--- /dev/null
+From ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 Mon Sep 17 00:00:00 2001
+From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Date: Thu, 21 Nov 2024 16:13:25 +0900
+Subject: ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
+
+From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+
+commit ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 upstream.
+
+On SoCFPGA/Sodia board, mdio bus cannot be probed, so the PHY cannot be
+found and the network device does not work.
+
+```
+stmmaceth ff702000.ethernet eth0: __stmmac_open: Cannot attach to PHY (error: -19)
+```
+
+To probe the mdio bus, add "snps,dwmac-mdio" as compatible string of the
+mdio bus. Also the PHY address connected to this board is 4. Therefore,
+change to 4.
+
+Cc: stable@vger.kernel.org # 6.3+
+Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts
++++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts
+@@ -66,8 +66,10 @@
+ mdio0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+- phy0: ethernet-phy@0 {
+- reg = <0>;
++ compatible = "snps,dwmac-mdio";
++
++ phy0: ethernet-phy@4 {
++ reg = <4>;
+ rxd0-skew-ps = <0>;
+ rxd1-skew-ps = <0>;
+ rxd2-skew-ps = <0>;
--- /dev/null
+From 48b51799a5461707705454568453618cdd7307f4 Mon Sep 17 00:00:00 2001
+From: Josua Mayer <josua@solid-run.com>
+Date: Thu, 11 Sep 2025 20:28:05 +0200
+Subject: arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
+
+From: Josua Mayer <josua@solid-run.com>
+
+commit 48b51799a5461707705454568453618cdd7307f4 upstream.
+
+Similar to MacchiatoBIN the high-speed modes are unstable on the CN9132
+CEX-7 module, leading to failed transactions under normal use.
+
+Disable all high-speed modes including UHS.
+
+Additionally add no-sdio and non-removable properties as appropriate for
+eMMC.
+
+Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi
++++ b/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi
+@@ -137,6 +137,14 @@
+ pinctrl-0 = <&ap_mmc0_pins>;
+ pinctrl-names = "default";
+ vqmmc-supply = <&v_1_8>;
++ /*
++ * Not stable in HS modes - phy needs "more calibration", so disable
++ * UHS (by preventing voltage switch), SDR104, SDR50 and DDR50 modes.
++ */
++ no-1-8-v;
++ no-sd;
++ no-sdio;
++ non-removable;
+ status = "okay";
+ };
+
--- /dev/null
+From 794a066688038df46c01e177cc6faebded0acba4 Mon Sep 17 00:00:00 2001
+From: Josua Mayer <josua@solid-run.com>
+Date: Thu, 11 Sep 2025 20:28:06 +0200
+Subject: arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
+
+From: Josua Mayer <josua@solid-run.com>
+
+commit 794a066688038df46c01e177cc6faebded0acba4 upstream.
+
+The mvebu-comphy driver does not currently know how to pass correct
+lane-count to ATF while configuring the serdes lanes.
+
+This causes the system to hard reset during reconfiguration, if a pci
+card is present and has established a link during bootloader.
+
+Remove the comphy handles from the respective pci nodes to avoid runtime
+reconfiguration, relying solely on bootloader configuration - while
+avoiding the hard reset.
+
+When bootloader has configured the lanes correctly, the pci ports are
+functional under Linux.
+
+This issue may be addressed in the comphy driver at a future point.
+
+Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
++++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
+@@ -413,7 +413,13 @@
+ /* SRDS #0,#1,#2,#3 - PCIe */
+ &cp0_pcie0 {
+ num-lanes = <4>;
+- phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>;
++ /*
++ * The mvebu-comphy driver does not currently know how to pass correct
++ * lane-count to ATF while configuring the serdes lanes.
++ * Rely on bootloader configuration only.
++ *
++ * phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>;
++ */
+ status = "okay";
+ };
+
+@@ -475,7 +481,13 @@
+ /* SRDS #0,#1 - PCIe */
+ &cp1_pcie0 {
+ num-lanes = <2>;
+- phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>;
++ /*
++ * The mvebu-comphy driver does not currently know how to pass correct
++ * lane-count to ATF while configuring the serdes lanes.
++ * Rely on bootloader configuration only.
