--- /dev/null
+From 8ce81685e88400b40a9d077209b2bc7404932138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 12:45:20 +0100
+Subject: ALSA: hda/cirrus_scodec_test: Don't select dependencies
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit e9c7fa025dc6125eb47993515d45da0cd02a263c ]
+
+Depend on SND_HDA_CIRRUS_SCODEC and GPIOLIB instead of selecting them.
+
+KUNIT_ALL_TESTS should only build tests that have satisfied dependencies
+and test components that are already being built. It must not cause
+other stuff to be added to the build.
+
+Fixes: 2144833e7b41 ("ALSA: hda: cirrus_scodec: Add KUnit test")
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250409114520.914079-1-rf@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/Kconfig | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
+index dbf933c18a821..fd9391e61b3d9 100644
+--- a/sound/pci/hda/Kconfig
++++ b/sound/pci/hda/Kconfig
+@@ -96,9 +96,7 @@ config SND_HDA_CIRRUS_SCODEC
+
+ config SND_HDA_CIRRUS_SCODEC_KUNIT_TEST
+ tristate "KUnit test for Cirrus side-codec library" if !KUNIT_ALL_TESTS
+- select SND_HDA_CIRRUS_SCODEC
+- select GPIOLIB
+- depends on KUNIT
++ depends on SND_HDA_CIRRUS_SCODEC && GPIOLIB && KUNIT
+ default KUNIT_ALL_TESTS
+ help
+ This builds KUnit tests for the cirrus side-codec library.
+--
+2.39.5
+
--- /dev/null
+From 19c39b3fcd6f9e9690add3425002dedea0cfe474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2024 12:21:45 +0100
+Subject: ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+[ Upstream commit a7df7f909cec96e2fb7813a9b0b7e06a976983ab ]
+
+This hardware has ALC294 codec with speaker NID 0x17 and bass speaker
+NID 0x15.
+
+This patch removes DAC NID 0x06 (without volume control) from
+the connection list for bass speaker NID 0x15. Both speaker PINs
+are routed to DAC NID 0x03 with this change.
+
+Link: https://github.com/alsa-project/alsa-ucm-conf/issues/467
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://patch.msgid.link/20241128112145.3409492-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Stable-dep-of: b5458fcabd96 ("ALSA: hda/realtek - Fixed ASUS platform headset Mic issue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0bf833c960215..4ae987731a152 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6603,6 +6603,16 @@ static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec,
+ }
+ }
+
++/* disable DAC3 (0x06) selection on NID 0x15 - share Speaker/Bass Speaker DAC 0x03 */
++static void alc294_fixup_bass_speaker_15(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ static const hda_nid_t conn[] = { 0x02, 0x03 };
++ snd_hda_override_conn_list(codec, 0x15, ARRAY_SIZE(conn), conn);
++ }
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ struct hda_jack_callback *jack)
+@@ -7888,6 +7898,7 @@ enum {
+ ALC245_FIXUP_CLEVO_NOISY_MIC,
+ ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE,
+ ALC233_FIXUP_MEDION_MTL_SPK,
++ ALC294_FIXUP_BASS_SPEAKER_15,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -10222,6 +10233,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ },
++ [ALC294_FIXUP_BASS_SPEAKER_15] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc294_fixup_bass_speaker_15,
++ },
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -10750,6 +10765,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x1df3, "ASUS UM5606WA", ALC294_FIXUP_BASS_SPEAKER_15),
+ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2),
+--
+2.39.5
+
--- /dev/null
+From fc3906ee04387ca05a1d153d7a798ecf923b6fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 15:09:08 +0800
+Subject: ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit b5458fcabd96ce29adbf7225c1741ecdfff70a91 ]
+
+ASUS platform Headset Mic was disable by default.
+Assigned verb table for Mic pin will enable it.
+
+Fixes: 7ab61d0a9a35 ("ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA")
+Fixes: c86dd79a7c33 ("ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/0fe3421a6850461fb0b7012cb28ef71d@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b660bbfc6b0cc..4171aa22747c3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7910,6 +7910,7 @@ enum {
+ ALC233_FIXUP_MEDION_MTL_SPK,
+ ALC294_FIXUP_BASS_SPEAKER_15,
+ ALC283_FIXUP_DELL_HP_RESUME,
++ ALC294_FIXUP_ASUS_CS35L41_SPI_2,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -10252,6 +10253,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc283_fixup_dell_hp_resume,
+ },
++ [ALC294_FIXUP_ASUS_CS35L41_SPI_2] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cs35l41_fixup_spi_two,
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC,
++ },
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -10715,7 +10722,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x12a3, "Asus N7691ZM", ALC269_FIXUP_ASUS_N7601ZM),
+ SND_PCI_QUIRK(0x1043, 0x12af, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x12b4, "ASUS B3405CCA / P3405CCA", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x12b4, "ASUS B3405CCA / P3405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
+@@ -10804,14 +10811,14 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1fb3, "ASUS ROG Flow Z13 GZ302EA", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x3011, "ASUS B5605CVA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+- SND_PCI_QUIRK(0x1043, 0x3061, "ASUS B3405CCA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x3071, "ASUS B5405CCA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x30c1, "ASUS B3605CCA / P3605CCA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x30d1, "ASUS B5405CCA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x30e1, "ASUS B5605CCA", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x3061, "ASUS B3405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x3071, "ASUS B5405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x30c1, "ASUS B3605CCA / P3605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x30d1, "ASUS B5405CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x30e1, "ASUS B5605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x31d0, "ASUS Zen AIO 27 Z272SD_A272SD", ALC274_FIXUP_ASUS_ZEN_AIO_27),
+- SND_PCI_QUIRK(0x1043, 0x31e1, "ASUS B5605CCA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x31f1, "ASUS B3605CCA", ALC245_FIXUP_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x31e1, "ASUS B5605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
++ SND_PCI_QUIRK(0x1043, 0x31f1, "ASUS B3605CCA", ALC294_FIXUP_ASUS_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+ SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+ SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+--
+2.39.5
+
--- /dev/null
+From 80e4498ace0cf3238969ee744f8c609a6ccb373e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2025 13:32:59 +0100
+Subject: ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8c2fa44132e8cd1b05c77a705adb8d1f5a5daf3f ]
+
+It was reported that the headphone output on Dell Venue 11 Pro 7130
+becomes mono after PM resume. The cause seems to be the BIOS setting
+up the codec COEF 0x0d bit 0x40 wrongly by some reason, and restoring
+the original value 0x2800 fixes the problem.
+
+This patch adds the quirk entry to perform the COEF restore.
