK_MAX] = {
+
+ };
+
+-static int res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack,
+- enum rdma_restrack_type res_type,
+- res_fill_func_t fill_func)
++static noinline_for_stack int
++res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
++ struct netlink_ext_ack *extack,
++ enum rdma_restrack_type res_type,
++ res_fill_func_t fill_func)
+ {
+ const struct nldev_fill_res_entry *fe = &fill_entries[res_type];
+ struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
+@@ -2263,10 +2264,10 @@ static int nldev_stat_del_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return ret;
+ }
+
+-static int stat_get_doit_default_counter(struct sk_buff *skb,
+- struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack,
+- struct nlattr *tb[])
++static noinline_for_stack int
++stat_get_doit_default_counter(struct sk_buff *skb, struct nlmsghdr *nlh,
++ struct netlink_ext_ack *extack,
++ struct nlattr *tb[])
+ {
+ struct rdma_hw_stats *stats;
+ struct nlattr *table_attr;
+@@ -2356,8 +2357,9 @@ static int stat_get_doit_default_counter(struct sk_buff *skb,
+ return ret;
+ }
+
+-static int stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack, struct nlattr *tb[])
++static noinline_for_stack int
++stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh,
++ struct netlink_ext_ack *extack, struct nlattr *tb[])
+
+ {
+ static enum rdma_nl_counter_mode mode;
+--
+2.39.5
+
--- /dev/null
+From 66cc7a1d38f1207f8e99f27d58ea3b91788839ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jun 2025 15:39:38 -0400
+Subject: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
+
+From: Yury Norov [NVIDIA] <yury.norov@gmail.com>
+
+[ Upstream commit 59f7d2138591ef8f0e4e4ab5f1ab674e8181ad3a ]
+
+The function divides number of online CPUs by num_core_siblings, and
+later checks the divider by zero. This implies a possibility to get
+and divide-by-zero runtime error. Fix it by moving the check prior to
+division. This also helps to save one indentation level.
+
+Signed-off-by: Yury Norov [NVIDIA] <yury.norov@gmail.com>
+Link: https://patch.msgid.link/20250604193947.11834-3-yury.norov@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/affinity.c | 44 +++++++++++++++------------
+ 1 file changed, 24 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
+index 7ead8746b79b..f2c530ab85a5 100644
+--- a/drivers/infiniband/hw/hfi1/affinity.c
++++ b/drivers/infiniband/hw/hfi1/affinity.c
+@@ -964,31 +964,35 @@ static void find_hw_thread_mask(uint hw_thread_no, cpumask_var_t hw_thread_mask,
+ struct hfi1_affinity_node_list *affinity)
+ {
+ int possible, curr_cpu, i;
+- uint num_cores_per_socket = node_affinity.num_online_cpus /
++ uint num_cores_per_socket;
++
++ cpumask_copy(hw_thread_mask, &affinity->proc.mask);
++
++ if (affinity->num_core_siblings == 0)
++ return;
++
++ num_cores_per_socket = node_affinity.num_online_cpus /
+ affinity->num_core_siblings /
+ node_affinity.num_online_nodes;
+
+- cpumask_copy(hw_thread_mask, &affinity->proc.mask);
+- if (affinity->num_core_siblings > 0) {
+- /* Removing other siblings not needed for now */
+- possible = cpumask_weight(hw_thread_mask);
+- curr_cpu = cpumask_first(hw_thread_mask);
+- for (i = 0;
+- i < num_cores_per_socket * node_affinity.num_online_nodes;
+- i++)
+- curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
+-
+- for (; i < possible; i++) {
+- cpumask_clear_cpu(curr_cpu, hw_thread_mask);
+- curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
+- }
++ /* Removing other siblings not needed for now */
++ possible = cpumask_weight(hw_thread_mask);
++ curr_cpu = cpumask_first(hw_thread_mask);
++ for (i = 0;
++ i < num_cores_per_socket * node_affinity.num_online_nodes;
++ i++)
++ curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
+
+- /* Identifying correct HW threads within physical cores */
+- cpumask_shift_left(hw_thread_mask, hw_thread_mask,
+- num_cores_per_socket *
+- node_affinity.num_online_nodes *
+- hw_thread_no);
++ for (; i < possible; i++) {
++ cpumask_clear_cpu(curr_cpu, hw_thread_mask);
++ curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
+ }
++
++ /* Identifying correct HW threads within physical cores */
++ cpumask_shift_left(hw_thread_mask, hw_thread_mask,
++ num_cores_per_socket *
++ node_affinity.num_online_nodes *
++ hw_thread_no);
+ }
+
+ int hfi1_get_proc_affinity(int node)
+--
+2.39.5
+
--- /dev/null
+From 3928df7b5920c95d0d1698031c423c75de4954d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 14:25:11 -0300
+Subject: remoteproc: imx_rproc: skip clock enable when M-core is managed by
+ the SCU
+
+From: Hiago De Franco <hiago.franco@toradex.com>
+
+[ Upstream commit 496deecb020d14ba89ba7084fbc3024f91687023 ]
+
+For the i.MX8X and i.MX8 family SoCs, when the Cortex-M core is powered
+up and started by the Cortex-A core using the bootloader (e.g., via the
+U-Boot bootaux command), both M-core and Linux run within the same SCFW
+(System Controller Firmware) partition. With that, Linux has permission
+to control the M-core.
+
+But once the M-core is started by the bootloader, the SCFW automatically
+enables its clock and sets the clock rate. If Linux later attempts to
+enable the same clock via clk_prepare_enable(), the SCFW returns a
+'LOCKED' error, as the clock is already configured by the SCFW. This
+causes the probe function in imx_rproc.c to fail, leading to the M-core
+power domain being shut down while the core is still running. This
+results in a fault from the SCU (System Controller Unit) and triggers a
+system reset.
+
+To address this issue, ignore handling the clk for i.MX8X and i.MX8
+M-core, as SCFW already takes care of enabling and configuring the
+clock.
+
+Suggested-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Hiago De Franco <hiago.franco@toradex.com>
+Acked-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20250629172512.14857-3-hiagofranco@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_rproc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
+index 74299af1d7f1..627e57a88db2 100644
+--- a/drivers/remoteproc/imx_rproc.c
++++ b/drivers/remoteproc/imx_rproc.c
+@@ -1029,8 +1029,8 @@ static int imx_rproc_clk_enable(struct imx_rproc *priv)
+ struct device *dev = priv->dev;
+ int ret;
+
+- /* Remote core is not under control of Linux */
+- if (dcfg->method == IMX_RPROC_NONE)
++ /* Remote core is not under control of Linux or it is managed by SCU API */
++ if (dcfg->method == IMX_RPROC_NONE || dcfg->method == IMX_RPROC_SCU_API)
+ return 0;
+
+ priv->clk = devm_clk_get(dev, NULL);
+--
+2.39.5
+
--- /dev/null
+From 890ac81e5475b6546525eebe4bdf2f69ebe80a1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:52:58 +0100
+Subject: reset: brcmstb: Enable reset drivers for ARCH_BCM2835
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 1d99f92f71b6b4b2eee776562c991428490f71ef ]
+
+The BRCMSTB and BRCMSTB_RESCAL reset drivers are also
+used in the BCM2712, AKA the RPi5. The RPi platforms
+have typically used the ARCH_BCM2835, and the PCIe
+support for this SoC can use this config which depends
+on these drivers so enable building them when just that
+arch option is enabled to ensure the platform works as
+expected.
+
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20250630175301.846082-1-pbrobinson@gmail.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/Kconfig | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
+index 99f6f9784e68..c9bbdc6ac382 100644
+--- a/drivers/reset/Kconfig
++++ b/drivers/reset/Kconfig
+@@ -51,8 +51,8 @@ config RESET_BERLIN
+
+ config RESET_BRCMSTB
+ tristate "Broadcom STB reset controller"
+- depends on ARCH_BRCMSTB || COMPILE_TEST
+- default ARCH_BRCMSTB
++ depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
++ default ARCH_BRCMSTB || ARCH_BCM2835
+ help
+ This enables the reset controller driver for Broadcom STB SoCs using
+ a SUN_TOP_CTRL_SW_INIT style controller.
+@@ -60,11 +60,11 @@ config RESET_BRCMSTB
+ config RESET_BRCMSTB_RESCAL
+ tristate "Broadcom STB RESCAL reset controller"
+ depends on HAS_IOMEM
+- depends on ARCH_BRCMSTB || COMPILE_TEST
+- default ARCH_BRCMSTB
++ depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
++ default ARCH_BRCMSTB || ARCH_BCM2835
+ help
+ This enables the RESCAL reset controller for SATA, PCIe0, or PCIe1 on
+- BCM7216.
++ BCM7216 or the BCM2712.
+
+ config RESET_EYEQ
+ bool "Mobileye EyeQ reset controller"
+--
+2.39.5
+
--- /dev/null
+From 0bead913f958dbeceb6a9eb4de02f15d9038f8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 11:14:16 -0700
+Subject: rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
+
+From: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
+
+[ Upstream commit 523923cfd5d622b8f4ba893fdaf29fa6adeb8c3e ]
+
+In using CONFIG_RTC_HCTOSYS, rtc_hctosys() will sync the RTC time to the
+kernel time as long as rtc_read_time() succeeds. In some power loss
+situations, our supercapacitor-backed DS1342 RTC comes up with either an
+unpredictable future time or the default 01/01/00 from the datasheet.
+The oscillator stop flag (OSF) is set in these scenarios due to the
+power loss and can be used to determine the validity of the RTC data.
+
+This change expands the oscillator stop flag (OSF) handling that has
+already been implemented for some chips to the ds1341 chip (DS1341 and
+DS1342 share a datasheet). This handling manages the validity of the RTC
+data in .read_time and .set_time based on the OSF.
+
+Signed-off-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
+Reviewed-by: Tyler Hicks <code@tyhicks.com>
+Acked-by: Rodolfo Giometti <giometti@enneenne.com>
+Link: https://lore.kernel.org/r/1749665656-30108-3-git-send-email-meaganlloyd@linux.microsoft.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1307.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index c8a666de9cbe..c6d388bb4a19 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -279,6 +279,13 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
+ if (tmp & DS1340_BIT_OSF)
+ return -EINVAL;
+ break;
++ case ds_1341:
++ ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp);
++ if (ret)
++ return ret;
++ if (tmp & DS1337_BIT_OSF)
++ return -EINVAL;
++ break;
+ case ds_1388:
+ ret = regmap_read(ds1307->regmap, DS1388_REG_FLAG, &tmp);
+ if (ret)
+@@ -377,6 +384,10 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t)
+ regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG,
+ DS1340_BIT_OSF, 0);
+ break;
++ case ds_1341:
++ regmap_update_bits(ds1307->regmap, DS1337_REG_STATUS,
++ DS1337_BIT_OSF, 0);
++ break;
+ case ds_1388:
+ regmap_update_bits(ds1307->regmap, DS1388_REG_FLAG,
+ DS1388_BIT_OSF, 0);
+--
+2.39.5
+
--- /dev/null
+From d77f4866dd62bed330d8052dce5cb31a50ad1a08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 11:14:15 -0700
+Subject: rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
+
+From: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
+
+[ Upstream commit 48458654659c9c2e149c211d86637f1592470da5 ]
+
+In using CONFIG_RTC_HCTOSYS, rtc_hctosys() will sync the RTC time to the
+kernel time as long as rtc_read_time() succeeds. In some power loss
+situations, our supercapacitor-backed DS1342 RTC comes up with either an
+unpredictable future time or the default 01/01/00 from the datasheet.
+The oscillator stop flag (OSF) is set in these scenarios due to the
+power loss and can be used to determine the validity of the RTC data.
+
+Some chip types in the ds1307 driver already have OSF handling to
+determine whether .read_time provides valid RTC data or returns -EINVAL.
+
+This change removes the clear of the OSF in .probe as the OSF needs to
+be preserved to expand the OSF handling to the ds1341 chip type (note
+that DS1341 and DS1342 share a datasheet).
+
+Signed-off-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
+Reviewed-by: Tyler Hicks <code@tyhicks.com>
+Acked-by: Rodolfo Giometti <giometti@enneenne.com>
+Link: https://lore.kernel.org/r/1749665656-30108-2-git-send-email-meaganlloyd@linux.microsoft.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1307.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index c6d388bb4a19..1960d1bd851c 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -1824,10 +1824,8 @@ static int ds1307_probe(struct i2c_client *client)
+ regmap_write(ds1307->regmap, DS1337_REG_CONTROL,
+ regs[0]);
+
+- /* oscillator fault? clear flag, and warn */
++ /* oscillator fault? warn */
+ if (regs[1] & DS1337_BIT_OSF) {
+- regmap_write(ds1307->regmap, DS1337_REG_STATUS,
+- regs[1] & ~DS1337_BIT_OSF);
+ dev_warn(ds1307->dev, "SET TIME!\n");
+ }
+ break;
+--
+2.39.5
+
--- /dev/null
+From ff157b89fe4d6e509cd56ec4df379c7253edf248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 21:21:12 +0200
+Subject: rv: Add #undef TRACE_INCLUDE_FILE
+
+From: Nam Cao <namcao@linutronix.de>
+
+[ Upstream commit 2d088762631b212eb0809e112642843844ef64eb ]
+
+Without "#undef TRACE_INCLUDE_FILE", there could be a build error due to
+TRACE_INCLUDE_FILE being redefined. Therefore add it.
+
+Also fix a typo while at it.
+
+Cc: John Ogness <john.ogness@linutronix.de>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://lore.kernel.org/f805e074581e927bb176c742c981fa7675b6ebe5.1752088709.git.namcao@linutronix.de
+Reviewed-by: Gabriele Monaco <gmonaco@redhat.com>
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/rv/rv_trace.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/trace/rv/rv_trace.h b/kernel/trace/rv/rv_trace.h
+index 422b75f58891..99c3801616d4 100644
+--- a/kernel/trace/rv/rv_trace.h
++++ b/kernel/trace/rv/rv_trace.h
+@@ -129,8 +129,9 @@ DECLARE_EVENT_CLASS(error_da_monitor_id,
+ #endif /* CONFIG_DA_MON_EVENTS_ID */
+ #endif /* _TRACE_RV_H */
+
+-/* This part ust be outside protection */
++/* This part must be outside protection */
+ #undef TRACE_INCLUDE_PATH
+ #define TRACE_INCLUDE_PATH .
++#undef TRACE_INCLUDE_FILE
+ #define TRACE_INCLUDE_FILE rv_trace
+ #include <trace/define_trace.h>
+--
+2.39.5
+
--- /dev/null
+From d6751726922bd29d93037c6dbcec0c0644dbbede Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 18:12:06 +0200
+Subject: s390/early: Copy last breaking event address to pt_regs
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 7cf636c99b257c1b4b12066ab34fd5f06e8d892f ]
+
+In case of an early crash the early program check handler also prints the
+last breaking event address which is contained within the pt_regs
+structure. However it is not initialized, and therefore a more or less
+random value is printed in case of a crash.
+
+Copy the last breaking event address from lowcore to pt_regs in case of an
+early program check to address this. This also makes it easier to analyze
+early crashes.
+
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/early.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index 54cf0923050f..9b4b5ccda323 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -154,6 +154,7 @@ void __init __do_early_pgm_check(struct pt_regs *regs)
+
+ regs->int_code = lc->pgm_int_code;
+ regs->int_parm_long = lc->trans_exc_code;
++ regs->last_break = lc->pgm_last_break;
+ ip = __rewind_psw(regs->psw, regs->int_code >> 16);
+
+ /* Monitor Event? Might be a warning */
+--
+2.39.5
+
--- /dev/null
+From dbb981d5f56a4b501e983bfe584a7f5c0d68cb52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 09:43:40 +0200
+Subject: s390/sclp: Use monotonic clock in sclp_sync_wait()
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+[ Upstream commit 925f0707a67cae0a974c4bd5b718f0263dc56824 ]
+
+sclp_sync_wait() should use the monotonic clock for the delay loop.
+Otherwise the code won't work correctly when the clock is changed.
+
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/char/sclp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
+index 840be75e75d4..9a55e2d04e63 100644
+--- a/drivers/s390/char/sclp.c
++++ b/drivers/s390/char/sclp.c
+@@ -719,7 +719,7 @@ sclp_sync_wait(void)
+ timeout = 0;
+ if (timer_pending(&sclp_request_timer)) {
+ /* Get timeout TOD value */
+- timeout = get_tod_clock_fast() +
++ timeout = get_tod_clock_monotonic() +
+ sclp_tod_from_jiffies(sclp_request_timer.expires -
+ jiffies);
+ }
+@@ -739,7 +739,7 @@ sclp_sync_wait(void)
+ /* Loop until driver state indicates finished request */
+ while (sclp_running_state != sclp_running_state_idle) {
+ /* Check for expired request timer */
+- if (get_tod_clock_fast() > timeout && timer_delete(&sclp_request_timer))
++ if (get_tod_clock_monotonic() > timeout && timer_delete(&sclp_request_timer))
+ sclp_request_timer.function(&sclp_request_timer);
+ cpu_relax();
+ }
+--
+2.39.5
+
--- /dev/null
+From e94f43169d63213d9d017630ecb5e1df6f631e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:50:27 +0200
+Subject: s390/stp: Remove udelay from stp_sync_clock()
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+[ Upstream commit b367017cdac21781a74eff4e208d3d38e1f38d3f ]
+
+When an stp sync check is handled on a system with multiple
+cpus each cpu gets a machine check but only the first one
+actually handles the sync operation. All other CPUs spin
+waiting for the first one to finish with a short udelay().
+But udelay can't be used here as the first CPU modifies tod_clock_base
+before performing the sync op. During this timeframe
+get_tod_clock_monotonic() might return a non-monotonic time.
+
+The time spent waiting should be very short and udelay is a busy loop
+anyways, therefore simply remove the udelay.
+
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
+index fed17d407a44..cb7ed55e24d2 100644
+--- a/arch/s390/kernel/time.c
++++ b/arch/s390/kernel/time.c
+@@ -580,7 +580,7 @@ static int stp_sync_clock(void *data)
+ atomic_dec(&sync->cpus);
+ /* Wait for in_sync to be set. */
+ while (READ_ONCE(sync->in_sync) == 0)
+- __udelay(1);
++ ;
+ }
+ if (sync->in_sync != 1)
+ /* Didn't work. Clear per-cpu in sync bit again. */
+--
+2.39.5
+
--- /dev/null
+From 8943fa9b56190f79c1da34e2f4d26d12564c1d62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 09:42:29 +0200
+Subject: s390/time: Use monotonic clock in get_cycles()
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+[ Upstream commit 09e7e29d2b49ba84bcefb3dc1657726d2de5bb24 ]
+
+Otherwise the code might not work correctly when the clock
+is changed.
+
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/timex.h | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index bed8d0b5a282..59dfb8780f62 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -196,13 +196,6 @@ static inline unsigned long get_tod_clock_fast(void)
+ asm volatile("stckf %0" : "=Q" (clk) : : "cc");
+ return clk;
+ }
+-
+-static inline cycles_t get_cycles(void)
+-{
+- return (cycles_t) get_tod_clock() >> 2;
+-}
+-#define get_cycles get_cycles
+-
+ int get_phys_clock(unsigned long *clock);
+ void init_cpu_timer(void);
+
+@@ -230,6 +223,12 @@ static inline unsigned long get_tod_clock_monotonic(void)
+ return tod;
+ }
+
++static inline cycles_t get_cycles(void)
++{
++ return (cycles_t)get_tod_clock_monotonic() >> 2;
++}
++#define get_cycles get_cycles
++
+ /**
+ * tod_to_ns - convert a TOD format value to nanoseconds
+ * @todval: to be converted TOD format value
+--
+2.39.5
+
--- /dev/null
+From e87bcc3e62879facfab6d4cf9be4953ded16e8c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 13:51:16 +0200
+Subject: sched/deadline: Fix accounting after global limits change
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit 440989c10f4e32620e9e2717ca52c3ed7ae11048 ]
+
+A global limits change (sched_rt_handler() logic) currently leaves stale
+and/or incorrect values in variables related to accounting (e.g.
+extra_bw).
+
+Properly clean up per runqueue variables before implementing the change
+and rebuild scheduling domains (so that accounting is also properly
+restored) after such a change is complete.
+
+Reported-by: Marcel Ziswiler <marcel.ziswiler@codethink.co.uk>
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Marcel Ziswiler <marcel.ziswiler@codethink.co.uk> # nuc & rock5b
+Link: https://lore.kernel.org/r/20250627115118.438797-4-juri.lelli@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 4 +++-
+ kernel/sched/rt.c | 6 ++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 65f3b2cc891d..d86b211f2c14 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -3249,6 +3249,9 @@ void sched_dl_do_global(void)
+ if (global_rt_runtime() != RUNTIME_INF)
+ new_bw = to_ratio(global_rt_period(), global_rt_runtime());
+
++ for_each_possible_cpu(cpu)
++ init_dl_rq_bw_ratio(&cpu_rq(cpu)->dl);
++
+ for_each_possible_cpu(cpu) {
+ rcu_read_lock_sched();
+
+@@ -3264,7 +3267,6 @@ void sched_dl_do_global(void)
+ raw_spin_unlock_irqrestore(&dl_b->lock, flags);
+
+ rcu_read_unlock_sched();
+- init_dl_rq_bw_ratio(&cpu_rq(cpu)->dl);
+ }
+ }
+
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index bfcb8b0a1e2c..41a216fec3ce 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2936,6 +2936,12 @@ static int sched_rt_handler(const struct ctl_table *table, int write, void *buff
+ sched_domains_mutex_unlock();
+ mutex_unlock(&mutex);
+
++ /*
++ * After changing maximum available bandwidth for DEADLINE, we need to
++ * recompute per root domain and per cpus variables accordingly.
++ */
++ rebuild_sched_domains();
++
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From defe0a08dc354a7e29824232a27072846e6e7106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 07:39:10 -0700
+Subject: sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
+
+From: Chris Mason <clm@fb.com>
+
+[ Upstream commit 155213a2aed42c85361bf4f5c817f5cb68951c3b ]
+
+schbench (https://github.com/masoncl/schbench.git) is showing a
+regression from previous production kernels that bisected down to:
+
+sched/fair: Remove sysctl_sched_migration_cost condition (c5b0a7eefc)
+
+The schbench command line was:
+
+schbench -L -m 4 -M auto -t 256 -n 0 -r 0 -s 0
+
+This creates 4 message threads pinned to CPUs 0-3, and 256x4 worker
+threads spread across the rest of the CPUs. Neither the worker threads
+or the message threads do any work, they just wake each other up and go
+back to sleep as soon as possible.
+
+The end result is the first 4 CPUs are pegged waking up those 1024
+workers, and the rest of the CPUs are constantly banging in and out of
+idle. If I take a v6.9 Linus kernel and revert that one commit,
+performance goes from 3.4M RPS to 5.4M RPS.
+
+schedstat shows there are ~100x more new idle balance operations, and
+profiling shows the worker threads are spending ~20% of their CPU time
+on new idle balance. schedstats also shows that almost all of these new
+idle balance attemps are failing to find busy groups.
+
+The fix used here is to crank up the cost of the newidle balance whenever it
+fails. Since we don't want sd->max_newidle_lb_cost to grow out of
+control, this also changes update_newidle_cost() to use
+sysctl_sched_migration_cost as the upper limit on max_newidle_lb_cost.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Vincent Guittot <vincent.guittot@linaro.org>
+Link: https://lkml.kernel.org/r/20250626144017.1510594-2-clm@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 138d9f4658d5..23264fe111e5 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -12170,8 +12170,14 @@ static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost)
+ /*
+ * Track max cost of a domain to make sure to not delay the
+ * next wakeup on the CPU.
++ *
++ * sched_balance_newidle() bumps the cost whenever newidle
++ * balance fails, and we don't want things to grow out of
++ * control. Use the sysctl_sched_migration_cost as the upper
++ * limit, plus a litle extra to avoid off by ones.
+ */
+- sd->max_newidle_lb_cost = cost;
++ sd->max_newidle_lb_cost =
++ min(cost, sysctl_sched_migration_cost + 200);
+ sd->last_decay_max_lb_cost = jiffies;
+ } else if (time_after(jiffies, sd->last_decay_max_lb_cost + HZ)) {
+ /*
+@@ -12863,10 +12869,17 @@ static int sched_balance_newidle(struct rq *this_rq, struct rq_flags *rf)
+
+ t1 = sched_clock_cpu(this_cpu);
+ domain_cost = t1 - t0;
+- update_newidle_cost(sd, domain_cost);
+-
+ curr_cost += domain_cost;
+ t0 = t1;
++
++ /*
++ * Failing newidle means it is not effective;
++ * bump the cost so we end up doing less of it.
++ */
++ if (!pulled_task)
++ domain_cost = (3 * sd->max_newidle_lb_cost) / 2;
++
++ update_newidle_cost(sd, domain_cost);
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From fcef468f1cbc108a370e8fe3acccd66b6f8a1459 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 11:15:35 +0000
+Subject: scsi: aacraid: Stop using PCI_IRQ_AFFINITY
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit dafeaf2c03e71255438ffe5a341d94d180e6c88e ]
+
+When PCI_IRQ_AFFINITY is set for calling pci_alloc_irq_vectors(), it
+means interrupts are spread around the available CPUs. It also means that
+the interrupts become managed, which means that an interrupt is shutdown
+when all the CPUs in the interrupt affinity mask go offline.
+
+Using managed interrupts in this way means that we should ensure that
+completions should not occur on HW queues where the associated interrupt
+is shutdown. This is typically achieved by ensuring only CPUs which are
+online can generate IO completion traffic to the HW queue which they are
+mapped to (so that they can also serve completion interrupts for that HW
+queue).
+
+The problem in the driver is that a CPU can generate completions to a HW
+queue whose interrupt may be shutdown, as the CPUs in the HW queue
+interrupt affinity mask may be offline. This can cause IOs to never
+complete and hang the system. The driver maintains its own CPU <-> HW
+queue mapping for submissions, see aac_fib_vector_assign(), but this does
+not reflect the CPU <-> HW queue interrupt affinity mapping.
+
+Commit 9dc704dcc09e ("scsi: aacraid: Reply queue mapping to CPUs based on
+IRQ affinity") tried to remedy this issue may mapping CPUs properly to HW
+queue interrupts. However this was later reverted in commit c5becf57dd56
+("Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ
+affinity") - it seems that there were other reports of hangs. I guess
+that this was due to some implementation issue in the original commit or
+maybe a HW issue.
+
+Fix the very original hang by just not using managed interrupts by not
+setting PCI_IRQ_AFFINITY. In this way, all CPUs will be in each HW queue
+affinity mask, so should not create completion problems if any CPUs go
+offline.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20250715111535.499853-1-john.g.garry@oracle.com
+Closes: https://lore.kernel.org/linux-scsi/20250618192427.3845724-1-jmeneghi@redhat.com/
+Reviewed-by: John Meneghini <jmeneghi@redhat.com>
+Tested-by: John Meneghini <jmeneghi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aacraid/comminit.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
+index 28cf18955a08..726c8531b7d3 100644
+--- a/drivers/scsi/aacraid/comminit.c
++++ b/drivers/scsi/aacraid/comminit.c
+@@ -481,8 +481,7 @@ void aac_define_int_mode(struct aac_dev *dev)
+ pci_find_capability(dev->pdev, PCI_CAP_ID_MSIX)) {
+ min_msix = 2;
+ i = pci_alloc_irq_vectors(dev->pdev,
+- min_msix, msi_count,
+- PCI_IRQ_MSIX | PCI_IRQ_AFFINITY);
++ min_msix, msi_count, PCI_IRQ_MSIX);
+ if (i > 0) {
+ dev->msi_enabled = 1;
+ msi_count = i;
+--
+2.39.5
+
--- /dev/null
+From 2c769246ce75da3a0f0f873b535efdb41dba18b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 19:58:24 +0800
+Subject: scsi: bfa: Double-free fix
+
+From: jackysliu <1972843537@qq.com>
+
+[ Upstream commit add4c4850363d7c1b72e8fce9ccb21fdd2cf5dc9 ]
+
+When the bfad_im_probe() function fails during initialization, the memory
+pointed to by bfad->im is freed without setting bfad->im to NULL.
+
+Subsequently, during driver uninstallation, when the state machine enters
+the bfad_sm_stopping state and calls the bfad_im_probe_undo() function,
+it attempts to free the memory pointed to by bfad->im again, thereby
+triggering a double-free vulnerability.
+
+Set bfad->im to NULL if probing fails.
+
+Signed-off-by: jackysliu <1972843537@qq.com>
+Link: https://lore.kernel.org/r/tencent_3BB950D6D2D470976F55FC879206DE0B9A09@qq.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bfa/bfad_im.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
+index a719a18f0fbc..f56e008ee52b 100644
+--- a/drivers/scsi/bfa/bfad_im.c
++++ b/drivers/scsi/bfa/bfad_im.c
+@@ -706,6 +706,7 @@ bfad_im_probe(struct bfad_s *bfad)
+
+ if (bfad_thread_workq(bfad) != BFA_STATUS_OK) {
+ kfree(im);
++ bfad->im = NULL;
+ return BFA_STATUS_FAILED;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 3a4790c8e15363582e3b7d7f4a4ebe61139c0644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 11:46:49 +0530
+Subject: scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 37c4e72b0651e7697eb338cd1fb09feef472cc1a ]
+
+sas_user_scan() did not fully process wildcard channel scans
+(SCAN_WILD_CARD) when a transport-specific user_scan() callback was
+present. Only channel 0 would be scanned via user_scan(), while the
+remaining channels were skipped, potentially missing devices.
+
+user_scan() invokes updated sas_user_scan() for channel 0, and if
+successful, iteratively scans remaining channels (1 to
+shost->max_channel) via scsi_scan_host_selected(). This ensures complete
+wildcard scanning without affecting transport-specific scanning behavior.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Link: https://lore.kernel.org/r/20250624061649.17990-1-ranjan.kumar@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_scan.c | 2 +-
+ drivers/scsi/scsi_transport_sas.c | 60 ++++++++++++++++++++++++-------
+ 2 files changed, 49 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 4833b8fe251b..396fcf194b6b 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1899,7 +1899,7 @@ int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel,
+
+ return 0;
+ }
+-
++EXPORT_SYMBOL(scsi_scan_host_selected);
+ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
+ {
+ struct scsi_device *sdev;
+diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
+index 351b028ef893..d69c7c444a31 100644
+--- a/drivers/scsi/scsi_transport_sas.c
++++ b/drivers/scsi/scsi_transport_sas.c
+@@ -40,6 +40,8 @@
+ #include <scsi/scsi_transport_sas.h>
+
+ #include "scsi_sas_internal.h"
++#include "scsi_priv.h"
++
+ struct sas_host_attrs {
+ struct list_head rphy_list;
+ struct mutex lock;
+@@ -1683,32 +1685,66 @@ int scsi_is_sas_rphy(const struct device *dev)
+ }
+ EXPORT_SYMBOL(scsi_is_sas_rphy);
+
+-
+-/*
+- * SCSI scan helper
+- */
+-
+-static int sas_user_scan(struct Scsi_Host *shost, uint channel,
+- uint id, u64 lun)
++static void scan_channel_zero(struct Scsi_Host *shost, uint id, u64 lun)
+ {
+ struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
+ struct sas_rphy *rphy;
+
+- mutex_lock(&sas_host->lock);
+ list_for_each_entry(rphy, &sas_host->rphy_list, list) {
+ if (rphy->identify.device_type != SAS_END_DEVICE ||
+ rphy->scsi_target_id == -1)
+ continue;
+
+- if ((channel == SCAN_WILD_CARD || channel == 0) &&
+- (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
++ if (id == SCAN_WILD_CARD || id == rphy->scsi_target_id) {
+ scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id,
+ lun, SCSI_SCAN_MANUAL);
+ }
+ }
+- mutex_unlock(&sas_host->lock);
++}
+
+- return 0;
++/*
++ * SCSI scan helper
++ */
++
++static int sas_user_scan(struct Scsi_Host *shost, uint channel,
++ uint id, u64 lun)
++{
++ struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
++ int res = 0;
++ int i;
++
++ switch (channel) {
++ case 0:
++ mutex_lock(&sas_host->lock);
++ scan_channel_zero(shost, id, lun);
++ mutex_unlock(&sas_host->lock);
++ break;
++
++ case SCAN_WILD_CARD:
++ mutex_lock(&sas_host->lock);
++ scan_channel_zero(shost, id, lun);
++ mutex_unlock(&sas_host->lock);
++
++ for (i = 1; i <= shost->max_channel; i++) {
++ res = scsi_scan_host_selected(shost, i, id, lun,
++ SCSI_SCAN_MANUAL);
++ if (res)
++ goto exit_scan;
++ }
++ break;
++
++ default:
++ if (channel < shost->max_channel) {
++ res = scsi_scan_host_selected(shost, channel, id, lun,
++ SCSI_SCAN_MANUAL);
++ } else {
++ res = -EINVAL;
++ }
++ break;
++ }
++
++exit_scan:
++ return res;
+ }
+
+
+--
+2.39.5
+
--- /dev/null
+From 70925a8a6870f58df08b91bfcc7a5b8f1f78c6f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 16:53:29 +0530
+Subject: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is
+ allocated
+
+From: Showrya M N <showrya@chelsio.com>
+
+[ Upstream commit 3ea3a256ed81f95ab0f3281a0e234b01a9cae605 ]
+
+In case of an ib_fast_reg_mr allocation failure during iSER setup, the
+machine hits a panic because iscsi_conn->dd_data is initialized
+unconditionally, even when no memory is allocated (dd_size == 0). This
+leads invalid pointer dereference during connection teardown.
+
+Fix by setting iscsi_conn->dd_data only if memory is actually allocated.