++ *
++ * phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>;
++ */
+ status = "okay";
+ };
+
--- /dev/null
+From d3021e6aa11fecdafa85038a037c04d5bfeda9d5 Mon Sep 17 00:00:00 2001
+From: Josua Mayer <josua@solid-run.com>
+Date: Thu, 11 Sep 2025 20:28:04 +0200
+Subject: arm64: dts: marvell: cn913x-solidrun: fix sata ports status
+
+From: Josua Mayer <josua@solid-run.com>
+
+commit d3021e6aa11fecdafa85038a037c04d5bfeda9d5 upstream.
+
+Commit "arm64: dts: marvell: only enable complete sata nodes" changed
+armada-cp11x.dtsi disabling all sata ports status by default.
+
+The author missed some dts which relied on the dtsi enabling all ports,
+and just disabled unused ones instead.
+
+Update dts for SolidRun cn913x based boards to enable the available
+ports, rather than disabling the unvavailable one.
+
+Further according to dt bindings the serdes phys are to be specified in
+the port node, not the controller node.
+Move those phys properties accordingly in clearfog base/pro/solidwan.
+
+Fixes: 30023876aef4 ("arm64: dts: marvell: only enable complete sata nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/marvell/cn9130-cf.dtsi | 7 ++++---
+ arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts | 6 ++++--
+ arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 6 ++----
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
+index ad0ab34b6602..bd42bfbe408b 100644
+--- a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
++++ b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
+@@ -152,11 +152,12 @@ expander0_pins: cp0-expander0-pins {
+
+ /* SRDS #0 - SATA on M.2 connector */
+ &cp0_sata0 {
+- phys = <&cp0_comphy0 1>;
+ status = "okay";
+
+- /* only port 1 is available */
+- /delete-node/ sata-port@0;
++ sata-port@1 {
++ phys = <&cp0_comphy0 1>;
++ status = "okay";
++ };
+ };
+
+ /* microSD */
+diff --git a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
+index 47234d0858dd..338853d3b179 100644
+--- a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
++++ b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
+@@ -563,11 +563,13 @@ &cp1_rtc {
+
+ /* SRDS #1 - SATA on M.2 (J44) */
+ &cp1_sata0 {
+- phys = <&cp1_comphy1 0>;
+ status = "okay";
+
+ /* only port 0 is available */
+- /delete-node/ sata-port@1;
++ sata-port@0 {
++ phys = <&cp1_comphy1 0>;
++ status = "okay";
++ };
+ };
+
+ &cp1_syscon0 {
+diff --git a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
+index 0f53745a6fa0..115c55d73786 100644
+--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
++++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
+@@ -512,10 +512,9 @@ &cp1_sata0 {
+ status = "okay";
+
+ /* only port 1 is available */
+- /delete-node/ sata-port@0;
+-
+ sata-port@1 {
+ phys = <&cp1_comphy3 1>;
++ status = "okay";
+ };
+ };
+
+@@ -631,9 +630,8 @@ &cp2_sata0 {
+ status = "okay";
+
+ /* only port 1 is available */
+- /delete-node/ sata-port@0;
+-
+ sata-port@1 {
++ status = "okay";
+ phys = <&cp2_comphy3 1>;
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 24 Sep 2025 13:18:22 -0700
+Subject: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
+
+From: Eric Biggers <ebiggers@kernel.org>
+
+commit d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb upstream.
+
+Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in
+af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of
+type u32.
+
+However, some assignments to these fields, specifically 'more' and
+'merge', assign values greater than 1. These relied on C's implicit
+conversion to bool, such that zero becomes false and nonzero becomes
+true.
+
+With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken
+instead, resulting in 0 being assigned in some cases when 1 was intended.
+
+Fix this by restoring the bool type.
+
+Fixes: 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/crypto/if_alg.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -152,7 +152,7 @@ struct af_alg_ctx {
+ size_t used;
+ atomic_t rcvused;
+
+- u32 more:1,
++ bool more:1,
+ merge:1,
+ enc:1,
+ write:1,
--- /dev/null
+From 44b0fed0a5947f54fd14255cd0766df952267bc5 Mon Sep 17 00:00:00 2001
+From: Matthew Schwartz <matthew.schwartz@linux.dev>
+Date: Thu, 11 Sep 2025 10:48:51 -0700
+Subject: drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
+
+From: Matthew Schwartz <matthew.schwartz@linux.dev>
+
+commit 44b0fed0a5947f54fd14255cd0766df952267bc5 upstream.