+
+Cc: <stable@vger.kernel.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219697
+Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1235686
+Link: https://patch.msgid.link/20250130123301.8996-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Stable-dep-of: b5458fcabd96 ("ALSA: hda/realtek - Fixed ASUS platform headset Mic issue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4ae987731a152..b660bbfc6b0cc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7597,6 +7597,16 @@ static void alc287_fixup_lenovo_thinkpad_with_alc1318(struct hda_codec *codec,
+ spec->gen.pcm_playback_hook = alc287_alc1318_playback_pcm_hook;
+ }
+
++/*
++ * Clear COEF 0x0d (PCBEEP passthrough) bit 0x40 where BIOS sets it wrongly
++ * at PM resume
++ */
++static void alc283_fixup_dell_hp_resume(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_INIT)
++ alc_write_coef_idx(codec, 0xd, 0x2800);
++}
+
+ enum {
+ ALC269_FIXUP_GPIO2,
+@@ -7899,6 +7909,7 @@ enum {
+ ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE,
+ ALC233_FIXUP_MEDION_MTL_SPK,
+ ALC294_FIXUP_BASS_SPEAKER_15,
++ ALC283_FIXUP_DELL_HP_RESUME,
+ };
+
+ /* A special fixup for Lenovo C940 and Yoga Duet 7;
+@@ -10237,6 +10248,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc294_fixup_bass_speaker_15,
+ },
++ [ALC283_FIXUP_DELL_HP_RESUME] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc283_fixup_dell_hp_resume,
++ },
+ };
+
+ static const struct hda_quirk alc269_fixup_tbl[] = {
+@@ -10297,6 +10312,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x05f4, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x0604, "Dell Venue 11 Pro 7130", ALC283_FIXUP_DELL_HP_RESUME),
+ SND_PCI_QUIRK(0x1028, 0x0615, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x062c, "Dell Latitude E5550", ALC292_FIXUP_DELL_E7X),
+--
+2.39.5
+
--- /dev/null
+From a48a18b8b85b91bbfc8afd5a3b62ddfe17994f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 13:07:17 +0100
+Subject: ASoC: cs42l43: Reset clamp override on jack removal
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 5fc7d2b5cab47f2ac712f689140b1fed978fb91c ]
+
+Some of the manually selected jack configurations will disable the
+headphone clamp override. Restore this on jack removal, such that
+the state is consistent for a new insert.
+
+Fixes: fc918cbe874e ("ASoC: cs42l43: Add support for the cs42l43")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250409120717.1294528-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l43-jack.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/cs42l43-jack.c b/sound/soc/codecs/cs42l43-jack.c
+index d9ab003e166bf..73d764fc85392 100644
+--- a/sound/soc/codecs/cs42l43-jack.c
++++ b/sound/soc/codecs/cs42l43-jack.c
+@@ -702,6 +702,9 @@ static void cs42l43_clear_jack(struct cs42l43_codec *priv)
+ CS42L43_PGA_WIDESWING_MODE_EN_MASK, 0);
+ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CTRL,
+ CS42L43_JACK_STEREO_CONFIG_MASK, 0);
++ regmap_update_bits(cs42l43->regmap, CS42L43_STEREO_MIC_CLAMP_CTRL,
++ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK,
++ CS42L43_SMIC_HPAMP_CLAMP_DIS_FRC_MASK);
+ regmap_update_bits(cs42l43->regmap, CS42L43_HS2,
+ CS42L43_HSDET_MODE_MASK | CS42L43_HSDET_MANUAL_MODE_MASK,
+ 0x2 << CS42L43_HSDET_MODE_SHIFT);
+--
+2.39.5
+
--- /dev/null
+From ac32e86b56d6728cff1ff12e71ae947e1cafc4d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Mar 2025 09:08:54 -0400
+Subject: ASoC: dwc: always enable/disable i2s irqs
+
+From: Brady Norander <bradynorander@gmail.com>
+
+[ Upstream commit 2b727b3f8a04fe52f55316ccb8792cfd9b2dd05d ]
+
+Commit a42e988 ("ASoC: dwc: add DMA handshake control") changed the
+behavior of the driver to not enable or disable i2s irqs if using DMA. This
+breaks platforms such as AMD ACP. Audio playback appears to work but no
+audio can be heard. Revert to the old behavior by always enabling and
+disabling i2s irqs while keeping DMA handshake control.
+
+Fixes: a42e988b626 ("ASoC: dwc: add DMA handshake control")
+Signed-off-by: Brady Norander <bradynorander@gmail.com>
+Link: https://patch.msgid.link/20250330130852.37881-3-bradynorander@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/dwc/dwc-i2s.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c
+index 57b789d7fbedd..5b4f20dbf7bba 100644
+--- a/sound/soc/dwc/dwc-i2s.c
++++ b/sound/soc/dwc/dwc-i2s.c
+@@ -199,12 +199,10 @@ static void i2s_start(struct dw_i2s_dev *dev,
+ else
+ i2s_write_reg(dev->i2s_base, IRER, 1);
+
+- /* I2S needs to enable IRQ to make a handshake with DMAC on the JH7110 SoC */
+- if (dev->use_pio || dev->is_jh7110)
+- i2s_enable_irqs(dev, substream->stream, config->chan_nr);
+- else
++ if (!(dev->use_pio || dev->is_jh7110))
+ i2s_enable_dma(dev, substream->stream);
+
++ i2s_enable_irqs(dev, substream->stream, config->chan_nr);
+ i2s_write_reg(dev->i2s_base, CER, 1);
+ }
+
+@@ -218,11 +216,12 @@ static void i2s_stop(struct dw_i2s_dev *dev,
+ else
+ i2s_write_reg(dev->i2s_base, IRER, 0);
+
+- if (dev->use_pio || dev->is_jh7110)
+- i2s_disable_irqs(dev, substream->stream, 8);
+- else
++ if (!(dev->use_pio || dev->is_jh7110))
+ i2s_disable_dma(dev, substream->stream);
+
++ i2s_disable_irqs(dev, substream->stream, 8);
++
++
+ if (!dev->active) {
+ i2s_write_reg(dev->i2s_base, CER, 0);
+ i2s_write_reg(dev->i2s_base, IER, 0);
+--
+2.39.5
+
--- /dev/null
+From 09edbd6282bc4d1ebb579d7e2f1a33c2f6c7ce5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 22:14:11 +0800
+Subject: ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
+
+From: Henry Martin <bsdhenrymartin@gmail.com>
+
+[ Upstream commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 ]
+
+devm_kasprintf() returns NULL when memory allocation fails. Currently,
+avs_component_probe() does not check for this case, which results in a
+NULL pointer dereference.