+
+Panic trace:
+------------
+ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12
+ iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers
+ BUG: unable to handle page fault for address: fffffffffffffff8
+ RIP: 0010:swake_up_locked.part.5+0xa/0x40
+ Call Trace:
+ complete+0x31/0x40
+ iscsi_iser_conn_stop+0x88/0xb0 [ib_iser]
+ iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi]
+ iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi]
+ iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi]
+ ? netlink_lookup+0x12f/0x1b0
+ ? netlink_deliver_tap+0x2c/0x200
+ netlink_unicast+0x1ab/0x280
+ netlink_sendmsg+0x257/0x4f0
+ ? _copy_from_user+0x29/0x60
+ sock_sendmsg+0x5f/0x70
+
+Signed-off-by: Showrya M N <showrya@chelsio.com>
+Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Link: https://lore.kernel.org/r/20250627112329.19763-1-showrya@chelsio.com
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 1ddaf7228340..09d5724db32a 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -3184,7 +3184,8 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
+ return NULL;
+ conn = cls_conn->dd_data;
+
+- conn->dd_data = cls_conn->dd_data + sizeof(*conn);
++ if (dd_size)
++ conn->dd_data = cls_conn->dd_data + sizeof(*conn);
+ conn->session = session;
+ conn->cls_conn = cls_conn;
+ conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
+--
+2.39.5
+
--- /dev/null
+From 28996f810a27d949950d6e6c88ac8207ba05565e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 12:21:28 -0700
+Subject: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport
+ structure
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 6698796282e828733cde3329c887b4ae9e5545e9 ]
+
+If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the
+resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may
+occur before sli4_hba.hdwqs are allocated. This may result in a null
+pointer dereference when attempting to take the abts_io_buf_list_lock for
+the first hardware queue. Fix by adding a null ptr check on
+phba->sli4_hba.hdwq and early return because this situation means there
+must have been an error during port initialization.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20250618192138.124116-4-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 9edf80b14b1a..8862343aae55 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -390,6 +390,10 @@ lpfc_sli4_vport_delete_fcp_xri_aborted(struct lpfc_vport *vport)
+ if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_FCP))
+ return;
+
++ /* may be called before queues established if hba_setup fails */
++ if (!phba->sli4_hba.hdwq)
++ return;
++
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ for (idx = 0; idx < phba->cfg_hdw_queue; idx++) {
+ qp = &phba->sli4_hba.hdwq[idx];
+--
+2.39.5
+
--- /dev/null
+From f95f0e8e257393f3f2559153704dd78f15bc7b33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 12:21:33 -0700
+Subject: scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
+ dev_loss_tmo_callbk
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 1cced5779e7a3ff7ec025fc47c76a7bd3bb38877 ]
+
+For SLI3, the HBA_SETUP flag is never set so the lpfc_dev_loss_tmo_callbk
+always early returns. Add a phba->sli_rev check for SLI4 mode so that
+the SLI3 path can flow through the original dev_loss_tmo worker thread
+design to lpfc_dev_loss_tmo_handler instead of early return.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20250618192138.124116-9-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index c256c3edd663..97263b8e1bf8 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -183,7 +183,8 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)
+
+ /* Don't schedule a worker thread event if the vport is going down. */
+ if (test_bit(FC_UNLOADING, &vport->load_flag) ||
+- !test_bit(HBA_SETUP, &phba->hba_flag)) {
++ (phba->sli_rev == LPFC_SLI_REV4 &&
++ !test_bit(HBA_SETUP, &phba->hba_flag))) {
+
+ spin_lock_irqsave(&ndlp->lock, iflags);
+ ndlp->rport = NULL;
+--
+2.39.5
+
--- /dev/null
+From 7e2678fc19536fffbb85a9b112b0a381034bc752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 14:27:46 +0900
+Subject: scsi: mpi3mr: Correctly handle ATA device errors
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 04caad5a7ba86e830d04750417a15bad8ac2613c ]
+
+With the ATA error model, an NCQ command failure always triggers an abort
+(termination) of all NCQ commands queued on the device. In such case, the
+SAT or the host must handle the failed command according to the command
+sense data and immediately retry all other NCQ commands that were aborted
+due to the failed NCQ command.
+
+For SAS HBAs controlled by the mpi3mr driver, NCQ command aborts are not
+handled by the HBA SAT and sent back to the host, with an ioc log
+information equal to 0x31080000 (IOC_LOGINFO_PREFIX_PL with the PL code
+PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR). The function
+mpi3mr_process_op_reply_desc() always forces a retry of commands
+terminated with the status MPI3_IOCSTATUS_SCSI_IOC_TERMINATED using the
+SCSI result DID_SOFT_ERROR, regardless of the ioc_loginfo for the
+command. This correctly forces the retry of collateral NCQ abort
+commands, but with the retry counter for the command being incremented.
+If a command to an ATA device is subject to too many retries due to other
+NCQ commands failing (e.g. read commands trying to access unreadable
+sectors), the collateral NCQ abort commands may be terminated with an
+error as they run out of retries. This violates the SAT specification and
+causes hard-to-debug command errors.
+
+Solve this issue by modifying the handling of the
+MPI3_IOCSTATUS_SCSI_IOC_TERMINATED status to check if a command is for an
+ATA device and if the command ioc_loginfo indicates an NCQ collateral
+abort. If that is the case, force the command retry using the SCSI result
+DID_IMM_RETRY to avoid incrementing the command retry count.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250606052747.742998-2-dlemoal@kernel.org
+Tested-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index c186b892150f..5ecea2c7584f 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -49,6 +49,13 @@ static void mpi3mr_send_event_ack(struct mpi3mr_ioc *mrioc, u8 event,
+
+ #define MPI3_EVENT_WAIT_FOR_DEVICES_TO_REFRESH (0xFFFE)
+
++/*
++ * SAS Log info code for a NCQ collateral abort after an NCQ error:
++ * IOC_LOGINFO_PREFIX_PL | PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR
++ * See: drivers/message/fusion/lsi/mpi_log_sas.h
++ */
++#define IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR 0x31080000
++
+ /**
+ * mpi3mr_host_tag_for_scmd - Get host tag for a scmd
+ * @mrioc: Adapter instance reference
+@@ -3397,7 +3404,18 @@ void mpi3mr_process_op_reply_desc(struct mpi3mr_ioc *mrioc,
+ scmd->result = DID_NO_CONNECT << 16;
+ break;
+ case MPI3_IOCSTATUS_SCSI_IOC_TERMINATED:
+- scmd->result = DID_SOFT_ERROR << 16;
++ if (ioc_loginfo == IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR) {
++ /*
++ * This is a ATA NCQ command aborted due to another NCQ
++ * command failure. We must retry this command
++ * immediately but without incrementing its retry
++ * counter.
++ */
++ WARN_ON_ONCE(xfer_count != 0);
++ scmd->result = DID_IMM_RETRY << 16;
++ } else {
++ scmd->result = DID_SOFT_ERROR << 16;
++ }
+ break;
+ case MPI3_IOCSTATUS_SCSI_TASK_TERMINATED:
+ case MPI3_IOCSTATUS_SCSI_EXT_TERMINATED:
+--
+2.39.5
+
--- /dev/null
+From a61b7370df828597d0beb7d0b50c514ec746c35c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 14:27:47 +0900
+Subject: scsi: mpt3sas: Correctly handle ATA device errors
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 15592a11d5a5c8411ac8494ec49736b658f6fbff ]
+
+With the ATA error model, an NCQ command failure always triggers an abort
+(termination) of all NCQ commands queued on the device. In such case, the
+SAT or the host must handle the failed command according to the command
+sense data and immediately retry all other NCQ commands that were aborted
+due to the failed NCQ command.
+
+For SAS HBAs controlled by the mpt3sas driver, NCQ command aborts are not
+handled by the HBA SAT and sent back to the host, with an ioc log
+information equal to 0x31080000 (IOC_LOGINFO_PREFIX_PL with the PL code
+PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR). The function
+_scsih_io_done() always forces a retry of commands terminated with the
+status MPI2_IOCSTATUS_SCSI_IOC_TERMINATED using the SCSI result
+DID_SOFT_ERROR, regardless of the log_info for the command. This
+correctly forces the retry of collateral NCQ abort commands, but with the
+retry counter for the command being incremented. If a command to an ATA
+device is subject to too many retries due to other NCQ commands failing
+(e.g. read commands trying to access unreadable sectors), the collateral
+NCQ abort commands may be terminated with an error as they run out of
+retries. This violates the SAT specification and causes hard-to-debug
+command errors.
+
+Solve this issue by modifying the handling of the
+MPI2_IOCSTATUS_SCSI_IOC_TERMINATED status to check if a command is for an
+ATA device and if the command loginfo indicates an NCQ collateral
+abort. If that is the case, force the command retry using the SCSI result
+DID_IMM_RETRY to avoid incrementing the command retry count.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250606052747.742998-3-dlemoal@kernel.org
+Tested-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 0f900ddb3047..967af259118e 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -195,6 +195,14 @@ struct sense_info {
+ #define MPT3SAS_PORT_ENABLE_COMPLETE (0xFFFD)
+ #define MPT3SAS_ABRT_TASK_SET (0xFFFE)
+ #define MPT3SAS_REMOVE_UNRESPONDING_DEVICES (0xFFFF)
++
++/*
++ * SAS Log info code for a NCQ collateral abort after an NCQ error:
++ * IOC_LOGINFO_PREFIX_PL | PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR
++ * See: drivers/message/fusion/lsi/mpi_log_sas.h
++ */
++#define IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR 0x31080000
++
+ /**
+ * struct fw_event_work - firmware event struct
+ * @list: link list framework
+@@ -5814,6 +5822,17 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
+ scmd->result = DID_TRANSPORT_DISRUPTED << 16;
+ goto out;
+ }
++ if (log_info == IOC_LOGINFO_SATA_NCQ_FAIL_AFTER_ERR) {
++ /*
++ * This is a ATA NCQ command aborted due to another NCQ
++ * command failure. We must retry this command
++ * immediately but without incrementing its retry
++ * counter.
++ */
++ WARN_ON_ONCE(xfer_cnt != 0);
++ scmd->result = DID_IMM_RETRY << 16;
++ break;
++ }
+ if (log_info == 0x31110630) {
+ if (scmd->retries > 2) {
+ scmd->result = DID_NO_CONNECT << 16;
+--
+2.39.5
+
--- /dev/null
+From 7d1ab5d53ee1527d5d58071e1565c48829e0dad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jun 2025 21:04:43 +0000
+Subject: scsi: pm80xx: Free allocated tags after failure
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit 258a0a19621793b811356fc9d1849f950629d669 ]
+
+This change frees resources after an error is detected.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250617210443.989058-1-frankramirez@google.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 5b373c53c036..c4074f062d93 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4677,8 +4677,12 @@ pm80xx_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+ &pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
+ payload.sas_identify.phy_id = phy_id;
+
+- return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
++ ret = pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+ sizeof(payload), 0);
++ if (ret < 0)
++ pm8001_tag_free(pm8001_ha, tag);
++
++ return ret;
+ }
+
+ /**
+@@ -4704,8 +4708,12 @@ static int pm80xx_chip_phy_stop_req(struct pm8001_hba_info *pm8001_ha,
+ payload.tag = cpu_to_le32(tag);
+ payload.phy_id = cpu_to_le32(phy_id);
+
+- return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
++ ret = pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+ sizeof(payload), 0);
++ if (ret < 0)
++ pm8001_tag_free(pm8001_ha, tag);
++
++ return ret;
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From 5e1c722fb7fbdde2dd118e9d0ce305cc5ccb5bc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 15:37:38 +0200
+Subject: scsi: target: core: Generate correct identifiers for PR OUT transport
+ IDs
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 6e0f6aa44b68335df404a2df955055f416b5f2aa ]
+
+Fix target_parse_pr_out_transport_id() to return a string representing
+the transport ID in a human-readable format (e.g., naa.xxxxxxxx...) for
+various SCSI protocol types (SAS, FCP, SRP, SBP).
+
+Previously, the function returned a pointer to the raw binary buffer,
+which was incorrectly compared against human-readable strings, causing
+comparisons to fail. Now, the function writes a properly formatted
+string into a buffer provided by the caller. The output format depends
+on the transport protocol:
+
+* SAS: 64-bit identifier, "naa." prefix.
+* FCP: 64-bit identifier, colon separated values.
+* SBP: 64-bit identifier, no prefix.
+* SRP: 128-bit identifier, "0x" prefix.
+* iSCSI: IQN string.
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Link: https://lore.kernel.org/r/20250714133738.11054-1-mlombard@redhat.com
+Reviewed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_fabric_lib.c | 63 +++++++++++++++++++------
+ drivers/target/target_core_internal.h | 4 +-
+ drivers/target/target_core_pr.c | 18 +++----
+ 3 files changed, 60 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
+index 43f47e3aa448..ec7bc6e30228 100644
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -257,11 +257,41 @@ static int iscsi_get_pr_transport_id_len(
+ return len;
+ }
+
+-static char *iscsi_parse_pr_out_transport_id(
++static void sas_parse_pr_out_transport_id(char *buf, char *i_str)
++{
++ char hex[17] = {};
++
++ bin2hex(hex, buf + 4, 8);
++ snprintf(i_str, TRANSPORT_IQN_LEN, "naa.%s", hex);
++}
++
++static void srp_parse_pr_out_transport_id(char *buf, char *i_str)
++{
++ char hex[33] = {};
++
++ bin2hex(hex, buf + 8, 16);
++ snprintf(i_str, TRANSPORT_IQN_LEN, "0x%s", hex);
++}
++
++static void fcp_parse_pr_out_transport_id(char *buf, char *i_str)
++{
++ snprintf(i_str, TRANSPORT_IQN_LEN, "%8phC", buf + 8);
++}
++
++static void sbp_parse_pr_out_transport_id(char *buf, char *i_str)
++{
++ char hex[17] = {};
++
++ bin2hex(hex, buf + 8, 8);
++ snprintf(i_str, TRANSPORT_IQN_LEN, "%s", hex);
++}
++
++static bool iscsi_parse_pr_out_transport_id(
+ struct se_portal_group *se_tpg,
+ char *buf,
+ u32 *out_tid_len,
+- char **port_nexus_ptr)
++ char **port_nexus_ptr,
++ char *i_str)
+ {
+ char *p;
+ int i;
+@@ -282,7 +312,7 @@ static char *iscsi_parse_pr_out_transport_id(
+ if ((format_code != 0x00) && (format_code != 0x40)) {
+ pr_err("Illegal format code: 0x%02x for iSCSI"
+ " Initiator Transport ID\n", format_code);
+- return NULL;
++ return false;
+ }
+ /*
+ * If the caller wants the TransportID Length, we set that value for the
+@@ -306,7 +336,7 @@ static char *iscsi_parse_pr_out_transport_id(
+ pr_err("Unable to locate \",i,0x\" separator"
+ " for Initiator port identifier: %s\n",
+ &buf[4]);
+- return NULL;
++ return false;
+ }
+ *p = '\0'; /* Terminate iSCSI Name */
+ p += 5; /* Skip over ",i,0x" separator */
+@@ -339,7 +369,8 @@ static char *iscsi_parse_pr_out_transport_id(
+ } else
+ *port_nexus_ptr = NULL;
+
+- return &buf[4];
++ strscpy(i_str, &buf[4], TRANSPORT_IQN_LEN);
++ return true;
+ }
+
+ int target_get_pr_transport_id_len(struct se_node_acl *nacl,
+@@ -387,33 +418,35 @@ int target_get_pr_transport_id(struct se_node_acl *nacl,
+ }
+ }
+
+-const char *target_parse_pr_out_transport_id(struct se_portal_group *tpg,
+- char *buf, u32 *out_tid_len, char **port_nexus_ptr)
++bool target_parse_pr_out_transport_id(struct se_portal_group *tpg,
++ char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str)
+ {
+- u32 offset;
+-
+ switch (tpg->proto_id) {
+ case SCSI_PROTOCOL_SAS:
+ /*
+ * Assume the FORMAT CODE 00b from spc4r17, 7.5.4.7 TransportID
+ * for initiator ports using SCSI over SAS Serial SCSI Protocol.
+ */
+- offset = 4;
++ sas_parse_pr_out_transport_id(buf, i_str);
+ break;
+- case SCSI_PROTOCOL_SBP:
+ case SCSI_PROTOCOL_SRP:
++ srp_parse_pr_out_transport_id(buf, i_str);
++ break;
+ case SCSI_PROTOCOL_FCP:
+- offset = 8;
++ fcp_parse_pr_out_transport_id(buf, i_str);
++ break;
++ case SCSI_PROTOCOL_SBP:
++ sbp_parse_pr_out_transport_id(buf, i_str);
+ break;
+ case SCSI_PROTOCOL_ISCSI:
+ return iscsi_parse_pr_out_transport_id(tpg, buf, out_tid_len,
+- port_nexus_ptr);
++ port_nexus_ptr, i_str);
+ default:
+ pr_err("Unknown proto_id: 0x%02x\n", tpg->proto_id);
+- return NULL;
++ return false;
+ }
+
+ *port_nexus_ptr = NULL;
+ *out_tid_len = 24;
+- return buf + offset;
++ return true;
+ }
+diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
+index 408be26d2e9b..20aab1f50565 100644
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -103,8 +103,8 @@ int target_get_pr_transport_id_len(struct se_node_acl *nacl,
+ int target_get_pr_transport_id(struct se_node_acl *nacl,
+ struct t10_pr_registration *pr_reg, int *format_code,
+ unsigned char *buf);
+-const char *target_parse_pr_out_transport_id(struct se_portal_group *tpg,
+- char *buf, u32 *out_tid_len, char **port_nexus_ptr);
++bool target_parse_pr_out_transport_id(struct se_portal_group *tpg,
++ char *buf, u32 *out_tid_len, char **port_nexus_ptr, char *i_str);
+
+ /* target_core_hba.c */
+ struct se_hba *core_alloc_hba(const char *, u32, u32);
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 70905805cb17..83e172c92238 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -1478,11 +1478,12 @@ core_scsi3_decode_spec_i_port(
+ LIST_HEAD(tid_dest_list);
+ struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp;
+ unsigned char *buf, *ptr, proto_ident;
+- const unsigned char *i_str = NULL;
++ unsigned char i_str[TRANSPORT_IQN_LEN];
+ char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN];
+ sense_reason_t ret;
+ u32 tpdl, tid_len = 0;
+ u32 dest_rtpi = 0;
++ bool tid_found;
+
+ /*
+ * Allocate a struct pr_transport_id_holder and setup the
+@@ -1571,9 +1572,9 @@ core_scsi3_decode_spec_i_port(
+ dest_rtpi = tmp_lun->lun_tpg->tpg_rtpi;
+
+ iport_ptr = NULL;
+- i_str = target_parse_pr_out_transport_id(tmp_tpg,
+- ptr, &tid_len, &iport_ptr);
+- if (!i_str)
++ tid_found = target_parse_pr_out_transport_id(tmp_tpg,
++ ptr, &tid_len, &iport_ptr, i_str);
++ if (!tid_found)
+ continue;
+ /*
+ * Determine if this SCSI device server requires that
+@@ -3153,13 +3154,14 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key,
+ struct t10_pr_registration *pr_reg, *pr_res_holder, *dest_pr_reg;
+ struct t10_reservation *pr_tmpl = &dev->t10_pr;
+ unsigned char *buf;
+- const unsigned char *initiator_str;
++ unsigned char initiator_str[TRANSPORT_IQN_LEN];
+ char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN] = { };
+ u32 tid_len, tmp_tid_len;
+ int new_reg = 0, type, scope, matching_iname;
+ sense_reason_t ret;
+ unsigned short rtpi;
+ unsigned char proto_ident;
++ bool tid_found;
+
+ if (!se_sess || !se_lun) {
+ pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
+@@ -3278,9 +3280,9 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key,
+ ret = TCM_INVALID_PARAMETER_LIST;
+ goto out;
+ }
+- initiator_str = target_parse_pr_out_transport_id(dest_se_tpg,
+- &buf[24], &tmp_tid_len, &iport_ptr);
+- if (!initiator_str) {
++ tid_found = target_parse_pr_out_transport_id(dest_se_tpg,
++ &buf[24], &tmp_tid_len, &iport_ptr, initiator_str);
++ if (!tid_found) {
+ pr_err("SPC-3 PR REGISTER_AND_MOVE: Unable to locate"
+ " initiator_str from Transport ID\n");
+ ret = TCM_INVALID_PARAMETER_LIST;
+--
+2.39.5
+
--- /dev/null
+From d2ba6ef49a936e55e3996d546a2bf8283d7cc2cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 23:38:01 -0400
+Subject: securityfs: don't pin dentries twice, once is enough...
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 27cd1bf1240d482e4f02ca4f9812e748f3106e4f ]
+
+incidentally, securityfs_recursive_remove() is broken without that -
+it leaks dentries, since simple_recursive_removal() does not expect
+anything of that sort. It could be worked around by dput() in
+remove_one() callback, but it's easier to just drop that double-get
+stuff.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/inode.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/security/inode.c b/security/inode.c
+index da3ab44c8e57..58cc60c50498 100644
+--- a/security/inode.c
++++ b/security/inode.c
+@@ -159,7 +159,6 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode,
+ inode->i_fop = fops;
+ }
+ d_instantiate(dentry, inode);
+- dget(dentry);
+ inode_unlock(dir);
+ return dentry;
+
+@@ -306,7 +305,6 @@ void securityfs_remove(struct dentry *dentry)
+ simple_rmdir(dir, dentry);
+ else
+ simple_unlink(dir, dentry);
+- dput(dentry);
+ }
+ inode_unlock(dir);
+ simple_release_fs(&mount, &mount_count);
+--
+2.39.5
+
--- /dev/null
+From b7f82d921ac85ec09aa22fd83f734a73a561e1e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 18:36:26 -0700
+Subject: selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit bbc7bd658ddc662083639b9e9a280b90225ecd9a ]
+
+The ringbuf max_entries must be PAGE_ALIGNED. See kernel function
+ringbuf_map_alloc(). So for arm64 64KB page size, adjust max_entries
+properly.
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250607013626.1553001-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/user_ringbuf.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
+index d424e7ecbd12..9fd3ae987321 100644
+--- a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
++++ b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
+@@ -21,8 +21,7 @@
+ #include "../progs/test_user_ringbuf.h"
+
+ static const long c_sample_size = sizeof(struct sample) + BPF_RINGBUF_HDR_SZ;
+-static const long c_ringbuf_size = 1 << 12; /* 1 small page */
+-static const long c_max_entries = c_ringbuf_size / c_sample_size;
++static long c_ringbuf_size, c_max_entries;
+
+ static void drain_current_samples(void)
+ {
+@@ -424,7 +423,9 @@ static void test_user_ringbuf_loop(void)
+ uint32_t remaining_samples = total_samples;
+ int err;
+
+- BUILD_BUG_ON(total_samples <= c_max_entries);
++ if (!ASSERT_LT(c_max_entries, total_samples, "compare_c_max_entries"))
++ return;
++
+ err = load_skel_create_user_ringbuf(&skel, &ringbuf);
+ if (err)
+ return;
+@@ -686,6 +687,9 @@ void test_user_ringbuf(void)
+ {
+ int i;
+
++ c_ringbuf_size = getpagesize(); /* 1 page */
++ c_max_entries = c_ringbuf_size / c_sample_size;
++
+ for (i = 0; i < ARRAY_SIZE(success_tests); i++) {
+ if (!test__start_subtest(success_tests[i].test_name))
+ continue;
+--
+2.39.5
+
--- /dev/null
+From aa8c3c0cb781cc0affe1b215e896313c740b9465 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 18:36:21 -0700
+Subject: selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB
+ page size
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 8c8c5e3c854a2593ec90dacd868f3066b67de1c4 ]
+
+The ringbuf max_entries must be PAGE_ALIGNED. See kernel function
+ringbuf_map_alloc(). So for arm64 64KB page size, adjust max_entries
+and other related metrics properly.
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250607013621.1552332-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/ringbuf.c | 4 ++--
+ tools/testing/selftests/bpf/progs/test_ringbuf_write.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/ringbuf.c b/tools/testing/selftests/bpf/prog_tests/ringbuf.c
+index da430df45aa4..d1e4cb28a72c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/ringbuf.c
++++ b/tools/testing/selftests/bpf/prog_tests/ringbuf.c
+@@ -97,7 +97,7 @@ static void ringbuf_write_subtest(void)
+ if (!ASSERT_OK_PTR(skel, "skel_open"))
+ return;
+
+- skel->maps.ringbuf.max_entries = 0x4000;
++ skel->maps.ringbuf.max_entries = 0x40000;
+
+ err = test_ringbuf_write_lskel__load(skel);
+ if (!ASSERT_OK(err, "skel_load"))
+@@ -108,7 +108,7 @@ static void ringbuf_write_subtest(void)
+ mmap_ptr = mmap(NULL, page_size, PROT_READ | PROT_WRITE, MAP_SHARED, rb_fd, 0);
+ if (!ASSERT_OK_PTR(mmap_ptr, "rw_cons_pos"))
+ goto cleanup;
+- *mmap_ptr = 0x3000;
++ *mmap_ptr = 0x30000;
+ ASSERT_OK(munmap(mmap_ptr, page_size), "unmap_rw");
+
+ skel->bss->pid = getpid();
+diff --git a/tools/testing/selftests/bpf/progs/test_ringbuf_write.c b/tools/testing/selftests/bpf/progs/test_ringbuf_write.c
+index 350513c0e4c9..f063a0013f85 100644
+--- a/tools/testing/selftests/bpf/progs/test_ringbuf_write.c
++++ b/tools/testing/selftests/bpf/progs/test_ringbuf_write.c
+@@ -26,11 +26,11 @@ int test_ringbuf_write(void *ctx)
+ if (cur_pid != pid)
+ return 0;
+
+- sample1 = bpf_ringbuf_reserve(&ringbuf, 0x3000, 0);
++ sample1 = bpf_ringbuf_reserve(&ringbuf, 0x30000, 0);
+ if (!sample1)
+ return 0;
+ /* first one can pass */
+- sample2 = bpf_ringbuf_reserve(&ringbuf, 0x3000, 0);
++ sample2 = bpf_ringbuf_reserve(&ringbuf, 0x30000, 0);
+ if (!sample2) {
+ bpf_ringbuf_discard(sample1, 0);
+ __sync_fetch_and_add(&discarded, 1);
+--
+2.39.5
+
--- /dev/null
+From 0fe6a041c5306365aebec3a748fbb0b83a837426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 18:36:30 +0800
+Subject: selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit
+ time_t
+
+From: Cynthia Huang <cynthia@andestech.com>
+
+[ Upstream commit 04850819c65c8242072818655d4341e70ae998b5 ]
+
+The kernel does not provide sys_futex() on 32-bit architectures that do not
+support 32-bit time representations, such as riscv32.
+
+As a result, glibc cannot define SYS_futex, causing compilation failures in
+tests that rely on this syscall. Define SYS_futex as SYS_futex_time64 in
+such cases to ensure successful compilation and compatibility.
+
+Signed-off-by: Cynthia Huang <cynthia@andestech.com>
+Signed-off-by: Ben Zong-You Xie <ben717@andestech.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Link: https://lore.kernel.org/all/20250710103630.3156130-1-ben717@andestech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/testing/selftests/futex/include/futextest.h b/tools/testing/selftests/futex/include/futextest.h
+index ddbcfc9b7bac..7a5fd1d5355e 100644
+--- a/tools/testing/selftests/futex/include/futextest.h
++++ b/tools/testing/selftests/futex/include/futextest.h
+@@ -47,6 +47,17 @@ typedef volatile u_int32_t futex_t;
+ FUTEX_PRIVATE_FLAG)
+ #endif
+
++/*
++ * SYS_futex is expected from system C library, in glibc some 32-bit
++ * architectures (e.g. RV32) are using 64-bit time_t, therefore it doesn't have
++ * SYS_futex defined but just SYS_futex_time64. Define SYS_futex as
++ * SYS_futex_time64 in this situation to ensure the compilation and the
++ * compatibility.
++ */
++#if !defined(SYS_futex) && defined(SYS_futex_time64)
++#define SYS_futex SYS_futex_time64
++#endif
++
+ /**
+ * futex() - SYS_futex syscall wrapper
+ * @uaddr: address of first futex
+--
+2.39.5
+
--- /dev/null
+From 32e4097b3e127755c1e0d999d2d7e6ba8521ea6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 17:44:25 +0200
+Subject: selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ba71a6e58b38aa6f86865d4e18579cb014903692 ]
+
+The config snippet specifies CONFIG_SCTP_DIAG. This was never an option.
+
+Replace CONFIG_SCTP_DIAG with the intended CONFIG_INET_SCTP_DIAG.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/netfilter/config | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/netfilter/config b/tools/testing/selftests/net/netfilter/config
+index 43d8b500d391..8cc6036f97dc 100644
+--- a/tools/testing/selftests/net/netfilter/config
++++ b/tools/testing/selftests/net/netfilter/config
+@@ -91,4 +91,4 @@ CONFIG_XFRM_STATISTICS=y
+ CONFIG_NET_PKTGEN=m
+ CONFIG_TUN=m
+ CONFIG_INET_DIAG=m
+-CONFIG_SCTP_DIAG=m
++CONFIG_INET_SCTP_DIAG=m
+--
+2.39.5
+
--- /dev/null
+From a1201457983542167930d25ab8fb6a4a9fbeb1c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:26:43 +0900
+Subject: selftests: tracing: Use mutex_unlock for testing glob filter
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit a089bb2822a49b0c5777a8936f82c1f8629231fb ]
+
+Since commit c5b6ababd21a ("locking/mutex: implement
+mutex_trylock_nested") makes mutex_trylock() as an inlined
+function if CONFIG_DEBUG_LOCK_ALLOC=y, we can not use
+mutex_trylock() for testing the glob filter of ftrace.
+
+Use mutex_unlock instead.
+
+Link: https://lore.kernel.org/r/175151680309.2149615.9795104805153538717.stgit@mhiramat.tok.corp.google.com
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+index 4b994b6df5ac..ed81eaf2afd6 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+@@ -29,7 +29,7 @@ ftrace_filter_check 'schedule*' '^schedule.*$'
+ ftrace_filter_check '*pin*lock' '.*pin.*lock$'
+
+ # filter by start*mid*
+-ftrace_filter_check 'mutex*try*' '^mutex.*try.*'
++ftrace_filter_check 'mutex*unl*' '^mutex.*unl.*'
+
+ # Advanced full-glob matching feature is recently supported.
+ # Skip the tests if we are sure the kernel does not support it.
+--
+2.39.5
+
--- /dev/null
+From 6838e3036889b9ba3a56bb8ea30a5a8c6b93b8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 12:33:58 +0200
+Subject: selftests: vDSO: vdso_test_getrandom: Always print TAP header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1158220b24674edaf885433153deb4f0e5c7d331 ]
+
+The TAP specification requires that the output begins with a header line.
+If vgetrandom_init() fails and skips the test, that header line is missing.
+
+Call vgetrandom_init() after ksft_print_header().