+
+On clients that utilize AMD_PRIVATE_COLOR properties for HDR support,
+brightness sliders can include a hardware controlled portion and a
+gamma-based portion. This is the case on the Steam Deck OLED when using
+gamescope with Steam as a client.
+
+When a user sets a brightness level while HDR is active, the gamma-based
+portion and/or hardware portion are adjusted to achieve the desired
+brightness. However, when a modeset takes place while the gamma-based
+portion is in-use, restoring the hardware brightness level overrides the
+user's overall brightness level and results in a mismatch between what
+the slider reports and the display's current brightness.
+
+To avoid overriding gamma-based brightness, only restore HW backlight
+level after boot or resume. This ensures that the backlight level is
+set correctly after the DC layer resets it while avoiding interference
+with subsequent modesets.
+
+Fixes: 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4551
+Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a490c8d77d500b5981e739be3d59c60cfe382536)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++----
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 +++++++
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2035,6 +2035,8 @@ static int amdgpu_dm_init(struct amdgpu_
+
+ dc_hardware_init(adev->dm.dc);
+
++ adev->dm.restore_backlight = true;
++
+ adev->dm.hpd_rx_offload_wq = hpd_rx_irq_create_workqueue(adev);
+ if (!adev->dm.hpd_rx_offload_wq) {
+ drm_err(adev_to_drm(adev), "amdgpu: failed to create hpd rx offload workqueue.\n");
+@@ -3396,6 +3398,7 @@ static int dm_resume(struct amdgpu_ip_bl
+ dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
+
+ dc_resume(dm->dc);
++ adev->dm.restore_backlight = true;
+
+ amdgpu_dm_irq_resume_early(adev);
+
+@@ -9801,7 +9804,6 @@ static void amdgpu_dm_commit_streams(str
+ bool mode_set_reset_required = false;
+ u32 i;
+ struct dc_commit_streams_params params = {dc_state->streams, dc_state->stream_count};
+- bool set_backlight_level = false;
+
+ /* Disable writeback */
+ for_each_old_connector_in_state(state, connector, old_con_state, i) {
+@@ -9921,7 +9923,6 @@ static void amdgpu_dm_commit_streams(str
+ acrtc->hw_mode = new_crtc_state->mode;
+ crtc->hwmode = new_crtc_state->mode;
+ mode_set_reset_required = true;
+- set_backlight_level = true;
+ } else if (modereset_required(new_crtc_state)) {
+ drm_dbg_atomic(dev,
+ "Atomic commit: RESET. crtc id %d:[%p]\n",
+@@ -9978,13 +9979,16 @@ static void amdgpu_dm_commit_streams(str
+ * to fix a flicker issue.
+ * It will cause the dm->actual_brightness is not the current panel brightness
+ * level. (the dm->brightness is the correct panel level)
+- * So we set the backlight level with dm->brightness value after set mode
++ * So we set the backlight level with dm->brightness value after initial
++ * set mode. Use restore_backlight flag to avoid setting backlight level
++ * for every subsequent mode set.
+ */
+- if (set_backlight_level) {
++ if (dm->restore_backlight) {
+ for (i = 0; i < dm->num_of_edps; i++) {
+ if (dm->backlight_dev[i])
+ amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]);
+ }
++ dm->restore_backlight = false;
+ }
+ }
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -611,6 +611,13 @@ struct amdgpu_display_manager {
+ u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP];
+
+ /**
++ * @restore_backlight:
++ *
++ * Flag to indicate whether to restore backlight after modeset.
++ */
++ bool restore_backlight;
++
++ /**
+ * @aux_hpd_discon_quirk:
+ *
+ * quirk for hpd discon while aux is on-going.
--- /dev/null
+From c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 Mon Sep 17 00:00:00 2001
+From: Nirmoy Das <nirmoyd@nvidia.com>
+Date: Wed, 17 Sep 2025 12:43:46 -0700
+Subject: drm/ast: Use msleep instead of mdelay for edid read
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 upstream.