+
+Fixes: 739c031110da ("ASoC: Intel: avs: Provide support for fallback topology")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Ethan Carter Edwards <ethan@ethancedwards.com>
+Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
+Link: https://patch.msgid.link/20250402141411.44972-1-bsdhenrymartin@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/pcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
+index 945f9c0a6a545..15defce0f3eb8 100644
+--- a/sound/soc/intel/avs/pcm.c
++++ b/sound/soc/intel/avs/pcm.c
+@@ -925,7 +925,8 @@ static int avs_component_probe(struct snd_soc_component *component)
+ else
+ mach->tplg_filename = devm_kasprintf(adev->dev, GFP_KERNEL,
+ "hda-generic-tplg.bin");
+-
++ if (!mach->tplg_filename)
++ return -ENOMEM;
+ filename = kasprintf(GFP_KERNEL, "%s/%s", component->driver->topology_name_prefix,
+ mach->tplg_filename);
+ if (!filename)
+--
+2.39.5
+
--- /dev/null
+From 2ae62ab8d4351fe9875f99696a8413e7718c9509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 09:30:15 +0200
+Subject: ata: libata-sata: Save all fields from sense data descriptor
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 399eab7f92fb73ffe621294a2d6bec8fc9f3b36b ]
+
+When filling the taskfile result for a successful NCQ command, we use
+the SDB FIS from the FIS Receive Area, see e.g. ahci_qc_ncq_fill_rtf().
+
+However, the SDB FIS only has fields STATUS and ERROR.
+
+For a successful NCQ command that has sense data, we will have a
+successful sense data descriptor, in the Sense Data for Successful NCQ
+Commands log.
+
+Since we have access to additional taskfile result fields, fill in these
+additional fields in qc->result_tf.
+
+This matches how for failing/aborted NCQ commands, we will use e.g.
+ahci_qc_fill_rtf() to fill in some fields, but then for the command that
+actually caused the NCQ error, we will use ata_eh_read_log_10h(), which
+provides additional fields, saving additional fields/overriding the
+qc->result_tf that was fetched using ahci_qc_fill_rtf().
+
+Fixes: 18bd7718b5c4 ("scsi: ata: libata: Handle completion of CDL commands using policy 0xD")
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-sata.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/ata/libata-sata.c b/drivers/ata/libata-sata.c
+index 9c76fb1ad2ec5..a7442dc0bd8e1 100644
+--- a/drivers/ata/libata-sata.c
++++ b/drivers/ata/libata-sata.c
+@@ -1510,6 +1510,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link)
+ unsigned int err_mask, tag;
+ u8 *sense, sk = 0, asc = 0, ascq = 0;
+ u64 sense_valid, val;
++ u16 extended_sense;
++ bool aux_icc_valid;
+ int ret = 0;
+
+ err_mask = ata_read_log_page(dev, ATA_LOG_SENSE_NCQ, 0, buf, 2);
+@@ -1529,6 +1531,8 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link)
+
+ sense_valid = (u64)buf[8] | ((u64)buf[9] << 8) |
+ ((u64)buf[10] << 16) | ((u64)buf[11] << 24);
++ extended_sense = get_unaligned_le16(&buf[14]);
++ aux_icc_valid = extended_sense & BIT(15);
+
+ ata_qc_for_each_raw(ap, qc, tag) {
+ if (!(qc->flags & ATA_QCFLAG_EH) ||
+@@ -1556,6 +1560,17 @@ int ata_eh_get_ncq_success_sense(struct ata_link *link)
+ continue;
+ }
+
++ qc->result_tf.nsect = sense[6];
++ qc->result_tf.hob_nsect = sense[7];
++ qc->result_tf.lbal = sense[8];
++ qc->result_tf.lbam = sense[9];
++ qc->result_tf.lbah = sense[10];
++ qc->result_tf.hob_lbal = sense[11];
++ qc->result_tf.hob_lbam = sense[12];
++ qc->result_tf.hob_lbah = sense[13];
++ if (aux_icc_valid)
++ qc->result_tf.auxiliary = get_unaligned_le32(&sense[16]);
++
+ /* Set sense without also setting scsicmd->result */
+ scsi_build_sense_buffer(dev->flags & ATA_DFLAG_D_SENSE,
+ qc->scsicmd->sense_buffer, sk,
+--
+2.39.5
+
--- /dev/null
+From 12a2834fa6973860a76ebaadfbe2028b47f1a38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 15:00:12 +0100
+Subject: blk-mq: introduce blk_mq_map_hw_queues
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 1452e9b470c903fc4137a448e9f5767e92d68229 ]
+
+blk_mq_pci_map_queues and blk_mq_virtio_map_queues will create a CPU to
+hardware queue mapping based on affinity information. These two function
+share common code and only differ on how the affinity information is
+retrieved. Also, those functions are located in the block subsystem
+where it doesn't really fit in. They are virtio and pci subsystem
+specific.
+
+Thus introduce provide a generic mapping function which uses the
+irq_get_affinity callback from bus_type.
+
+Originally idea from Ming Lei <ming.lei@redhat.com>
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Link: https://lore.kernel.org/r/20241202-refactor-blk-affinity-helpers-v6-4-27211e9c2cd5@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: a2d5a0072235 ("scsi: smartpqi: Use is_kdump_kernel() to check for kdump")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-cpumap.c | 37 +++++++++++++++++++++++++++++++++++++
+ include/linux/blk-mq.h | 2 ++
+ 2 files changed, 39 insertions(+)
+
+diff --git a/block/blk-mq-cpumap.c b/block/blk-mq-cpumap.c
+index 9638b25fd5212..ad8d6a363f24a 100644
+--- a/block/blk-mq-cpumap.c
++++ b/block/blk-mq-cpumap.c
+@@ -11,6 +11,7 @@
+ #include <linux/smp.h>
+ #include <linux/cpu.h>
+ #include <linux/group_cpus.h>
++#include <linux/device/bus.h>
+
+ #include "blk.h"
+ #include "blk-mq.h"
+@@ -54,3 +55,39 @@ int blk_mq_hw_queue_to_node(struct blk_mq_queue_map *qmap, unsigned int index)
+
+ return NUMA_NO_NODE;
+ }
++
++/**
++ * blk_mq_map_hw_queues - Create CPU to hardware queue mapping
++ * @qmap: CPU to hardware queue map
++ * @dev: The device to map queues
++ * @offset: Queue offset to use for the device
++ *
++ * Create a CPU to hardware queue mapping in @qmap. The struct bus_type
++ * irq_get_affinity callback will be used to retrieve the affinity.