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-8-e62e37a6bcf5@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_getrandom.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_getrandom.c b/tools/testing/selftests/vDSO/vdso_test_getrandom.c
+index 95057f7567db..ff8d5675da2b 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_getrandom.c
++++ b/tools/testing/selftests/vDSO/vdso_test_getrandom.c
+@@ -242,6 +242,7 @@ static void kselftest(void)
+ pid_t child;
+
+ ksft_print_header();
++ vgetrandom_init();
+ ksft_set_plan(2);
+
+ for (size_t i = 0; i < 1000; ++i) {
+@@ -295,8 +296,6 @@ static void usage(const char *argv0)
+
+ int main(int argc, char *argv[])
+ {
+- vgetrandom_init();
+-
+ if (argc == 1) {
+ kselftest();
+ return 0;
+@@ -306,6 +305,9 @@ int main(int argc, char *argv[])
+ usage(argv[0]);
+ return 1;
+ }
++
++ vgetrandom_init();
++
+ if (!strcmp(argv[1], "bench-single"))
+ bench_single();
+ else if (!strcmp(argv[1], "bench-multi"))
+--
+2.39.5
+
tls-handle-data-disappearing-from-under-the-tls-ulp.patch
ipvs-fix-estimator-kthreads-preferred-affinity.patch
net-kcm-fix-race-condition-in-kcm_unattach.patch
+hfs-fix-general-protection-fault-in-hfs_find_init.patch
+hfs-fix-slab-out-of-bounds-in-hfs_bnode_read.patch
+hfsplus-fix-slab-out-of-bounds-in-hfsplus_bnode_read.patch
+hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch
+hfsplus-don-t-use-bug_on-in-hfsplus_create_attribute.patch
+arm64-handle-kcov-__init-vs-inline-mismatches.patch
+tpm-check-for-completion-after-timeout.patch
+tpm-tpm_crb_ffa-try-to-probe-tpm_crb_ffa-when-it-s-b.patch
+firmware-arm_ffa-change-initcall-level-of-ffa_init-t.patch
+smb-server-avoid-deadlock-when-linking-with-replacei.patch
+nvme-pci-try-function-level-reset-on-init-failure.patch
+dm-stripe-limit-chunk_sectors-to-the-stripe-size.patch
+md-raid10-set-chunk_sectors-limit.patch
+nvme-tcp-log-tls-handshake-failures-at-error-level.patch
+gfs2-validate-i_depth-for-exhash-directories.patch
+gfs2-set-.migrate_folio-in-gfs2_-rgrp-meta-_aops.patch
+md-call-del_gendisk-in-control-path.patch
+loop-avoid-updating-block-size-under-exclusive-owner.patch
+udf-verify-partition-map-count.patch
+drbd-add-missing-kref_get-in-handle_write_conflicts.patch
+hfs-fix-not-erasing-deleted-b-tree-node-issue.patch
+better-lockdep-annotations-for-simple_recursive_remo.patch
+ata-ahci-disallow-lpm-policy-control-if-not-supporte.patch
+ata-ahci-disable-dipm-if-host-lacks-support.patch
+ata-libata-sata-disallow-changing-lpm-state-if-not-s.patch
+fs-ntfs3-add-sanity-check-for-file-name.patch
+fs-ntfs3-correctly-create-symlink-for-relative-path.patch
+md-don-t-clear-md_closing-until-mddev-is-freed.patch
+pidfs-raise-sb_i_nodev-and-sb_i_noexec.patch
+landlock-opened-file-never-has-a-negative-dentry.patch
+ext2-handle-fiemap-on-empty-files-to-prevent-einval.patch
+fix-locking-in-efi_secret_unlink.patch
+securityfs-don-t-pin-dentries-twice-once-is-enough.patch
+tracefs-add-d_delete-to-remove-negative-dentries.patch
+usb-xhci-print-xhci-xhc_state-when-queue_command-fai.patch
+staging-gpib-add-init-response-codes-for-new-ni-usb-.patch
+platform-x86-amd-pmc-add-lenovo-yoga-6-13alc6-to-pmc.patch
+cpufreq-cppc-mark-driver-with-need_update_limits-fla.patch
+selftests-futex-define-sys_futex-on-32-bit-architect.patch
+usb-typec-ucsi-psy-set-current-max-to-100ma-for-bc-1.patch
+bus-mhi-host-pci_generic-add-telit-fn990b40-modem-su.patch
+bus-mhi-host-pci_generic-disable-runtime-pm-for-qdu1.patch
+usb-xhci-avoid-showing-warnings-for-dying-controller.patch
+usb-xhci-set-avg_trb_len-8-for-ep0-during-address-de.patch
+usb-xhci-avoid-showing-errors-during-surprise-remova.patch
+firmware-qcom-scm-initialize-tzmem-before-marking-sc.patch
+soc-qcom-rpmh-rsc-add-rsc-version-4-support.patch
+acpi-apei-send-sigbus-to-current-task-if-synchronous.patch
+remoteproc-imx_rproc-skip-clock-enable-when-m-core-i.patch
+binder-fix-selftest-page-indexing.patch
+gpio-loongson-64bit-extend-gpio-irq-support.patch
+usb-typec-ucsi-add-poll_cci-operation-to-cros_ec_ucs.patch
+usb-typec-tcpm-tcpci_maxim-fix-irq-wake-usage.patch
+pmdomain-ti-select-pm_generic_domains.patch
+gpio-wcd934x-check-the-return-value-of-regmap_update.patch
+cpufreq-exit-governor-when-failed-to-start-old-gover.patch
+cpufreq-intel_pstate-add-granite-rapids-support-in-n.patch
+arm-rockchip-fix-kernel-hang-during-smp-initializati.patch
+pm-devfreq-governor-replace-sscanf-with-kstrtoul-in-.patch
+edac-synopsys-clear-the-ecc-counters-on-init.patch
+asoc-soc-dapm-set-bias_level-if-snd_soc_dapm_set_bia.patch
+thermal-drivers-qcom-spmi-temp-alarm-enable-stage-2-.patch
+tools-nolibc-define-time_t-in-terms-of-__kernel_old_.patch
+iio-adc-ad_sigma_delta-don-t-overallocate-scan-buffe.patch
+gpio-tps65912-check-the-return-value-of-regmap_updat.patch
+mfd-tps6594-add-ti-tps652g1-support.patch
+arm-tegra-use-i-o-memcpy-to-write-to-iram.patch
+tools-build-fix-s390-x-cross-compilation-with-clang.patch
+selftests-tracing-use-mutex_unlock-for-testing-glob-.patch
+acpi-prm-reduce-unnecessary-printing-to-avoid-user-c.patch
+firmware-arm_scmi-power_control-ensure-scmi_syspower.patch
+firmware-tegra-fix-ivc-dependency-problems.patch
+alsa-hda-add-module_firmware-for-cs35l41-cs35l56.patch
+pm-runtime-clear-power.needs_force_resume-in-pm_runt.patch
+thermal-sysfs-return-enodata-instead-of-eagain-for-r.patch
+pm-sleep-console-fix-the-black-screen-issue.patch
+acpi-processor-fix-acpi_object-initialization.patch
+mmc-sdhci-msm-ensure-sd-card-power-isn-t-on-when-car.patch
+acpi-apei-ghes-add-taint_machine_check-on-ghes-panic.patch
+irqchip-renesas-rzv2h-enable-skip_set_wake-and-mask_.patch
+selftests-vdso-vdso_test_getrandom-always-print-tap-.patch
+pps-clients-gpio-fix-interrupt-handling-order-in-rem.patch
+reset-brcmstb-enable-reset-drivers-for-arch_bcm2835.patch
+asoc-sdca-add-flag-for-unused-irqs.patch
+char-misc-fix-improper-and-inaccurate-error-code-ret.patch
+mei-bus-check-for-still-connected-devices-in-mei_cl_.patch
+mmc-rtsx_usb_sdmmc-fix-error-path-in-sd_set_power_mo.patch
+platform-chrome-cros_ec_sensorhub-retries-when-a-sen.patch
+alsa-hda-handle-the-jack-polling-always-via-a-work.patch
+alsa-hda-disable-jack-polling-at-shutdown.patch
+x86-bugs-avoid-warning-when-overriding-return-thunk.patch
+asoc-hdac_hdmi-rate-limit-logging-on-connection-and-.patch
+alsa-intel8x0-fix-incorrect-codec-index-usage-in-mix.patch
+irqchip-mips-gic-allow-forced-affinity.patch
+asoc-sof-topology-parse-the-dapm_widget_tokens-in-ca.patch
+tty-serial-fix-print-format-specifiers.patch
+asoc-core-check-for-rtd-null-in-snd_soc_remove_pcm_r.patch
+usb-typec-intel_pmc_mux-defer-probe-if-scu-ipc-isn-t.patch
+usb-core-usb_submit_urb-downgrade-type-check.patch
+usb-dwc3-xilinx-add-shutdown-callback.patch
+pm-cpupower-fix-the-snapshot-order-of-tsc-mperf-cloc.patch
+imx8m-blk-ctrl-set-isi-panic-write-hurry-level.patch
+soc-qcom-mdt_loader-actually-use-the-e_phoff.patch
+platform-x86-thinkpad_acpi-handle-kcov-__init-vs-inl.patch
+platform-chrome-cros_ec_typec-defer-probe-on-missing.patch
+alsa-hda-ca0132-fix-buffer-overflow-in-add_tuning_co.patch
+alsa-pcm-rewrite-recalculate_boundary-to-avoid-costl.patch
+alsa-usb-audio-avoid-precedence-issues-in-mixer_quir.patch
+iio-adc-ad7768-1-ensure-sync_in-pulse-minimum-timing.patch
+asoc-codecs-rt5640-retry-device_id-verification.patch
+asoc-qcom-use-drvdata-instead-of-component-to-keep-i.patch
+netfilter-nft_set_pipapo-prefer-kvmalloc-for-scratch.patch
+selftests-netfilter-enable-config_inet_sctp_diag.patch
+powerpc-thp-tracing-hide-hugepage-events-under-confi.patch
+verification-dot2k-make-a-separate-dot2k_templates-k.patch
+bootconfig-fix-unaligned-access-when-building-footer.patch
+bluetooth-btusb-add-new-vid-pid-0489-e14e-for-mt7925.patch
+bluetooth-hci_event-add-support-for-handling-le-big-.patch
+bluetooth-hci_sock-reset-cookie-to-zero-in-hci_sock_.patch
+bluetooth-btusb-add-support-for-variant-of-rtl8851be.patch
+xen-netfront-fix-tx-response-spurious-interrupts.patch
+wifi-iwlwifi-mld-use-spec-link-id-and-not-fw-link-id.patch
+wifi-iwlwifi-mld-avoid-outdated-reorder-buffer-head_.patch
+wifi-iwlwifi-mvm-avoid-outdated-reorder-buffer-head_.patch
+net-usb-cdc-ncm-check-for-filtering-capability.patch
+wifi-ath12k-correct-tid-cleanup-when-tid-setup-fails.patch
+ktest.pl-prevent-recursion-of-default-variable-optio.patch
+wifi-cfg80211-reject-htc-bit-for-management-frames.patch
+s390-sclp-use-monotonic-clock-in-sclp_sync_wait.patch
+s390-time-use-monotonic-clock-in-get_cycles.patch
+be2net-use-correct-byte-order-and-format-string-for-.patch
+libbpf-verify-that-arena-map-exists-when-adding-aren.patch
+idpf-preserve-coalescing-settings-across-resets.patch
+libbpf-fix-warning-in-calloc-usage.patch
+wifi-rtw89-wow-add-basic-rate-ie-to-probe-request-in.patch
+wifi-rtw89-lower-the-timeout-in-rtw89_fw_read_c2h_re.patch
+et131x-add-missing-check-after-dma-map.patch
+net-ag71xx-add-missing-check-after-dma-map.patch
+net-mlx5e-properly-access-rcu-protected-qdisc_sleepi.patch
+net-pcs-xpcs-mask-readl-return-value-to-16-bits.patch
+arm64-mark-kernel-as-tainted-on-sae-and-serror-panic.patch
+drm-amd-pm-fix-null-pointer-access.patch
+rcu-protect-defer_qs_iw_pending-from-data-race.patch
+drm-amd-display-limit-clear_update_flags-to-dcn32-an.patch
+can-ti_hecc-fix-woverflow-compiler-warning.patch
+net-mctp-prevent-duplicate-binds.patch
+wifi-mac80211-don-t-use-tpe-data-from-assoc-response.patch
+wifi-mac80211-handle-wlan_ht_action_notify_chanwidth.patch
+wifi-cfg80211-fix-interface-type-validation.patch
+wifi-mac80211-don-t-unreserve-never-reserved-chanctx.patch
+net-ipv4-fix-incorrect-mtu-in-broadcast-routes.patch
+net-thunderx-fix-format-truncation-warning-in-bgx_ac.patch
+net-phy-micrel-add-ksz9131_resume.patch
+perf-cxlpmu-remove-unintended-newline-from-irq-name-.patch
+sched-deadline-fix-accounting-after-global-limits-ch.patch
+bpf-forget-ranges-when-refining-tnum-after-jset.patch
+wifi-iwlwifi-mvm-set-gtk-id-also-in-older-fws.patch
+wifi-iwlwifi-mld-fix-scan-request-validation.patch
+um-re-evaluate-thread-flags-repeatedly.patch
+wifi-iwlwifi-mvm-fix-scan-request-validation.patch
+drm-sched-avoid-memory-leaks-with-cancel_job-callbac.patch
+s390-stp-remove-udelay-from-stp_sync_clock.patch
+net-phy-bcm54811-phy-initialization.patch
+rv-add-undef-trace_include_file.patch
+sched-fair-bump-sd-max_newidle_lb_cost-when-newidle-.patch
+wifi-mac80211-don-t-complete-management-tx-on-sae-co.patch
+wifi-mac80211-avoid-weird-state-in-error-path.patch
+s390-early-copy-last-breaking-event-address-to-pt_re.patch
+powerpc-512-fix-possible-dma_unmap_single-on-uniniti.patch
+ipv6-mcast-check-inet6_dev-dead-under-idev-mc_lock-i.patch
+rcu-nocb-fix-possible-invalid-rdp-s-nocb_cb_kthread-.patch
+wifi-mac80211-fix-rx-link-assignment-for-non-mlo-sta.patch
+wifi-mt76-mt7996-fix-mlink-lookup-in-mt7996_tx_prepa.patch
+wifi-mt76-fix-vif-link-allocation.patch
+drm-fbdev-client-skip-drm-clients-if-modesetting-is-.patch
+drm-msm-update-register-xml.patch
+drm-msm-use-trylock-for-debugfs.patch
+drm-msm-add-error-handling-for-krealloc-in-metadata-.patch
+perf-arm-add-missing-.suppress_bind_attrs.patch
+drm-imagination-clear-runtime-pm-errors-while-resett.patch
+wifi-rtw89-fix-rtw89_mac_power_switch-for-usb.patch
+wifi-rtw89-disable-deep-power-saving-for-usb-sdio.patch
+wifi-mt76-mt7915-mcu-re-init-mcu-before-loading-fw-p.patch
+wifi-mt76-mt7915-mcu-increase-eeprom-command-timeout.patch
+kselftest-arm64-specify-sve-data-when-testing-vl-set.patch
+drm-xe-xe_query-use-separate-iterator-while-filling-.patch
+net-thunderbolt-enable-end-to-end-flow-control-also-.patch
+net-thunderbolt-fix-the-parameter-passing-of-tb_xdom.patch
+xfrm-duplicate-spi-handling.patch
+net-atlantic-add-set_power-to-fw_ops-for-atl2-to-fix.patch
+acpi-suppress-misleading-spcr-console-message-when-s.patch
+net-ieee8021q-fix-insufficient-table-size-assertion.patch
+net-fec-allow-disable-coalescing.patch
+drm-amdgpu-use-correct-severity-for-bp-threshold-exc.patch
+drm-amd-display-separate-set_gsl-from-set_gsl_source.patch
+drm-amd-display-add-null-check.patch
+wifi-ath10k-shutdown-driver-when-hardware-is-unrelia.patch
+drm-panel-raydium-rm67200-move-initialization-from-e.patch
+wifi-ath12k-add-memset-and-update-default-rate-value.patch
+wifi-ath12k-fix-station-association-with-mbssid-non-.patch
+lib-packing-include-necessary-headers.patch
+wifi-iwlwifi-dvm-fix-potential-overflow-in-rs_fill_l.patch
+wifi-iwlwifi-mld-don-t-exit-emlsr-when-we-shouldn-t.patch
+wifi-iwlwifi-mld-fix-last_mlo_scan_time-type.patch
+wifi-iwlwifi-fw-fix-possible-memory-leak-in-iwl_fw_d.patch
+rcutorture-fix-rcutorture_one_extend_check-splat-in-.patch
+drm-amd-display-fix-failed-to-blank-crtc.patch
+drm-amd-display-initialize-mode_select-to-0.patch
+wifi-mac80211-update-radar_required-in-channel-conte.patch
+wifi-rtlwifi-fix-possible-skb-memory-leak-in-_rtl_pc.patch
+wifi-rtw89-coex-not-to-set-slot-duration-to-zero-to-.patch
+wifi-ath12k-enable-reo-queue-lookup-table-feature-on.patch
+wifi-ath12k-decrement-tid-on-rx-peer-frag-setup-erro.patch
+powerpc-floppy-add-missing-checks-after-dma-map.patch
+netmem-fix-skb_frag_address_safe-with-unreadable-skb.patch
+arm64-stacktrace-check-kretprobe_find_ret_addr-retur.patch
+wifi-iwlegacy-check-rate_idx-range-after-addition.patch
+dpaa_eth-don-t-use-fixed_phy_change_carrier.patch
+drm-amd-allow-printing-vangogh-od-sclk-levels-withou.patch
+drm-amd-display-stop-storing-failures-into-adev-dm.c.patch
+drm-amdgpu-suspend-ih-during-mode-2-reset.patch
+drm-amdgpu-clear-pa-and-mca-record-counter-when-rese.patch
+net-vlan-make-is_vlan_dev-a-stub-when-vlan-is-not-co.patch
+net-vlan-replace-bug-with-warn_on_once-in-vlan_dev_-.patch
+gve-return-error-for-unknown-admin-queue-command.patch
+net-dsa-b53-ensure-bcm5325-phys-are-enabled.patch
+net-dsa-b53-fix-b53_imp_vlan_setup-for-bcm5325.patch
+net-dsa-b53-prevent-gmii_port_override_ctrl-access-o.patch
+net-dsa-b53-prevent-dis_learning-access-on-bcm5325.patch
+net-dsa-b53-prevent-switch_ctrl-access-on-bcm5325.patch
+bpftool-fix-json-writer-resource-leak-in-version-com.patch
+ptp-use-ratelimite-for-freerun-error-message.patch
+wifi-rtw89-scan-abort-when-assign-unassign_vif.patch
+wifi-rtlwifi-fix-possible-skb-memory-leak-in-_rtl_pc.patch-7094
+ionic-clean-dbpage-in-de-init.patch
+drm-xe-make-dma-fences-compliant-with-the-safe-acces.patch
+net-ncsi-fix-buffer-overflow-in-fetching-version-id.patch
+drm-renesas-rz-du-mipi_dsi-add-min-check-for-vclk-ra.patch
+drm-ttm-should-to-return-the-evict-error.patch
+uapi-in6-restore-visibility-of-most-ipv6-socket-opti.patch
+bpf-make-reg_not_null-true-for-const_ptr_to_map.patch
+selftests-bpf-fix-ringbuf-ringbuf_write-test-failure.patch
+selftests-bpf-fix-a-user_ringbuf-failure-with-arm64-.patch
+drm-amd-display-update-dmcub-loading-sequence-for-dc.patch
+drm-amd-display-avoid-trying-aux-transactions-on-dis.patch
+drm-ttm-respect-the-shrinker-core-free-target.patch
+rcu-fix-rcu_read_unlock-deadloop-due-to-irq-work.patch
+net-dsa-b53-fix-ip_multicast_ctrl-on-bcm5325.patch
+vsock-virtio-resize-receive-buffers-so-that-each-skb.patch
+vhost-fail-early-when-__vhost_add_used-fails.patch
+drm-amd-display-only-finalize-atomic_obj-if-it-was-i.patch
+drm-amd-display-avoid-configuring-psr-granularity-if.patch
+drm-amd-display-disable-dsc_power_gate-for-dcn314-by.patch
+watchdog-sbsa-adjust-keepalive-timeout-to-avoid-medi.patch
+cifs-fix-calling-cifsfindfirst-for-root-path-without.patch
+smb-client-fix-session-setup-against-servers-that-re.patch
+fbdev-fix-potential-buffer-overflow-in-do_register_f.patch
+crypto-hisilicon-hpre-fix-dma-unmap-sequence.patch
+ext4-do-not-bug-when-inline_data_fl-lacks-system.dat.patch
+clk-tegra-periph-fix-error-handling-and-resolve-unsi.patch
+sphinx-kernel_abi-fix-performance-regression-with-o-.patch
+mfd-axp20x-set-explicit-id-for-axp313-regulator.patch
+phy-rockchip-pcie-properly-disable-test_write-strobe.patch
+phy-rockchip-pcie-enable-all-four-lanes-if-required.patch
+scsi-libiscsi-initialize-iscsi_conn-dd_data-only-if-.patch
+fs-orangefs-use-snprintf-instead-of-sprintf.patch
+watchdog-dw_wdt-fix-default-timeout.patch
+hwmon-emc2305-set-initial-pwm-minimum-value-during-p.patch
+clk-qcom-ipq5018-keep-xo-clock-always-on.patch
+mips-vpe-mt-add-missing-prototypes-for-vpe_-alloc-st.patch
+watchdog-itco_wdt-report-error-if-timeout-configurat.patch
+scsi-bfa-double-free-fix.patch
+jfs-truncate-good-inode-pages-when-hard-link-is-0.patch
+jfs-regular-file-corruption-check.patch
+jfs-upper-bound-check-of-tree-index-in-dballocag.patch
+media-hi556-fix-reset-gpio-timings.patch
+rdma-bnxt_re-fix-size-of-uverbs_copy_to-in-bnxt_re_m.patch
+crypto-jitter-fix-intermediary-handling.patch
+mips-don-t-crash-in-stack_top-for-tasks-without-abi-.patch
+mips-lantiq-falcon-sysctrl-fix-request-memory-check-.patch
+media-iris-add-handling-for-corrupt-and-drop-frames.patch
+clk-thead-mark-essential-bus-clocks-as-clk_ignore_un.patch
+media-ipu-bridge-add-_hid-for-ov5670.patch
+media-v4l2-common-reduce-warnings-about-missing-v4l2.patch
+leds-leds-lp50xx-handle-reg-to-get-correct-multi_ind.patch
+dmaengine-stm32-dma-configure-next-sg-only-if-there-.patch
+rdma-hfi1-fix-possible-divide-by-zero-in-find_hw_thr.patch
+rdma-core-reduce-stack-using-in-nldev_stat_get_doit.patch
+scsi-lpfc-ensure-hba_setup-flag-is-used-only-for-sli.patch
+scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-l.patch
+power-supply-qcom_battmgr-add-lithium-polymer-entry.patch
+hid-rate-limit-hid_warn-to-prevent-log-flooding.patch
+scsi-mpt3sas-correctly-handle-ata-device-errors.patch
+scsi-pm80xx-free-allocated-tags-after-failure.patch
+scsi-mpi3mr-correctly-handle-ata-device-errors.patch
+pinctrl-stm32-manage-irq-affinity-settings.patch
+media-raspberrypi-cfe-fix-min_reqbufs_allocation.patch
+media-tc358743-check-i2c-succeeded-during-probe.patch
+media-tc358743-return-an-appropriate-colorspace-from.patch
+media-tc358743-increase-fifo-trigger-level-to-374.patch
+media-usb-hdpvr-disable-zero-length-read-messages.patch
+media-dvb-frontends-dib7090p-fix-null-ptr-deref-in-d.patch
+media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
+media-uvcvideo-add-quirk-for-hp-webcam-hd-2300.patch
+media-uvcvideo-set-v4l2_ctrl_flag_disabled-during-qu.patch
+media-uvcvideo-fix-bandwidth-issue-for-alcor-camera.patch
+crypto-octeontx2-add-timeout-for-load_fvc-completion.patch
+crypto-ccp-add-missing-bootloader-info-reg-for-pspv6.patch
+clk-renesas-rzg2l-postpone-updating-priv-clks.patch
+soundwire-amd-serialize-amd-manager-resume-sequence-.patch
+soundwire-amd-cancel-pending-slave-status-handling-w.patch
+soundwire-move-handle_nested_irq-outside-of-sdw_dev_.patch
+md-dm-zoned-target-initialize-return-variable-r-to-a.patch
+module-prevent-silent-truncation-of-module-name-in-d.patch
+i3c-add-missing-include-to-internal-header.patch
+rtc-ds1307-handle-oscillator-stop-flag-osf-for-ds134.patch
+apparmor-shift-ouid-when-mediating-hard-links-in-use.patch
+i3c-don-t-fail-if-gethdrcap-is-unsupported.patch
+i3c-master-initialize-ret-in-i3c_i2c_notifier_call.patch
+dm-mpath-don-t-print-the-loaded-message-if-registeri.patch
+dm-table-fix-checking-for-rq-stackable-devices.patch
+apparmor-use-the-condition-in-aa_bug_fmt-even-with-d.patch
+apparmor-fix-x_table_lookup-when-stacking-is-not-the.patch
+i2c-force-dll0945-touchpad-i2c-freq-to-100khz.patch
+exfat-add-cluster-chain-loop-check-for-dir.patch
+f2fs-check-the-generic-conditions-first.patch
+printk-nbcon-allow-reacquire-during-panic.patch
+kconfig-lxdialog-replace-strcpy-with-strncpy-in-inpu.patch
+vfio-type1-conditional-rescheduling-while-pinning.patch
+kconfig-nconf-ensure-null-termination-where-strncpy-.patch
+scsi-fix-sas_user_scan-to-handle-wildcard-and-multi-.patch
+scsi-target-core-generate-correct-identifiers-for-pr.patch
+scsi-aacraid-stop-using-pci_irq_affinity.patch
+vfio-mlx5-fix-possible-overflow-in-tracking-max-mess.patch
+ipmi-use-dev_warn_ratelimited-for-incorrect-message-.patch
+kconfig-gconf-avoid-hardcoding-model2-in-on_treeview.patch
+kconfig-gconf-fix-potential-memory-leak-in-renderer_.patch
+kheaders-rebuild-kheaders_data.tar.xz-when-a-file-is.patch
+kconfig-lxdialog-fix-space-to-de-select-options.patch
+ipmi-fix-strcpy-source-and-destination-the-same.patch
+tools-power-turbostat-handle-non-root-legacy-uncore-.patch
+tools-power-turbostat-fix-build-with-musl.patch
+tools-power-turbostat-handle-cap_get_proc-enosys.patch
+smb-client-don-t-call-init_waitqueue_head-info-conn_.patch
+lib-sbitmap-convert-shallow_depth-from-one-word-to-t.patch
+alsa-hda-realtek-add-lg-gram-16z90r-a-to-alc269-fixu.patch
+asoc-intel-sof_sdw-add-quirk-for-alienware-area-51-2.patch
+net-phy-smsc-add-proper-reset-flags-for-lan8710a.patch
+asoc-intel-avs-fix-uninitialized-pointer-error-in-pr.patch
+block-avoid-possible-overflow-for-chunk_sectors-chec.patch
+pnfs-fix-stripe-mapping-in-block-scsi-layout.patch
+pnfs-fix-disk-addr-range-check-in-block-scsi-layout.patch
+pnfs-handle-rpc-size-limit-for-layoutcommits.patch
+pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
+rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
--- /dev/null
+From 4dce4f08a4f6974c11ee8a33ee3fc45a26e9d178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:12:13 +0200
+Subject: smb: client: don't call init_waitqueue_head(&info->conn_wait) twice
+ in _smbd_get_connection
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit 550a194c5998e4e77affc6235e80d3766dc2d27e ]
+
+It is already called long before we may hit this cleanup code path.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index cd4c61932cb2..b9bb531717a6 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1689,7 +1689,6 @@ static struct smbd_connection *_smbd_get_connection(
+ cancel_delayed_work_sync(&info->idle_timer_work);
+ destroy_caches_and_workqueue(info);
+ sc->status = SMBDIRECT_SOCKET_NEGOTIATE_FAILED;
+- init_waitqueue_head(&info->conn_wait);
+ rdma_disconnect(sc->rdma.cm_id);
+ wait_event(info->conn_wait,
+ sc->status == SMBDIRECT_SOCKET_DISCONNECTED);
+--
+2.39.5
+
--- /dev/null
+From cd786575af1a5e853bf49d53ad2e78d0ebedb8c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 00:04:44 -0300
+Subject: smb: client: fix session setup against servers that require SPN
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit 33cfdd726381828b9907a61c038a9f48b6690a31 ]
+
+Some servers might enforce the SPN to be set in the target info
+blob (AV pairs) when sending NTLMSSP_AUTH message. In Windows Server,
+this could be enforced with SmbServerNameHardeningLevel set to 2.
+
+Fix this by always appending SPN (cifs/<hostname>) to the existing
+list of target infos when setting up NTLMv2 response blob.
+
+Cc: linux-cifs@vger.kernel.org
+Cc: David Howells <dhowells@redhat.com>
+Reported-by: Pierguido Lambri <plambri@redhat.com>
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsencrypt.c | 79 ++++++++++++++++++++++++++++---------
+ 1 file changed, 61 insertions(+), 18 deletions(-)
+
+diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c
+index 6be850d2a346..3cc686246908 100644
+--- a/fs/smb/client/cifsencrypt.c
++++ b/fs/smb/client/cifsencrypt.c
+@@ -532,17 +532,67 @@ CalcNTLMv2_response(const struct cifs_ses *ses, char *ntlmv2_hash, struct shash_
+ return rc;
+ }
+
++/*
++ * Set up NTLMv2 response blob with SPN (cifs/<hostname>) appended to the
++ * existing list of AV pairs.
++ */
++static int set_auth_key_response(struct cifs_ses *ses)
++{
++ size_t baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
++ size_t len, spnlen, tilen = 0, num_avs = 2 /* SPN + EOL */;
++ struct TCP_Server_Info *server = ses->server;
++ char *spn __free(kfree) = NULL;
++ struct ntlmssp2_name *av;
++ char *rsp = NULL;
++ int rc;
++
++ spnlen = strlen(server->hostname);
++ len = sizeof("cifs/") + spnlen;
++ spn = kmalloc(len, GFP_KERNEL);
++ if (!spn) {
++ rc = -ENOMEM;
++ goto out;
++ }
++
++ spnlen = scnprintf(spn, len, "cifs/%.*s",
++ (int)spnlen, server->hostname);
++
++ av_for_each_entry(ses, av)
++ tilen += sizeof(*av) + AV_LEN(av);
++
++ len = baselen + tilen + spnlen * sizeof(__le16) + num_avs * sizeof(*av);
++ rsp = kmalloc(len, GFP_KERNEL);
++ if (!rsp) {
++ rc = -ENOMEM;
++ goto out;
++ }
++
++ memcpy(rsp + baselen, ses->auth_key.response, tilen);
++ av = (void *)(rsp + baselen + tilen);
++ av->type = cpu_to_le16(NTLMSSP_AV_TARGET_NAME);
++ av->length = cpu_to_le16(spnlen * sizeof(__le16));
++ cifs_strtoUTF16((__le16 *)av->data, spn, spnlen, ses->local_nls);
++ av = (void *)((__u8 *)av + sizeof(*av) + AV_LEN(av));
++ av->type = cpu_to_le16(NTLMSSP_AV_EOL);
++ av->length = 0;
++
++ rc = 0;
++ ses->auth_key.len = len;
++out:
++ ses->auth_key.response = rsp;
++ return rc;
++}
++
+ int
+ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ {
+ struct shash_desc *hmacmd5 = NULL;
+- int rc;
+- int baselen;
+- unsigned int tilen;
++ unsigned char *tiblob = NULL; /* target info blob */
+ struct ntlmv2_resp *ntlmv2;
+ char ntlmv2_hash[16];
+- unsigned char *tiblob = NULL; /* target info blob */
+ __le64 rsp_timestamp;
++ __u64 cc;
++ int rc;
+
+ if (nls_cp == NULL) {
+ cifs_dbg(VFS, "%s called with nls_cp==NULL\n", __func__);
+@@ -588,32 +638,25 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ * (as Windows 7 does)
+ */
+ rsp_timestamp = find_timestamp(ses);
++ get_random_bytes(&cc, sizeof(cc));
+
+- baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
+- tilen = ses->auth_key.len;
+- tiblob = ses->auth_key.response;
++ cifs_server_lock(ses->server);
+
+- ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
+- if (!ses->auth_key.response) {
+- rc = -ENOMEM;
++ tiblob = ses->auth_key.response;
++ rc = set_auth_key_response(ses);
++ if (rc) {
+ ses->auth_key.len = 0;
+- goto setup_ntlmv2_rsp_ret;
++ goto unlock;
+ }
+- ses->auth_key.len += baselen;
+
+ ntlmv2 = (struct ntlmv2_resp *)
+ (ses->auth_key.response + CIFS_SESS_KEY_SIZE);
+ ntlmv2->blob_signature = cpu_to_le32(0x00000101);
+ ntlmv2->reserved = 0;
+ ntlmv2->time = rsp_timestamp;
+-
+- get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal));
++ ntlmv2->client_chal = cc;
+ ntlmv2->reserved2 = 0;
+
+- memcpy(ses->auth_key.response + baselen, tiblob, tilen);
+-
+- cifs_server_lock(ses->server);
+-
+ rc = cifs_alloc_hash("hmac(md5)", &hmacmd5);
+ if (rc) {
+ cifs_dbg(VFS, "Could not allocate HMAC-MD5, rc=%d\n", rc);
+--
+2.39.5
+
--- /dev/null
+From 72b46fd7a42450cfe7e190f005898d5c01a5126a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 09:35:09 +1000
+Subject: smb/server: avoid deadlock when linking with ReplaceIfExists
+
+From: NeilBrown <neil@brown.name>
+
+[ Upstream commit d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694 ]
+
+If smb2_create_link() is called with ReplaceIfExists set and the name
+does exist then a deadlock will happen.
+
+ksmbd_vfs_kern_path_locked() will return with success and the parent
+directory will be locked. ksmbd_vfs_remove_file() will then remove the
+file. ksmbd_vfs_link() will then be called while the parent is still
+locked. It will try to lock the same parent and will deadlock.
+
+This patch moves the ksmbd_vfs_kern_path_unlock() call to *before*
+ksmbd_vfs_link() and then simplifies the code, removing the file_present
+flag variable.
+
+Signed-off-by: NeilBrown <neil@brown.name>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 55a7887fdad7..1e379de6b22b 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -6035,7 +6035,6 @@ static int smb2_create_link(struct ksmbd_work *work,
+ {
+ char *link_name = NULL, *target_name = NULL, *pathname = NULL;
+ struct path path, parent_path;
+- bool file_present = false;
+ int rc;
+
+ if (buf_len < (u64)sizeof(struct smb2_file_link_info) +
+@@ -6068,11 +6067,8 @@ static int smb2_create_link(struct ksmbd_work *work,
+ if (rc) {
+ if (rc != -ENOENT)
+ goto out;
+- } else
+- file_present = true;
+-
+- if (file_info->ReplaceIfExists) {
+- if (file_present) {
++ } else {
++ if (file_info->ReplaceIfExists) {
+ rc = ksmbd_vfs_remove_file(work, &path);
+ if (rc) {
+ rc = -EINVAL;
+@@ -6080,21 +6076,17 @@ static int smb2_create_link(struct ksmbd_work *work,
+ link_name);
+ goto out;
+ }
+- }
+- } else {
+- if (file_present) {
++ } else {
+ rc = -EEXIST;
+ ksmbd_debug(SMB, "link already exists\n");
+ goto out;
+ }
++ ksmbd_vfs_kern_path_unlock(&parent_path, &path);
+ }
+-
+ rc = ksmbd_vfs_link(work, target_name, link_name);
+ if (rc)
+ rc = -EINVAL;
+ out:
+- if (file_present)
+- ksmbd_vfs_kern_path_unlock(&parent_path, &path);
+
+ if (!IS_ERR(link_name))
+ kfree(link_name);
+--
+2.39.5
+
--- /dev/null
+From de12af16e9e1f1cc887c9b2c8e462ef1c05b0f2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 21:58:30 -0500
+Subject: soc: qcom: mdt_loader: Actually use the e_phoff
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 47e339cac89143709e84a3b71ba8bd9b2fdd2368 ]
+
+Rather than relying/assuming that the tools generating the firmware
+places the program headers immediately following the ELF header, use
+e_phoff as intended to find the program headers.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-3-f7073e9ab899@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/mdt_loader.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index b2c0fb55d4ae..44589d10b15b 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -83,7 +83,7 @@ ssize_t qcom_mdt_get_size(const struct firmware *fw)
+ int i;
+
+ ehdr = (struct elf32_hdr *)fw->data;
+- phdrs = (struct elf32_phdr *)(ehdr + 1);
++ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ phdr = &phdrs[i];
+@@ -135,7 +135,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len,
+ void *data;
+
+ ehdr = (struct elf32_hdr *)fw->data;
+- phdrs = (struct elf32_phdr *)(ehdr + 1);
++ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
+
+ if (ehdr->e_phnum < 2)
+ return ERR_PTR(-EINVAL);
+@@ -215,7 +215,7 @@ int qcom_mdt_pas_init(struct device *dev, const struct firmware *fw,
+ int i;
+
+ ehdr = (struct elf32_hdr *)fw->data;
+- phdrs = (struct elf32_phdr *)(ehdr + 1);
++ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ phdr = &phdrs[i];
+@@ -270,7 +270,7 @@ static bool qcom_mdt_bins_are_split(const struct firmware *fw, const char *fw_na
+ int i;
+
+ ehdr = (struct elf32_hdr *)fw->data;
+- phdrs = (struct elf32_phdr *)(ehdr + 1);
++ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ /*
+@@ -312,7 +312,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+
+ is_split = qcom_mdt_bins_are_split(fw, fw_name);
+ ehdr = (struct elf32_hdr *)fw->data;
+- phdrs = (struct elf32_phdr *)(ehdr + 1);
++ phdrs = (struct elf32_phdr *)(fw->data + ehdr->e_phoff);
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ phdr = &phdrs[i];
+--
+2.39.5
+
--- /dev/null
+From ac6ccf9e1a97dca1657b7eafc4a6750c81214587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 11:19:43 +0530
+Subject: soc: qcom: rpmh-rsc: Add RSC version 4 support
+
+From: Maulik Shah <maulik.shah@oss.qualcomm.com>
+
+[ Upstream commit 84684c57c9cd47b86c883a7170dd68222d97ef13 ]
+
+Register offsets for v3 and v4 versions are backward compatible. Assign v3
+offsets for v4 and all higher versions to avoid end up using v2 offsets.
+
+Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250623-rsc_v4-v1-1-275b27bc5e3c@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index cb82e887b51d..fdab2b1067db 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -1072,7 +1072,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev)
+ drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT);
+ drv->ver.minor >>= MINOR_VER_SHIFT;
+
+- if (drv->ver.major == 3)
++ if (drv->ver.major >= 3)
+ drv->regs = rpmh_rsc_reg_offset_ver_3_0;
+ else
+ drv->regs = rpmh_rsc_reg_offset_ver_2_7;
+--
+2.39.5
+
--- /dev/null
+From 4b8c333f42651bafa31912d8b82c3e220f049358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 11:13:41 +0530
+Subject: soundwire: amd: cancel pending slave status handling workqueue during
+ remove sequence
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit f93b697ed98e3c85d1973ea170d4f4e7a6b2b45d ]
+
+During remove sequence, cancel the pending slave status update workqueue.
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20250530054447.1645807-4-Vijendar.Mukunda@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/amd_manager.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c
+index 3b335d6eaa94..7ed9c8c0b4c8 100644
+--- a/drivers/soundwire/amd_manager.c
++++ b/drivers/soundwire/amd_manager.c
+@@ -1074,6 +1074,7 @@ static void amd_sdw_manager_remove(struct platform_device *pdev)
+ int ret;
+
+ pm_runtime_disable(&pdev->dev);
++ cancel_work_sync(&amd_manager->amd_sdw_work);
+ amd_disable_sdw_interrupts(amd_manager);
+ sdw_bus_master_delete(&amd_manager->bus);
+ ret = amd_disable_sdw_manager(amd_manager);
+--
+2.39.5
+
--- /dev/null
+From 2fd9a7c8393f4856c8d7bfc91efc733948f41294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 11:13:40 +0530
+Subject: soundwire: amd: serialize amd manager resume sequence during
+ pm_prepare
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 03837341790039d6f1cbf7a1ae7dfa2cb77ef0a4 ]
+
+During pm_prepare callback, pm_request_resume() delays SoundWire manager D0
+entry sequence. Synchronize runtime resume sequence for amd_manager
+instance prior to invoking child devices resume sequence for both the amd
+power modes(ClockStop Mode and Power off mode).