+
+The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts
+during boot.
+
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Carol L Soto csoto@nvidia.com<mailto:csoto@nvidia.com>
+Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port")
+Cc: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Jocelyn Falempe <jfalempe@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.19+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ast/ast_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ast/ast_dp.c
++++ b/drivers/gpu/drm/ast/ast_dp.c
+@@ -134,7 +134,7 @@ static int ast_astdp_read_edid_block(voi
+ * 3. The Delays are often longer a lot when system resume from S3/S4.
+ */
+ if (j)
+- mdelay(j + 1);
++ msleep(j + 1);
+
+ /* Wait for EDID offset to show up in mirror register */
+ vgacrd7 = ast_get_index_reg(ast, AST_IO_VGACRI, 0xd7);
--- /dev/null
+From 77c8ede611c6a70a95f7b15648551d0121b40d6c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= <thomas.hellstrom@linux.intel.com>
+Date: Thu, 18 Sep 2025 11:22:05 +0200
+Subject: drm/xe: Don't copy pinned kernel bos twice on suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+
+commit 77c8ede611c6a70a95f7b15648551d0121b40d6c upstream.
+
+We were copying the bo content the bos on the list
+"xe->pinned.late.kernel_bo_present" twice on suspend.
+
+Presumingly the intent is to copy the pinned external bos on
+the first pass.
+
+This is harmless since we (currently) should have no pinned
+external bos needing copy since
+a) exernal system bos don't have compressed content,
+b) We do not (yet) allow pinning of VRAM bos.
+
+Still, fix this up so that we copy pinned external bos on
+the first pass. We're about to allow bos pinned in VRAM.
+
+Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier")
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: <stable@vger.kernel.org> # v6.16+
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://lore.kernel.org/r/20250918092207.54472-2-thomas.hellstrom@linux.intel.com
+(cherry picked from commit 9e69bafece43dcefec864f00b3ec7e088aa7fcbc)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_bo_evict.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c
+index 7484ce55a303..d5dbc51e8612 100644
+--- a/drivers/gpu/drm/xe/xe_bo_evict.c
++++ b/drivers/gpu/drm/xe/xe_bo_evict.c
+@@ -158,8 +158,8 @@ int xe_bo_evict_all(struct xe_device *xe)
+ if (ret)
+ return ret;
+
+- ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
+- &xe->pinned.late.evicted, xe_bo_evict_pinned);
++ ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.external,
++ &xe->pinned.late.external, xe_bo_evict_pinned);
+
+ if (!ret)
+ ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
+--
+2.51.0
+
--- /dev/null
+From a061e739d36220c002da8b2429d5f16f637eb59a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 8 Sep 2025 13:37:19 +0200
+Subject: pinctrl: airoha: fix wrong MDIO function bitmaks
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+commit a061e739d36220c002da8b2429d5f16f637eb59a upstream.
+
+With further testing with an attached Aeonsemi it was discovered that
+the pinctrl MDIO function applied the wrong bitmask. The error was
+probably caused by the confusing documentation related to these bits.
+
+Inspecting what the bootloader actually configure, the SGMII_MDIO_MODE
+is never actually set but instead it's set force enable to the 2 GPIO
+(gpio 1-2) for MDC and MDIO pin.
+
+The usage of GPIO might be confusing but this is just to instruct the
+SoC to not mess with those 2 PIN and as Benjamin reported it's also an
+Errata of 7581. The FORCE_GPIO_EN doesn't set them as GPIO function
+(that is configured by a different register) but it's really to actually
+""enable"" those lines.
+
+Normally the SoC should autodetect this by HW but it seems AN7581 have
+problem with this and require this workaround to force enable the 2 pin.
+
+Applying this configuration permits correct functionality of any
+externally attached PHY.