++ */
++void blk_mq_map_hw_queues(struct blk_mq_queue_map *qmap,
++ struct device *dev, unsigned int offset)
++
++{
++ const struct cpumask *mask;
++ unsigned int queue, cpu;
++
++ if (!dev->bus->irq_get_affinity)
++ goto fallback;
++
++ for (queue = 0; queue < qmap->nr_queues; queue++) {
++ mask = dev->bus->irq_get_affinity(dev, queue + offset);
++ if (!mask)
++ goto fallback;
++
++ for_each_cpu(cpu, mask)
++ qmap->mq_map[cpu] = qmap->queue_offset + queue;
++ }
++
++ return;
++
++fallback:
++ WARN_ON_ONCE(qmap->nr_queues > 1);
++ blk_mq_clear_mq_map(qmap);
++}
++EXPORT_SYMBOL_GPL(blk_mq_map_hw_queues);
+diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
+index 7b5e5388c3801..d5229fd6f054b 100644
+--- a/include/linux/blk-mq.h
++++ b/include/linux/blk-mq.h
+@@ -947,6 +947,8 @@ void blk_mq_unfreeze_queue_non_owner(struct request_queue *q);
+ void blk_freeze_queue_start_non_owner(struct request_queue *q);
+
+ void blk_mq_map_queues(struct blk_mq_queue_map *qmap);
++void blk_mq_map_hw_queues(struct blk_mq_queue_map *qmap,
++ struct device *dev, unsigned int offset);
+ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues);
+
+ void blk_mq_quiesce_queue_nowait(struct request_queue *q);
+--
+2.39.5
+
--- /dev/null
+From 2fb983be0bb60aeefb4bbf001d321b354cb8a820 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 17:25:54 +0800
+Subject: block: fix resource leak in blk_register_queue() error path
+
+From: Zheng Qixing <zhengqixing@huawei.com>
+
+[ Upstream commit 40f2eb9b531475dd01b683fdaf61ca3cfd03a51e ]
+
+When registering a queue fails after blk_mq_sysfs_register() is
+successful but the function later encounters an error, we need
+to clean up the blk_mq_sysfs resources.
+
+Add the missing blk_mq_sysfs_unregister() call in the error path
+to properly clean up these resources and prevent a memory leak.
+
+Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250412092554.475218-1-zhengqixing@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 692b27266220f..0e2520d929e1d 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -813,6 +813,8 @@ int blk_register_queue(struct gendisk *disk)
+ out_debugfs_remove:
+ blk_debugfs_remove(disk);
+ mutex_unlock(&q->sysfs_lock);
++ if (queue_is_mq(q))
++ blk_mq_sysfs_unregister(disk);
+ out_put_queue_kobj:
+ kobject_put(&disk->queue_kobj);
+ mutex_unlock(&q->sysfs_dir_lock);
+--
+2.39.5
+
--- /dev/null
+From 377d189e7c0d367f12452a358b0d5ec132f4c611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 14:01:41 +0300
+Subject: Bluetooth: btrtl: Prevent potential NULL dereference
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 324dddea321078a6eeb535c2bff5257be74c9799 ]
+
+The btrtl_initialize() function checks that rtl_load_file() either
+had an error or it loaded a zero length file. However, if it loaded
+a zero length file then the error code is not set correctly. It
+results in an error pointer vs NULL bug, followed by a NULL pointer
+dereference. This was detected by Smatch:
+
+drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'
+
+Fixes: 26503ad25de8 ("Bluetooth: btrtl: split the device initialization into smaller parts")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btrtl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 0a6ca6dfb9484..59eb948664223 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ rtl_dev_err(hdev, "mandatory config file %s not found",
+ btrtl_dev->ic_info->cfg_name);
+ ret = btrtl_dev->cfg_len;
++ if (!ret)
++ ret = -EINVAL;
+ goto err_free;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 4142bb8f61e05ea9916792711bad677c6484c2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 13:02:08 -0400
+Subject: Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid
+ address
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit eb73b5a9157221f405b4fe32751da84ee46b7a25 ]
+
+This fixes sending MGMT_EV_DEVICE_FOUND for invalid address
+(00:00:00:00:00:00) which is a regression introduced by
+a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
+since in the attempt to skip storing data for extended advertisement it
+actually made the code to skip the entire if statement supposed to send
+MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which
+is garanteed to be invalid for extended advertisement since we never
+store anything on it.
+
+Link: https://github.com/bluez/bluez/issues/1157
+Link: https://github.com/bluez/bluez/issues/1149#issuecomment-2767215658
+Fixes: a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index d64117be62cc4..96ad1b75d1c4d 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6150,11 +6150,12 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ * event or send an immediate device found event if the data
+ * should not be stored for later.
+ */
+- if (!ext_adv && !has_pending_adv_report(hdev)) {
++ if (!has_pending_adv_report(hdev)) {
+ /* If the report will trigger a SCAN_REQ store it for
+ * later merging.
+ */
+- if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
++ if (!ext_adv && (type == LE_ADV_IND ||
++ type == LE_ADV_SCAN_IND)) {
+ store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+ rssi, flags, data, len);
+ return;
+--
+2.39.5
+
--- /dev/null
+From 16c62aa9b44490ef24cec8f4e9eedf24f7fc50ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 10:53:06 +0200
+Subject: Bluetooth: l2cap: Check encryption key size on incoming connection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frédéric Danis <frederic.danis@collabora.com>
+
+[ Upstream commit 522e9ed157e3c21b4dd623c79967f72c21e45b78 ]
+
+This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
+ Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
+ - 128 bit
+
+This tests the security key with size from 1 to 15 bytes while the
+Security Mode 4 Level 4 requests 16 bytes key size.