+Change the power_mode_mask check and use pm_runtime_resume() in
+amd_pm_prepare() callback.
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20250530054447.1645807-3-Vijendar.Mukunda@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/amd_manager.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c
+index 7a671a786197..3b335d6eaa94 100644
+--- a/drivers/soundwire/amd_manager.c
++++ b/drivers/soundwire/amd_manager.c
+@@ -1178,10 +1178,10 @@ static int __maybe_unused amd_pm_prepare(struct device *dev)
+ * device is not in runtime suspend state, observed that device alerts are missing
+ * without pm_prepare on AMD platforms in clockstop mode0.
+ */
+- if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) {
+- ret = pm_request_resume(dev);
++ if (amd_manager->power_mode_mask) {
++ ret = pm_runtime_resume(dev);
+ if (ret < 0) {
+- dev_err(bus->dev, "pm_request_resume failed: %d\n", ret);
++ dev_err(bus->dev, "pm_runtime_resume failed: %d\n", ret);
+ return 0;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 0b6cc218ff813bd0e03917094a52995025a7c669 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 15:30:40 +0100
+Subject: soundwire: Move handle_nested_irq outside of sdw_dev_lock
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ccb7bb13c00bcc3178d270da052635c56148bc16 ]
+
+The sdw_dev_lock protects the SoundWire driver callbacks against
+the probed flag, which is used to skip the callbacks if the
+driver gets removed. For more information see commit bd29c00edd0a
+("soundwire: revisit driver bind/unbind and callbacks").
+
+However, this lock is a frequent source of mutex inversions.
+Many audio operations eventually hit the hardware resulting in a
+SoundWire callback, this means that typically the driver has the
+locking order ALSA/ASoC locks -> sdw_dev_lock. Conversely, the IRQ
+comes in directly from the SoundWire hardware, but then will often
+want to access ALSA/ASoC, such as updating something in DAPM or
+an ALSA control. This gives the other lock order sdw_dev_lock ->
+ALSA/ASoC locks.
+
+When the IRQ handling was initially added to SoundWire this was
+through a callback mechanism. As such it required being covered by
+the lock because the callbacks are part of the sdw_driver structure
+and are thus present regardless of if the driver is currently
+probed.
+
+Since then a newer mechanism using the IRQ framework has been
+added, which is currently covered by the same lock but this isn't
+actually required. Handlers for the IRQ framework are registered in
+probe and should by released during remove, thus the IRQ framework
+will have already unbound the IRQ before the slave driver is
+removed. Avoid the aforementioned mutex inversion by moving the
+handle_nested_irq call outside of the sdw_dev_lock.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20250609143041.495049-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 39aecd34c641..1a70f80c2514 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -1756,15 +1756,15 @@ static int sdw_handle_slave_alerts(struct sdw_slave *slave)
+
+ /* Update the Slave driver */
+ if (slave_notify) {
++ if (slave->prop.use_domain_irq && slave->irq)
++ handle_nested_irq(slave->irq);
++
+ mutex_lock(&slave->sdw_dev_lock);
+
+ if (slave->probed) {
+ struct device *dev = &slave->dev;
+ struct sdw_driver *drv = drv_to_sdw_driver(dev->driver);
+
+- if (slave->prop.use_domain_irq && slave->irq)
+- handle_nested_irq(slave->irq);
+-
+ if (drv->ops && drv->ops->interrupt_callback) {
+ slave_intr.sdca_cascade = sdca_cascade;
+ slave_intr.control_port = clear;
+--
+2.39.5
+
--- /dev/null
+From abfbadc97a75f175021447c4bdc1d792603e85a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 13:37:19 +0200
+Subject: sphinx: kernel_abi: fix performance regression with O=<dir>
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 2b16b71a05a7f056221751b906c13f8809656b1f ]
+
+The logic there which adds a dependency note to Sphinx cache
+is not taking into account that the build dir may not be
+the source dir. This causes a performance regression:
+
+$ time make O=/tmp/foo SPHINXDIRS=admin-guide htmldocs
+
+ [OUTDATED]
+ Added: set()
+ Changed: {'abi-obsolete', 'abi-removed', 'abi-stable-files', 'abi-obsolete-files', 'abi-stable', 'abi', 'abi-removed-files', 'abi-testing-files', 'abi-testing', 'gpio/index', 'gpio/obsolete'}
+ Removed: set()
+ All docs count: 385
+ Found docs count: 385
+
+ real 0m11,324s
+ user 0m15,783s
+ sys 0m1,164s
+
+To get the root cause of the problem (ABI files reported as changed),
+I used this changeset:
+
+ diff --git a/Documentation/conf.py b/Documentation/conf.py
+ index e8766e689c1b..ab486623bd8b 100644
+ --- a/Documentation/conf.py
+ +++ b/Documentation/conf.py
+ @@ -571,3 +571,16 @@ def setup(app):
+ """Patterns need to be updated at init time on older Sphinx versions"""
+
+ app.connect('config-inited', update_patterns)
+ + app.connect('env-get-outdated', on_outdated)
+ +
+ +def on_outdated(app, env, added, changed, removed):
+ + """Track cache outdated due to added/changed/removed files"""
+ + print("\n[OUTDATED]")
+ + print(f"Added: {added}")
+ + print(f"Changed: {changed}")
+ + print(f"Removed: {removed}")
+ + print(f"All docs count: {len(env.all_docs)}")
+ + print(f"Found docs count: {len(env.found_docs)}")
+ +
+ + # Just return what we have
+ + return added | changed | removed
+
+Reported-by: Akira Yokosawa <akiyks@gmail.com>
+Closes: https://lore.kernel.org/linux-doc/c174f7c5-ec21-4eae-b1c3-f643cca90d9d@gmail.com/
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Tested-by: Akira Yokosawa <akiyks@gmail.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Link: https://lore.kernel.org/r/e25673d87357457bc54ee863e97ff8f75956580d.1752752211.git.mchehab+huawei@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sphinx/kernel_abi.py | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/sphinx/kernel_abi.py b/Documentation/sphinx/kernel_abi.py
+index db6f0380de94..4c4375201b9e 100644
+--- a/Documentation/sphinx/kernel_abi.py
++++ b/Documentation/sphinx/kernel_abi.py
+@@ -146,8 +146,10 @@ class KernelCmd(Directive):
+ n += 1
+
+ if f != old_f:
+- # Add the file to Sphinx build dependencies
+- env.note_dependency(os.path.abspath(f))
++ # Add the file to Sphinx build dependencies if the file exists
++ fname = os.path.join(srctree, f)
++ if os.path.isfile(fname):
++ env.note_dependency(fname)
+
+ old_f = f
+
+--
+2.39.5
+
--- /dev/null
+From 776cfdd030c59a41d2b643592e613b53bd9ed934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 18:48:10 +0200
+Subject: staging: gpib: Add init response codes for new ni-usb-hs+
+
+From: Dave Penkler <dpenkler@gmail.com>
+
+[ Upstream commit f50d5e0c1f80d004510bf77cb0e1759103585c00 ]
+
+A new version of a bona fide genuine NI-USB-HS+ adaptor
+sends new response codes to the initialization sequence.
+
+Add the checking for these response codes to suppress
+console warning messages.
+
+Signed-off-by: Dave Penkler <dpenkler@gmail.com>
+Link: https://lore.kernel.org/r/20250722164810.2621-1-dpenkler@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
+index 9f1b9927f025..56d3b62249b8 100644
+--- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
++++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
+@@ -2069,10 +2069,10 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)
+ }
+ if (buffer[++j] != 0x0) { // [6]
+ ready = 1;
+- // NI-USB-HS+ sends 0xf here
++ // NI-USB-HS+ sends 0xf or 0x19 here
+ if (buffer[j] != 0x2 && buffer[j] != 0xe && buffer[j] != 0xf &&
+- buffer[j] != 0x16) {
+- dev_err(&usb_dev->dev, "unexpected data: buffer[%i]=0x%x, expected 0x2, 0xe, 0xf or 0x16\n",
++ buffer[j] != 0x16 && buffer[j] != 0x19) {
++ dev_err(&usb_dev->dev, "unexpected data: buffer[%i]=0x%x, expected 0x2, 0xe, 0xf, 0x16 or 0x19\n",
+ j, (int)buffer[j]);
+ unexpected = 1;
+ }
+@@ -2100,11 +2100,11 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)
+ j, (int)buffer[j]);
+ unexpected = 1;
+ }
+- if (buffer[++j] != 0x0) {
++ if (buffer[++j] != 0x0) { // [10] MC usb-488 sends 0x7 here, new HS+ sends 0x59
+ ready = 1;
+- if (buffer[j] != 0x96 && buffer[j] != 0x7 && buffer[j] != 0x6e) {
+-// [10] MC usb-488 sends 0x7 here
+- dev_err(&usb_dev->dev, "unexpected data: buffer[%i]=0x%x, expected 0x96, 0x07 or 0x6e\n",
++ if (buffer[j] != 0x96 && buffer[j] != 0x7 && buffer[j] != 0x6e &&
++ buffer[j] != 0x59) {
++ dev_err(&usb_dev->dev, "unexpected data: buffer[%i]=0x%x, expected 0x96, 0x07, 0x6e or 0x59\n",
+ j, (int)buffer[j]);
+ unexpected = 1;
+ }
+--
+2.39.5
+
--- /dev/null
+From 053255bf4242d4832b0613dcab8e0d34a5b995c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 15:45:51 -0700
+Subject: thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
+ required
+
+From: David Collins <david.collins@oss.qualcomm.com>
+
+[ Upstream commit f8e157ff2df46ddabd930815d196895976227831 ]
+
+Certain TEMP_ALARM GEN2 PMIC peripherals need over-temperature stage 2
+automatic PMIC partial shutdown. This will ensure that in the event of
+reaching the hotter stage 3 over-temperature threshold, repeated faults
+will be avoided during the automatic PMIC hardware full shutdown.
+Modify the stage 2 shutdown control logic to ensure that stage 2
+shutdown is enabled on all affected PMICs. Read the digital major
+and minor revision registers to identify these PMICs.
+
+Signed-off-by: David Collins <david.collins@oss.qualcomm.com>
+Signed-off-by: Anjelique Melendez <anjelique.melendez@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250710224555.3047790-2-anjelique.melendez@oss.qualcomm.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 43 ++++++++++++++++-----
+ 1 file changed, 34 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
+index a81e7d6e865f..4b91cc13ce34 100644
+--- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
++++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+ * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+ #include <linux/bitops.h>
+@@ -16,6 +17,7 @@
+
+ #include "../thermal_hwmon.h"
+
++#define QPNP_TM_REG_DIG_MINOR 0x00
+ #define QPNP_TM_REG_DIG_MAJOR 0x01
+ #define QPNP_TM_REG_TYPE 0x04
+ #define QPNP_TM_REG_SUBTYPE 0x05
+@@ -31,7 +33,7 @@
+ #define STATUS_GEN2_STATE_MASK GENMASK(6, 4)
+ #define STATUS_GEN2_STATE_SHIFT 4
+
+-#define SHUTDOWN_CTRL1_OVERRIDE_S2 BIT(6)
++#define SHUTDOWN_CTRL1_OVERRIDE_STAGE2 BIT(6)
+ #define SHUTDOWN_CTRL1_THRESHOLD_MASK GENMASK(1, 0)
+
+ #define SHUTDOWN_CTRL1_RATE_25HZ BIT(3)
+@@ -78,6 +80,7 @@ struct qpnp_tm_chip {
+ /* protects .thresh, .stage and chip registers */
+ struct mutex lock;
+ bool initialized;
++ bool require_stage2_shutdown;
+
+ struct iio_channel *adc;
+ const long (*temp_map)[THRESH_COUNT][STAGE_COUNT];
+@@ -220,13 +223,13 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip,
+ {
+ long stage2_threshold_min = (*chip->temp_map)[THRESH_MIN][1];
+ long stage2_threshold_max = (*chip->temp_map)[THRESH_MAX][1];
+- bool disable_s2_shutdown = false;
++ bool disable_stage2_shutdown = false;
+ u8 reg;
+
+ WARN_ON(!mutex_is_locked(&chip->lock));
+
+ /*
+- * Default: S2 and S3 shutdown enabled, thresholds at
++ * Default: Stage 2 and Stage 3 shutdown enabled, thresholds at
+ * lowest threshold set, monitoring at 25Hz
+ */
+ reg = SHUTDOWN_CTRL1_RATE_25HZ;
+@@ -241,12 +244,12 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip,
+ chip->thresh = THRESH_MAX -
+ ((stage2_threshold_max - temp) /
+ TEMP_THRESH_STEP);
+- disable_s2_shutdown = true;
++ disable_stage2_shutdown = true;
+ } else {
+ chip->thresh = THRESH_MAX;
+
+ if (chip->adc)
+- disable_s2_shutdown = true;
++ disable_stage2_shutdown = true;
+ else
+ dev_warn(chip->dev,
+ "No ADC is configured and critical temperature %d mC is above the maximum stage 2 threshold of %ld mC! Configuring stage 2 shutdown at %ld mC.\n",
+@@ -255,8 +258,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip,
+
+ skip:
+ reg |= chip->thresh;
+- if (disable_s2_shutdown)
+- reg |= SHUTDOWN_CTRL1_OVERRIDE_S2;
++ if (disable_stage2_shutdown && !chip->require_stage2_shutdown)
++ reg |= SHUTDOWN_CTRL1_OVERRIDE_STAGE2;
+
+ return qpnp_tm_write(chip, QPNP_TM_REG_SHUTDOWN_CTRL1, reg);
+ }
+@@ -350,8 +353,8 @@ static int qpnp_tm_probe(struct platform_device *pdev)
+ {
+ struct qpnp_tm_chip *chip;
+ struct device_node *node;
+- u8 type, subtype, dig_major;
+- u32 res;
++ u8 type, subtype, dig_major, dig_minor;
++ u32 res, dig_revision;
+ int ret, irq;
+
+ node = pdev->dev.of_node;
+@@ -402,6 +405,11 @@ static int qpnp_tm_probe(struct platform_device *pdev)
+ return dev_err_probe(&pdev->dev, ret,
+ "could not read dig_major\n");
+
++ ret = qpnp_tm_read(chip, QPNP_TM_REG_DIG_MINOR, &dig_minor);
++ if (ret < 0)
++ return dev_err_probe(&pdev->dev, ret,
++ "could not read dig_minor\n");
++
+ if (type != QPNP_TM_TYPE || (subtype != QPNP_TM_SUBTYPE_GEN1
+ && subtype != QPNP_TM_SUBTYPE_GEN2)) {
+ dev_err(&pdev->dev, "invalid type 0x%02x or subtype 0x%02x\n",
+@@ -415,6 +423,23 @@ static int qpnp_tm_probe(struct platform_device *pdev)
+ else
+ chip->temp_map = &temp_map_gen1;
+
++ if (chip->subtype == QPNP_TM_SUBTYPE_GEN2) {
++ dig_revision = (dig_major << 8) | dig_minor;
++ /*
++ * Check if stage 2 automatic partial shutdown must remain
++ * enabled to avoid potential repeated faults upon reaching
++ * over-temperature stage 3.
++ */
++ switch (dig_revision) {
++ case 0x0001:
++ case 0x0002:
++ case 0x0100:
++ case 0x0101:
++ chip->require_stage2_shutdown = true;
++ break;
++ }
++ }
++
+ /*
+ * Register the sensor before initializing the hardware to be able to
+ * read the trip points. get_temp() returns the default temperature
+--
+2.39.5
+
--- /dev/null
+From 7f7976ed6630866897d3c0bc45f5f61421048e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 10:41:43 +0000
+Subject: thermal: sysfs: Return ENODATA instead of EAGAIN for reads
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit 1a4aabc27e95674837f2e25f4ef340c0469e6203 ]
+
+According to POSIX spec, EAGAIN returned by read with O_NONBLOCK set
+means the read would block. Hence, the common implementation in
+nonblocking model will poll the file when the nonblocking read returns
+EAGAIN. However, when the target file is thermal zone, this mechanism
+will totally malfunction because thermal zone doesn't implement sysfs
+notification and thus the poll will never return.
+
+For example, the read in Golang implemnts such method and sometimes
+hangs at reading some thermal zones via sysfs.
+
+Change to return -ENODATA instead of -EAGAIN to userspace.
+
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://patch.msgid.link/20250620-temp-v3-1-6becc6aeb66c@chromium.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_sysfs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
+index 24b9055a0b6c..d80612506a33 100644
+--- a/drivers/thermal/thermal_sysfs.c
++++ b/drivers/thermal/thermal_sysfs.c
+@@ -40,10 +40,13 @@ temp_show(struct device *dev, struct device_attribute *attr, char *buf)
+
+ ret = thermal_zone_get_temp(tz, &temperature);
+
+- if (ret)
+- return ret;
++ if (!ret)
++ return sprintf(buf, "%d\n", temperature);
+
+- return sprintf(buf, "%d\n", temperature);
++ if (ret == -EAGAIN)
++ return -ENODATA;
++
++ return ret;
+ }
+
+ static ssize_t
+--
+2.39.5
+
--- /dev/null
+From 3c40c015f8960793afe4a07eaca68c6b4c76045f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 13:00:27 +0200
+Subject: tools/build: Fix s390(x) cross-compilation with clang
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit a40f0cdce78be8a559ee8a85c908049c65a410b2 ]
+
+The heuristic to derive a clang target triple from a GCC one does not work
+for s390. GCC uses "s390-linux" while clang expects "s390x-linux" or
+"powerz-linux".
+
+Add an explicit override.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://lore.kernel.org/r/20250620-tools-cross-s390-v2-1-ecda886e00e5@linutronix.de
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/scripts/Makefile.include | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
+index 5158250988ce..ded48263dd5e 100644
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -101,7 +101,9 @@ else ifneq ($(CROSS_COMPILE),)
+ # Allow userspace to override CLANG_CROSS_FLAGS to specify their own
+ # sysroots and flags or to avoid the GCC call in pure Clang builds.
+ ifeq ($(CLANG_CROSS_FLAGS),)
+-CLANG_CROSS_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%))
++CLANG_TARGET := $(notdir $(CROSS_COMPILE:%-=%))
++CLANG_TARGET := $(subst s390-linux,s390x-linux,$(CLANG_TARGET))
++CLANG_CROSS_FLAGS := --target=$(CLANG_TARGET)
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)gcc 2>/dev/null))
+ ifneq ($(GCC_TOOLCHAIN_DIR),)
+ CLANG_CROSS_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
+--
+2.39.5
+
--- /dev/null
+From 60c264c81288cb5e9750feeda179d96ddaa93144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Jul 2025 11:00:55 +0200
+Subject: tools/nolibc: define time_t in terms of __kernel_old_time_t
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit d5094bcb5bfdfea2cf0de8aaf77cc65db56cbdb5 ]
+
+Nolibc assumes that the kernel ABI is using a time values that are as
+large as a long integer. For most ABIs this holds true.
+But for x32 this is not correct, as it uses 32bit longs but 64bit times.
+
+Also the 'struct stat' implementation of nolibc relies on timespec::tv_sec
+and time_t being the same type. While timespec::tv_sec comes from the
+kernel and is of type __kernel_old_time_t, time_t is defined within nolibc.
+
+Switch to the __kernel_old_time_t to always get the correct type.
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/r/20250712-nolibc-x32-v1-1-6d81cb798710@weissschuh.net
+Acked-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index 933bc0be7e1c..a9d8b5b51f37 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -20,6 +20,8 @@
+
+ #include "stdint.h"
+
++#include <linux/types.h>
++
+ /* those are commonly provided by sys/types.h */
+ typedef unsigned int dev_t;
+ typedef unsigned long ino_t;
+@@ -31,6 +33,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef signed long time_t;
++typedef __kernel_old_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.39.5
+
--- /dev/null
+From 2cdb4c525db848a25ac42c631f67693f198989cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 09:54:23 -0700
+Subject: tools/power turbostat: Fix build with musl
+
+From: Calvin Owens <calvin@wbinvd.org>
+
+[ Upstream commit 6ea0ec1b958a84aff9f03fb0ae4613a4d5bed3ea ]
+
+turbostat.c: In function 'parse_int_file':
+ turbostat.c:5567:19: error: 'PATH_MAX' undeclared (first use in this function)
+ 5567 | char path[PATH_MAX];
+ | ^~~~~~~~
+
+ turbostat.c: In function 'probe_graphics':
+ turbostat.c:6787:19: error: 'PATH_MAX' undeclared (first use in this function)
+ 6787 | char path[PATH_MAX];
+ | ^~~~~~~~
+
+Signed-off-by: Calvin Owens <calvin@wbinvd.org>
+Reviewed-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 3e97b69b1dfb..2c77ec8df67d 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -67,6 +67,7 @@
+ #include <stdbool.h>
+ #include <assert.h>
+ #include <linux/kernel.h>
++#include <limits.h>
+
+ #define UNUSED(x) (void)(x)
+
+--
+2.39.5
+
--- /dev/null
+From 87a38814bb4acd9f582eba3bcf815a508cc49487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 19:20:28 -0700
+Subject: tools/power turbostat: Handle cap_get_proc() ENOSYS
+
+From: Calvin Owens <calvin@wbinvd.org>
+
+[ Upstream commit d34fe509f5f76d9dc36291242d67c6528027ebbd ]
+
+Kernels configured with CONFIG_MULTIUSER=n have no cap_get_proc().
+Check for ENOSYS to recognize this case, and continue on to
+attempt to access the requested MSRs (such as temperature).
+
+Signed-off-by: Calvin Owens <calvin@wbinvd.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 2c77ec8df67d..dd3c32ab9ec1 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -6527,8 +6527,16 @@ int check_for_cap_sys_rawio(void)
+ int ret = 0;
+
+ caps = cap_get_proc();
+- if (caps == NULL)
++ if (caps == NULL) {
++ /*
++ * CONFIG_MULTIUSER=n kernels have no cap_get_proc()
++ * Allow them to continue and attempt to access MSRs
++ */
++ if (errno == ENOSYS)
++ return 0;
++
+ return 1;
++ }
+
+ if (cap_get_flag(caps, CAP_SYS_RAWIO, CAP_EFFECTIVE, &cap_flag_value)) {
+ ret = 1;
+--
+2.39.5
+
--- /dev/null
+From 2db8dbbccb1242598be4a42e89d761851b2e6c13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 16:31:31 -0400
+Subject: tools/power turbostat: Handle non-root legacy-uncore sysfs
+ permissions
+
+From: Len Brown <len.brown@intel.com>
+
+[ Upstream commit e60a13bcef206795d3ddf82f130fe8f570176d06 ]
+
+/sys/devices/system/cpu/intel_uncore_frequency/package_X_die_Y/
+may be readable by all, but
+/sys/devices/system/cpu/intel_uncore_frequency/package_X_die_Y/current_freq_khz
+may be readable only by root.
+
+Non-root turbostat users see complaints in this scenario.
+
+Fail probe of the interface if we can't read current_freq_khz.
+
+Reported-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Original-patch-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 444b6bfb4683..3e97b69b1dfb 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -6690,7 +6690,8 @@ static void probe_intel_uncore_frequency_legacy(void)
+ sprintf(path_base, "/sys/devices/system/cpu/intel_uncore_frequency/package_%02d_die_%02d", i,
+ j);
+
+- if (access(path_base, R_OK))
++ sprintf(path, "%s/current_freq_khz", path_base);
++ if (access(path, R_OK))
+ continue;
+
+ BIC_PRESENT(BIC_UNCORE_MHZ);
+--
+2.39.5
+
--- /dev/null
+From 4215a9572a1187048d9222475bd35ca3b1ca797d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 02:21:24 +0300
+Subject: tpm: Check for completion after timeout
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+[ Upstream commit d4640c394f23b202a89512346cf28f6622a49031 ]
+
+The current implementation of timeout detection works in the following
+way:
+
+1. Read completion status. If completed, return the data
+2. Sleep for some time (usleep_range)
+3. Check for timeout using current jiffies value. Return an error if
+ timed out
+4. Goto 1
+
+usleep_range doesn't guarantee it's always going to wake up strictly in
+(min, max) range, so such a situation is possible:
+
+1. Driver reads completion status. No completion yet
+2. Process sleeps indefinitely. In the meantime, TPM responds
+3. We check for timeout without checking for the completion again.
+ Result is lost.
+
+Such a situation also happens for the guest VMs: if vCPU goes to sleep
+and doesn't get scheduled for some time, the guest TPM driver will
+timeout instantly after waking up without checking for the completion
+(which may already be in place).
+
+Perform the completion check once again after exiting the busy loop in
+order to give the device the last chance to send us some data.
+
+Since now we check for completion in two places, extract this check into
+a separate function.
+
+Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Reviewed-by: Jonathan McDowell <noodles@meta.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm-interface.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 8d7e4da6ed53..8d18b33aa62d 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -82,6 +82,13 @@ static bool tpm_chip_req_canceled(struct tpm_chip *chip, u8 status)
+ return chip->ops->req_canceled(chip, status);
+ }
+
++static bool tpm_transmit_completed(u8 status, struct tpm_chip *chip)
++{
++ u8 status_masked = status & chip->ops->req_complete_mask;
++
++ return status_masked == chip->ops->req_complete_val;
++}
++
+ static ssize_t tpm_try_transmit(struct tpm_chip *chip, void *buf, size_t bufsiz)
+ {
+ struct tpm_header *header = buf;
+@@ -129,8 +136,7 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, void *buf, size_t bufsiz)
+ stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
+ do {
+ u8 status = tpm_chip_status(chip);
+- if ((status & chip->ops->req_complete_mask) ==
+- chip->ops->req_complete_val)
++ if (tpm_transmit_completed(status, chip))
+ goto out_recv;
+
+ if (tpm_chip_req_canceled(chip, status)) {
+@@ -142,6 +148,13 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, void *buf, size_t bufsiz)
+ rmb();
+ } while (time_before(jiffies, stop));
+
++ /*
++ * Check for completion one more time, just in case the device reported
++ * it while the driver was sleeping in the busy loop above.
++ */
++ if (tpm_transmit_completed(tpm_chip_status(chip), chip))
++ goto out_recv;
++
+ tpm_chip_cancel(chip);
+ dev_err(&chip->dev, "Operation Timed out\n");
+ return -ETIME;
+--
+2.39.5
+
--- /dev/null
+From 182f1454e506b8baf70bbde41e85024165cf8cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jul 2025 13:27:46 +0300
+Subject: tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's built-in
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yeoreum Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit 746d9e9f62a6e8ba0eba2b83fc61cfe7fa8797ce ]
+
+To generate the boot_aggregate log in the IMA subsystem using TPM PCR
+values, the TPM driver must be built as built-in and must be probed
+before the IMA subsystem is initialized.
+
+However, when the TPM device operates over the FF-A protocol using the
+CRB interface, probing fails and returns -EPROBE_DEFER if the
+tpm_crb_ffa device — an FF-A device that provides the communication
+interface to the tpm_crb driver — has not yet been probed.
+
+This issue occurs because both crb_acpi_driver_init() and
+tpm_crb_ffa_driver_init() are registered with device_initcall. As a
+result, crb_acpi_driver_init() may be invoked before
+tpm_crb_ffa_driver_init(), which is responsible for probing the
+tpm_crb_ffa device.
+
+When this happens, IMA fails to detect the TPM device and logs the
+following message:
+
+ | ima: No TPM chip found, activating TPM-bypass!
+
+Consequently, it cannot generate the boot_aggregate log with the PCR
+values provided by the TPM.
+
+To resolve this issue, the tpm_crb_ffa_init() function explicitly
+attempts to probe the tpm_crb_ffa by register tpm_crb_ffa driver so that
+when tpm_crb_ffa device is created before tpm_crb_ffa_init(), probe the
+tpm_crb_ffa device in tpm_crb_ffa_init() to finish probe the TPM device
+completely.
+
+This ensures that the TPM device using CRB over FF-A can be successfully
+probed, even if crb_acpi_driver_init() is called first.
+
+[ jarkko: reformatted some of the paragraphs because they were going past
+ the 75 character boundary. ]
+
+Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_crb_ffa.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_crb_ffa.c b/drivers/char/tpm/tpm_crb_ffa.c
+index 3169a87a56b6..430b99c04124 100644
+--- a/drivers/char/tpm/tpm_crb_ffa.c
++++ b/drivers/char/tpm/tpm_crb_ffa.c
+@@ -109,6 +109,7 @@ struct tpm_crb_ffa {
+ };
+
+ static struct tpm_crb_ffa *tpm_crb_ffa;
++static struct ffa_driver tpm_crb_ffa_driver;
+
+ static int tpm_crb_ffa_to_linux_errno(int errno)
+ {
+@@ -162,13 +163,23 @@ static int tpm_crb_ffa_to_linux_errno(int errno)
+ */
+ int tpm_crb_ffa_init(void)
+ {
++ int ret = 0;
++
++ if (!IS_MODULE(CONFIG_TCG_ARM_CRB_FFA)) {
++ ret = ffa_register(&tpm_crb_ffa_driver);
++ if (ret) {
++ tpm_crb_ffa = ERR_PTR(-ENODEV);
++ return ret;
++ }
++ }
++
+ if (!tpm_crb_ffa)
+- return -ENOENT;
++ ret = -ENOENT;
+
+ if (IS_ERR_VALUE(tpm_crb_ffa))
+- return -ENODEV;
++ ret = -ENODEV;
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(tpm_crb_ffa_init);
+
+@@ -341,7 +352,9 @@ static struct ffa_driver tpm_crb_ffa_driver = {
+ .id_table = tpm_crb_ffa_device_id,
+ };
+
++#ifdef MODULE
+ module_ffa_driver(tpm_crb_ffa_driver);
++#endif
+
+ MODULE_AUTHOR("Arm");
+ MODULE_DESCRIPTION("TPM CRB FFA driver");
+--
+2.39.5
+
--- /dev/null
+From 4915b62ad4ad880b7dff61751ba36afab2e59253 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 12:18:15 -0400
+Subject: tracefs: Add d_delete to remove negative dentries
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+[ Upstream commit d9b13cdad80dc11d74408cf201939a946e9303a6 ]
+
+If a lookup in tracefs is done on a file that does not exist, it leaves a
+dentry hanging around until memory pressure removes it. But eventfs
+dentries should hang around as when their ref count goes to zero, it
+requires more work to recreate it. For the rest of the tracefs dentries,
+they hang around as their dentry is used as a descriptor for the tracing
+system. But if a file lookup happens for a file in tracefs that does not
+exist, it should be deleted.
+
+Add a .d_delete callback that checks if dentry->fsdata is set or not. Only
+eventfs dentries set fsdata so if it has content it should not be deleted
+and should hang around in the cache.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/tracefs/inode.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
+index cb1af30b49f5..2c4a0c0202f6 100644
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -465,9 +465,20 @@ static int tracefs_d_revalidate(struct inode *inode, const struct qstr *name,
+ return !(ei && ei->is_freed);
+ }
+
++static int tracefs_d_delete(const struct dentry *dentry)
++{
++ /*
++ * We want to keep eventfs dentries around but not tracefs
++ * ones. eventfs dentries have content in d_fsdata.
++ * Use d_fsdata to determine if it's a eventfs dentry or not.
++ */
++ return dentry->d_fsdata == NULL;
++}
++
+ static const struct dentry_operations tracefs_dentry_operations = {
+ .d_revalidate = tracefs_d_revalidate,
+ .d_release = tracefs_d_release,
++ .d_delete = tracefs_d_delete,
+ };
+
+ static int tracefs_fill_super(struct super_block *sb, struct fs_context *fc)
+--
+2.39.5
+
--- /dev/null
+From 39e3a2cd110bfd0b1272313d7a1c9bfab916b165 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 23:56:53 -0700
+Subject: tty: serial: fix print format specifiers
+
+From: Joseph Tilahun <jtilahun@astranis.com>
+
+[ Upstream commit 33a2515abd45c64911955ff1da179589db54f99f ]
+
+The serial info sometimes produces negative TX/RX counts. E.g.:
+
+3: uart:FSL_LPUART mmio:0x02970000 irq:46 tx:-1595870545 rx:339619
+RTS|CTS|DTR|DSR|CD
+
+It appears that the print format specifiers don't match with the types of
+the respective variables. E.g.: All of the fields in struct uart_icount
+are u32, but the format specifier used is %d, even though u32 is unsigned
+and %d is for signed integers. Update drivers/tty/serial/serial_core.c
+to use the proper format specifiers. Reference
+https://docs.kernel.org/core-api/printk-formats.html as the documentation
+for what format specifiers are the proper ones to use for a given C type.