+
+Cc: stable@vger.kernel.org
+Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-airoha.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c
+index ee5b9bab4552..b405dfa20891 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c
++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c
+@@ -108,6 +108,9 @@
+ #define JTAG_UDI_EN_MASK BIT(4)
+ #define JTAG_DFD_EN_MASK BIT(3)
+
++#define REG_FORCE_GPIO_EN 0x0228
++#define FORCE_GPIO_EN(n) BIT(n)
++
+ /* LED MAP */
+ #define REG_LAN_LED0_MAPPING 0x027c
+ #define REG_LAN_LED1_MAPPING 0x0280
+@@ -718,17 +721,17 @@ static const struct airoha_pinctrl_func_group mdio_func_group[] = {
+ {
+ .name = "mdio",
+ .regmap[0] = {
+- AIROHA_FUNC_MUX,
+- REG_GPIO_PON_MODE,
+- GPIO_SGMII_MDIO_MODE_MASK,
+- GPIO_SGMII_MDIO_MODE_MASK
+- },
+- .regmap[1] = {
+ AIROHA_FUNC_MUX,
+ REG_GPIO_2ND_I2C_MODE,
+ GPIO_MDC_IO_MASTER_MODE_MODE,
+ GPIO_MDC_IO_MASTER_MODE_MODE
+ },
++ .regmap[1] = {
++ AIROHA_FUNC_MUX,
++ REG_FORCE_GPIO_EN,
++ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2),
++ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2)
++ },
+ .regmap_size = 2,
+ },
+ };
+--
+2.51.0
+
--- /dev/null
+From 6f9674aa69ad0178ca8fc6995942ba9848c324f4 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 8 Sep 2025 13:34:24 +0200
+Subject: pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+commit 6f9674aa69ad0178ca8fc6995942ba9848c324f4 upstream.
+
+In all the MUX value for LED1 GPIO46 there is a Copy-Paste error where
+the MUX value is set to LED0_MODE_MASK instead of LED1_MODE_MASK.
+
+This wasn't notice as there were no board that made use of the
+secondary PHY LED but looking at the internal Documentation the actual
+value should be LED1_MODE_MASK similar to the other GPIO entry.
+
+Fix the wrong value to apply the correct MUX configuration.
+
+Cc: stable@vger.kernel.org
+Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-airoha.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c
+index 1b2f132d76f0..ee5b9bab4552 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c
++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c
+@@ -1752,8 +1752,8 @@ static const struct airoha_pinctrl_func_group phy1_led1_func_group[] = {
+ .regmap[0] = {
+ AIROHA_FUNC_MUX,
+ REG_GPIO_2ND_I2C_MODE,
+- GPIO_LAN3_LED0_MODE_MASK,
+- GPIO_LAN3_LED0_MODE_MASK
++ GPIO_LAN3_LED1_MODE_MASK,
++ GPIO_LAN3_LED1_MODE_MASK
+ },
+ .regmap[1] = {
+ AIROHA_FUNC_MUX,
+@@ -1816,8 +1816,8 @@ static const struct airoha_pinctrl_func_group phy2_led1_func_group[] = {
+ .regmap[0] = {
+ AIROHA_FUNC_MUX,
+ REG_GPIO_2ND_I2C_MODE,
+- GPIO_LAN3_LED0_MODE_MASK,
+- GPIO_LAN3_LED0_MODE_MASK
++ GPIO_LAN3_LED1_MODE_MASK,
++ GPIO_LAN3_LED1_MODE_MASK
+ },
+ .regmap[1] = {
+ AIROHA_FUNC_MUX,
+@@ -1880,8 +1880,8 @@ static const struct airoha_pinctrl_func_group phy3_led1_func_group[] = {
+ .regmap[0] = {
+ AIROHA_FUNC_MUX,
+ REG_GPIO_2ND_I2C_MODE,
+- GPIO_LAN3_LED0_MODE_MASK,
+- GPIO_LAN3_LED0_MODE_MASK
++ GPIO_LAN3_LED1_MODE_MASK,
++ GPIO_LAN3_LED1_MODE_MASK
+ },
+ .regmap[1] = {
+ AIROHA_FUNC_MUX,
+@@ -1944,8 +1944,8 @@ static const struct airoha_pinctrl_func_group phy4_led1_func_group[] = {
+ .regmap[0] = {
+ AIROHA_FUNC_MUX,
+ REG_GPIO_2ND_I2C_MODE,
+- GPIO_LAN3_LED0_MODE_MASK,
+- GPIO_LAN3_LED0_MODE_MASK
++ GPIO_LAN3_LED1_MODE_MASK,
++ GPIO_LAN3_LED1_MODE_MASK
+ },
+ .regmap[1] = {
+ AIROHA_FUNC_MUX,
+--
+2.51.0
+
--- /dev/null
+From 4174152771bf0d014d58f7d7e148bb0c8830fe53 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 17 Sep 2025 14:30:44 +0800
+Subject: Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 4174152771bf0d014d58f7d7e148bb0c8830fe53 upstream.