+
+Currently PTS fails with the following logs:
+- expected:Connection Response:
+ Code: [3 (0x03)] Code
+ Identifier: (lt)WildCard: Exists(gt)
+ Length: [8 (0x0008)]
+ Destination CID: (lt)WildCard: Exists(gt)
+ Source CID: [64 (0x0040)]
+ Result: [3 (0x0003)] Connection refused - Security block
+ Status: (lt)WildCard: Exists(gt),
+but received:Connection Response:
+ Code: [3 (0x03)] Code
+ Identifier: [1 (0x01)]
+ Length: [8 (0x0008)]
+ Destination CID: [64 (0x0040)]
+ Source CID: [64 (0x0040)]
+ Result: [0 (0x0000)] Connection Successful
+ Status: [0 (0x0000)] No further information available
+
+And HCI logs:
+< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
+ Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
+> HCI Event: Command Complete (0x0e) plen 7
+ Read Encryption Key Size (0x05|0x0008) ncmd 1
+ Status: Success (0x00)
+ Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
+ Key size: 7
+> ACL Data RX: Handle 14 flags 0x02 dlen 12
+ L2CAP: Connection Request (0x02) ident 1 len 4
+ PSM: 4097 (0x1001)
+ Source CID: 64
+< ACL Data TX: Handle 14 flags 0x00 dlen 16
+ L2CAP: Connection Response (0x03) ident 1 len 8
+ Destination CID: 64
+ Source CID: 64
+ Result: Connection successful (0x0000)
+ Status: No further information available (0x0000)
+
+Fixes: 288c06973daa ("Bluetooth: Enforce key size of 16 bytes on FIPS level")
+Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c27ea70f71e1e..499e38ed639e6 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3956,7 +3956,8 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
+
+ /* Check if the ACL is secure enough (if not SDP) */
+ if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
+- !hci_conn_check_link_mode(conn->hcon)) {
++ (!hci_conn_check_link_mode(conn->hcon) ||
++ !l2cap_check_enc_key_size(conn->hcon))) {
+ conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
+ result = L2CAP_CR_SEC_BLOCK;
+ goto response;
+--
+2.39.5
+
--- /dev/null
+From 177c48104734772eb046d62b26a74785495640a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 19:44:16 +0800
+Subject: can: rockchip_canfd: fix broken quirks checks
+
+From: Weizhao Ouyang <o451686892@gmail.com>
+
+[ Upstream commit 6315d93541f8a5f77c5ef5c4f25233e66d189603 ]
+
+First get the devtype_data then check quirks.
+
+Fixes: bbdffb341498 ("can: rockchip_canfd: add quirk for broken CAN-FD support")
+Signed-off-by: Weizhao Ouyang <o451686892@gmail.com>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://patch.msgid.link/20250324114416.10160-1-o451686892@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rockchip/rockchip_canfd-core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/rockchip/rockchip_canfd-core.c b/drivers/net/can/rockchip/rockchip_canfd-core.c
+index d9a937ba126c3..ac514766d431c 100644
+--- a/drivers/net/can/rockchip/rockchip_canfd-core.c
++++ b/drivers/net/can/rockchip/rockchip_canfd-core.c
+@@ -907,15 +907,16 @@ static int rkcanfd_probe(struct platform_device *pdev)
+ priv->can.data_bittiming_const = &rkcanfd_data_bittiming_const;
+ priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
+ CAN_CTRLMODE_BERR_REPORTING;
+- if (!(priv->devtype_data.quirks & RKCANFD_QUIRK_CANFD_BROKEN))
+- priv->can.ctrlmode_supported |= CAN_CTRLMODE_FD;
+ priv->can.do_set_mode = rkcanfd_set_mode;
+ priv->can.do_get_berr_counter = rkcanfd_get_berr_counter;
+ priv->ndev = ndev;
+
+ match = device_get_match_data(&pdev->dev);
+- if (match)
++ if (match) {
+ priv->devtype_data = *(struct rkcanfd_devtype_data *)match;
++ if (!(priv->devtype_data.quirks & RKCANFD_QUIRK_CANFD_BROKEN))
++ priv->can.ctrlmode_supported |= CAN_CTRLMODE_FD;
++ }
+
+ err = can_rx_offload_add_manual(ndev, &priv->offload,
+ RKCANFD_NAPI_WEIGHT);
+--
+2.39.5
+
--- /dev/null
+From 7137b19efcf31851191775209c3e660f6e6a6c7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 11:58:08 +0200
+Subject: cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit cfde542df7dd51d26cf667f4af497878ddffd85a ]
+
+Commit 8e461a1cb43d ("cpufreq: schedutil: Fix superfluous updates caused
+by need_freq_update") modified sugov_should_update_freq() to set the
+need_freq_update flag only for drivers with CPUFREQ_NEED_UPDATE_LIMITS
+set, but that flag generally needs to be set when the policy limits
+change because the driver callback may need to be invoked for the new
+limits to take effect.
+
+However, if the return value of cpufreq_driver_resolve_freq() after
+applying the new limits is still equal to the previously selected
+frequency, the driver callback needs to be invoked only in the case
+when CPUFREQ_NEED_UPDATE_LIMITS is set (which means that the driver
+specifically wants its callback to be invoked every time the policy
+limits change).
+
+Update the code accordingly to avoid missing policy limits changes for
+drivers without CPUFREQ_NEED_UPDATE_LIMITS.
+
+Fixes: 8e461a1cb43d ("cpufreq: schedutil: Fix superfluous updates caused by need_freq_update")
+Closes: https://lore.kernel.org/lkml/Z_Tlc6Qs-tYpxWYb@linaro.org/
+Reported-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/3010358.e9J7NaK4W3@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index e51d5ce730be1..3a807c2e50854 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -83,7 +83,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
+
+ if (unlikely(sg_policy->limits_changed)) {
+ sg_policy->limits_changed = false;
+- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS);
++ sg_policy->need_freq_update = true;
+ return true;
+ }
+
+@@ -95,10 +95,22 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
+ static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time,
+ unsigned int next_freq)
+ {
+- if (sg_policy->need_freq_update)
++ if (sg_policy->need_freq_update) {
+ sg_policy->need_freq_update = false;
+- else if (sg_policy->next_freq == next_freq)
++ /*
++ * The policy limits have changed, but if the return value of
++ * cpufreq_driver_resolve_freq() after applying the new limits
++ * is still equal to the previously selected frequency, the
++ * driver callback need not be invoked unless the driver
++ * specifically wants that to happen on every update of the
++ * policy limits.
++ */
++ if (sg_policy->next_freq == next_freq &&
++ !cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS))
++ return false;
++ } else if (sg_policy->next_freq == next_freq) {
+ return false;
++ }
+
+ sg_policy->next_freq = next_freq;
+ sg_policy->last_freq_update_time = time;
+--
+2.39.5
+
--- /dev/null
+From ebe3ed75720296a2faee8ebffb751fb048273602 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2025 14:46:02 +0530
+Subject: crypto: tegra - Do not use fixed size buffers
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit 1cb328da4e8f34350c61a2b6548766c79b4bb64c ]
+
+Allocate the buffer based on the request instead of a fixed buffer
+length. In operations which may require larger buffer size, a fixed
+buffer may fail.