+
+Signed-off-by: Joseph Tilahun <jtilahun@astranis.com>
+Link: https://lore.kernel.org/r/20250610065653.3750067-1-jtilahun@astranis.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/serial_core.c | 44 ++++++++++++++++----------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 88669972d9a0..8658377dbe1c 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1337,28 +1337,28 @@ static void uart_sanitize_serial_rs485_delays(struct uart_port *port,
+ if (!port->rs485_supported.delay_rts_before_send) {
+ if (rs485->delay_rts_before_send) {
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): RTS delay before sending not supported\n",
++ "%s (%u): RTS delay before sending not supported\n",
+ port->name, port->line);
+ }
+ rs485->delay_rts_before_send = 0;
+ } else if (rs485->delay_rts_before_send > RS485_MAX_RTS_DELAY) {
+ rs485->delay_rts_before_send = RS485_MAX_RTS_DELAY;
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): RTS delay before sending clamped to %u ms\n",
++ "%s (%u): RTS delay before sending clamped to %u ms\n",
+ port->name, port->line, rs485->delay_rts_before_send);
+ }
+
+ if (!port->rs485_supported.delay_rts_after_send) {
+ if (rs485->delay_rts_after_send) {
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): RTS delay after sending not supported\n",
++ "%s (%u): RTS delay after sending not supported\n",
+ port->name, port->line);
+ }
+ rs485->delay_rts_after_send = 0;
+ } else if (rs485->delay_rts_after_send > RS485_MAX_RTS_DELAY) {
+ rs485->delay_rts_after_send = RS485_MAX_RTS_DELAY;
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): RTS delay after sending clamped to %u ms\n",
++ "%s (%u): RTS delay after sending clamped to %u ms\n",
+ port->name, port->line, rs485->delay_rts_after_send);
+ }
+ }
+@@ -1388,14 +1388,14 @@ static void uart_sanitize_serial_rs485(struct uart_port *port, struct serial_rs4
+ rs485->flags &= ~SER_RS485_RTS_AFTER_SEND;
+
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): invalid RTS setting, using RTS_ON_SEND instead\n",
++ "%s (%u): invalid RTS setting, using RTS_ON_SEND instead\n",
+ port->name, port->line);
+ } else {
+ rs485->flags |= SER_RS485_RTS_AFTER_SEND;
+ rs485->flags &= ~SER_RS485_RTS_ON_SEND;
+
+ dev_warn_ratelimited(port->dev,
+- "%s (%d): invalid RTS setting, using RTS_AFTER_SEND instead\n",
++ "%s (%u): invalid RTS setting, using RTS_AFTER_SEND instead\n",
+ port->name, port->line);
+ }
+ }
+@@ -1834,7 +1834,7 @@ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+
+ expire = jiffies + timeout;
+
+- pr_debug("uart_wait_until_sent(%d), jiffies=%lu, expire=%lu...\n",
++ pr_debug("uart_wait_until_sent(%u), jiffies=%lu, expire=%lu...\n",
+ port->line, jiffies, expire);
+
+ /*
+@@ -2029,7 +2029,7 @@ static void uart_line_info(struct seq_file *m, struct uart_state *state)
+ return;
+
+ mmio = uport->iotype >= UPIO_MEM;
+- seq_printf(m, "%d: uart:%s %s%08llX irq:%d",
++ seq_printf(m, "%u: uart:%s %s%08llX irq:%u",
+ uport->line, uart_type(uport),
+ mmio ? "mmio:0x" : "port:",
+ mmio ? (unsigned long long)uport->mapbase
+@@ -2051,18 +2051,18 @@ static void uart_line_info(struct seq_file *m, struct uart_state *state)
+ if (pm_state != UART_PM_STATE_ON)
+ uart_change_pm(state, pm_state);
+
+- seq_printf(m, " tx:%d rx:%d",
++ seq_printf(m, " tx:%u rx:%u",
+ uport->icount.tx, uport->icount.rx);
+ if (uport->icount.frame)
+- seq_printf(m, " fe:%d", uport->icount.frame);
++ seq_printf(m, " fe:%u", uport->icount.frame);
+ if (uport->icount.parity)
+- seq_printf(m, " pe:%d", uport->icount.parity);
++ seq_printf(m, " pe:%u", uport->icount.parity);
+ if (uport->icount.brk)
+- seq_printf(m, " brk:%d", uport->icount.brk);
++ seq_printf(m, " brk:%u", uport->icount.brk);
+ if (uport->icount.overrun)
+- seq_printf(m, " oe:%d", uport->icount.overrun);
++ seq_printf(m, " oe:%u", uport->icount.overrun);
+ if (uport->icount.buf_overrun)
+- seq_printf(m, " bo:%d", uport->icount.buf_overrun);
++ seq_printf(m, " bo:%u", uport->icount.buf_overrun);
+
+ #define INFOBIT(bit, str) \
+ if (uport->mctrl & (bit)) \
+@@ -2554,7 +2554,7 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
+ break;
+ }
+
+- pr_info("%s%s%s at %s (irq = %d, base_baud = %d) is a %s\n",
++ pr_info("%s%s%s at %s (irq = %u, base_baud = %u) is a %s\n",
+ port->dev ? dev_name(port->dev) : "",
+ port->dev ? ": " : "",
+ port->name,
+@@ -2562,7 +2562,7 @@ uart_report_port(struct uart_driver *drv, struct uart_port *port)
+
+ /* The magic multiplier feature is a bit obscure, so report it too. */
+ if (port->flags & UPF_MAGIC_MULTIPLIER)
+- pr_info("%s%s%s extra baud rates supported: %d, %d",
++ pr_info("%s%s%s extra baud rates supported: %u, %u",
+ port->dev ? dev_name(port->dev) : "",
+ port->dev ? ": " : "",
+ port->name,
+@@ -2961,7 +2961,7 @@ static ssize_t close_delay_show(struct device *dev,
+ struct tty_port *port = dev_get_drvdata(dev);
+
+ uart_get_info(port, &tmp);
+- return sprintf(buf, "%d\n", tmp.close_delay);
++ return sprintf(buf, "%u\n", tmp.close_delay);
+ }
+
+ static ssize_t closing_wait_show(struct device *dev,
+@@ -2971,7 +2971,7 @@ static ssize_t closing_wait_show(struct device *dev,
+ struct tty_port *port = dev_get_drvdata(dev);
+
+ uart_get_info(port, &tmp);
+- return sprintf(buf, "%d\n", tmp.closing_wait);
++ return sprintf(buf, "%u\n", tmp.closing_wait);
+ }
+
+ static ssize_t custom_divisor_show(struct device *dev,
+@@ -2991,7 +2991,7 @@ static ssize_t io_type_show(struct device *dev,
+ struct tty_port *port = dev_get_drvdata(dev);
+
+ uart_get_info(port, &tmp);
+- return sprintf(buf, "%d\n", tmp.io_type);
++ return sprintf(buf, "%u\n", tmp.io_type);
+ }
+
+ static ssize_t iomem_base_show(struct device *dev,
+@@ -3011,7 +3011,7 @@ static ssize_t iomem_reg_shift_show(struct device *dev,
+ struct tty_port *port = dev_get_drvdata(dev);
+
+ uart_get_info(port, &tmp);
+- return sprintf(buf, "%d\n", tmp.iomem_reg_shift);
++ return sprintf(buf, "%u\n", tmp.iomem_reg_shift);
+ }
+
+ static ssize_t console_show(struct device *dev,
+@@ -3147,7 +3147,7 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
+ state->pm_state = UART_PM_STATE_UNDEFINED;
+ uart_port_set_cons(uport, drv->cons);
+ uport->minor = drv->tty_driver->minor_start + uport->line;
+- uport->name = kasprintf(GFP_KERNEL, "%s%d", drv->dev_name,
++ uport->name = kasprintf(GFP_KERNEL, "%s%u", drv->dev_name,
+ drv->tty_driver->name_base + uport->line);
+ if (!uport->name)
+ return -ENOMEM;
+@@ -3186,7 +3186,7 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
+ device_set_wakeup_capable(tty_dev, 1);
+ } else {
+ uport->flags |= UPF_DEAD;
+- dev_err(uport->dev, "Cannot register tty device on line %d\n",
++ dev_err(uport->dev, "Cannot register tty device on line %u\n",
+ uport->line);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From d8add09e7aa7cbb829774e1af2d3d0d3ff15276b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 07:39:33 -0700
+Subject: uapi: in6: restore visibility of most IPv6 socket options
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 31557b3487b349464daf42bc4366153743c1e727 ]
+
+A decade ago commit 6d08acd2d32e ("in6: fix conflict with glibc")
+hid the definitions of IPV6 options, because GCC was complaining
+about duplicates. The commit did not list the warnings seen, but
+trying to recreate them now I think they are (building iproute2):
+
+In file included from ./include/uapi/rdma/rdma_user_cm.h:39,
+ from rdma.h:16,
+ from res.h:9,
+ from res-ctx.c:7:
+../include/uapi/linux/in6.h:171:9: warning: ‘IPV6_ADD_MEMBERSHIP’ redefined
+ 171 | #define IPV6_ADD_MEMBERSHIP 20
+ | ^~~~~~~~~~~~~~~~~~~
+In file included from /usr/include/netinet/in.h:37,
+ from rdma.h:13:
+/usr/include/bits/in.h:233:10: note: this is the location of the previous definition
+ 233 | # define IPV6_ADD_MEMBERSHIP IPV6_JOIN_GROUP
+ | ^~~~~~~~~~~~~~~~~~~
+../include/uapi/linux/in6.h:172:9: warning: ‘IPV6_DROP_MEMBERSHIP’ redefined
+ 172 | #define IPV6_DROP_MEMBERSHIP 21
+ | ^~~~~~~~~~~~~~~~~~~~
+/usr/include/bits/in.h:234:10: note: this is the location of the previous definition
+ 234 | # define IPV6_DROP_MEMBERSHIP IPV6_LEAVE_GROUP
+ | ^~~~~~~~~~~~~~~~~~~~
+
+Compilers don't complain about redefinition if the defines
+are identical, but here we have the kernel using the literal
+value, and glibc using an indirection (defining to a name
+of another define, with the same numerical value).
+
+Problem is, the commit in question hid all the IPV6 socket
+options, and glibc has a pretty sparse list. For instance
+it lacks Flow Label related options. Willem called this out
+in commit 3fb321fde22d ("selftests/net: ipv6 flowlabel"):
+
+ /* uapi/glibc weirdness may leave this undefined */
+ #ifndef IPV6_FLOWINFO
+ #define IPV6_FLOWINFO 11
+ #endif
+
+More interestingly some applications (socat) use
+a #ifdef IPV6_FLOWINFO to gate compilation of thier
+rudimentary flow label support. (For added confusion
+socat misspells it as IPV4_FLOWINFO in some places.)
+
+Hide only the two defines we know glibc has a problem
+with. If we discover more warnings we can hide more
+but we should avoid covering the entire block of
+defines for "IPV6 socket options".
+
+Link: https://patch.msgid.link/20250609143933.1654417-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/in6.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
+index ff8d21f9e95b..5a47339ef7d7 100644
+--- a/include/uapi/linux/in6.h
++++ b/include/uapi/linux/in6.h
+@@ -152,7 +152,6 @@ struct in6_flowlabel_req {
+ /*
+ * IPV6 socket options
+ */
+-#if __UAPI_DEF_IPV6_OPTIONS
+ #define IPV6_ADDRFORM 1
+ #define IPV6_2292PKTINFO 2
+ #define IPV6_2292HOPOPTS 3
+@@ -169,8 +168,10 @@ struct in6_flowlabel_req {
+ #define IPV6_MULTICAST_IF 17
+ #define IPV6_MULTICAST_HOPS 18
+ #define IPV6_MULTICAST_LOOP 19
++#if __UAPI_DEF_IPV6_OPTIONS
+ #define IPV6_ADD_MEMBERSHIP 20
+ #define IPV6_DROP_MEMBERSHIP 21
++#endif
+ #define IPV6_ROUTER_ALERT 22
+ #define IPV6_MTU_DISCOVER 23
+ #define IPV6_MTU 24
+@@ -203,7 +204,6 @@ struct in6_flowlabel_req {
+ #define IPV6_IPSEC_POLICY 34
+ #define IPV6_XFRM_POLICY 35
+ #define IPV6_HDRINCL 36
+-#endif
+
+ /*
+ * Multicast:
+--
+2.39.5
+
--- /dev/null
+From 2ed48f4997cccd66cc4fb9c835c74eed6e3bf28c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 19:01:20 +0200
+Subject: udf: Verify partition map count
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 1a11201668e8635602577dcf06f2e96c591d8819 ]
+
+Verify that number of partition maps isn't insanely high which can lead
+to large allocation in udf_sb_alloc_partition_maps(). All partition maps
+have to fit in the LVD which is in a single block.
+
+Reported-by: syzbot+478f2c1a6f0f447a46bb@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 1c8a736b3309..b2f168b0a0d1 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1440,7 +1440,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ struct genericPartitionMap *gpm;
+ uint16_t ident;
+ struct buffer_head *bh;
+- unsigned int table_len;
++ unsigned int table_len, part_map_count;
+ int ret;
+
+ bh = udf_read_tagged(sb, block, block, &ident);
+@@ -1461,7 +1461,16 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ "logical volume");
+ if (ret)
+ goto out_bh;
+- ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
++
++ part_map_count = le32_to_cpu(lvd->numPartitionMaps);
++ if (part_map_count > table_len / sizeof(struct genericPartitionMap1)) {
++ udf_err(sb, "error loading logical volume descriptor: "
++ "Too many partition maps (%u > %u)\n", part_map_count,
++ table_len / (unsigned)sizeof(struct genericPartitionMap1));
++ ret = -EIO;
++ goto out_bh;
++ }
++ ret = udf_sb_alloc_partition_maps(sb, part_map_count);
+ if (ret)
+ goto out_bh;
+
+--
+2.39.5
+
--- /dev/null
+From 95b0aab50e3d37e0eee4eed23a250d2c822e3ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 14:34:47 +0200
+Subject: um: Re-evaluate thread flags repeatedly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b9e2f2246eb2b5617d53af7b5e4e1b8c916f26a8 ]
+
+The thread flags may change during their processing.
+For example a task_work can queue a new signal to be sent.
+This signal should be delivered before returning to usespace again.
+
+Evaluate the flags repeatedly similar to other architectures.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Link: https://patch.msgid.link/20250704-uml-thread_flags-v1-1-0e293fd8d627@linutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/asm/thread_info.h | 4 ++++
+ arch/um/kernel/process.c | 20 ++++++++++++--------
+ 2 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
+index f9ad06fcc991..eb9b3a6d99e8 100644
+--- a/arch/um/include/asm/thread_info.h
++++ b/arch/um/include/asm/thread_info.h
+@@ -50,7 +50,11 @@ struct thread_info {
+ #define _TIF_NOTIFY_SIGNAL (1 << TIF_NOTIFY_SIGNAL)
+ #define _TIF_MEMDIE (1 << TIF_MEMDIE)
+ #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
++#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
+ #define _TIF_SECCOMP (1 << TIF_SECCOMP)
+ #define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP)
+
++#define _TIF_WORK_MASK (_TIF_NEED_RESCHED | _TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL | \
++ _TIF_NOTIFY_RESUME)
++
+ #endif
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 0cd6fad3d908..1be644de9e41 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -82,14 +82,18 @@ struct task_struct *__switch_to(struct task_struct *from, struct task_struct *to
+ void interrupt_end(void)
+ {
+ struct pt_regs *regs = ¤t->thread.regs;
+-
+- if (need_resched())
+- schedule();
+- if (test_thread_flag(TIF_SIGPENDING) ||
+- test_thread_flag(TIF_NOTIFY_SIGNAL))
+- do_signal(regs);
+- if (test_thread_flag(TIF_NOTIFY_RESUME))
+- resume_user_mode_work(regs);
++ unsigned long thread_flags;
++
++ thread_flags = read_thread_flags();
++ while (thread_flags & _TIF_WORK_MASK) {
++ if (thread_flags & _TIF_NEED_RESCHED)
++ schedule();
++ if (thread_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL))
++ do_signal(regs);
++ if (thread_flags & _TIF_NOTIFY_RESUME)
++ resume_user_mode_work(regs);
++ thread_flags = read_thread_flags();
++ }
+ }
+
+ int get_current_pid(void)
+--
+2.39.5
+
--- /dev/null
+From 814b740bd108013eda41312fda715b7ed42d281b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 14:20:25 +0200
+Subject: usb: core: usb_submit_urb: downgrade type check
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit 503bbde34cc3dd2acd231f277ba70c3f9ed22e59 ]
+
+Checking for the endpoint type is no reason for a WARN, as that can
+cause a reboot. A driver not checking the endpoint type must not cause a
+reboot, as there is just no point in this. We cannot prevent a device
+from doing something incorrect as a reaction to a transfer. Hence
+warning for a mere assumption being wrong is not sensible.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20250612122149.2559724-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/urb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index 5e52a35486af..120de3c499d2 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -500,7 +500,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+
+ /* Check that the pipe's type matches the endpoint's type */
+ if (usb_pipe_type_check(urb->dev, urb->pipe))
+- dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
++ dev_warn_once(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
+ usb_pipetype(urb->pipe), pipetypes[xfertype]);
+
+ /* Check against a simple/standard policy */
+--
+2.39.5
+
--- /dev/null
+From e2261c2c91dc84cd287cdb85952555a753269526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jun 2025 00:39:31 +0530
+Subject: usb: dwc3: xilinx: add shutdown callback
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 70627bf82e36e61c40c3315e1206e4ea4c02e668 ]
+
+Adds a shutdown callback to ensure that the XHCI stack is properly
+shutdown in reboot/shutdown path.
+
+In kexec flow, kernel_restart_prepare() performs actions necessary
+to prepare the system for a restart and invokes device_shutdown. To
+ensure proper shutdown attach the dwc3 shutdown implementation which
+mirrors the remove method.
+
+$ kexec -e
+
+<snip>
+xhci-hcd xhci-hcd.0.auto: remove, state 1
+usb usb1: USB disconnect, device number 1
+usb 1-1: USB disconnect, device number 6
+xhci-hcd xhci-hcd.0.auto: USB bus 1 deregistered
+kexec_core: Starting new kernel
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/1748977771-714153-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-xilinx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-xilinx.c b/drivers/usb/dwc3/dwc3-xilinx.c
+index 4ca7f6240d07..09c3c5c226ab 100644
+--- a/drivers/usb/dwc3/dwc3-xilinx.c
++++ b/drivers/usb/dwc3/dwc3-xilinx.c
+@@ -422,6 +422,7 @@ static const struct dev_pm_ops dwc3_xlnx_dev_pm_ops = {
+ static struct platform_driver dwc3_xlnx_driver = {
+ .probe = dwc3_xlnx_probe,
+ .remove = dwc3_xlnx_remove,
++ .shutdown = dwc3_xlnx_remove,
+ .driver = {
+ .name = "dwc3-xilinx",
+ .of_match_table = dwc3_xlnx_of_match,
+--
+2.39.5
+
--- /dev/null
+From 121b23b5beaa190c76912ea41f2149fb16f6d9ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 17:40:58 +0200
+Subject: usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
+
+From: Tomasz Michalec <tmichalec@google.com>
+
+[ Upstream commit df9a825f330e76c72d1985bc9bdc4b8981e3d15f ]
+
+If pmc_usb_probe is called before SCU IPC is registered, pmc_usb_probe
+will fail.
+
+Return -EPROBE_DEFER when pmc_usb_probe doesn't get SCU IPC device, so
+the probe function can be called again after SCU IPC is initialized.
+
+Signed-off-by: Tomasz Michalec <tmichalec@google.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250610154058.1859812-1-tmichalec@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c
+index 65dda9183e6f..1698428654ab 100644
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -754,7 +754,7 @@ static int pmc_usb_probe(struct platform_device *pdev)
+
+ pmc->ipc = devm_intel_scu_ipc_dev_get(&pdev->dev);
+ if (!pmc->ipc)
+- return -ENODEV;
++ return -EPROBE_DEFER;
+
+ pmc->dev = &pdev->dev;
+
+--
+2.39.5
+
--- /dev/null
+From f04c2a9d90205acc46b59e7656d3717bb96fa7c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 11:50:27 +0100
+Subject: usb: typec: tcpm/tcpci_maxim: fix irq wake usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Draszik <andre.draszik@linaro.org>
+
+[ Upstream commit 31611223fb34a3e9320cdfc4f4395072a13ea78e ]
+
+This driver calls enable_irq_wake() during probe() unconditionally, and
+never issues the required corresponding disable_irq_wake() to disable
+hardware interrupt wakeup signals.
+
+Additionally, whether or not a device should wake-up the system is
+meant to be a policy decision based on sysfs (.../power/wakeup) in the
+first place.
+
+Update the driver to use the standard approach to enable/disable IRQ
+wake during the suspend/resume callbacks. This solves both issues
+described above.
+
+Signed-off-by: André Draszik <andre.draszik@linaro.org>
+Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20250707-max77759-irq-wake-v1-1-d367f633e4bc@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/tcpci_maxim_core.c | 46 +++++++++++++++--------
+ 1 file changed, 30 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/usb/typec/tcpm/tcpci_maxim_core.c b/drivers/usb/typec/tcpm/tcpci_maxim_core.c
+index b5a5ed40faea..ff3604be79da 100644
+--- a/drivers/usb/typec/tcpm/tcpci_maxim_core.c
++++ b/drivers/usb/typec/tcpm/tcpci_maxim_core.c
+@@ -421,21 +421,6 @@ static irqreturn_t max_tcpci_isr(int irq, void *dev_id)
+ return IRQ_WAKE_THREAD;
+ }
+
+-static int max_tcpci_init_alert(struct max_tcpci_chip *chip, struct i2c_client *client)
+-{
+- int ret;
+-
+- ret = devm_request_threaded_irq(chip->dev, client->irq, max_tcpci_isr, max_tcpci_irq,
+- (IRQF_TRIGGER_LOW | IRQF_ONESHOT), dev_name(chip->dev),
+- chip);
+-
+- if (ret < 0)
+- return ret;
+-
+- enable_irq_wake(client->irq);
+- return 0;
+-}
+-
+ static int max_tcpci_start_toggling(struct tcpci *tcpci, struct tcpci_data *tdata,
+ enum typec_cc_status cc)
+ {
+@@ -532,7 +517,9 @@ static int max_tcpci_probe(struct i2c_client *client)
+
+ chip->port = tcpci_get_tcpm_port(chip->tcpci);
+
+- ret = max_tcpci_init_alert(chip, client);
++ ret = devm_request_threaded_irq(&client->dev, client->irq, max_tcpci_isr, max_tcpci_irq,
++ (IRQF_TRIGGER_LOW | IRQF_ONESHOT), dev_name(chip->dev),
++ chip);
+ if (ret < 0)
+ return dev_err_probe(&client->dev, ret,
+ "IRQ initialization failed\n");
+@@ -544,6 +531,32 @@ static int max_tcpci_probe(struct i2c_client *client)
+ return 0;
+ }
+
++#ifdef CONFIG_PM_SLEEP
++static int max_tcpci_resume(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++ int ret = 0;
++
++ if (client->irq && device_may_wakeup(dev))
++ ret = disable_irq_wake(client->irq);
++
++ return ret;
++}
++
++static int max_tcpci_suspend(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++ int ret = 0;
++
++ if (client->irq && device_may_wakeup(dev))
++ ret = enable_irq_wake(client->irq);
++
++ return ret;
++}
++#endif /* CONFIG_PM_SLEEP */
++
++static SIMPLE_DEV_PM_OPS(max_tcpci_pm_ops, max_tcpci_suspend, max_tcpci_resume);
++
+ static const struct i2c_device_id max_tcpci_id[] = {
+ { "maxtcpc" },
+ { }
+@@ -562,6 +575,7 @@ static struct i2c_driver max_tcpci_i2c_driver = {
+ .driver = {
+ .name = "maxtcpc",
+ .of_match_table = of_match_ptr(max_tcpci_of_match),
++ .pm = &max_tcpci_pm_ops,
+ },
+ .probe = max_tcpci_probe,
+ .id_table = max_tcpci_id,
+--
+2.39.5
+
--- /dev/null
+From 18037506a25d51de1800800d8a6d8bc0c38302f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 20:20:33 +0000
+Subject: usb: typec: ucsi: Add poll_cci operation to cros_ec_ucsi
+
+From: Jameson Thies <jthies@google.com>
+
+[ Upstream commit 300386d117a98961fc1d612d1f1a61997d731b8a ]
+
+cros_ec_ucsi fails to allocate a UCSI instance in it's probe function
+because it does not define all operations checked by ucsi_create.
+Update cros_ec_ucsi operations to use the same function for read_cci
+and poll_cci.
+
+Signed-off-by: Jameson Thies <jthies@google.com>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Link: https://lore.kernel.org/r/20250711202033.2201305-1-jthies@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/cros_ec_ucsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/typec/ucsi/cros_ec_ucsi.c b/drivers/usb/typec/ucsi/cros_ec_ucsi.c
+index 4ec1c6d22310..eed2a7d0ebc6 100644
+--- a/drivers/usb/typec/ucsi/cros_ec_ucsi.c
++++ b/drivers/usb/typec/ucsi/cros_ec_ucsi.c
+@@ -137,6 +137,7 @@ static int cros_ucsi_sync_control(struct ucsi *ucsi, u64 cmd, u32 *cci,
+ static const struct ucsi_operations cros_ucsi_ops = {
+ .read_version = cros_ucsi_read_version,
+ .read_cci = cros_ucsi_read_cci,
++ .poll_cci = cros_ucsi_read_cci,
+ .read_message_in = cros_ucsi_read_message_in,
+ .async_control = cros_ucsi_async_control,
+ .sync_control = cros_ucsi_sync_control,
+--
+2.39.5
+
--- /dev/null
+From ff53a7c2dbd835f511f1e15e647daf555b1d2ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 20:08:05 +0000
+Subject: usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and
+ Default
+
+From: Benson Leung <bleung@chromium.org>
+
+[ Upstream commit af833e7f7db3cf4c82f063668e1b52297a30ec18 ]
+
+ucsi_psy_get_current_max would return 0mA as the maximum current if
+UCSI detected a BC or a Default USB Power sporce.
+
+The comment in this function is true that we can't tell the difference
+between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit
+of USB 1.1/2.0 power is available, which is 100mA, which is a better
+fallback value than 0, which causes some userspaces, including the ChromeOS
+power manager, to regard this as a power source that is not providing
+any power.
+
+In reality, 100mA is guaranteed from all sources in these classes.
+
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Jameson Thies <jthies@google.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20250717200805.3710473-1-bleung@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/psy.c | 2 +-
+ drivers/usb/typec/ucsi/ucsi.h | 7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
+index 62ac69730405..62a9d68bb66d 100644
+--- a/drivers/usb/typec/ucsi/psy.c
++++ b/drivers/usb/typec/ucsi/psy.c
+@@ -164,7 +164,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
+ case UCSI_CONSTAT_PWR_OPMODE_DEFAULT:
+ /* UCSI can't tell b/w DCP/CDP or USB2/3x1/3x2 SDP chargers */
+ default:
+- val->intval = 0;
++ val->intval = UCSI_TYPEC_DEFAULT_CURRENT * 1000;
+ break;
+ }
+ return 0;
+diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
+index 70910232a05d..1ae068a92844 100644
+--- a/drivers/usb/typec/ucsi/ucsi.h
++++ b/drivers/usb/typec/ucsi/ucsi.h
+@@ -479,9 +479,10 @@ struct ucsi {
+ #define UCSI_MAX_SVID 5
+ #define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6)
+
+-#define UCSI_TYPEC_VSAFE5V 5000
+-#define UCSI_TYPEC_1_5_CURRENT 1500
+-#define UCSI_TYPEC_3_0_CURRENT 3000
++#define UCSI_TYPEC_VSAFE5V 5000
++#define UCSI_TYPEC_DEFAULT_CURRENT 100
++#define UCSI_TYPEC_1_5_CURRENT 1500
++#define UCSI_TYPEC_3_0_CURRENT 3000
+
+ struct ucsi_connector {
+ int num;
+--
+2.39.5
+
--- /dev/null
+From 48243b433484af0cd8faf89139d7e3ceb8448228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 10:31:05 +0300
+Subject: usb: xhci: Avoid showing errors during surprise removal
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 4b9c60e440525b729ac5f071e00bcee12e0a7e84 ]
+
+When a USB4 dock is unplugged from a system it won't respond to ring
+events. The PCI core handles the surprise removal event and notifies
+all PCI drivers. The XHCI PCI driver sets a flag that the device is
+being removed as well.
+
+When that flag is set don't show messages in the cleanup path for
+marking the controller dead.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250717073107.488599-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 8be033f1877d..fc3ae7318046 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1376,12 +1376,15 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
+ */
+ void xhci_hc_died(struct xhci_hcd *xhci)
+ {
++ bool notify;
+ int i, j;
+
+ if (xhci->xhc_state & XHCI_STATE_DYING)
+ return;
+
+- xhci_err(xhci, "xHCI host controller not responding, assume dead\n");
++ notify = !(xhci->xhc_state & XHCI_STATE_REMOVING);
++ if (notify)
++ xhci_err(xhci, "xHCI host controller not responding, assume dead\n");
+ xhci->xhc_state |= XHCI_STATE_DYING;
+
+ xhci_cleanup_command_queue(xhci);
+@@ -1395,7 +1398,7 @@ void xhci_hc_died(struct xhci_hcd *xhci)
+ }
+
+ /* inform usb core hc died if PCI remove isn't already handling it */
+- if (!(xhci->xhc_state & XHCI_STATE_REMOVING))
++ if (notify)
+ usb_hc_died(xhci_to_hcd(xhci));
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 1963a711f74dd6eca7a1702a54043f84c9dde3f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 10:31:06 +0300
+Subject: usb: xhci: Avoid showing warnings for dying controller
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 65fc0fc137b5da3ee1f4ca4f61050fcb203d7582 ]
+
+When a USB4 dock is unplugged from a system it won't respond to ring
+events. The PCI core handles the surprise removal event and notifies
+all PCI drivers. The XHCI PCI driver sets a flag that the device is
+being removed, and when the device stops responding a flag is also
+added to indicate it's dying.
+
+When that flag is set don't bother to show warnings about a missing
+controller.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250717073107.488599-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index cb9f35acb1f9..cb29aa49ceba 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -120,7 +120,8 @@ int xhci_halt(struct xhci_hcd *xhci)
+ ret = xhci_handshake(&xhci->op_regs->status,
+ STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC);
+ if (ret) {
+- xhci_warn(xhci, "Host halt failed, %d\n", ret);
++ if (!(xhci->xhc_state & XHCI_STATE_DYING))
++ xhci_warn(xhci, "Host halt failed, %d\n", ret);
+ return ret;
+ }
+
+@@ -179,7 +180,8 @@ int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us)
+ state = readl(&xhci->op_regs->status);
+
+ if (state == ~(u32)0) {
+- xhci_warn(xhci, "Host not accessible, reset failed.\n");
++ if (!(xhci->xhc_state & XHCI_STATE_DYING))
++ xhci_warn(xhci, "Host not accessible, reset failed.\n");
+ return -ENODEV;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From e4c260ca9c6c680ad5c848b5e5490241c9dc698a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 14:01:18 +0800
+Subject: usb: xhci: print xhci->xhc_state when queue_command failed
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 7919407eca2ef562fa6c98c41cfdf6f6cdd69d92 ]
+
+When encounters some errors like these:
+xhci_hcd 0000:4a:00.2: xHCI dying or halted, can't queue_command
+xhci_hcd 0000:4a:00.2: FIXME: allocate a command ring segment
+usb usb5-port6: couldn't allocate usb_device
+
+It's hard to know whether xhc_state is dying or halted. So it's better
+to print xhc_state's value which can help locate the resaon of the bug.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://lore.kernel.org/r/20250725060117.1773770-1-suhui@nfschina.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index b720e04ce7d8..8be033f1877d 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -4337,7 +4337,8 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
+
+ if ((xhci->xhc_state & XHCI_STATE_DYING) ||
+ (xhci->xhc_state & XHCI_STATE_HALTED)) {
+- xhci_dbg(xhci, "xHCI dying or halted, can't queue_command\n");
++ xhci_dbg(xhci, "xHCI dying or halted, can't queue_command. state: 0x%x\n",
++ xhci->xhc_state);
+ return -ESHUTDOWN;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a1cb51760db5313145616de4625322e8cfea90fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 10:31:07 +0300
+Subject: usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
+
+From: Jay Chen <shawn2000100@gmail.com>
+
+[ Upstream commit f72b9aa821a2bfe4b6dfec4be19f264d0673b008 ]
+
+There is a subtle contradiction between sections of the xHCI 1.2 spec
+regarding the initialization of Input Endpoint Context fields. Section
+4.8.2 ("Endpoint Context Initialization") states that all fields should
+be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453)
+specifies that the Average TRB Length (avg_trb_len) field shall be
+greater than 0, and explicitly notes (p.454): "Software shall set
+Average TRB Length to '8' for control endpoints."
+
+Strictly setting all fields to 0 during initialization conflicts with
+the specific recommendation for control endpoints. In practice, setting
+avg_trb_len = 0 is not meaningful for the hardware/firmware, as the
+value is used for bandwidth calculation.
+
+Motivation: Our company is developing a custom Virtual xHC hardware
+platform that strictly follows the xHCI spec and its recommendations.
+During validation, we observed that enumeration fails and a parameter
+error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is
+not set to 8 as recommended by Section 6.2.3. This demonstrates the
+importance of assigning a meaningful, non-zero value to avg_trb_len,
+even in virtualized or emulated environments.
+
+This patch explicitly sets avg_trb_len to 8 for EP0 in
+xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to
+prevent potential issues with xHCI host controllers that enforce the
+spec strictly.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=220033
+Signed-off-by: Jay Chen <shawn2000100@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250717073107.488599-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index a5e7980ac103..2a503de0a881 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1166,6 +1166,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
+ ep0_ctx->deq = cpu_to_le64(dev->eps[0].ring->first_seg->dma |
+ dev->eps[0].ring->cycle_state);
+
++ ep0_ctx->tx_info = cpu_to_le32(EP_AVG_TRB_LENGTH(8));
++
+ trace_xhci_setup_addressable_virt_device(dev);
+
+ /* Steps 7 and 8 were done in xhci_alloc_virt_device() */
+--
+2.39.5
+
--- /dev/null
+From 6a29e66df329f99af306db491b77cb6aa2b4b3ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 15:19:57 +0200
+Subject: verification/dot2k: Make a separate dot2k_templates/Kconfig_container
+
+From: Nam Cao <namcao@linutronix.de>
+
+[ Upstream commit 214459699fd202c28b7b9f787e674acbd3af724a ]
+
+A generated container's Kconfig has an incorrect line:
+
+ select DA_MON_EVENTS_IMPLICIT
+
+This is due to container generation uses the same template Kconfig file as
+deterministic automaton monitor.
+
+Therefore, make a separate Kconfig template for container which has only
+the necessaries for container.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://lore.kernel.org/d54fd7ee120785bec5695220e837dbbd6efb30e5.1751634289.git.namcao@linutronix.de
+Reviewed-by: Gabriele Monaco <gmonaco@redhat.com>
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/verification/dot2/dot2k.py | 3 ++-
+ tools/verification/dot2/dot2k_templates/Kconfig_container | 5 +++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+ create mode 100644 tools/verification/dot2/dot2k_templates/Kconfig_container
+
+diff --git a/tools/verification/dot2/dot2k.py b/tools/verification/dot2/dot2k.py
+index 745d35a4a379..dd4b5528a4f2 100644
+--- a/tools/verification/dot2/dot2k.py
++++ b/tools/verification/dot2/dot2k.py
+@@ -35,6 +35,7 @@ class dot2k(Dot2c):
+ self.states = []
+ self.main_c = self.__read_file(self.monitor_templates_dir + "main_container.c")
+ self.main_h = self.__read_file(self.monitor_templates_dir + "main_container.h")
++ self.kconfig = self.__read_file(self.monitor_templates_dir + "Kconfig_container")
+ else:
+ super().__init__(file_path, extra_params.get("model_name"))
+
+@@ -44,7 +45,7 @@ class dot2k(Dot2c):
+ self.monitor_type = MonitorType
+ self.main_c = self.__read_file(self.monitor_templates_dir + "main.c")
+ self.trace_h = self.__read_file(self.monitor_templates_dir + "trace.h")
+- self.kconfig = self.__read_file(self.monitor_templates_dir + "Kconfig")
++ self.kconfig = self.__read_file(self.monitor_templates_dir + "Kconfig")
+ self.enum_suffix = "_%s" % self.name
+ self.description = extra_params.get("description", self.name) or "auto-generated"
+ self.auto_patch = extra_params.get("auto_patch")
+diff --git a/tools/verification/dot2/dot2k_templates/Kconfig_container b/tools/verification/dot2/dot2k_templates/Kconfig_container
+new file mode 100644
+index 000000000000..a606111949c2
+--- /dev/null
++++ b/tools/verification/dot2/dot2k_templates/Kconfig_container
+@@ -0,0 +1,5 @@
++config RV_MON_%%MODEL_NAME_UP%%
++ depends on RV
++ bool "%%MODEL_NAME%% monitor"
++ help
++ %%DESCRIPTION%%
+--
+2.39.5
+
--- /dev/null
+From a44115f86b622848e8148be935a4f8c3cad943b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 14:40:17 +0000
+Subject: vfio/mlx5: fix possible overflow in tracking max message size
+
+From: Artem Sadovnikov <a.sadovnikov@ispras.ru>
+
+[ Upstream commit b3060198483bac43ec113c62ae3837076f61f5de ]
+
+MLX cap pg_track_log_max_msg_size consists of 5 bits, value of which is
+used as power of 2 for max_msg_size. This can lead to multiplication
+overflow between max_msg_size (u32) and integer constant, and afterwards
+incorrect value is being written to rq_size.