+
+This reverts commit 8c2e6b26ffe243be1e78f5a4bfb1a857d6e6f6d6. It tries
+to defer the notification enabling by moving the logic out of the loop
+after the vhost_tx_batch() when nothing new is spotted. This will
+bring side effects as the new logic would be reused for several other
+error conditions.
+
+One example is the IOTLB: when there's an IOTLB miss, get_tx_bufs()
+might return -EAGAIN and exit the loop and see there's still available
+buffers, so it will queue the tx work again until userspace feed the
+IOTLB entry correctly. This will slowdown the tx processing and
+trigger the TX watchdog in the guest as reported in
+https://lkml.org/lkml/2025/9/10/1596.
+
+To fix, revert the change. A follow up patch will bring the performance
+back in a safe way.
+
+Reported-by: Jon Kohler <jon@nutanix.com>
+Cc: stable@vger.kernel.org
+Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20250917063045.2042-2-jasowang@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/net.c | 30 +++++++++---------------------
+ 1 file changed, 9 insertions(+), 21 deletions(-)
+
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -760,10 +760,10 @@ static void handle_tx_copy(struct vhost_
+ int err;
+ int sent_pkts = 0;
+ bool sock_can_batch = (sock->sk->sk_sndbuf == INT_MAX);
+- bool busyloop_intr;
+
+ do {
+- busyloop_intr = false;
++ bool busyloop_intr = false;
++
+ if (nvq->done_idx == VHOST_NET_BATCH)
+ vhost_tx_batch(net, nvq, sock, &msg);
+
+@@ -774,10 +774,13 @@ static void handle_tx_copy(struct vhost_
+ break;
+ /* Nothing new? Wait for eventfd to tell us they refilled. */
+ if (head == vq->num) {
+- /* Kicks are disabled at this point, break loop and
+- * process any remaining batched packets. Queue will
+- * be re-enabled afterwards.
+- */
++ if (unlikely(busyloop_intr)) {
++ vhost_poll_queue(&vq->poll);
++ } else if (unlikely(vhost_enable_notify(&net->dev,
++ vq))) {
++ vhost_disable_notify(&net->dev, vq);
++ continue;
++ }
+ break;
+ }
+
+@@ -827,22 +830,7 @@ done:
+ ++nvq->done_idx;
+ } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
+
+- /* Kicks are still disabled, dispatch any remaining batched msgs. */
+ vhost_tx_batch(net, nvq, sock, &msg);
+-
+- if (unlikely(busyloop_intr))
+- /* If interrupted while doing busy polling, requeue the
+- * handler to be fair handle_rx as well as other tasks
+- * waiting on cpu.
+- */
+- vhost_poll_queue(&vq->poll);
+- else
+- /* All of our work has been completed; however, before
+- * leaving the TX handler, do one last check for work,
+- * and requeue handler if necessary. If there is no work,
+- * queue will be reenabled.