+
+Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 1ddaff40c08a ("crypto: tegra - Fix IV usage for AES ECB")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/tegra/tegra-se-aes.c | 124 ++++++++++++++-------------
+ drivers/crypto/tegra/tegra-se-hash.c | 38 +++++---
+ drivers/crypto/tegra/tegra-se.h | 2 -
+ 3 files changed, 89 insertions(+), 75 deletions(-)
+
+diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c
+index 9ab832bee81a2..46c4dac92dd7a 100644
+--- a/drivers/crypto/tegra/tegra-se-aes.c
++++ b/drivers/crypto/tegra/tegra-se-aes.c
+@@ -263,12 +263,6 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
+ unsigned int cmdlen;
+ int ret;
+
+- rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_AES_BUFLEN,
+- &rctx->datbuf.addr, GFP_KERNEL);
+- if (!rctx->datbuf.buf)
+- return -ENOMEM;
+-
+- rctx->datbuf.size = SE_AES_BUFLEN;
+ rctx->iv = (u32 *)req->iv;
+ rctx->len = req->cryptlen;
+
+@@ -278,6 +272,12 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
+ rctx->len += AES_BLOCK_SIZE - (rctx->len % AES_BLOCK_SIZE);
+ }
+
++ rctx->datbuf.size = rctx->len;
++ rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->datbuf.size,
++ &rctx->datbuf.addr, GFP_KERNEL);
++ if (!rctx->datbuf.buf)
++ return -ENOMEM;
++
+ scatterwalk_map_and_copy(rctx->datbuf.buf, req->src, 0, req->cryptlen, 0);
+
+ /* Prepare the command and submit for execution */
+@@ -289,7 +289,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
+ scatterwalk_map_and_copy(rctx->datbuf.buf, req->dst, 0, req->cryptlen, 1);
+
+ /* Free the buffer */
+- dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
+ rctx->datbuf.buf, rctx->datbuf.addr);
+
+ crypto_finalize_skcipher_request(se->engine, req, ret);
+@@ -1120,6 +1120,11 @@ static int tegra_ccm_crypt_init(struct aead_request *req, struct tegra_se *se,
+ rctx->assoclen = req->assoclen;
+ rctx->authsize = crypto_aead_authsize(tfm);
+
++ if (rctx->encrypt)
++ rctx->cryptlen = req->cryptlen;
++ else
++ rctx->cryptlen = req->cryptlen - rctx->authsize;
++
+ memcpy(iv, req->iv, 16);
+
+ ret = tegra_ccm_check_iv(iv);
+@@ -1148,30 +1153,26 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
+ struct tegra_se *se = ctx->se;
+ int ret;
+
++ ret = tegra_ccm_crypt_init(req, se, rctx);
++ if (ret)
++ return ret;
++
+ /* Allocate buffers required */
+- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
++ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
+ &rctx->inbuf.addr, GFP_KERNEL);
+ if (!rctx->inbuf.buf)
+ return -ENOMEM;
+
+- rctx->inbuf.size = SE_AES_BUFLEN;
+-
+- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
++ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
+ &rctx->outbuf.addr, GFP_KERNEL);
+ if (!rctx->outbuf.buf) {
+ ret = -ENOMEM;
+ goto outbuf_err;
+ }
+
+- rctx->outbuf.size = SE_AES_BUFLEN;
+-
+- ret = tegra_ccm_crypt_init(req, se, rctx);
+- if (ret)
+- goto out;
+-
+ if (rctx->encrypt) {
+- rctx->cryptlen = req->cryptlen;
+-
+ /* CBC MAC Operation */
+ ret = tegra_ccm_compute_auth(ctx, rctx);
+ if (ret)
+@@ -1182,8 +1183,6 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
+ if (ret)
+ goto out;
+ } else {
+- rctx->cryptlen = req->cryptlen - ctx->authsize;
+-
+ /* CTR operation */
+ ret = tegra_ccm_do_ctr(ctx, rctx);
+ if (ret)
+@@ -1196,11 +1195,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
+ }
+
+ out:
+- dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
+ rctx->outbuf.buf, rctx->outbuf.addr);
+
+ outbuf_err:
+- dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
+ rctx->inbuf.buf, rctx->inbuf.addr);
+
+ crypto_finalize_aead_request(ctx->se->engine, req, ret);
+@@ -1216,23 +1215,6 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
+ struct tegra_aead_reqctx *rctx = aead_request_ctx(req);
+ int ret;
+
+- /* Allocate buffers required */
+- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
+- &rctx->inbuf.addr, GFP_KERNEL);
+- if (!rctx->inbuf.buf)
+- return -ENOMEM;
+-
+- rctx->inbuf.size = SE_AES_BUFLEN;
+-
+- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, SE_AES_BUFLEN,
+- &rctx->outbuf.addr, GFP_KERNEL);
+- if (!rctx->outbuf.buf) {
+- ret = -ENOMEM;
+- goto outbuf_err;
+- }
+-
+- rctx->outbuf.size = SE_AES_BUFLEN;
+-
+ rctx->src_sg = req->src;
+ rctx->dst_sg = req->dst;
+ rctx->assoclen = req->assoclen;
+@@ -1246,6 +1228,21 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
+ memcpy(rctx->iv, req->iv, GCM_AES_IV_SIZE);
+ rctx->iv[3] = (1 << 24);
+
++ /* Allocate buffers required */
++ rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
++ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
++ &rctx->inbuf.addr, GFP_KERNEL);
++ if (!rctx->inbuf.buf)
++ return -ENOMEM;
++
++ rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
++ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
++ &rctx->outbuf.addr, GFP_KERNEL);
++ if (!rctx->outbuf.buf) {
++ ret = -ENOMEM;
++ goto outbuf_err;
++ }
++
+ /* If there is associated data perform GMAC operation */
+ if (rctx->assoclen) {
+ ret = tegra_gcm_do_gmac(ctx, rctx);
+@@ -1269,11 +1266,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
+ ret = tegra_gcm_do_verify(ctx->se, rctx);
+
+ out:
+- dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
+ rctx->outbuf.buf, rctx->outbuf.addr);
+
+ outbuf_err:
+- dma_free_coherent(ctx->se->dev, SE_AES_BUFLEN,
++ dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
+ rctx->inbuf.buf, rctx->inbuf.addr);
+
+ /* Finalize the request if there are no errors */
+@@ -1500,6 +1497,11 @@ static int tegra_cmac_do_update(struct ahash_request *req)
+ return 0;
+ }
+
++ rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->datbuf.size,
++ &rctx->datbuf.addr, GFP_KERNEL);
++ if (!rctx->datbuf.buf)
++ return -ENOMEM;
++
+ /* Copy the previous residue first */
+ if (rctx->residue.size)
+ memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
+@@ -1525,6 +1527,9 @@ static int tegra_cmac_do_update(struct ahash_request *req)