+
+Fix this issue by extending integer constant to u64 type.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Artem Sadovnikov <a.sadovnikov@ispras.ru>
+Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
+Link: https://lore.kernel.org/r/20250701144017.2410-2-a.sadovnikov@ispras.ru
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/mlx5/cmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/mlx5/cmd.c b/drivers/vfio/pci/mlx5/cmd.c
+index 11eda6b207f1..6d36b3b4cd30 100644
+--- a/drivers/vfio/pci/mlx5/cmd.c
++++ b/drivers/vfio/pci/mlx5/cmd.c
+@@ -1538,8 +1538,8 @@ int mlx5vf_start_page_tracker(struct vfio_device *vdev,
+ log_max_msg_size = MLX5_CAP_ADV_VIRTUALIZATION(mdev, pg_track_log_max_msg_size);
+ max_msg_size = (1ULL << log_max_msg_size);
+ /* The RQ must hold at least 4 WQEs/messages for successful QP creation */
+- if (rq_size < 4 * max_msg_size)
+- rq_size = 4 * max_msg_size;
++ if (rq_size < 4ULL * max_msg_size)
++ rq_size = 4ULL * max_msg_size;
+
+ memset(tracker, 0, sizeof(*tracker));
+ tracker->uar = mlx5_get_uars_page(mdev);
+--
+2.39.5
+
--- /dev/null
+From 2ace98c153f603b195590f0ef329c5f6daa33c01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 11:46:22 -0700
+Subject: vfio/type1: conditional rescheduling while pinning
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit b1779e4f209c7ff7e32f3c79d69bca4e3a3a68b6 ]
+
+A large DMA mapping request can loop through dma address pinning for
+many pages. In cases where THP can not be used, the repeated vmf_insert_pfn can
+be costly, so let the task reschedule as need to prevent CPU stalls. Failure to
+do so has potential harmful side effects, like increased memory pressure
+as unrelated rcu tasks are unable to make their reclaim callbacks and
+result in OOM conditions.
+
+ rcu: INFO: rcu_sched self-detected stall on CPU
+ rcu: 36-....: (20999 ticks this GP) idle=b01c/1/0x4000000000000000 softirq=35839/35839 fqs=3538
+ rcu: hardirqs softirqs csw/system
+ rcu: number: 0 107 0
+ rcu: cputime: 50 0 10446 ==> 10556(ms)
+ rcu: (t=21075 jiffies g=377761 q=204059 ncpus=384)
+...
+ <TASK>
+ ? asm_sysvec_apic_timer_interrupt+0x16/0x20
+ ? walk_system_ram_range+0x63/0x120
+ ? walk_system_ram_range+0x46/0x120
+ ? pgprot_writethrough+0x20/0x20
+ lookup_memtype+0x67/0xf0
+ track_pfn_insert+0x20/0x40
+ vmf_insert_pfn_prot+0x88/0x140
+ vfio_pci_mmap_huge_fault+0xf9/0x1b0 [vfio_pci_core]
+ __do_fault+0x28/0x1b0
+ handle_mm_fault+0xef1/0x2560
+ fixup_user_fault+0xf5/0x270
+ vaddr_get_pfns+0x169/0x2f0 [vfio_iommu_type1]
+ vfio_pin_pages_remote+0x162/0x8e0 [vfio_iommu_type1]
+ vfio_iommu_type1_ioctl+0x1121/0x1810 [vfio_iommu_type1]
+ ? futex_wake+0x1c1/0x260
+ x64_sys_call+0x234/0x17a0
+ do_syscall_64+0x63/0x130
+ ? exc_page_fault+0x63/0x130
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Link: https://lore.kernel.org/r/20250715184622.3561598-1-kbusch@meta.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index ba5d91e576af..a685e01f73f5 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -648,6 +648,13 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
+
+ while (npage) {
+ if (!batch->size) {
++ /*
++ * Large mappings may take a while to repeatedly refill
++ * the batch, so conditionally relinquish the CPU when
++ * needed to avoid stalls.
++ */
++ cond_resched();
++
+ /* Empty batch, so refill it. */
+ ret = vaddr_get_pfns(mm, vaddr, npage, dma->prot,
+ &pfn, batch);
+--
+2.39.5
+
--- /dev/null
+From 98c19b2ce64535f22ebe4b09ca36256d65e282ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 16:47:53 +0800
+Subject: vhost: fail early when __vhost_add_used() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit b4ba1207d45adaafa2982c035898b36af2d3e518 ]
+
+This patch fails vhost_add_used_n() early when __vhost_add_used()
+fails to make sure used idx is not updated with stale used ring
+information.
+
+Reported-by: Eugenio Pérez <eperezma@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <20250714084755.11921-2-jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Lei Yang <leiyang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 79b0b7cd2860..71604668e53f 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -2971,6 +2971,9 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
+ }
+ r = __vhost_add_used_n(vq, heads, count);
+
++ if (r < 0)
++ return r;
++
+ /* Make sure buffer is written before we update index. */
+ smp_wmb();
+ if (vhost_put_used_idx(vq)) {
+--
+2.39.5
+
--- /dev/null
+From 36e83e81560bed4ec342d4268eef5aac78fdb26c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 10:01:11 +0100
+Subject: vsock/virtio: Resize receive buffers so that each SKB fits in a 4K
+ page
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 03a92f036a04fed2b00d69f5f46f1a486e70dc5c ]
+
+When allocating receive buffers for the vsock virtio RX virtqueue, an
+SKB is allocated with a 4140 data payload (the 44-byte packet header +
+VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE). Even when factoring in the SKB
+overhead, the resulting 8KiB allocation thanks to the rounding in
+kmalloc_reserve() is wasteful (~3700 unusable bytes) and results in a
+higher-order page allocation on systems with 4KiB pages just for the
+sake of a few hundred bytes of packet data.
+
+Limit the vsock virtio RX buffers to 4KiB per SKB, resulting in much
+better memory utilisation and removing the need to allocate higher-order
+pages entirely.
+
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Message-Id: <20250717090116.11987-5-will@kernel.org>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/virtio_vsock.h | 7 ++++++-
+ net/vmw_vsock/virtio_transport.c | 2 +-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
+index 36fb3edfa403..6c00687539cf 100644
+--- a/include/linux/virtio_vsock.h
++++ b/include/linux/virtio_vsock.h
+@@ -111,7 +111,12 @@ static inline size_t virtio_vsock_skb_len(struct sk_buff *skb)
+ return (size_t)(skb_end_pointer(skb) - skb->head);
+ }
+
+-#define VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE (1024 * 4)
++/* Dimension the RX SKB so that the entire thing fits exactly into
++ * a single 4KiB page. This avoids wasting memory due to alloc_skb()
++ * rounding up to the next page order and also means that we
++ * don't leave higher-order pages sitting around in the RX queue.
++ */
++#define VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE SKB_WITH_OVERHEAD(1024 * 4)
+ #define VIRTIO_VSOCK_MAX_BUF_SIZE 0xFFFFFFFFUL
+ #define VIRTIO_VSOCK_MAX_PKT_BUF_SIZE (1024 * 64)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index f0e48e6911fc..f01f9e878106 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -307,7 +307,7 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+
+ static void virtio_vsock_rx_fill(struct virtio_vsock *vsock)
+ {
+- int total_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM;
++ int total_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE;
+ struct scatterlist pkt, *p;
+ struct virtqueue *vq;
+ struct sk_buff *skb;
+--
+2.39.5
+
--- /dev/null
+From 778032901da249a6114fa0bc6a703fd3ebb80d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 18:55:02 +0200
+Subject: watchdog: dw_wdt: Fix default timeout
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit ac3dbb91e0167d017f44701dd51c1efe30d0c256 ]
+
+The Synopsys Watchdog driver sets the default timeout to 30 seconds,
+but on some devices this is not a valid timeout. E.g. on RK3588 the
+actual timeout being used is 44 seconds instead.
+
+Once the watchdog is started the value is updated accordingly, but
+it would be better to expose a sensible timeout to userspace without
+the need to first start the watchdog.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250717-dw-wdt-fix-initial-timeout-v1-1-86dc864d48dd@kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/dw_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c
+index 26efca9ae0e7..c3fbb6068c52 100644
+--- a/drivers/watchdog/dw_wdt.c
++++ b/drivers/watchdog/dw_wdt.c
+@@ -644,6 +644,8 @@ static int dw_wdt_drv_probe(struct platform_device *pdev)
+ } else {
+ wdd->timeout = DW_WDT_DEFAULT_SECONDS;
+ watchdog_init_timeout(wdd, 0, dev);
++ /* Limit timeout value to hardware constraints. */
++ dw_wdt_set_timeout(wdd, wdd->timeout);
+ }
+
+ platform_set_drvdata(pdev, dw_wdt);
+--
+2.39.5
+
--- /dev/null
+From 4e928fb41c750117338811bf0f7fb4af56fdafc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 15:35:18 +0800
+Subject: watchdog: iTCO_wdt: Report error if timeout configuration fails
+
+From: Ziyan Fu <fuzy5@lenovo.com>
+
+[ Upstream commit 40efc43eb7ffb5a4e2f998c13b8cfb555e671b92 ]
+
+The driver probes with the invalid timeout value when
+'iTCO_wdt_set_timeout()' fails, as its return value is not checked. In
+this case, when executing "wdctl", we may get:
+
+Device: /dev/watchdog0
+Timeout: 30 seconds
+Timeleft: 613 seconds
+
+The timeout value is the value of "heartbeat" or "WATCHDOG_TIMEOUT", and
+the timeleft value is calculated from the register value we actually read
+(0xffff) by masking with 0x3ff and converting ticks to seconds (* 6 / 10).
+
+Add error handling to return the failure code if 'iTCO_wdt_set_timeout()'
+fails, ensuring the driver probe fails and prevents invalid operation.
+
+Signed-off-by: Ziyan Fu <fuzy5@lenovo.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250704073518.7838-1-13281011316@163.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/iTCO_wdt.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
+index 7672582fa407..e9bf53929b53 100644
+--- a/drivers/watchdog/iTCO_wdt.c
++++ b/drivers/watchdog/iTCO_wdt.c
+@@ -601,7 +601,11 @@ static int iTCO_wdt_probe(struct platform_device *pdev)
+ /* Check that the heartbeat value is within it's range;
+ if not reset to the default */
+ if (iTCO_wdt_set_timeout(&p->wddev, heartbeat)) {
+- iTCO_wdt_set_timeout(&p->wddev, WATCHDOG_TIMEOUT);
++ ret = iTCO_wdt_set_timeout(&p->wddev, WATCHDOG_TIMEOUT);
++ if (ret != 0) {
++ dev_err(dev, "Failed to set watchdog timeout (%d)\n", WATCHDOG_TIMEOUT);
++ return ret;
++ }
+ dev_info(dev, "timeout value out of range, using %d\n",
+ WATCHDOG_TIMEOUT);
+ }
+--
+2.39.5
+
--- /dev/null
+From 1d1bf64a57602b93eb9cc91e8aaa2d8f7705b3f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 16:06:39 -0700
+Subject: watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
+ condition
+
+From: Aaron Plattner <aplattner@nvidia.com>
+
+[ Upstream commit 48defdf6b083f74a44e1f742db284960d3444aec ]
+
+The MediaTek implementation of the sbsa_gwdt watchdog has a race
+condition where a write to SBSA_GWDT_WRR is ignored if it occurs while
+the hardware is processing a timeout refresh that asserts WS0.
+
+Detect this based on the hardware implementer and adjust
+wdd->min_hw_heartbeat_ms to avoid the race by forcing the keepalive ping
+to be one second later.
+
+Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
+Acked-by: Timur Tabi <ttabi@nvidia.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250721230640.2244915-1-aplattner@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sbsa_gwdt.c | 50 +++++++++++++++++++++++++++++++++---
+ 1 file changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
+index 5f23913ce3b4..6ce1bfb39064 100644
+--- a/drivers/watchdog/sbsa_gwdt.c
++++ b/drivers/watchdog/sbsa_gwdt.c
+@@ -75,11 +75,17 @@
+ #define SBSA_GWDT_VERSION_MASK 0xF
+ #define SBSA_GWDT_VERSION_SHIFT 16
+
++#define SBSA_GWDT_IMPL_MASK 0x7FF
++#define SBSA_GWDT_IMPL_SHIFT 0
++#define SBSA_GWDT_IMPL_MEDIATEK 0x426
++
+ /**
+ * struct sbsa_gwdt - Internal representation of the SBSA GWDT
+ * @wdd: kernel watchdog_device structure
+ * @clk: store the System Counter clock frequency, in Hz.
+ * @version: store the architecture version
++ * @need_ws0_race_workaround:
++ * indicate whether to adjust wdd->timeout to avoid a race with WS0
+ * @refresh_base: Virtual address of the watchdog refresh frame
+ * @control_base: Virtual address of the watchdog control frame
+ */
+@@ -87,6 +93,7 @@ struct sbsa_gwdt {
+ struct watchdog_device wdd;
+ u32 clk;
+ int version;
++ bool need_ws0_race_workaround;
+ void __iomem *refresh_base;
+ void __iomem *control_base;
+ };
+@@ -161,6 +168,31 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd,
+ */
+ sbsa_gwdt_reg_write(((u64)gwdt->clk / 2) * timeout, gwdt);
+
++ /*
++ * Some watchdog hardware has a race condition where it will ignore
++ * sbsa_gwdt_keepalive() if it is called at the exact moment that a
++ * timeout occurs and WS0 is being asserted. Unfortunately, the default
++ * behavior of the watchdog core is very likely to trigger this race
++ * when action=0 because it programs WOR to be half of the desired
++ * timeout, and watchdog_next_keepalive() chooses the exact same time to
++ * send keepalive pings.
++ *
++ * This triggers a race where sbsa_gwdt_keepalive() can be called right
++ * as WS0 is being asserted, and affected hardware will ignore that
++ * write and continue to assert WS0. After another (timeout / 2)
++ * seconds, the same race happens again. If the driver wins then the
++ * explicit refresh will reset WS0 to false but if the hardware wins,
++ * then WS1 is asserted and the system resets.
++ *
++ * Avoid the problem by scheduling keepalive heartbeats one second later
++ * than the WOR timeout.
++ *
++ * This workaround might not be needed in a future revision of the
++ * hardware.
++ */
++ if (gwdt->need_ws0_race_workaround)
++ wdd->min_hw_heartbeat_ms = timeout * 500 + 1000;
++
+ return 0;
+ }
+
+@@ -202,12 +234,15 @@ static int sbsa_gwdt_keepalive(struct watchdog_device *wdd)
+ static void sbsa_gwdt_get_version(struct watchdog_device *wdd)
+ {
+ struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd);
+- int ver;
++ int iidr, ver, impl;
+
+- ver = readl(gwdt->control_base + SBSA_GWDT_W_IIDR);
+- ver = (ver >> SBSA_GWDT_VERSION_SHIFT) & SBSA_GWDT_VERSION_MASK;
++ iidr = readl(gwdt->control_base + SBSA_GWDT_W_IIDR);
++ ver = (iidr >> SBSA_GWDT_VERSION_SHIFT) & SBSA_GWDT_VERSION_MASK;
++ impl = (iidr >> SBSA_GWDT_IMPL_SHIFT) & SBSA_GWDT_IMPL_MASK;
+
+ gwdt->version = ver;
++ gwdt->need_ws0_race_workaround =
++ !action && (impl == SBSA_GWDT_IMPL_MEDIATEK);
+ }
+
+ static int sbsa_gwdt_start(struct watchdog_device *wdd)
+@@ -299,6 +334,15 @@ static int sbsa_gwdt_probe(struct platform_device *pdev)
+ else
+ wdd->max_hw_heartbeat_ms = GENMASK_ULL(47, 0) / gwdt->clk * 1000;
+
++ if (gwdt->need_ws0_race_workaround) {
++ /*
++ * A timeout of 3 seconds means that WOR will be set to 1.5
++ * seconds and the heartbeat will be scheduled every 2.5
++ * seconds.
++ */
++ wdd->min_timeout = 3;
++ }
++
+ status = readl(cf_base + SBSA_GWDT_WCS);
+ if (status & SBSA_GWDT_WCS_WS1) {
+ dev_warn(dev, "System reset by WDT.\n");
+--
+2.39.5
+
--- /dev/null
+From 0f7eb8d26362ef02a9254afc50a64cfee01f2b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 10:27:31 +0800
+Subject: wifi: ath10k: shutdown driver when hardware is unreliable
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit c256a94d1b1b15109740306f7f2a7c2173e12072 ]
+
+In rare cases, ath10k may lose connection with the PCIe bus due to
+some unknown reasons, which could further lead to system crashes during
+resuming due to watchdog timeout:
+
+ath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware
+ath10k_pci 0000:01:00.0: already restarting
+ath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11
+ath10k_pci 0000:01:00.0: failed to stop vdev 0: -11
+ieee80211 phy0: PM: **** DPM device timeout ****
+Call Trace:
+ panic+0x125/0x315
+ dpm_watchdog_set+0x54/0x54
+ dpm_watchdog_handler+0x57/0x57
+ call_timer_fn+0x31/0x13c
+
+At this point, all WMI commands will timeout and attempt to restart
+device. So set a threshold for consecutive restart failures. If the
+threshold is exceeded, consider the hardware is unreliable and all
+ath10k operations should be skipped to avoid system crash.
+
+fail_cont_count and pending_recovery are atomic variables, and
+do not involve complex conditional logic. Therefore, even if recovery
+check and reconfig complete are executed concurrently, the recovery
+mechanism will not be broken.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
+
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250623022731.509-1-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/core.c | 48 +++++++++++++++++++++++---
+ drivers/net/wireless/ath/ath10k/core.h | 11 ++++--
+ drivers/net/wireless/ath/ath10k/mac.c | 7 +++-
+ drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++
+ 4 files changed, 63 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 6d336e39d673..1adc35e37f40 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -2491,12 +2491,50 @@ static int ath10k_init_hw_params(struct ath10k *ar)
+ return 0;
+ }
+
++static bool ath10k_core_needs_recovery(struct ath10k *ar)
++{
++ long time_left;
++
++ /* Sometimes the recovery will fail and then the next all recovery fail,
++ * so avoid infinite recovery.
++ */
++ if (atomic_read(&ar->fail_cont_count) >= ATH10K_RECOVERY_MAX_FAIL_COUNT) {
++ ath10k_err(ar, "consecutive fail %d times, will shutdown driver!",
++ atomic_read(&ar->fail_cont_count));
++ ar->state = ATH10K_STATE_WEDGED;
++ return false;
++ }
++
++ ath10k_dbg(ar, ATH10K_DBG_BOOT, "total recovery count: %d", ++ar->recovery_count);
++
++ if (atomic_read(&ar->pending_recovery)) {
++ /* Sometimes it happened another recovery work before the previous one
++ * completed, then the second recovery work will destroy the previous
++ * one, thus below is to avoid that.
++ */
++ time_left = wait_for_completion_timeout(&ar->driver_recovery,
++ ATH10K_RECOVERY_TIMEOUT_HZ);
++ if (time_left) {
++ ath10k_warn(ar, "previous recovery succeeded, skip this!\n");
++ return false;
++ }
++
++ /* Record the continuous recovery fail count when recovery failed. */
++ atomic_inc(&ar->fail_cont_count);
++
++ /* Avoid having multiple recoveries at the same time. */
++ return false;
++ }
++
++ atomic_inc(&ar->pending_recovery);
++
++ return true;
++}
++
+ void ath10k_core_start_recovery(struct ath10k *ar)
+ {
+- if (test_and_set_bit(ATH10K_FLAG_RESTARTING, &ar->dev_flags)) {
+- ath10k_warn(ar, "already restarting\n");
++ if (!ath10k_core_needs_recovery(ar))
+ return;
+- }
+
+ queue_work(ar->workqueue, &ar->restart_work);
+ }
+@@ -2532,6 +2570,8 @@ static void ath10k_core_restart(struct work_struct *work)
+ struct ath10k *ar = container_of(work, struct ath10k, restart_work);
+ int ret;
+
++ reinit_completion(&ar->driver_recovery);
++
+ set_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags);
+
+ /* Place a barrier to make sure the compiler doesn't reorder
+@@ -2596,8 +2636,6 @@ static void ath10k_core_restart(struct work_struct *work)
+ if (ret)
+ ath10k_warn(ar, "failed to send firmware crash dump via devcoredump: %d",
+ ret);
+-
+- complete(&ar->driver_recovery);
+ }
+
+ static void ath10k_core_set_coverage_class_work(struct work_struct *work)
+diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
+index 446dca74f06a..85e16c945b5c 100644
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -4,6 +4,7 @@
+ * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+ #ifndef _CORE_H_
+@@ -87,6 +88,8 @@
+ IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER)
+ #define ATH10K_ITER_RESUME_FLAGS (IEEE80211_IFACE_ITER_RESUME_ALL |\
+ IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER)
++#define ATH10K_RECOVERY_TIMEOUT_HZ (5 * HZ)
++#define ATH10K_RECOVERY_MAX_FAIL_COUNT 4
+
+ struct ath10k;
+
+@@ -865,9 +868,6 @@ enum ath10k_dev_flags {
+ /* Per Station statistics service */
+ ATH10K_FLAG_PEER_STATS,
+
+- /* Indicates that ath10k device is during recovery process and not complete */
+- ATH10K_FLAG_RESTARTING,
+-
+ /* protected by conf_mutex */
+ ATH10K_FLAG_NAPI_ENABLED,
+ };
+@@ -1211,6 +1211,11 @@ struct ath10k {
+ struct work_struct bundle_tx_work;
+ struct work_struct tx_complete_work;
+
++ atomic_t pending_recovery;
++ unsigned int recovery_count;
++ /* continuous recovery fail count */
++ atomic_t fail_cont_count;
++
+ /* cycle count is reported twice for each visited channel during scan.
+ * access protected by data_lock
+ */
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index c61b95a928da..0a53ec55b46b 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8139,7 +8139,12 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
+ ath10k_info(ar, "device successfully recovered\n");
+ ar->state = ATH10K_STATE_ON;
+ ieee80211_wake_queues(ar->hw);
+- clear_bit(ATH10K_FLAG_RESTARTING, &ar->dev_flags);
++
++ /* Clear recovery state. */
++ complete(&ar->driver_recovery);
++ atomic_set(&ar->fail_cont_count, 0);
++ atomic_set(&ar->pending_recovery, 0);
++
+ if (ar->hw_params.hw_restart_disconnect) {
+ list_for_each_entry(arvif, &ar->arvifs, list) {
+ if (arvif->is_up && arvif->vdev_type == WMI_VDEV_TYPE_STA)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 5e061f7525a6..09066e6aca40 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -4,6 +4,7 @@
+ * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+ #include <linux/skbuff.h>
+@@ -1941,6 +1942,11 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
+ }
+
+ wait_event_timeout(ar->wmi.tx_credits_wq, ({
++ if (ar->state == ATH10K_STATE_WEDGED) {
++ ret = -ESHUTDOWN;
++ ath10k_dbg(ar, ATH10K_DBG_WMI,
++ "drop wmi command %d, hardware is wedged\n", cmd_id);
++ }
+ /* try to send pending beacons first. they take priority */
+ ath10k_wmi_tx_beacons_nowait(ar);
+
+--
+2.39.5
+
--- /dev/null
+From c5ba8aec50efa5e2862741eb68385aa61da49378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jun 2025 12:05:12 +0530
+Subject: wifi: ath12k: Add memset and update default rate value in wmi tx
+ completion
+
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+
+[ Upstream commit 9903c0986f782dfc511d7638b6f15fb6e8600cd3 ]
+
+When both AP/STA and monitor interfaces are enabled, ieee80211_tx_status()
+is invoked from two paths: the TX completion handler for data frames
+and the WMI TX completion handler for management frames.
+In the data path, the skb->cb is properly zeroed using memset, but in
+the WMI path, this step is missing.
+
+As a result, mac80211 encountered uninitialized (junk) values in
+skb->cb when generating the radiotap header for monitor mode, leading
+to invalid radiotap lengths.
+
+Hence, explicitly zero the status field in the skb->cb using memset
+in WMI TX completion path to ensure consistent and correct behavior
+during WMI tx completion path.
+
+Additionally, set info->status.rates[0].idx = -1 to indicate that
+no valid rate information is available, avoiding misinterpretation of
+garbage values.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250603063512.1887652-1-quic_sarishar@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/wmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
+index 9ebe4b573f7e..3a39a1be3f7c 100644
+--- a/drivers/net/wireless/ath/ath12k/wmi.c
++++ b/drivers/net/wireless/ath/ath12k/wmi.c
+@@ -5465,6 +5465,11 @@ static int wmi_process_mgmt_tx_comp(struct ath12k *ar, u32 desc_id,
+ dma_unmap_single(ar->ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+
+ info = IEEE80211_SKB_CB(msdu);
++ memset(&info->status, 0, sizeof(info->status));
++
++ /* skip tx rate update from ieee80211_status*/
++ info->status.rates[0].idx = -1;
++
+ if ((!(info->flags & IEEE80211_TX_CTL_NO_ACK)) && !status)
+ info->flags |= IEEE80211_TX_STAT_ACK;
+
+--
+2.39.5
+
--- /dev/null
+From 2acd16a89604a03f27561af4fa3c6d740569656f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 11:47:49 +0530
+Subject: wifi: ath12k: Correct tid cleanup when tid setup fails
+
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+
+[ Upstream commit 4a2bf707270f897ab8077baee8ed5842a5321686 ]
+
+Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(),
+the tid value is already incremented, even though the corresponding
+TID is not actually allocated. Proceed to
+ath12k_dp_rx_peer_tid_delete() starting from unallocated tid,
+which might leads to freeing unallocated TID and cause potential
+crash or out-of-bounds access.
+
+Hence, fix by correctly decrementing tid before cleanup to match only
+the successfully allocated TIDs.
+
+Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(),
+as decrementing the tid before cleanup in loop will take care of this.
+
+Compile tested only.
+
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250721061749.886732-1-quic_sarishar@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
+index 34e1bd2934ce..807c5b345e06 100644
+--- a/drivers/net/wireless/ath/ath12k/dp.c
++++ b/drivers/net/wireless/ath/ath12k/dp.c
+@@ -101,7 +101,7 @@ int ath12k_dp_peer_setup(struct ath12k *ar, int vdev_id, const u8 *addr)
+ return -ENOENT;
+ }
+
+- for (; tid >= 0; tid--)
++ for (tid--; tid >= 0; tid--)
+ ath12k_dp_rx_peer_tid_delete(ar, peer, tid);
+
+ spin_unlock_bh(&ab->base_lock);
+--
+2.39.5
+
--- /dev/null
+From c01e69bec53d827d7542e66a31e39df694e304a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 May 2025 09:17:13 +0530
+Subject: wifi: ath12k: Decrement TID on RX peer frag setup error handling
+
+From: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+
+[ Upstream commit 7c0884fcd2ddde0544d2e77f297ae461e1f53f58 ]
+
+Currently, TID is not decremented before peer cleanup, during error
+handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to
+out-of-bounds access in peer->rx_tid[].
+
+Hence, add a decrement operation for TID, before peer cleanup to
+ensures proper cleanup and prevents out-of-bounds access issues when
+the RX peer frag setup fails.
+
+Found during code review. Compile tested only.
+
+Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250526034713.712592-1-quic_sarishar@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
+index 807c5b345e06..a53e4ebdcbfc 100644
+--- a/drivers/net/wireless/ath/ath12k/dp.c
++++ b/drivers/net/wireless/ath/ath12k/dp.c
+@@ -84,6 +84,7 @@ int ath12k_dp_peer_setup(struct ath12k *ar, int vdev_id, const u8 *addr)
+ ret = ath12k_dp_rx_peer_frag_setup(ar, addr, vdev_id);
+ if (ret) {
+ ath12k_warn(ab, "failed to setup rx defrag context\n");
++ tid--;
+ goto peer_clean;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 89fe6d0f189c0a3d9a54583754b7449a6dcee71e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 08:48:50 +0530
+Subject: wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
+
+From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+
+[ Upstream commit b79742b84e16e41c4a09f3126436f39f36e75c06 ]
+
+The commit 89ac53e96217 ("wifi: ath12k: Enable REO queue lookup table
+feature on QCN9274") originally intended to enable the reoq_lut_support
+hardware parameter flag for both QCN9274 hw1.0 and hw2.0. However,
+it enabled it only for QCN9274 hw1.0.
+
+Hence, enable REO queue lookup table feature on QCN9274 hw2.0.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250609-qcn9274-reoq-v1-1-a92c91abc9b9@quicinc.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c
+index a5fa3b6a831a..e0e766a0b6d6 100644
+--- a/drivers/net/wireless/ath/ath12k/hw.c
++++ b/drivers/net/wireless/ath/ath12k/hw.c
+@@ -1090,7 +1090,7 @@ static const struct ath12k_hw_params ath12k_hw_params[] = {
+ .download_calib = true,
+ .supports_suspend = false,
+ .tcl_ring_retry = true,
+- .reoq_lut_support = false,
++ .reoq_lut_support = true,
+ .supports_shadow_regs = false,
+
+ .num_tcl_banks = 48,
+--
+2.39.5
+
--- /dev/null
+From 3f1ad1b16c3a695db07fdf684811c5869e0995ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 09:26:14 +0530
+Subject: wifi: ath12k: Fix station association with MBSSID Non-TX BSS
+
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+
+[ Upstream commit 70eeacc1a92a444f4b5777ab19e1c378a5edc8dd ]
+
+ath12k station is unable to associate with non-transmitting BSSes
+in a Multiple BSS set because the user-space does not receive
+information about the non-transmitting BSSes from mac80211's
+scan results.
+
+The ath12k driver does not advertise its MBSSID capability to mac80211,
+resulting in wiphy->support_mbssid not being set. Consequently, the
+information about non-transmitting BSS is not parsed from received
+Beacon/Probe response frames and is therefore not included in the
+scan results.
+
+Fix this by advertising the MBSSID capability of ath12k driver to
+mac80211.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250530035615.3178480-2-rameshkumar.sundaram@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 029376c57496..cb0232113f5f 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -11337,6 +11337,7 @@ static int ath12k_mac_hw_register(struct ath12k_hw *ah)
+
+ wiphy->mbssid_max_interfaces = mbssid_max_interfaces;
+ wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD;
++ ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
+
+ if (is_6ghz) {
+ wiphy_ext_feature_set(wiphy,
+--
+2.39.5
+
--- /dev/null
+From ccddeea7dc924e27e4f8891212cfbc85b9461f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 23:37:55 +0300
+Subject: wifi: cfg80211: Fix interface type validation
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 14450be2332a49445106403492a367412b8c23f4 ]
+
+Fix a condition that verified valid values of interface types.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250709233537.7ad199ca5939.I0ac1ff74798bf59a87a57f2e18f2153c308b119b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 75f2e5782887..71db571617ba 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -633,7 +633,7 @@ ieee80211_get_sband_iftype_data(const struct ieee80211_supported_band *sband,
+ const struct ieee80211_sband_iftype_data *data;
+ int i;
+
+- if (WARN_ON(iftype >= NL80211_IFTYPE_MAX))
++ if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
+ return NULL;
+
+ if (iftype == NL80211_IFTYPE_AP_VLAN)
+--
+2.39.5
+
--- /dev/null
+From 2660c6f5298cac661925201374c7a855484e1531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 20:23:06 +0200
+Subject: wifi: cfg80211: reject HTC bit for management frames
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit be06a8c7313943109fa870715356503c4c709cbc ]
+
+Management frames sent by userspace should never have the
+order/HTC bit set, reject that. It could also cause some
+confusion with the length of the buffer and the header so
+the validation might end up wrong.
+
+Link: https://patch.msgid.link/20250718202307.97a0455f0f35.I1805355c7e331352df16611839bc8198c855a33f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/mlme.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
+index 05d44a443518..fd88a32d43d6 100644
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -850,7 +850,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
+
+ mgmt = (const struct ieee80211_mgmt *)params->buf;
+
+- if (!ieee80211_is_mgmt(mgmt->frame_control))
++ if (!ieee80211_is_mgmt(mgmt->frame_control) ||
++ ieee80211_has_order(mgmt->frame_control))
+ return -EINVAL;
+
+ stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
+--
+2.39.5
+
--- /dev/null
+From 74f511fb119b2ab88e7c64d3d66de7b8a15cc982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 May 2025 16:45:24 +0200
+Subject: wifi: iwlegacy: Check rate_idx range after addition
+
+From: Stanislaw Gruszka <stf_xl@wp.pl>
+
+[ Upstream commit 0de19d5ae0b2c5b18b88c5c7f0442f707a207409 ]
+
+Limit rate_idx to IL_LAST_OFDM_RATE for 5GHz band for thinkable case
+the index is incorrect.
+
+Reported-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Reported-by: Alexei Safin <a.safin@rosa.ru>
+Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Reviewed-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Link: https://patch.msgid.link/20250525144524.GA172583@wp.pl
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index dc8c408902e6..4d2148147b94 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -1575,8 +1575,11 @@ il4965_tx_cmd_build_rate(struct il_priv *il,
+ || rate_idx > RATE_COUNT_LEGACY)
+ rate_idx = rate_lowest_index(&il->bands[info->band], sta);
+ /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
+- if (info->band == NL80211_BAND_5GHZ)
++ if (info->band == NL80211_BAND_5GHZ) {
+ rate_idx += IL_FIRST_OFDM_RATE;
++ if (rate_idx > IL_LAST_OFDM_RATE)
++ rate_idx = IL_LAST_OFDM_RATE;
++ }
+ /* Get PLCP rate for tx_cmd->rate_n_flags */
+ rate_plcp = il_rates[rate_idx].plcp;
+ /* Zero out flags for this packet */
+--
+2.39.5
+
--- /dev/null
+From 6c0e7fa5fd8b7a3227f12d161f5ffafa3f7966fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 13:17:55 +0300
+Subject: wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
+
+From: Rand Deeb <rand.sec96@gmail.com>
+
+[ Upstream commit e3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78 ]
+
+The 'index' variable in the rs_fill_link_cmd() function can reach
+LINK_QUAL_MAX_RETRY_NUM during the execution of the inner loop. This
+variable is used as an index for the lq_cmd->rs_table array, which has a
+size of LINK_QUAL_MAX_RETRY_NUM, without proper validation.
+
+Modify the condition of the inner loop to ensure that the 'index' variable
+does not exceed LINK_QUAL_MAX_RETRY_NUM - 1, thereby preventing any
+potential overflow issues.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
+Link: https://patch.msgid.link/20240313101755.269209-1-rand.sec96@gmail.com
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
+index 8879e668ef0d..ed964103281e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
+@@ -2899,7 +2899,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
+ /* Repeat initial/next rate.
+ * For legacy IWL_NUMBER_TRY == 1, this loop will not execute.