+- */
+- vhost_net_busy_poll_try_queue(net, vq);
+ }
+
+ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
i40e-add-max-boundary-check-for-vf-filters.patch
i40e-add-mask-to-apply-valid-bits-for-itr_idx.patch
i40e-improve-vf-mac-filters-accounting.patch
+crypto-af_alg-fix-incorrect-boolean-values-in-af_alg_ctx.patch
+tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch
+tracing-fgraph-protect-return-handler-from-recursion-loop.patch
+tracing-fprobe-fix-to-remove-recorded-module-addresses-from-filter.patch
+arm-dts-socfpga-sodia-fix-mdio-bus-probe-and-phy-address.patch
+arm64-dts-marvell-cn913x-solidrun-fix-sata-ports-status.patch
+arm64-dts-marvell-cn9132-clearfog-disable-emmc-high-speed-modes.patch
+arm64-dts-marvell-cn9132-clearfog-fix-multi-lane-pci-x2-and-x4-ports.patch
+drm-xe-don-t-copy-pinned-kernel-bos-twice-on-suspend.patch
+drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch
+drm-amd-display-only-restore-backlight-after-amdgpu_dm_init-or-dm_resume.patch
+pinctrl-airoha-fix-wrong-phy-led-mux-value-for-led1-gpio46.patch
+pinctrl-airoha-fix-wrong-mdio-function-bitmaks.patch
+revert-vhost-net-defer-tx-queue-re-enable-until-after-sendmsg.patch
+vhost-net-flush-batched-before-enabling-notifications.patch
--- /dev/null
+From 456c32e3c4316654f95f9d49c12cbecfb77d5660 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Fri, 19 Sep 2025 10:15:56 +0900
+Subject: tracing: dynevent: Add a missing lockdown check on dynevent
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 upstream.
+
+Since dynamic_events interface on tracefs is compatible with
+kprobe_events and uprobe_events, it should also check the lockdown
+status and reject if it is set.
+
+Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@devnote2/
+
+Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_dynevent.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/trace/trace_dynevent.c
++++ b/kernel/trace/trace_dynevent.c
+@@ -230,6 +230,10 @@ static int dyn_event_open(struct inode *
+ {
+ int ret;
+
++ ret = security_locked_down(LOCKDOWN_TRACEFS);
++ if (ret)
++ return ret;
++
+ ret = tracing_check_open_get_tr(NULL);
+ if (ret)
+ return ret;
--- /dev/null
+From 0db0934e7f9bb624ed98a665890dbe249f65b8fd Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Mon, 22 Sep 2025 15:35:22 +0900
+Subject: tracing: fgraph: Protect return handler from recursion loop
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 0db0934e7f9bb624ed98a665890dbe249f65b8fd upstream.
+
+function_graph_enter_regs() prevents itself from recursion by
+ftrace_test_recursion_trylock(), but __ftrace_return_to_handler(),
+which is called at the exit, does not prevent such recursion.
+Therefore, while it can prevent recursive calls from
+fgraph_ops::entryfunc(), it is not able to prevent recursive calls
+to fgraph from fgraph_ops::retfunc(), resulting in a recursive loop.
+This can lead an unexpected recursion bug reported by Menglong.
+
+ is_endbr() is called in __ftrace_return_to_handler -> fprobe_return
+ -> kprobe_multi_link_exit_handler -> is_endbr.
+
+To fix this issue, acquire ftrace_test_recursion_trylock() in the
+__ftrace_return_to_handler() after unwind the shadow stack to mark
+this section must prevent recursive call of fgraph inside user-defined
+fgraph_ops::retfunc().
+
+This is essentially a fix to commit 4346ba160409 ("fprobe: Rewrite
+fprobe on function-graph tracer"), because before that fgraph was
+only used from the function graph tracer. Fprobe allowed user to run
+any callbacks from fgraph after that commit.
+
+Reported-by: Menglong Dong <menglong8.dong@gmail.com>
+Closes: https://lore.kernel.org/all/20250918120939.1706585-1-dongml2@chinatelecom.cn/
+Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
+Cc: stable@vger.kernel.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/175852292275.307379.9040117316112640553.stgit@devnote2
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Menglong Dong <menglong8.dong@gmail.com>
+Acked-by: Menglong Dong <menglong8.dong@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/fgraph.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/kernel/trace/fgraph.c
++++ b/kernel/trace/fgraph.c
+@@ -815,6 +815,7 @@ __ftrace_return_to_handler(struct ftrace
+ unsigned long bitmap;
+ unsigned long ret;
+ int offset;
++ int bit;
+ int i;
+
+ ret_stack = ftrace_pop_return_trace(&trace, &ret, frame_pointer, &offset);
+@@ -829,6 +830,15 @@ __ftrace_return_to_handler(struct ftrace
+ if (fregs)
+ ftrace_regs_set_instruction_pointer(fregs, ret);
+
++ bit = ftrace_test_recursion_trylock(trace.func, ret);
++ /*
++ * This can fail because ftrace_test_recursion_trylock() allows one nest
++ * call. If we are already in a nested call, then we don't probe this and
++ * just return the original return address.