+
+ tegra_cmac_copy_result(ctx->se, rctx);
+
++ dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
++ rctx->datbuf.buf, rctx->datbuf.addr);
++
+ return ret;
+ }
+
+@@ -1539,10 +1544,20 @@ static int tegra_cmac_do_final(struct ahash_request *req)
+
+ if (!req->nbytes && !rctx->total_len && ctx->fallback_tfm) {
+ return crypto_shash_tfm_digest(ctx->fallback_tfm,
+- rctx->datbuf.buf, 0, req->result);
++ NULL, 0, req->result);
++ }
++
++ if (rctx->residue.size) {
++ rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->residue.size,
++ &rctx->datbuf.addr, GFP_KERNEL);
++ if (!rctx->datbuf.buf) {
++ ret = -ENOMEM;
++ goto out_free;
++ }
++
++ memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
+ }
+
+- memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
+ rctx->datbuf.size = rctx->residue.size;
+ rctx->total_len += rctx->residue.size;
+ rctx->config = tegra234_aes_cfg(SE_ALG_CMAC, 0);
+@@ -1568,8 +1583,10 @@ static int tegra_cmac_do_final(struct ahash_request *req)
+ writel(0, se->base + se->hw->regs->result + (i * 4));
+
+ out:
+- dma_free_coherent(se->dev, SE_SHA_BUFLEN,
+- rctx->datbuf.buf, rctx->datbuf.addr);
++ if (rctx->residue.size)
++ dma_free_coherent(se->dev, rctx->datbuf.size,
++ rctx->datbuf.buf, rctx->datbuf.addr);
++out_free:
+ dma_free_coherent(se->dev, crypto_ahash_blocksize(tfm) * 2,
+ rctx->residue.buf, rctx->residue.addr);
+ return ret;
+@@ -1681,28 +1698,15 @@ static int tegra_cmac_init(struct ahash_request *req)
+ rctx->residue.buf = dma_alloc_coherent(se->dev, rctx->blk_size * 2,
+ &rctx->residue.addr, GFP_KERNEL);
+ if (!rctx->residue.buf)
+- goto resbuf_fail;
++ return -ENOMEM;
+
+ rctx->residue.size = 0;
+
+- rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_SHA_BUFLEN,
+- &rctx->datbuf.addr, GFP_KERNEL);
+- if (!rctx->datbuf.buf)
+- goto datbuf_fail;
+-
+- rctx->datbuf.size = 0;
+-
+ /* Clear any previous result */
+ for (i = 0; i < CMAC_RESULT_REG_COUNT; i++)
+ writel(0, se->base + se->hw->regs->result + (i * 4));
+
+ return 0;
+-
+-datbuf_fail:
+- dma_free_coherent(se->dev, rctx->blk_size, rctx->residue.buf,
+- rctx->residue.addr);
+-resbuf_fail:
+- return -ENOMEM;
+ }
+
+ static int tegra_cmac_setkey(struct crypto_ahash *tfm, const u8 *key,
+diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c
+index 726e30c0e63eb..451b8eaab16aa 100644
+--- a/drivers/crypto/tegra/tegra-se-hash.c
++++ b/drivers/crypto/tegra/tegra-se-hash.c
+@@ -332,6 +332,11 @@ static int tegra_sha_do_update(struct ahash_request *req)
+ return 0;
+ }
+
++ rctx->datbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->datbuf.size,
++ &rctx->datbuf.addr, GFP_KERNEL);
++ if (!rctx->datbuf.buf)
++ return -ENOMEM;
++
+ /* Copy the previous residue first */
+ if (rctx->residue.size)
+ memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
+@@ -368,6 +373,9 @@ static int tegra_sha_do_update(struct ahash_request *req)
+ if (!(rctx->task & SHA_FINAL))
+ tegra_sha_copy_hash_result(se, rctx);
+
++ dma_free_coherent(ctx->se->dev, rctx->datbuf.size,
++ rctx->datbuf.buf, rctx->datbuf.addr);
++
+ return ret;
+ }
+
+@@ -380,7 +388,17 @@ static int tegra_sha_do_final(struct ahash_request *req)
+ u32 *cpuvaddr = se->cmdbuf->addr;
+ int size, ret = 0;
+
+- memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
++ if (rctx->residue.size) {
++ rctx->datbuf.buf = dma_alloc_coherent(se->dev, rctx->residue.size,
++ &rctx->datbuf.addr, GFP_KERNEL);
++ if (!rctx->datbuf.buf) {
++ ret = -ENOMEM;
++ goto out_free;
++ }
++
++ memcpy(rctx->datbuf.buf, rctx->residue.buf, rctx->residue.size);
++ }
++
+ rctx->datbuf.size = rctx->residue.size;
+ rctx->total_len += rctx->residue.size;
+
+@@ -397,8 +415,10 @@ static int tegra_sha_do_final(struct ahash_request *req)
+ memcpy(req->result, rctx->digest.buf, rctx->digest.size);
+
+ out:
+- dma_free_coherent(se->dev, SE_SHA_BUFLEN,
+- rctx->datbuf.buf, rctx->datbuf.addr);
++ if (rctx->residue.size)
++ dma_free_coherent(se->dev, rctx->datbuf.size,
++ rctx->datbuf.buf, rctx->datbuf.addr);
++out_free:
+ dma_free_coherent(se->dev, crypto_ahash_blocksize(tfm),
+ rctx->residue.buf, rctx->residue.addr);
+ dma_free_coherent(se->dev, rctx->digest.size, rctx->digest.buf,
+@@ -534,19 +554,11 @@ static int tegra_sha_init(struct ahash_request *req)
+ if (!rctx->residue.buf)
+ goto resbuf_fail;
+
+- rctx->datbuf.buf = dma_alloc_coherent(se->dev, SE_SHA_BUFLEN,
+- &rctx->datbuf.addr, GFP_KERNEL);
+- if (!rctx->datbuf.buf)
+- goto datbuf_fail;
+-
+ return 0;
+
+-datbuf_fail:
+- dma_free_coherent(se->dev, rctx->blk_size, rctx->residue.buf,
+- rctx->residue.addr);
+ resbuf_fail:
+- dma_free_coherent(se->dev, SE_SHA_BUFLEN, rctx->datbuf.buf,
+- rctx->datbuf.addr);
++ dma_free_coherent(se->dev, rctx->digest.size, rctx->digest.buf,
++ rctx->digest.addr);
+ digbuf_fail:
+ return -ENOMEM;
+ }
+diff --git a/drivers/crypto/tegra/tegra-se.h b/drivers/crypto/tegra/tegra-se.h
+index b54aefe717a17..e196a90eedb92 100644
+--- a/drivers/crypto/tegra/tegra-se.h
++++ b/drivers/crypto/tegra/tegra-se.h
+@@ -340,8 +340,6 @@
+ #define SE_CRYPTO_CTR_REG_COUNT 4
+ #define SE_MAX_KEYSLOT 15
+ #define SE_MAX_MEM_ALLOC SZ_4M
+-#define SE_AES_BUFLEN 0x8000
+-#define SE_SHA_BUFLEN 0x2000
+
+ #define SHA_FIRST BIT(0)
+ #define SHA_UPDATE BIT(1)
+--
+2.39.5
+
--- /dev/null
+From dd4a5aa87927cf657cef22dde91172909959f9bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 20:21:10 +0530
+Subject: crypto: tegra - Fix IV usage for AES ECB
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit 1ddaff40c08abb926be5ba713c5efc412d0836c5 ]
+
+Modifying the crypto_request turns out to be not the right way to handle
+the stale value issue with the IV. Though the IV is not used for AES ECB,
+it eventually get used in algorithms like LRW in the next step after
+AES ECB encryption/decryption. Setting req->iv to NULL breaks the
+implementation of such algorithms. Hence modify only the local reqctx
+to check for IV.