+ * For HT IWL_HT_NUMBER_TRY == 3, this executes twice. */
+- while (repeat_rate > 0 && (index < LINK_QUAL_MAX_RETRY_NUM)) {
++ while (repeat_rate > 0 && index < (LINK_QUAL_MAX_RETRY_NUM - 1)) {
+ if (is_legacy(tbl_type.lq_type)) {
+ if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE)
+ ant_toggle_cnt++;
+--
+2.39.5
+
--- /dev/null
+From b1c839868faafbc29eda063347b76dbad7a775aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 22:26:23 +0300
+Subject: wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
+
+From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+
+[ Upstream commit cc8d9cbf269dab363c768bfa9312265bc807fca5 ]
+
+Ensure descriptor is freed on error to avoid memory leak.
+
+Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250611222325.8158d15ec866.Ifa3e422c302397111f20a16da7509e6574bc19e3@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 03f639fbf9b6..3df15ff3e9d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -3006,6 +3006,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
+ struct iwl_fw_dump_desc *desc;
+ unsigned int delay = 0;
+ bool monitor_only = false;
++ int ret;
+
+ if (trigger) {
+ u16 occurrences = le16_to_cpu(trigger->occurrences) - 1;
+@@ -3036,7 +3037,11 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
+ desc->trig_desc.type = cpu_to_le32(trig);
+ memcpy(desc->trig_desc.data, str, len);
+
+- return iwl_fw_dbg_collect_desc(fwrt, desc, monitor_only, delay);
++ ret = iwl_fw_dbg_collect_desc(fwrt, desc, monitor_only, delay);
++ if (ret)
++ kfree(desc);
++
++ return ret;
+ }
+ IWL_EXPORT_SYMBOL(iwl_fw_dbg_collect);
+
+--
+2.39.5
+
--- /dev/null
+From 3076b1d316f533ac9793d5157ea98894e357b68f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 09:45:06 +0300
+Subject: wifi: iwlwifi: mld: avoid outdated reorder buffer head_sn
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 666357bf3e57c6a68be128825775aee14f9a24f7 ]
+
+If no frames are received on a queue for a while, the reorder buffer
+head_sn may be an old one. When the next frame that is received on
+that queue and buffered is a subframe of an AMSDU but not the last
+subframe, it will not update the buffer's head_sn. When the frame
+release notification arrives, it will not release the buffered frame
+because it will look like the notification's NSSN is lower than the
+buffer's head_sn (because of a wraparound).
+Fix it by updating the head_sn when the first frame is buffered.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250723094230.e1f62a9a603c.I7b57a481122074b1f40d39cd31db2e5262668eb2@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/agg.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+index 687a9450ac98..aab11c61a82d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+@@ -303,10 +303,15 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
+ * already ahead and it will be dropped.
+ * If the last sub-frame is not on this queue - we will get frame
+ * release notification with up to date NSSN.
++ * If this is the first frame that is stored in the buffer, the head_sn
++ * may be outdated. Update it based on the last NSSN to make sure it
++ * will be released when the frame release notification arrives.
+ */
+ if (!amsdu || last_subframe)
+ iwl_mld_reorder_release_frames(mld, sta, napi, baid_data,
+ buffer, nssn);
++ else if (buffer->num_stored == 1)
++ buffer->head_sn = nssn;
+
+ return IWL_MLD_BUFFERED_SKB;
+ }
+--
+2.39.5
+
--- /dev/null
+From 94a1ff21b0da74716a59d797829187f28b0b2674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 14:48:57 +0300
+Subject: wifi: iwlwifi: mld: don't exit EMLSR when we shouldn't
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 0cdb8ff6ebbac55f38933f4621215784887b400e ]
+
+There is a requirement to exit EMLSR if there wasn't enough throughput
+in the secondary link.
+This is checked in check_tpt_wk, which runs every 5 seconds in a high
+throughput scenario (when the throughput blocker isn't set)
+
+It can happen that this worker is running immediately after we entered
+EMLSR, and in that case the secondary link didn't have a chance to have
+throughput. In that case we will exit EMLSR for no good reason.
+
+Fix this by tracking the time we entered EMLSR, and in the worker make
+sure that 5 seconds passed from when we entered EMLSR. If not, don't
+check the secondary link throughput.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250612144708.c680f8d7dc37.I8a02d1e8d99df3789da8d5714f19b31a865a61ff@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/iface.h | 3 +++
+ drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 1 +
+ drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 8 +++++---
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/iface.h b/drivers/net/wireless/intel/iwlwifi/mld/iface.h
+index ec14d0736cee..586bfed450c5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/iface.h
++++ b/drivers/net/wireless/intel/iwlwifi/mld/iface.h
+@@ -84,6 +84,8 @@ enum iwl_mld_emlsr_exit {
+ * @last_exit_reason: Reason for the last EMLSR exit
+ * @last_exit_ts: Time of the last EMLSR exit (if @last_exit_reason is non-zero)
+ * @exit_repeat_count: Number of times EMLSR was exited for the same reason
++ * @last_entry_ts: the time of the last EMLSR entry (if iwl_mld_emlsr_active()
++ * is true)
+ * @unblock_tpt_wk: Unblock EMLSR because the throughput limit was reached
+ * @check_tpt_wk: a worker to check if IWL_MLD_EMLSR_BLOCKED_TPT should be
+ * added, for example if there is no longer enough traffic.
+@@ -102,6 +104,7 @@ struct iwl_mld_emlsr {
+ enum iwl_mld_emlsr_exit last_exit_reason;
+ unsigned long last_exit_ts;
+ u8 exit_repeat_count;
++ unsigned long last_entry_ts;
+ );
+
+ struct wiphy_work unblock_tpt_wk;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+index 2d5233dc3e24..8a020d161f4a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+@@ -995,6 +995,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
+
+ /* Indicate to mac80211 that EML is enabled */
+ vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE;
++ mld_vif->emlsr.last_entry_ts = jiffies;
+
+ if (vif->active_links & BIT(mld_vif->emlsr.selected_links))
+ mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+index a870e169e265..962a27e8d791 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+@@ -508,10 +508,12 @@ void iwl_mld_emlsr_check_tpt(struct wiphy *wiphy, struct wiphy_work *wk)
+ /*
+ * TPT is unblocked, need to check if the TPT criteria is still met.
+ *
+- * If EMLSR is active, then we also need to check the secondar link
+- * requirements.
++ * If EMLSR is active for at least 5 seconds, then we also
++ * need to check the secondary link requirements.
+ */
+- if (iwl_mld_emlsr_active(vif)) {
++ if (iwl_mld_emlsr_active(vif) &&
++ time_is_before_jiffies(mld_vif->emlsr.last_entry_ts +
++ IWL_MLD_TPT_COUNT_WINDOW)) {
+ sec_link_id = iwl_mld_get_other_link(vif, iwl_mld_get_primary_link(vif));
+ sec_link = iwl_mld_link_dereference_check(mld_vif, sec_link_id);
+ if (WARN_ON_ONCE(!sec_link))
+--
+2.39.5
+
--- /dev/null
+From 60e0eab4105605e64fa6b51ef972e1536f9a52b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 22:26:27 +0300
+Subject: wifi: iwlwifi: mld: fix last_mlo_scan_time type
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit f26281c1b727b90ec18ae90044d5f429d2250e82 ]
+
+This should be u64, otherwise it rolls over quickly on 32-bit
+systems.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250611222325.5381030253cd.I4e3a7bca5b52fc826e26311055286421508c4d1b@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/scan.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/scan.h b/drivers/net/wireless/intel/iwlwifi/mld/scan.h
+index 3ae940d55065..4044cac3f086 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/scan.h
++++ b/drivers/net/wireless/intel/iwlwifi/mld/scan.h
+@@ -130,7 +130,7 @@ struct iwl_mld_scan {
+ void *cmd;
+ unsigned long last_6ghz_passive_jiffies;
+ unsigned long last_start_time_jiffies;
+- unsigned long last_mlo_scan_time;
++ u64 last_mlo_scan_time;
+ };
+
+ #endif /* __iwl_mld_scan_h__ */
+--
+2.39.5
+
--- /dev/null
+From c3ca54ec1fd3e5c192682a3cf5007dd44bcd3c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 21:28:18 +0300
+Subject: wifi: iwlwifi: mld: fix scan request validation
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit d1f5f881ac2c5dc185a88c7bfe47d2b3ecbbc501 ]
+
+The scan request validation function uses bitwise and instead
+of logical and. Fix it.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Reviewed-by: Daniel Gabay <daniel.gabay@intel.com>
+Reviewed-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250710212632.ec7d665f56a4.I416816b491fafa5d3efdf0a4be78356eedf2bd95@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/scan.c b/drivers/net/wireless/intel/iwlwifi/mld/scan.c
+index 7ec04318ec2f..13b9ae18dd7c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/scan.c
+@@ -359,7 +359,7 @@ iwl_mld_scan_fits(struct iwl_mld *mld, int n_ssids,
+ struct ieee80211_scan_ies *ies, int n_channels)
+ {
+ return ((n_ssids <= PROBE_OPTION_MAX) &&
+- (n_channels <= mld->fw->ucode_capa.n_scan_channels) &
++ (n_channels <= mld->fw->ucode_capa.n_scan_channels) &&
+ (ies->common_ie_len + ies->len[NL80211_BAND_2GHZ] +
+ ies->len[NL80211_BAND_5GHZ] + ies->len[NL80211_BAND_6GHZ] <=
+ iwl_mld_scan_max_template_size()));
+--
+2.39.5
+
--- /dev/null
+From 5070121ecd39e4b9533881d8e292e576c607fa12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 09:45:12 +0300
+Subject: wifi: iwlwifi: mld: use spec link id and not FW link id
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 170db5f873850a04a8eafd3401b2ea36adb20cea ]
+
+In missed beacon handling, we compare the FW link id to the
+bss_param_ch_cnt_link_id, which is a spec link id. Fix it.
+
+Reviewed-by: Somashekhar Puttagangaiah <somashekhar.puttagangaiah@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250723094230.2104f8cac836.I25ed77c2b87bde82a9153e2aa26e09b8a42f6ee3@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/link.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
+index 82a4979a3af3..5f7628c65e3c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
+@@ -863,21 +863,23 @@ void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,
+ {
+ const struct iwl_missed_beacons_notif *notif = (const void *)pkt->data;
+ union iwl_dbg_tlv_tp_data tp_data = { .fw_pkt = pkt };
+- u32 link_id = le32_to_cpu(notif->link_id);
++ u32 fw_link_id = le32_to_cpu(notif->link_id);
+ u32 missed_bcon = le32_to_cpu(notif->consec_missed_beacons);
+ u32 missed_bcon_since_rx =
+ le32_to_cpu(notif->consec_missed_beacons_since_last_rx);
+ u32 scnd_lnk_bcn_lost =
+ le32_to_cpu(notif->consec_missed_beacons_other_link);
+ struct ieee80211_bss_conf *link_conf =
+- iwl_mld_fw_id_to_link_conf(mld, link_id);
++ iwl_mld_fw_id_to_link_conf(mld, fw_link_id);
+ u32 bss_param_ch_cnt_link_id;
+ struct ieee80211_vif *vif;
++ u8 link_id;
+
+ if (WARN_ON(!link_conf))
+ return;
+
+ vif = link_conf->vif;
++ link_id = link_conf->link_id;
+ bss_param_ch_cnt_link_id = link_conf->bss_param_ch_cnt_link_id;
+
+ IWL_DEBUG_INFO(mld,
+@@ -889,7 +891,7 @@ void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,
+
+ mld->trans->dbg.dump_file_name_ext_valid = true;
+ snprintf(mld->trans->dbg.dump_file_name_ext, IWL_FW_INI_MAX_NAME,
+- "LinkId_%d_MacType_%d", link_id,
++ "LinkId_%d_MacType_%d", fw_link_id,
+ iwl_mld_mac80211_iftype_to_fw(vif));
+
+ iwl_dbg_tlv_time_point(&mld->fwrt,
+--
+2.39.5
+
--- /dev/null
+From 812f5d53928252adeeb50e5a873795e5f4014d03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 09:45:05 +0300
+Subject: wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 422850b29e05e67c9145895bfe559940caa0caa8 ]
+
+If no frames are received on a queue for a while, the reorder buffer
+head_sn may be an old one. When the next frame that is received on
+that queue and buffered is a subframe of an AMSDU but not the last
+subframe, it will not update the buffer's head_sn. When the frame
+release notification arrives, it will not release the buffered frame
+because it will look like the notification's NSSN is lower than the
+buffer's head_sn (because of a wraparound).
+Fix it by updating the head_sn when the first frame is buffered.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Reviewed-by: Daniel Gabay <daniel.gabay@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250723094230.795ec0cb8817.I9ec9a3508e7935e8d1833ea3e086066fdefee644@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 14ea89f931bb..ff59a322fbcb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -854,10 +854,15 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
+ * already ahead and it will be dropped.
+ * If the last sub-frame is not on this queue - we will get frame
+ * release notification with up to date NSSN.
++ * If this is the first frame that is stored in the buffer, the head_sn
++ * may be outdated. Update it based on the last NSSN to make sure it
++ * will be released when the frame release notification arrives.
+ */
+ if (!amsdu || last_subframe)
+ iwl_mvm_release_frames(mvm, sta, napi, baid_data,
+ buffer, nssn);
++ else if (buffer->num_stored == 1)
++ buffer->head_sn = nssn;
+
+ spin_unlock_bh(&buffer->lock);
+ return true;
+--
+2.39.5
+
--- /dev/null
+From a4216d97fa297b8d1454b69de36afd75f6d5c10e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 23:05:43 +0300
+Subject: wifi: iwlwifi: mvm: fix scan request validation
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 7c2f3ec7707188d8d5269ae2dce97d7be3e9f261 ]
+
+The scan request validation function uses bitwise and instead
+of logical and. Fix it.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Reviewed-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250709230308.3fbc1f27871b.I7a8ee91f463c1a2d9d8561c8232e196885d02c43@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+index 60bd9c7e5f03..3dbda1e4a522 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -835,7 +835,7 @@ static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
+ int n_channels)
+ {
+ return ((n_ssids <= PROBE_OPTION_MAX) &&
+- (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
++ (n_channels <= mvm->fw->ucode_capa.n_scan_channels) &&
+ (ies->common_ie_len +
+ ies->len[NL80211_BAND_2GHZ] + ies->len[NL80211_BAND_5GHZ] +
+ ies->len[NL80211_BAND_6GHZ] <=
+--
+2.39.5
+
--- /dev/null
+From 2b80115bcaa1455b863946aa82f7f7cd5f8bf552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 21:28:27 +0300
+Subject: wifi: iwlwifi: mvm: set gtk id also in older FWs
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 61be9803f322ab46f31ba944c6ef7de195891f64 ]
+
+We use gtk[i].id, but it is not even set in older FW APIs
+(iwl_wowlan_status_v6 and iwl_wowlan_status_v7).
+Set it also in older FWs.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250710212632.e91e49590414.I27d2fdbed1c54aee59929fa11ec169f07e159406@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 3e8b7168af01..a30ef33525ec 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -2387,6 +2387,7 @@ static void iwl_mvm_convert_gtk_v2(struct iwl_wowlan_status_data *status,
+
+ status->gtk[0].len = data->key_len;
+ status->gtk[0].flags = data->key_flags;
++ status->gtk[0].id = status->gtk[0].flags & IWL_WOWLAN_GTK_IDX_MASK;
+
+ memcpy(status->gtk[0].key, data->key, sizeof(data->key));
+
+@@ -2737,6 +2738,7 @@ iwl_mvm_send_wowlan_get_status(struct iwl_mvm *mvm, u8 sta_id)
+ * currently used key.
+ */
+ status->gtk[0].flags = v6->gtk.key_index | BIT(7);
++ status->gtk[0].id = v6->gtk.key_index;
+ } else if (notif_ver == 7) {
+ struct iwl_wowlan_status_v7 *v7 = (void *)cmd.resp_pkt->data;
+
+--
+2.39.5
+
--- /dev/null
+From 36a663beeabe324985d40f5d8e2fffb5545f60ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 21:35:13 +0300
+Subject: wifi: mac80211: avoid weird state in error path
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit be1ba9ed221ffb95a8bb15f4c83d0694225ba808 ]
+
+If we get to the error path of ieee80211_prep_connection, for example
+because of a FW issue, then ieee80211_vif_set_links is called
+with 0.
+But the call to drv_change_vif_links from ieee80211_vif_update_links
+will probably fail as well, for the same reason.
+In this case, the valid_links and active_links bitmaps will be reverted
+to the value of the failing connection.
+Then, in the next connection, due to the logic of
+ieee80211_set_vif_links_bitmaps, valid_links will be set to the ID of
+the new connection assoc link, but the active_links will remain with the
+ID of the old connection's assoc link.
+If those IDs are different, we get into a weird state of valid_links and
+active_links being different. One of the consequences of this state is
+to call drv_change_vif_links with new_links as 0, since the & operation
+between the bitmaps will be 0.
+
+Since a removal of a link should always succeed, ignore the return value
+of drv_change_vif_links if it was called to only remove links, which is
+the case for the ieee80211_prep_connection's error path.
+That way, the bitmaps will not be reverted to have the value from the
+failing connection and will have 0, so the next connection will have a
+good state.
+
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://patch.msgid.link/20250609213231.ba2011fb435f.Id87ff6dab5e1cf757b54094ac2d714c656165059@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/mac80211.h | 2 ++
+ net/mac80211/link.c | 9 ++++++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 829032258978..5989cacb9d50 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4462,6 +4462,8 @@ struct ieee80211_prep_tx_info {
+ * new links bitmaps may be 0 if going from/to a non-MLO situation.
+ * The @old array contains pointers to the old bss_conf structures
+ * that were already removed, in case they're needed.
++ * Note that removal of link should always succeed, so the return value
++ * will be ignored in a removal only case.
+ * This callback can sleep.
+ * @change_sta_links: Change the valid links of a station, similar to
+ * @change_vif_links. This callback can sleep.
+diff --git a/net/mac80211/link.c b/net/mac80211/link.c
+index 4f7b7d0f64f2..d71eabe5abf8 100644
+--- a/net/mac80211/link.c
++++ b/net/mac80211/link.c
+@@ -2,7 +2,7 @@
+ /*
+ * MLO link handling
+ *
+- * Copyright (C) 2022-2024 Intel Corporation
++ * Copyright (C) 2022-2025 Intel Corporation
+ */
+ #include <linux/slab.h>
+ #include <linux/kernel.h>
+@@ -368,6 +368,13 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
+ ieee80211_update_apvlan_links(sdata);
+ }
+
++ /*
++ * Ignore errors if we are only removing links as removal should
++ * always succeed
++ */
++ if (!new_links)
++ ret = 0;
++
+ if (ret) {
+ /* restore config */
+ memcpy(sdata->link, old_data, sizeof(old_data));
+--
+2.39.5
+
--- /dev/null
+From 3e1e6e9450a66fcd17187fabf5715d222284f639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 21:35:27 +0300
+Subject: wifi: mac80211: don't complete management TX on SAE commit
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6b04716cdcac37bdbacde34def08bc6fdb5fc4e2 ]
+
+When SAE commit is sent and received in response, there's no
+ordering for the SAE confirm messages. As such, don't call
+drivers to stop listening on the channel when the confirm
+message is still expected.
+
+This fixes an issue if the local confirm is transmitted later
+than the AP's confirm, for iwlwifi (and possibly mt76) the
+AP's confirm would then get lost since the device isn't on
+the channel at the time the AP transmit the confirm.
+
+For iwlwifi at least, this also improves the overall timing
+of the authentication handshake (by about 15ms according to
+the report), likely since the session protection won't be
+aborted and rescheduled.
+
+Note that even before this, mgd_complete_tx() wasn't always
+called for each call to mgd_prepare_tx() (e.g. in the case
+of WEP key shared authentication), and the current drivers
+that have the complete callback don't seem to mind. Document
+this as well though.
+
+Reported-by: Jan Hendrik Farr <kernel@jfarr.cc>
+Closes: https://lore.kernel.org/all/aB30Ea2kRG24LINR@archlinux/
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250609213232.12691580e140.I3f1d3127acabcd58348a110ab11044213cf147d3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/mac80211.h | 2 ++
+ net/mac80211/mlme.c | 9 ++++++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 5349df596157..829032258978 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4296,6 +4296,8 @@ struct ieee80211_prep_tx_info {
+ * @mgd_complete_tx: Notify the driver that the response frame for a previously
+ * transmitted frame announced with @mgd_prepare_tx was received, the data
+ * is filled similarly to @mgd_prepare_tx though the duration is not used.
++ * Note that this isn't always called for each mgd_prepare_tx() call, for
++ * example for SAE the 'confirm' messages can be on the air in any order.
+ *
+ * @mgd_protect_tdls_discover: Protect a TDLS discovery session. After sending
+ * a TDLS discovery-request, we expect a reply to arrive on the AP's
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index f4f13e170732..160821e42524 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4754,6 +4754,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_prep_tx_info info = {
+ .subtype = IEEE80211_STYPE_AUTH,
+ };
++ bool sae_need_confirm = false;
+
+ lockdep_assert_wiphy(sdata->local->hw.wiphy);
+
+@@ -4799,6 +4800,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+ jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
+ ifmgd->auth_data->timeout_started = true;
+ run_again(sdata, ifmgd->auth_data->timeout);
++ if (auth_transaction == 1)
++ sae_need_confirm = true;
+ goto notify_driver;
+ }
+
+@@ -4841,6 +4844,9 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+ ifmgd->auth_data->expected_transaction == 2)) {
+ if (!ieee80211_mark_sta_auth(sdata))
+ return; /* ignore frame -- wait for timeout */
++ } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
++ auth_transaction == 1) {
++ sae_need_confirm = true;
+ } else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
+ auth_transaction == 2) {
+ sdata_info(sdata, "SAE peer confirmed\n");
+@@ -4849,7 +4855,8 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+
+ cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+ notify_driver:
+- drv_mgd_complete_tx(sdata->local, sdata, &info);
++ if (!sae_need_confirm)
++ drv_mgd_complete_tx(sdata->local, sdata, &info);
+ }
+
+ #define case_WLAN(type) \
+--
+2.39.5
+
--- /dev/null
+From eadd9854b3b10d2323303d4f8ccd241e274ac7fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 23:37:53 +0300
+Subject: wifi: mac80211: don't unreserve never reserved chanctx
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit a6d521bafcb290294128a51b13dbf4baae5748fc ]
+
+If a link has no chanctx, indicating it is an inactive link
+that we tracked CSA for, then attempting to unreserve the
+reserved chanctx will throw a warning and fail, since there
+never was a reserved chanctx. Skip the unreserve.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250709233537.022192f4b1ae.Ib58156ac13e674a9f4d714735be0764a244c0aae@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 526b55e28348..f4f13e170732 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2535,7 +2535,8 @@ ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
+ if (!local->ops->abort_channel_switch)
+ return;
+
+- ieee80211_link_unreserve_chanctx(link);
++ if (rcu_access_pointer(link->conf->chanctx_conf))
++ ieee80211_link_unreserve_chanctx(link);
+
+ ieee80211_vif_unblock_queues_csa(sdata);
+
+--
+2.39.5
+
--- /dev/null
+From 00e366932f4b1cccc1269a902f9643546b92c448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 23:38:03 +0300
+Subject: wifi: mac80211: don't use TPE data from assoc response
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit a597432cc9e640439370d9dc95952220cc13fc2b ]
+
+Since there's no TPE element in the (re)assoc response, trying
+to use the data from it just leads to using the defaults, even
+though the real values had been set during authentication from
+the discovered BSS information.
+
+Fix this by simply not handling the TPE data in assoc response
+since it's not intended to be present, if it changes later the
+necessary changes will be made by tracking beacons later.
+
+As a side effect, by passing the real frame subtype, now print
+a correct value for ML reconfiguration responses.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250709233537.caa1ca853f5a.I588271f386731978163aa9d84ae75d6f79633e16@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index dc8df3129c00..526b55e28348 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1218,18 +1218,36 @@ EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_determine_chan_mode);
+
+ static int ieee80211_config_bw(struct ieee80211_link_data *link,
+ struct ieee802_11_elems *elems,
+- bool update, u64 *changed,
+- const char *frame)
++ bool update, u64 *changed, u16 stype)
+ {
+ struct ieee80211_channel *channel = link->conf->chanreq.oper.chan;
+ struct ieee80211_sub_if_data *sdata = link->sdata;
+ struct ieee80211_chan_req chanreq = {};
+ struct cfg80211_chan_def ap_chandef;
+ enum ieee80211_conn_mode ap_mode;
++ const char *frame;
+ u32 vht_cap_info = 0;
+ u16 ht_opmode;
+ int ret;
+
++ switch (stype) {
++ case IEEE80211_STYPE_BEACON:
++ frame = "beacon";
++ break;
++ case IEEE80211_STYPE_ASSOC_RESP:
++ frame = "assoc response";
++ break;
++ case IEEE80211_STYPE_REASSOC_RESP:
++ frame = "reassoc response";
++ break;
++ case IEEE80211_STYPE_ACTION:
++ /* the only action frame that gets here */
++ frame = "ML reconf response";
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ /* don't track any bandwidth changes in legacy/S1G modes */
+ if (link->u.mgd.conn.mode == IEEE80211_CONN_MODE_LEGACY ||
+ link->u.mgd.conn.mode == IEEE80211_CONN_MODE_S1G)
+@@ -1278,7 +1296,9 @@ static int ieee80211_config_bw(struct ieee80211_link_data *link,
+ ieee80211_min_bw_limit_from_chandef(&chanreq.oper))
+ ieee80211_chandef_downgrade(&chanreq.oper, NULL);
+
+- if (ap_chandef.chan->band == NL80211_BAND_6GHZ &&
++ /* TPE element is not present in (re)assoc/ML reconfig response */
++ if (stype == IEEE80211_STYPE_BEACON &&
++ ap_chandef.chan->band == NL80211_BAND_6GHZ &&
+ link->u.mgd.conn.mode >= IEEE80211_CONN_MODE_HE) {
+ ieee80211_rearrange_tpe(&elems->tpe, &ap_chandef,
+ &chanreq.oper);
+@@ -5290,7 +5310,9 @@ static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
+ /* check/update if AP changed anything in assoc response vs. scan */
+ if (ieee80211_config_bw(link, elems,
+ link_id == assoc_data->assoc_link_id,
+- changed, "assoc response")) {
++ changed,
++ le16_to_cpu(mgmt->frame_control) &
++ IEEE80211_FCTL_STYPE)) {
+ ret = false;
+ goto out;
+ }
+@@ -7478,7 +7500,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+
+ changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
+
+- if (ieee80211_config_bw(link, elems, true, &changed, "beacon")) {
++ if (ieee80211_config_bw(link, elems, true, &changed,
++ IEEE80211_STYPE_BEACON)) {
+ ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+ WLAN_REASON_DEAUTH_LEAVING,
+ true, deauth_buf);
+--
+2.39.5
+
--- /dev/null
+From 64778fbc4226c5d322bf35d4efff24c38c6944a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 14:11:19 +0530
+Subject: wifi: mac80211: fix rx link assignment for non-MLO stations
+
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+
+[ Upstream commit cc2b722132893164bcb3cee4f08ed056e126eb6c ]
+
+Currently, ieee80211_rx_data_set_sta() does not correctly handle the
+case where the interface supports multiple links (MLO), but the station
+does not (non-MLO). This can lead to incorrect link assignment or
+unexpected warnings when accessing link information.
+
+Hence, add a fix to check if the station lacks valid link support and
+use its default link ID for rx->link assignment. If the station
+unexpectedly has valid links, fall back to the default link.
+
+This ensures correct link association and prevents potential issues
+in mixed MLO/non-MLO environments.
+
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Link: https://patch.msgid.link/20250630084119.3583593-1-quic_sarishar@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8ec06cf0a9f0..7b801dd3f569 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4211,10 +4211,16 @@ static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
+ rx->link_sta = NULL;
+ }
+
+- if (link_id < 0)
+- rx->link = &rx->sdata->deflink;
+- else if (!ieee80211_rx_data_set_link(rx, link_id))
++ if (link_id < 0) {
++ if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
++ sta && !sta->sta.valid_links)
++ rx->link =
++ rcu_dereference(rx->sdata->link[sta->deflink.link_id]);
++ else
++ rx->link = &rx->sdata->deflink;
++ } else if (!ieee80211_rx_data_set_link(rx, link_id)) {
+ return false;
++ }
+
+ return true;
+ }
+--
+2.39.5
+
--- /dev/null
+From f7a27852167f8b5da2402a790c6c9e71f1520e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 23:38:02 +0300
+Subject: wifi: mac80211: handle WLAN_HT_ACTION_NOTIFY_CHANWIDTH async
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 93370f2d37f50757a810da409efc0223c342527e ]
+
+If this action frame, with the value of IEEE80211_HT_CHANWIDTH_ANY,
+arrives right after a beacon that changed the operational bandwidth from
+20 MHz to 40 MHz, then updating the rate control bandwidth to 40 can
+race with updating the chanctx width (that happens in the beacon
+proccesing) back to 40 MHz:
+
+cpu0 cpu1
+
+ieee80211_rx_mgmt_beacon
+ieee80211_config_bw
+ieee80211_link_change_chanreq
+(*)ieee80211_link_update_chanreq
+ ieee80211_rx_h_action
+ (**)ieee80211_sta_cur_vht_bw
+(***) ieee80211_recalc_chanctx_chantype
+
+in (**), the maximum between the capability width and the bss width is
+returned. But the bss width was just updated to 40 in (*),
+so the action frame handling code will increase the width of the rate
+control before the chanctx was increased (in ***), leading to a FW error
+(at least in iwlwifi driver. But this is wrong regardless).
+
+Fix this by simply handling the action frame async, so it won't race
+with the beacon proccessing.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218632
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250709233537.bb9dc6f36c35.I39782d6077424e075974c3bee4277761494a1527@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ht.c | 40 +++++++++++++++++++++++++++++++++++++-
+ net/mac80211/ieee80211_i.h | 6 ++++++
+ net/mac80211/iface.c | 29 +++++++++++++++++++++++++++
+ net/mac80211/rx.c | 35 ++++++---------------------------
+ 4 files changed, 80 insertions(+), 30 deletions(-)
+
+diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
+index 32390d8a9d75..1c82a28b03de 100644
+--- a/net/mac80211/ht.c
++++ b/net/mac80211/ht.c
+@@ -9,7 +9,7 @@
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017 Intel Deutschland GmbH
+- * Copyright(c) 2020-2024 Intel Corporation
++ * Copyright(c) 2020-2025 Intel Corporation
+ */
+
+ #include <linux/ieee80211.h>
+@@ -603,3 +603,41 @@ void ieee80211_request_smps(struct ieee80211_vif *vif, unsigned int link_id,
+ }
+ /* this might change ... don't want non-open drivers using it */
+ EXPORT_SYMBOL_GPL(ieee80211_request_smps);
++
++void ieee80211_ht_handle_chanwidth_notif(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct sta_info *sta,
++ struct link_sta_info *link_sta,
++ u8 chanwidth, enum nl80211_band band)
++{
++ enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
++ struct ieee80211_supported_band *sband;
++ struct sta_opmode_info sta_opmode = {};
++
++ lockdep_assert_wiphy(local->hw.wiphy);
++
++ if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
++ max_bw = IEEE80211_STA_RX_BW_20;
++ else
++ max_bw = ieee80211_sta_cap_rx_bw(link_sta);
++
++ /* set cur_max_bandwidth and recalc sta bw */
++ link_sta->cur_max_bandwidth = max_bw;
++ new_bw = ieee80211_sta_cur_vht_bw(link_sta);
++
++ if (link_sta->pub->bandwidth == new_bw)
++ return;
++
++ link_sta->pub->bandwidth = new_bw;
++ sband = local->hw.wiphy->bands[band];
++ sta_opmode.bw =
++ ieee80211_sta_rx_bw_to_chan_width(link_sta);
++ sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
++
++ rate_control_rate_update(local, sband, link_sta,
++ IEEE80211_RC_BW_CHANGED);
++ cfg80211_sta_opmode_change_notify(sdata->dev,
++ sta->addr,
++ &sta_opmode,
++ GFP_KERNEL);
++}
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index e0b44dbebe00..b504e09cc457 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2205,6 +2205,12 @@ u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs);
+ enum nl80211_smps_mode
+ ieee80211_smps_mode_to_smps_mode(enum ieee80211_smps_mode smps);
+
++void ieee80211_ht_handle_chanwidth_notif(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata,
++ struct sta_info *sta,
++ struct link_sta_info *link_sta,
++ u8 chanwidth, enum nl80211_band band);
++
+ /* VHT */
+ void
+ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 7d93e5aa595b..e062d2d7b3be 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1521,6 +1521,35 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
+ break;
+ }
+ }
++ } else if (ieee80211_is_action(mgmt->frame_control) &&
++ mgmt->u.action.category == WLAN_CATEGORY_HT) {
++ switch (mgmt->u.action.u.ht_smps.action) {
++ case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
++ u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
++ struct ieee80211_rx_status *status;
++ struct link_sta_info *link_sta;
++ struct sta_info *sta;
++
++ sta = sta_info_get_bss(sdata, mgmt->sa);
++ if (!sta)
++ break;
++
++ status = IEEE80211_SKB_RXCB(skb);
++ if (!status->link_valid)
++ link_sta = &sta->deflink;
++ else
++ link_sta = rcu_dereference_protected(sta->link[status->link_id],
++ lockdep_is_held(&local->hw.wiphy->mtx));
++ if (link_sta)
++ ieee80211_ht_handle_chanwidth_notif(local, sdata, sta,
++ link_sta, chanwidth,
++ status->band);
++ break;
++ }
++ default:
++ WARN_ON(1);
++ break;
++ }
+ } else if (ieee80211_is_action(mgmt->frame_control) &&
+ mgmt->u.action.category == WLAN_CATEGORY_VHT) {
+ switch (mgmt->u.action.u.vht_group_notif.action_code) {
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index e73431549ce7..8ec06cf0a9f0 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3576,41 +3576,18 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ goto handled;
+ }
+ case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
+- struct ieee80211_supported_band *sband;
+ u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
+- enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
+- struct sta_opmode_info sta_opmode = {};
++
++ if (chanwidth != IEEE80211_HT_CHANWIDTH_20MHZ &&
++ chanwidth != IEEE80211_HT_CHANWIDTH_ANY)
++ goto invalid;
+
+ /* If it doesn't support 40 MHz it can't change ... */
+ if (!(rx->link_sta->pub->ht_cap.cap &
+- IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+- goto handled;
+-
+- if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
+- max_bw = IEEE80211_STA_RX_BW_20;
+- else
+- max_bw = ieee80211_sta_cap_rx_bw(rx->link_sta);
+-
+- /* set cur_max_bandwidth and recalc sta bw */
+- rx->link_sta->cur_max_bandwidth = max_bw;
+- new_bw = ieee80211_sta_cur_vht_bw(rx->link_sta);
+-
+- if (rx->link_sta->pub->bandwidth == new_bw)
++ IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+ goto handled;
+
+- rx->link_sta->pub->bandwidth = new_bw;
+- sband = rx->local->hw.wiphy->bands[status->band];
+- sta_opmode.bw =
+- ieee80211_sta_rx_bw_to_chan_width(rx->link_sta);
+- sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
+-
+- rate_control_rate_update(local, sband, rx->link_sta,
+- IEEE80211_RC_BW_CHANGED);
+- cfg80211_sta_opmode_change_notify(sdata->dev,
+- rx->sta->addr,
+- &sta_opmode,
+- GFP_ATOMIC);
+- goto handled;
++ goto queue;
+ }
+ default:
+ goto invalid;
+--
+2.39.5
+
--- /dev/null
+From 0de65aaffb110b723d76306a50354a72d2161232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jun 2025 19:33:24 +0530
+Subject: wifi: mac80211: update radar_required in channel context after
+ channel switch
+
+From: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+
+[ Upstream commit 140c6a61d83cbd85adba769b5ef8d61acfa5b392 ]
+
+Currently, when a non-DFS channel is brought up and the bandwidth is
+expanded from 80 MHz to 160 MHz, where the primary 80 MHz is non-DFS
+and the secondary 80 MHz consists of DFS channels, radar detection
+fails if radar occurs in the secondary 80 MHz.