++ */
++ if (unlikely(bit < 0))
++ goto out;
++
+ #ifdef CONFIG_FUNCTION_GRAPH_RETVAL
+ trace.retval = ftrace_regs_get_return_value(fregs);
+ #endif
+@@ -852,6 +862,8 @@ __ftrace_return_to_handler(struct ftrace
+ }
+ }
+
++ ftrace_test_recursion_unlock(bit);
++out:
+ /*
+ * The ftrace_graph_return() may still access the current
+ * ret_stack structure, we need to make sure the update of
--- /dev/null
+From c539feff3c8f8c86213eee2b237410714712c326 Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Wed, 24 Sep 2025 09:26:39 +0900
+Subject: tracing: fprobe: Fix to remove recorded module addresses from filter
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit c539feff3c8f8c86213eee2b237410714712c326 upstream.
+
+Even if there is a memory allocation failure in fprobe_addr_list_add(),
+there is a partial list of module addresses. So remove the recorded
+addresses from filter if exists.
+This also removes the redundant ret local variable.
+
+Fixes: a3dc2983ca7b ("tracing: fprobe: Cleanup fprobe hash when module unloading")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Reviewed-by: Menglong Dong <menglong8.dong@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/fprobe.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
+index c8034dfc1070..5a807d62e76d 100644
+--- a/kernel/trace/fprobe.c
++++ b/kernel/trace/fprobe.c
+@@ -428,8 +428,9 @@ static int fprobe_addr_list_add(struct fprobe_addr_list *alist, unsigned long ad
+ {
+ unsigned long *addrs;
+
+- if (alist->index >= alist->size)
+- return -ENOMEM;
++ /* Previously we failed to expand the list. */
++ if (alist->index == alist->size)
++ return -ENOSPC;
+
+ alist->addrs[alist->index++] = addr;
+ if (alist->index < alist->size)
+@@ -489,7 +490,7 @@ static int fprobe_module_callback(struct notifier_block *nb,
+ for (i = 0; i < FPROBE_IP_TABLE_SIZE; i++)
+ fprobe_remove_node_in_module(mod, &fprobe_ip_table[i], &alist);
+
+- if (alist.index < alist.size && alist.index > 0)
++ if (alist.index > 0)
+ ftrace_set_filter_ips(&fprobe_graph_ops.ops,
+ alist.addrs, alist.index, 1, 0);
+ mutex_unlock(&fprobe_mutex);
+--
+2.51.0
+
--- /dev/null
+From e430451613c7a27beeadd00d707bcf7ceec6328e Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 17 Sep 2025 14:30:45 +0800
+Subject: vhost-net: flush batched before enabling notifications
+
+From: Jason Wang <jasowang@redhat.com>
+
+commit e430451613c7a27beeadd00d707bcf7ceec6328e upstream.
+
+Commit 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after
+sendmsg") tries to defer the notification enabling by moving the logic
+out of the loop after the vhost_tx_batch() when nothing new is spotted.
+This caused unexpected side effects as the new logic is reused for
+several other error conditions.
+
+A previous patch reverted 8c2e6b26ffe2. Now, bring the performance
+back up by flushing batched buffers before enabling notifications.
+
+Reported-by: Jon Kohler <jon@nutanix.com>
+Cc: stable@vger.kernel.org
+Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Message-Id: <20250917063045.2042-3-jasowang@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/net.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -774,6 +774,11 @@ static void handle_tx_copy(struct vhost_
+ break;
+ /* Nothing new? Wait for eventfd to tell us they refilled. */
+ if (head == vq->num) {
++ /* Flush batched packets to handle pending RX
++ * work (if busyloop_intr is set) and to avoid
++ * unnecessary virtqueue kicks.
++ */
++ vhost_tx_batch(net, nvq, sock, &msg);
+ if (unlikely(busyloop_intr)) {
+ vhost_poll_queue(&vq->poll);
+ } else if (unlikely(vhost_enable_notify(&net->dev,
projects / thirdparty / kernel / stable-queue.git / commitdiff