+
+When the channel is switched from 80 MHz to 160 MHz, with the primary
+80 MHz being non-DFS and the secondary 80 MHz consisting of DFS
+channels, the radar required flag in the channel switch parameters
+is set to true. However, when using a reserved channel context,
+it is not updated in sdata, which disables radar detection in the
+secondary 80 MHz DFS channels.
+
+Update the radar required flag in sdata to fix this issue when using
+a reserved channel context.
+
+Signed-off-by: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+Signed-off-by: Ramasamy Kaliappan <ramasamy.kaliappan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250608140324.1687117-1-ramasamy.kaliappan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/chan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index 3aaf5abf1acc..e0fdeaafc489 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -1381,6 +1381,7 @@ ieee80211_link_use_reserved_reassign(struct ieee80211_link_data *link)
+ goto out;
+ }
+
++ link->radar_required = link->reserved_radar_required;
+ list_move(&link->assigned_chanctx_list, &new_ctx->assigned_links);
+ rcu_assign_pointer(link_conf->chanctx_conf, &new_ctx->conf);
+
+--
+2.39.5
+
--- /dev/null
+From 49c7300ea9ec2083c477eca0ea7b946d4d21b341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 15:08:05 +0200
+Subject: wifi: mt76: fix vif link allocation
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 53a5d72bdd70e262623b6009cc4754927b428bad ]
+
+Reuse the vif deflink for link_id = 0 in order to avoid confusion with
+vif->bss_conf, which also gets a link id of 0.
+
+Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-1-356456c73f43@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/channel.c | 4 ++--
+ drivers/net/wireless/mediatek/mt76/mt76.h | 5 ++++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/channel.c b/drivers/net/wireless/mediatek/mt76/channel.c
+index cc2d888e3f17..77b75792eb48 100644
+--- a/drivers/net/wireless/mediatek/mt76/channel.c
++++ b/drivers/net/wireless/mediatek/mt76/channel.c
+@@ -173,13 +173,13 @@ void mt76_unassign_vif_chanctx(struct ieee80211_hw *hw,
+ if (!mlink)
+ goto out;
+
+- if (link_conf != &vif->bss_conf)
++ if (mlink != (struct mt76_vif_link *)vif->drv_priv)
+ rcu_assign_pointer(mvif->link[link_id], NULL);
+
+ dev->drv->vif_link_remove(phy, vif, link_conf, mlink);
+ mlink->ctx = NULL;
+
+- if (link_conf != &vif->bss_conf)
++ if (mlink != (struct mt76_vif_link *)vif->drv_priv)
+ kfree_rcu(mlink, rcu_head);
+
+ out:
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index d7cd467b812f..cc92eb9e5b1d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -1852,6 +1852,9 @@ mt76_vif_link(struct mt76_dev *dev, struct ieee80211_vif *vif, int link_id)
+ struct mt76_vif_link *mlink = (struct mt76_vif_link *)vif->drv_priv;
+ struct mt76_vif_data *mvif = mlink->mvif;
+
++ if (!link_id)
++ return mlink;
++
+ return mt76_dereference(mvif->link[link_id], dev);
+ }
+
+@@ -1862,7 +1865,7 @@ mt76_vif_conf_link(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ struct mt76_vif_link *mlink = (struct mt76_vif_link *)vif->drv_priv;
+ struct mt76_vif_data *mvif = mlink->mvif;
+
+- if (link_conf == &vif->bss_conf)
++ if (link_conf == &vif->bss_conf || !link_conf->link_id)
+ return mlink;
+
+ return mt76_dereference(mvif->link[link_conf->link_id], dev);
+--
+2.39.5
+
--- /dev/null
+From c80576295975394b00149553aa1c333ed5d2ddb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 02:45:26 +0200
+Subject: wifi: mt76: mt7915: mcu: increase eeprom command timeout
+
+From: David Bauer <mail@david-bauer.net>
+
+[ Upstream commit efd31873cdb3e5580fb76eeded6314856f52b06e ]
+
+Increase the timeout for MCU_EXT_CMD_EFUSE_BUFFER_MODE command.
+
+Regular retries upon hardware-recovery have been observed. Increasing
+the timeout slightly remedies this problem.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Link: https://patch.msgid.link/20250402004528.1036715-2-mail@david-bauer.net
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 45dd444ce360..cac176ee5152 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -208,6 +208,9 @@ mt7915_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
+ case MCU_EXT_CMD_BSS_INFO_UPDATE:
+ mdev->mcu.timeout = 2 * HZ;
+ return;
++ case MCU_EXT_CMD_EFUSE_BUFFER_MODE:
++ mdev->mcu.timeout = 10 * HZ;
++ return;
+ default:
+ break;
+ }
+--
+2.39.5
+
--- /dev/null
+From 23a548502e9b6b5951af12b07ddb6a9d1cb0a3b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 02:45:27 +0200
+Subject: wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
+
+From: David Bauer <mail@david-bauer.net>
+
+[ Upstream commit ac9c50c79eaef5fca0f165e45d0c5880606db53e ]
+
+Restart the MCU and release the patch semaphore before loading the MCU
+patch firmware from the host.
+
+This fixes failures upon error recovery in case the semaphore was
+previously taken and never released by the host.
+
+This happens from time to time upon triggering a full-chip error
+recovery. Under this circumstance, the hardware restart fails and the
+radio is rendered inoperational.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Link: https://patch.msgid.link/20250402004528.1036715-3-mail@david-bauer.net
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 25 +++++++++++--------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 3643c72bb68d..45dd444ce360 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -2092,16 +2092,21 @@ static int mt7915_load_firmware(struct mt7915_dev *dev)
+ {
+ int ret;
+
+- /* make sure fw is download state */
+- if (mt7915_firmware_state(dev, false)) {
+- /* restart firmware once */
+- mt76_connac_mcu_restart(&dev->mt76);
+- ret = mt7915_firmware_state(dev, false);
+- if (ret) {
+- dev_err(dev->mt76.dev,
+- "Firmware is not ready for download\n");
+- return ret;
+- }
++ /* Release Semaphore if taken by previous failed attempt */
++ ret = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
++ if (ret != PATCH_REL_SEM_SUCCESS) {
++ dev_err(dev->mt76.dev, "Could not release semaphore\n");
++ /* Continue anyways */
++ }
++
++ /* Always restart MCU firmware */
++ mt76_connac_mcu_restart(&dev->mt76);
++
++ /* Check if MCU is ready */
++ ret = mt7915_firmware_state(dev, false);
++ if (ret) {
++ dev_err(dev->mt76.dev, "Firmware did not enter download state\n");
++ return ret;
+ }
+
+ ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
+--
+2.39.5
+
--- /dev/null
+From a0edff52387955d744fdfd574a29860dda3f3d0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jul 2025 15:08:09 +0200
+Subject: wifi: mt76: mt7996: Fix mlink lookup in mt7996_tx_prepare_skb
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 59ea7af6f9ce218b86f9f46520819247c3a5f97b ]
+
+Use proper link_id in mt7996_tx_prepare_skb routine for mlink lookup.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-5-356456c73f43@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 3646806088e9..8f8c31042843 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1059,9 +1059,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ if (wcid->offchannel)
+ mlink = rcu_dereference(mvif->mt76.offchannel_link);
+ if (!mlink)
+- mlink = &mvif->deflink.mt76;
++ mlink = rcu_dereference(mvif->mt76.link[wcid->link_id]);
+
+- txp->fw.bss_idx = mlink->idx;
++ txp->fw.bss_idx = mlink ? mlink->idx : mvif->deflink.mt76.idx;
+ }
+
+ txp->fw.token = cpu_to_le16(id);
+--
+2.39.5
+
--- /dev/null
+From 48eb1b8b96064b8d7d69bb73d7640bef9d0a9a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 12:56:30 +0200
+Subject: wifi: rtlwifi: fix possible skb memory leak in
+ `_rtl_pci_rx_interrupt()`.
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 44c0e191004f0e3aa1bdee3be248be14dbe5b020 ]
+
+The function `_rtl_pci_init_one_rxdesc()` can fail even when the new
+`skb` is passed because of a DMA mapping error. If it fails, the `skb`
+is not saved in the rx ringbuffer and thus lost.
+
+Compile tested only
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250616105631.444309-4-fourier.thomas@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 898f597f70a9..2741c3beac4c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -802,13 +802,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ skb = new_skb;
+ no_new:
+ if (rtlpriv->use_new_trx_flow) {
+- _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
+- rxring_idx,
+- rtlpci->rx_ring[rxring_idx].idx);
++ if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)buffer_desc,
++ rxring_idx,
++ rtlpci->rx_ring[rxring_idx].idx)) {
++ if (new_skb)
++ dev_kfree_skb_any(skb);
++ }
+ } else {
+- _rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
+- rxring_idx,
+- rtlpci->rx_ring[rxring_idx].idx);
++ if (!_rtl_pci_init_one_rxdesc(hw, skb, (u8 *)pdesc,
++ rxring_idx,
++ rtlpci->rx_ring[rxring_idx].idx)) {
++ if (new_skb)
++ dev_kfree_skb_any(skb);
++ }
+ if (rtlpci->rx_ring[rxring_idx].idx ==
+ rtlpci->rxringcount - 1)
+ rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc,
+--
+2.39.5
+
--- /dev/null
+From 9fe2ad9a089e6520f2022d93e686542c80bc2f58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 09:38:36 +0200
+Subject: wifi: rtlwifi: fix possible skb memory leak in
+ _rtl_pci_init_one_rxdesc()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 76b3e5078d76f0eeadb7aacf9845399f8473da0d ]
+
+When `dma_mapping_error()` is true, if a new `skb` has been allocated,
+then it must be de-allocated.
+
+Compile tested only
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250613074014.69856-2-fourier.thomas@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 2741c3beac4c..d080469264cf 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -572,8 +572,11 @@ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+ dma_map_single(&rtlpci->pdev->dev, skb_tail_pointer(skb),
+ rtlpci->rxbuffersize, DMA_FROM_DEVICE);
+ bufferaddress = *((dma_addr_t *)skb->cb);
+- if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress))
++ if (dma_mapping_error(&rtlpci->pdev->dev, bufferaddress)) {
++ if (!new_skb)
++ kfree_skb(skb);
+ return 0;
++ }
+ rtlpci->rx_ring[rxring_idx].rx_buf[desc_idx] = skb;
+ if (rtlpriv->use_new_trx_flow) {
+ /* skb->cb may be 64 bit address */
+--
+2.39.5
+
--- /dev/null
+From 936c32e5dad82112e390d39d1c6dd24f36a3ecb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 17:02:49 +0800
+Subject: wifi: rtw89: coex: Not to set slot duration to zero to avoid firmware
+ issue
+
+From: Ching-Te Ku <ku920601@realtek.com>
+
+[ Upstream commit a7feafea4ce80d5fa5284d05d54b4f108d2ab575 ]
+
+If the duration set to zero, Wi-Fi firmware will trigger some unexpected
+issue when firmware try to enable timer.
+
+Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250616090252.51098-9-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/coex.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
+index 5ccf0cbaed2f..ea3664103fbf 100644
+--- a/drivers/net/wireless/realtek/rtw89/coex.c
++++ b/drivers/net/wireless/realtek/rtw89/coex.c
+@@ -3836,13 +3836,13 @@ void rtw89_btc_set_policy_v1(struct rtw89_dev *rtwdev, u16 policy_type)
+
+ switch (policy_type) {
+ case BTC_CXP_OFFE_2GBWISOB: /* for normal-case */
+- _slot_set(btc, CXST_E2G, 0, tbl_w1, SLOT_ISO);
++ _slot_set(btc, CXST_E2G, 5, tbl_w1, SLOT_ISO);
+ _slot_set_le(btc, CXST_EBT, s_def[CXST_EBT].dur,
+ s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
+ _slot_set_dur(btc, CXST_EBT, dur_2);
+ break;
+ case BTC_CXP_OFFE_2GISOB: /* for bt no-link */
+- _slot_set(btc, CXST_E2G, 0, cxtbl[1], SLOT_ISO);
++ _slot_set(btc, CXST_E2G, 5, cxtbl[1], SLOT_ISO);
+ _slot_set_le(btc, CXST_EBT, s_def[CXST_EBT].dur,
+ s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
+ _slot_set_dur(btc, CXST_EBT, dur_2);
+@@ -3868,15 +3868,15 @@ void rtw89_btc_set_policy_v1(struct rtw89_dev *rtwdev, u16 policy_type)
+ break;
+ case BTC_CXP_OFFE_2GBWMIXB:
+ if (a2dp->exist)
+- _slot_set(btc, CXST_E2G, 0, cxtbl[2], SLOT_MIX);
++ _slot_set(btc, CXST_E2G, 5, cxtbl[2], SLOT_MIX);
+ else
+- _slot_set(btc, CXST_E2G, 0, tbl_w1, SLOT_MIX);
++ _slot_set(btc, CXST_E2G, 5, tbl_w1, SLOT_MIX);
+ _slot_set_le(btc, CXST_EBT, s_def[CXST_EBT].dur,
+ s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
+ break;
+ case BTC_CXP_OFFE_WL: /* for 4-way */
+- _slot_set(btc, CXST_E2G, 0, cxtbl[1], SLOT_MIX);
+- _slot_set(btc, CXST_EBT, 0, cxtbl[1], SLOT_MIX);
++ _slot_set(btc, CXST_E2G, 5, cxtbl[1], SLOT_MIX);
++ _slot_set(btc, CXST_EBT, 5, cxtbl[1], SLOT_MIX);
+ break;
+ default:
+ break;
+--
+2.39.5
+
--- /dev/null
+From 7c6134391ebdd1327cb09e2fc6ac7cffb223ae33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 23:43:25 +0300
+Subject: wifi: rtw89: Disable deep power saving for USB/SDIO
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit a3b871a0f7c083c2a632a31da8bc3de554ae8550 ]
+
+Disable deep power saving for USB and SDIO because rtw89_mac_send_rpwm()
+is called in atomic context and accessing hardware registers results in
+"scheduling while atomic" errors.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/0f49eceb-0de0-47e2-ba36-3c6a0dddd17d@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 69546a039494..628b64457a17 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -2788,6 +2788,9 @@ static enum rtw89_ps_mode rtw89_update_ps_mode(struct rtw89_dev *rtwdev)
+ {
+ const struct rtw89_chip_info *chip = rtwdev->chip;
+
++ if (rtwdev->hci.type != RTW89_HCI_TYPE_PCIE)
++ return RTW89_PS_MODE_NONE;
++
+ if (rtw89_disable_ps_mode || !chip->ps_mode_supported ||
+ RTW89_CHK_FW_FEATURE(NO_DEEP_PS, &rtwdev->fw))
+ return RTW89_PS_MODE_NONE;
+--
+2.39.5
+
--- /dev/null
+From 2f4f15a52e48dac4183425b05be4260fc73dce7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 23:45:55 +0300
+Subject: wifi: rtw89: Fix rtw89_mac_power_switch() for USB
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit e2b71603333a9dd73ee88347d8894fffc3456ac1 ]
+
+Clear some bits in some registers in order to allow RTL8851BU to power
+on. This is done both when powering on and when powering off because
+that's what the vendor driver does.
+
+Also tested with RTL8832BU and RTL8832CU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/a39da939-d640-4486-ad38-f658f220afc8@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 19 +++++++++++++++++++
+ drivers/net/wireless/realtek/rtw89/reg.h | 1 +
+ 2 files changed, 20 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index b4841f948ec1..4d76a5e47967 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -1441,6 +1441,23 @@ void rtw89_mac_notify_wake(struct rtw89_dev *rtwdev)
+ rtw89_mac_send_rpwm(rtwdev, state, true);
+ }
+
++static void rtw89_mac_power_switch_boot_mode(struct rtw89_dev *rtwdev)
++{
++ u32 boot_mode;
++
++ if (rtwdev->hci.type != RTW89_HCI_TYPE_USB)
++ return;
++
++ boot_mode = rtw89_read32_mask(rtwdev, R_AX_GPIO_MUXCFG, B_AX_BOOT_MODE);
++ if (!boot_mode)
++ return;
++
++ rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_APFN_ONMAC);
++ rtw89_write32_clr(rtwdev, R_AX_SYS_STATUS1, B_AX_AUTO_WLPON);
++ rtw89_write32_clr(rtwdev, R_AX_GPIO_MUXCFG, B_AX_BOOT_MODE);
++ rtw89_write32_clr(rtwdev, R_AX_RSV_CTRL, B_AX_R_DIS_PRST);
++}
++
+ static int rtw89_mac_power_switch(struct rtw89_dev *rtwdev, bool on)
+ {
+ #define PWR_ACT 1
+@@ -1451,6 +1468,8 @@ static int rtw89_mac_power_switch(struct rtw89_dev *rtwdev, bool on)
+ int ret;
+ u8 val;
+
++ rtw89_mac_power_switch_boot_mode(rtwdev);
++
+ if (on) {
+ cfg_seq = chip->pwr_on_seq;
+ cfg_func = chip->ops->pwr_on_func;
+diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h
+index c776954ad360..f33dc82a641e 100644
+--- a/drivers/net/wireless/realtek/rtw89/reg.h
++++ b/drivers/net/wireless/realtek/rtw89/reg.h
+@@ -182,6 +182,7 @@
+
+ #define R_AX_SYS_STATUS1 0x00F4
+ #define B_AX_SEL_0XC0_MASK GENMASK(17, 16)
++#define B_AX_AUTO_WLPON BIT(10)
+ #define B_AX_PAD_HCI_SEL_V2_MASK GENMASK(5, 3)
+ #define MAC_AX_HCI_SEL_SDIO_UART 0
+ #define MAC_AX_HCI_SEL_MULTI_USB 1
+--
+2.39.5
+
--- /dev/null
+From 96981083813512c0f94a46df06eee566f5f8c3f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 22:44:47 +0300
+Subject: wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 671be46afd1f03de9dc6e4679c88e1a7a81cdff6 ]
+
+This read_poll_timeout_atomic() with a delay of 1 µs and a timeout of
+1000000 µs can take ~250 seconds in the worst case because sending a
+USB control message takes ~250 µs.
+
+Lower the timeout to 4000 for USB in order to reduce the maximum polling
+time to ~1 second.
+
+This problem was observed with RTL8851BU while suspending to RAM with
+WOWLAN enabled. The computer sat for 4 minutes with a black screen
+before suspending.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/09313da6-c865-4e91-b758-4cb38a878796@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 9 +++++++--
+ drivers/net/wireless/realtek/rtw89/fw.h | 2 ++
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 6c52b0425f2e..4d7d0197736f 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -6446,13 +6446,18 @@ static int rtw89_fw_read_c2h_reg(struct rtw89_dev *rtwdev,
+ const struct rtw89_chip_info *chip = rtwdev->chip;
+ struct rtw89_fw_info *fw_info = &rtwdev->fw;
+ const u32 *c2h_reg = chip->c2h_regs;
+- u32 ret;
++ u32 ret, timeout;
+ u8 i, val;
+
+ info->id = RTW89_FWCMD_C2HREG_FUNC_NULL;
+
++ if (rtwdev->hci.type == RTW89_HCI_TYPE_USB)
++ timeout = RTW89_C2H_TIMEOUT_USB;
++ else
++ timeout = RTW89_C2H_TIMEOUT;
++
+ ret = read_poll_timeout_atomic(rtw89_read8, val, val, 1,
+- RTW89_C2H_TIMEOUT, false, rtwdev,
++ timeout, false, rtwdev,
+ chip->c2h_ctrl_reg);
+ if (ret) {
+ rtw89_warn(rtwdev, "c2h reg timeout\n");
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
+index 55255b48bdb7..43e569b90e18 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.h
++++ b/drivers/net/wireless/realtek/rtw89/fw.h
+@@ -112,6 +112,8 @@ struct rtw89_h2creg_sch_tx_en {
+ #define RTW89_C2HREG_HDR_LEN 2
+ #define RTW89_H2CREG_HDR_LEN 2
+ #define RTW89_C2H_TIMEOUT 1000000
++#define RTW89_C2H_TIMEOUT_USB 4000
++
+ struct rtw89_mac_c2h_info {
+ u8 id;
+ u8 content_len;
+--
+2.39.5
+
--- /dev/null
+From 9a122f144aecdd560a76a2d90455e4936a7ee896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 21:00:34 +0800
+Subject: wifi: rtw89: scan abort when assign/unassign_vif
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 3db8563bac6c34018cbb96b14549a95c368b0304 ]
+
+If scan happen during start_ap, the register which control TX might be
+turned off during scan. Additionally, if set_channel occurs during scan
+will backup this register and set to firmware after set_channel done.
+When scan complete, firmware will also set TX by this register, causing
+TX to be disabled and beacon can't be TX. Therefore, in assign/unassign_vif
+call scan abort before set_channel to avoid scan racing with set_channel.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250610130034.14692-13-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/chan.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c
+index f60e93870b09..d343681c2c00 100644
+--- a/drivers/net/wireless/realtek/rtw89/chan.c
++++ b/drivers/net/wireless/realtek/rtw89/chan.c
+@@ -2680,6 +2680,9 @@ int rtw89_chanctx_ops_assign_vif(struct rtw89_dev *rtwdev,
+ rtwvif_link->chanctx_assigned = true;
+ cfg->ref_count++;
+
++ if (rtwdev->scanning)
++ rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif);
++
+ if (list_empty(&rtwvif->mgnt_entry))
+ list_add_tail(&rtwvif->mgnt_entry, &mgnt->active_list);
+
+@@ -2719,6 +2722,9 @@ void rtw89_chanctx_ops_unassign_vif(struct rtw89_dev *rtwdev,
+ rtwvif_link->chanctx_assigned = false;
+ cfg->ref_count--;
+
++ if (rtwdev->scanning)
++ rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif);
++
+ if (!rtw89_vif_is_active_role(rtwvif))
+ list_del_init(&rtwvif->mgnt_entry);
+
+--
+2.39.5
+
--- /dev/null
+From 8ad6fc838c8a19b28f84df325618c4a93a62d6f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 20:29:26 +0800
+Subject: wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled
+ scan mode
+
+From: Chin-Yen Lee <timlee@realtek.com>
+
+[ Upstream commit 37c23874d13eb369d8b384a1ce5992ff6c23d56f ]
+
+In scheduled scan mode, the current probe request only includes the SSID
+IE, but omits the Basic Rate IE. Some APs do not respond to such
+incomplete probe requests, causing net-detect failures. To improve
+interoperability and ensure APs respond correctly, add the Basic Rate IE
+to the probe request in driver.
+
+Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250716122926.6709-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/wow.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
+index 17eee58503cb..ea2d3ad8391a 100644
+--- a/drivers/net/wireless/realtek/rtw89/wow.c
++++ b/drivers/net/wireless/realtek/rtw89/wow.c
+@@ -1413,6 +1413,8 @@ static void rtw89_fw_release_pno_pkt_list(struct rtw89_dev *rtwdev,
+ static int rtw89_pno_scan_update_probe_req(struct rtw89_dev *rtwdev,
+ struct rtw89_vif_link *rtwvif_link)
+ {
++ static const u8 basic_rate_ie[] = {WLAN_EID_SUPP_RATES, 0x08,
++ 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c};
+ struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+ struct cfg80211_sched_scan_request *nd_config = rtw_wow->nd_config;
+ u8 num = nd_config->n_match_sets, i;
+@@ -1424,10 +1426,11 @@ static int rtw89_pno_scan_update_probe_req(struct rtw89_dev *rtwdev,
+ skb = ieee80211_probereq_get(rtwdev->hw, rtwvif_link->mac_addr,
+ nd_config->match_sets[i].ssid.ssid,
+ nd_config->match_sets[i].ssid.ssid_len,
+- nd_config->ie_len);
++ nd_config->ie_len + sizeof(basic_rate_ie));
+ if (!skb)
+ return -ENOMEM;
+
++ skb_put_data(skb, basic_rate_ie, sizeof(basic_rate_ie));
+ skb_put_data(skb, nd_config->ie, nd_config->ie_len);
+
+ info = kzalloc(sizeof(*info), GFP_KERNEL);
+--
+2.39.5
+
--- /dev/null
+From 6b93a96550230fd73bcdbf022a847a58b2a78964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 10:29:31 -0700
+Subject: x86/bugs: Avoid warning when overriding return thunk
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+[ Upstream commit 9f85fdb9fc5a1bd308a10a0a7d7e34f2712ba58b ]
+
+The purpose of the warning is to prevent an unexpected change to the return
+thunk mitigation. However, there are legitimate cases where the return
+thunk is intentionally set more than once. For example, ITS and SRSO both
+can set the return thunk after retbleed has set it. In both the cases
+retbleed is still mitigated.
+
+Replace the warning with an info about the active return thunk.
+
+Suggested-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250611-eibrs-fix-v4-3-5ff86cac6c61@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/bugs.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 0f6bc28db182..82089a464d30 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -70,10 +70,9 @@ void (*x86_return_thunk)(void) __ro_after_init = __x86_return_thunk;
+
+ static void __init set_return_thunk(void *thunk)
+ {
+- if (x86_return_thunk != __x86_return_thunk)
+- pr_warn("x86/bugs: return thunk changed\n");
+-
+ x86_return_thunk = thunk;
++
++ pr_info("active return thunk: %ps\n", thunk);
+ }
+
+ /* Update SPEC_CTRL MSR and its cached copy unconditionally */
+--
+2.39.5
+
--- /dev/null
+From b1338205655c382afcc080dfddc8b95aac55f721 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 09:34:54 +0000
+Subject: xen/netfront: Fix TX response spurious interrupts
+
+From: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+
+[ Upstream commit 114a2de6fa86d99ed9546cc9113a3cad58beef79 ]
+
+We found at Vates that there are lot of spurious interrupts when
+benchmarking the xen-net PV driver frontend. This issue appeared with a
+patch that addresses security issue XSA-391 (b27d47950e48 "xen/netfront:
+harden netfront against event channel storms"). On an iperf benchmark,
+spurious interrupts can represent up to 50% of the interrupts.
+
+Spurious interrupts are interrupts that are rised for nothing, there is
+no work to do. This appends because the function that handles the
+interrupts ("xennet_tx_buf_gc") is also called at the end of the request
+path to garbage collect the responses received during the transmission
+load.
+
+The request path is doing the work that the interrupt handler should
+have done otherwise. This is particurary true when there is more than
+one vcpu and get worse linearly with the number of vcpu/queue.
+
+Moreover, this problem is amplifyed by the penalty imposed by a spurious
+interrupt. When an interrupt is found spurious the interrupt chip will
+delay the EOI to slowdown the backend. This delay will allow more
+responses to be handled by the request path and then there will be more
+chance the next interrupt will not find any work to do, creating a new
+spurious interrupt.
+
+This causes performance issue. The solution here is to remove the calls
+from the request path and let the interrupt handler do the processing of
+the responses. This approch removes most of the spurious interrupts
+(<0.05%) and also has the benefit of freeing up cycles in the request
+path, allowing it to process more work, which improves performance
+compared to masking the spurious interrupt one way or another.
+
+This optimization changes a part of the code that is present since the
+net frontend driver was upstreamed. There is no similar pattern in the
+other xen PV drivers. Since the first commit of xen-netfront is a blob
+that doesn't explain all the design choices I can only guess why this
+specific mecanism was here. This could have been introduce to compensate
+a slow backend at the time (maybe the backend was fixed or optimize
+later) or a small queue. In 18 years, both frontend and backend gain lot
+of features and optimizations that could have obsolete the feature of
+reaping completions from the TX path.
+
+Some vif throughput performance figures from a 8 vCPUs, 4GB of RAM HVM
+guest(s):
+
+Without this patch on the :
+vm -> dom0: 4.5Gb/s
+vm -> vm: 7.0Gb/s
+
+Without XSA-391 patch (revert of b27d47950e48):
+vm -> dom0: 8.3Gb/s
+vm -> vm: 8.7Gb/s
+
+With XSA-391 and this patch:
+vm -> dom0: 11.5Gb/s
+vm -> vm: 12.6Gb/s
+
+v2:
+- add revewed and tested by tags
+- resend with the maintainers in the recipients list
+
+v3:
+- remove Fixes tag but keep the commit ref in the explanation
+- add a paragraph on why this code was here
+
+Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@vates.tech>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Tested-by: Elliott Mitchell <ehem+xen@m5p.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250721093316.23560-1-anthoine.bourgeois@vates.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netfront.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 5091e1fa4a0d..186d8ec1eaa6 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -637,8 +637,6 @@ static int xennet_xdp_xmit_one(struct net_device *dev,
+ tx_stats->packets++;
+ u64_stats_update_end(&tx_stats->syncp);
+
+- xennet_tx_buf_gc(queue);
+-
+ return 0;
+ }
+
+@@ -848,9 +846,6 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ tx_stats->packets++;
+ u64_stats_update_end(&tx_stats->syncp);
+
+- /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
+- xennet_tx_buf_gc(queue);
+-
+ if (!netfront_tx_slot_available(queue))
+ netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
+
+--
+2.39.5
+
--- /dev/null
+From 80529e9764b0bf5cdf85a28e787031ecc1e3266b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:08:56 +0530
+Subject: xfrm: Duplicate SPI Handling
+
+From: Aakash Kumar S <saakashkumar@marvell.com>
+
+[ Upstream commit 94f39804d891cffe4ce17737d295f3b195bc7299 ]
+
+The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI
+Netlink message, which triggers the kernel function xfrm_alloc_spi().
+This function is expected to ensure uniqueness of the Security Parameter
+Index (SPI) for inbound Security Associations (SAs). However, it can
+return success even when the requested SPI is already in use, leading
+to duplicate SPIs assigned to multiple inbound SAs, differentiated
+only by their destination addresses.
+
+This behavior causes inconsistencies during SPI lookups for inbound packets.
+Since the lookup may return an arbitrary SA among those with the same SPI,
+packet processing can fail, resulting in packet drops.
+
+According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA
+is uniquely identified by the SPI and optionally protocol.
+
+Reproducing the Issue Reliably:
+To consistently reproduce the problem, restrict the available SPI range in
+charon.conf : spi_min = 0x10000000 spi_max = 0x10000002
+This limits the system to only 2 usable SPI values.
+Next, create more than 2 Child SA. each using unique pair of src/dst address.
+As soon as the 3rd Child SA is initiated, it will be assigned a duplicate
+SPI, since the SPI pool is already exhausted.
+With a narrow SPI range, the issue is consistently reproducible.
+With a broader/default range, it becomes rare and unpredictable.
+
+Current implementation:
+xfrm_spi_hash() lookup function computes hash using daddr, proto, and family.
+So if two SAs have the same SPI but different destination addresses, then
+they will:
+a. Hash into different buckets
+b. Be stored in different linked lists (byspi + h)
+c. Not be seen in the same hlist_for_each_entry_rcu() iteration.
+As a result, the lookup will result in NULL and kernel allows that Duplicate SPI
+
+Proposed Change:
+xfrm_state_lookup_spi_proto() does a truly global search - across all states,
+regardless of hash bucket and matches SPI and proto.
+
+Signed-off-by: Aakash Kumar S <saakashkumar@marvell.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_state.c | 72 ++++++++++++++++++++++++++-----------------
+ 1 file changed, 43 insertions(+), 29 deletions(-)
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 0cf516b4e6d9..f57bb78fb12a 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1702,6 +1702,26 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
+ }
+ EXPORT_SYMBOL(xfrm_state_lookup_byspi);
+
++static struct xfrm_state *xfrm_state_lookup_spi_proto(struct net *net, __be32 spi, u8 proto)
++{
++ struct xfrm_state *x;
++ unsigned int i;
++
++ rcu_read_lock();
++ for (i = 0; i <= net->xfrm.state_hmask; i++) {
++ hlist_for_each_entry_rcu(x, &net->xfrm.state_byspi[i], byspi) {
++ if (x->id.spi == spi && x->id.proto == proto) {
++ if (!xfrm_state_hold_rcu(x))
++ continue;
++ rcu_read_unlock();
++ return x;
++ }
++ }
++ }
++ rcu_read_unlock();
++ return NULL;
++}
++
+ static void __xfrm_state_insert(struct xfrm_state *x)
+ {
+ struct net *net = xs_net(x);
+@@ -2538,10 +2558,8 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high,
+ unsigned int h;
+ struct xfrm_state *x0;
+ int err = -ENOENT;
+- __be32 minspi = htonl(low);
+- __be32 maxspi = htonl(high);
++ u32 range = high - low + 1;
+ __be32 newspi = 0;
+- u32 mark = x->mark.v & x->mark.m;
+
+ spin_lock_bh(&x->lock);
+ if (x->km.state == XFRM_STATE_DEAD) {
+@@ -2555,38 +2573,34 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high,
+
+ err = -ENOENT;
+
+- if (minspi == maxspi) {
+- x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
+- if (x0) {
+- NL_SET_ERR_MSG(extack, "Requested SPI is already in use");
+- xfrm_state_put(x0);
++ for (h = 0; h < range; h++) {
++ u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high);
++ newspi = htonl(spi);
++
++ spin_lock_bh(&net->xfrm.xfrm_state_lock);
++ x0 = xfrm_state_lookup_spi_proto(net, newspi, x->id.proto);
++ if (!x0) {
++ x->id.spi = newspi;
++ h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family);
++ XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, x->xso.type);
++ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
++ err = 0;
+ goto unlock;
+ }
+- newspi = minspi;
+- } else {
+- u32 spi = 0;
+- for (h = 0; h < high-low+1; h++) {
+- spi = get_random_u32_inclusive(low, high);
+- x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
+- if (x0 == NULL) {
+- newspi = htonl(spi);
+- break;
+- }
+- xfrm_state_put(x0);
++ xfrm_state_put(x0);
++ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
++
++ if (signal_pending(current)) {
++ err = -ERESTARTSYS;
++ goto unlock;
+ }
++
++ if (low == high)
++ break;
+ }
+- if (newspi) {
+- spin_lock_bh(&net->xfrm.xfrm_state_lock);
+- x->id.spi = newspi;
+- h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
+- XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h,
+- x->xso.type);
+- spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+- err = 0;
+- } else {
++ if (err)
+ NL_SET_ERR_MSG(extack, "No SPI available in the requested range");
+- }
+
+ unlock:
+ spin_unlock_bh(&x->lock);
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