+
+Fixes: bde558220866 ("crypto: tegra - Set IV to NULL explicitly for AES ECB")
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/tegra/tegra-se-aes.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c
+index 46c4dac92dd7a..cd52807e76afd 100644
+--- a/drivers/crypto/tegra/tegra-se-aes.c
++++ b/drivers/crypto/tegra/tegra-se-aes.c
+@@ -263,7 +263,7 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq)
+ unsigned int cmdlen;
+ int ret;
+
+- rctx->iv = (u32 *)req->iv;
++ rctx->iv = (ctx->alg == SE_ALG_ECB) ? NULL : (u32 *)req->iv;
+ rctx->len = req->cryptlen;
+
+ /* Pad input to AES Block size */
+@@ -443,9 +443,6 @@ static int tegra_aes_crypt(struct skcipher_request *req, bool encrypt)
+ if (!req->cryptlen)
+ return 0;
+
+- if (ctx->alg == SE_ALG_ECB)
+- req->iv = NULL;
+-
+ rctx->encrypt = encrypt;
+ rctx->config = tegra234_aes_cfg(ctx->alg, encrypt);
+ rctx->crypto_config = tegra234_aes_crypto_cfg(ctx->alg, encrypt);
+--
+2.39.5
+
--- /dev/null
+From 6c72fddb40537026ff5b886cbdd2455b2a838c43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 14:11:22 +0100
+Subject: crypto: tegra - remove redundant error check on ret
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 7b90df78184de90fe5afcc45393c8ad83b5b18a1 ]
+
+Currently there is an unnecessary error check on ret without a proceeding
+assignment to ret that needs checking. The check is redundant and can be
+removed.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Akhil R <akhilrajeev@nvidia.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 1ddaff40c08a ("crypto: tegra - Fix IV usage for AES ECB")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/tegra/tegra-se-aes.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c
+index 0ed0515e1ed54..9ab832bee81a2 100644
+--- a/drivers/crypto/tegra/tegra-se-aes.c
++++ b/drivers/crypto/tegra/tegra-se-aes.c
+@@ -1183,8 +1183,6 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
+ goto out;
+ } else {
+ rctx->cryptlen = req->cryptlen - ctx->authsize;
+- if (ret)
+- goto out;
+
+ /* CTR operation */
+ ret = tegra_ccm_do_ctr(ctx, rctx);
+--
+2.39.5
+
--- /dev/null
+From d7c67ecbbf9671a8b575b344a53142513cac6b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 22:36:46 +0530
+Subject: cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 00ffb3724ce743578163f5ade2884374554ca021 ]
+
+In the for loop used to allocate the loc_array and bmap for each port, a
+memory leak is possible when the allocation for loc_array succeeds,
+but the allocation for bmap fails. This is because when the control flow
+goes to the label free_eth_finfo, only the allocations starting from
+(i-1)th iteration are freed.
+
+Fix that by freeing the loc_array in the bmap allocation error path.
+
+Fixes: d915c299f1da ("cxgb4: add skeleton for ethtool n-tuple filters")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250414170649.89156-1-abdun.nihaal@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+index 7f3f5afa864f4..1546c3db08f09 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+@@ -2270,6 +2270,7 @@ int cxgb4_init_ethtool_filters(struct adapter *adap)
+ eth_filter->port[i].bmap = bitmap_zalloc(nentries, GFP_KERNEL);
+ if (!eth_filter->port[i].bmap) {
+ ret = -ENOMEM;
++ kvfree(eth_filter->port[i].loc_array);
+ goto free_eth_finfo;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 4684c6043809b849c65cf18d1d61a322811107b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 15:00:09 +0100
+Subject: driver core: bus: add irq_get_affinity callback to bus_type
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit fea4952df0eeec4e1a295ebaac9f61c0065fae87 ]
+
+Introducing a callback in struct bus_type so that a subsystem
+can hook up the getters directly. This approach avoids exposing
+random getters in any subsystems APIs.
+
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Link: https://lore.kernel.org/r/20241202-refactor-blk-affinity-helpers-v6-1-27211e9c2cd5@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: a2d5a0072235 ("scsi: smartpqi: Use is_kdump_kernel() to check for kdump")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/device/bus.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h
+index cdc4757217f9b..b18658bce2c38 100644
+--- a/include/linux/device/bus.h
++++ b/include/linux/device/bus.h
+@@ -48,6 +48,7 @@ struct fwnode_handle;
+ * will never get called until they do.
+ * @remove: Called when a device removed from this bus.
+ * @shutdown: Called at shut-down time to quiesce the device.
++ * @irq_get_affinity: Get IRQ affinity mask for the device on this bus.
+ *
+ * @online: Called to put the device back online (after offlining it).
+ * @offline: Called to put the device offline for hot-removal. May fail.
+@@ -87,6 +88,8 @@ struct bus_type {
+ void (*sync_state)(struct device *dev);
+ void (*remove)(struct device *dev);
+ void (*shutdown)(struct device *dev);
++ const struct cpumask *(*irq_get_affinity)(struct device *dev,
++ unsigned int irq_vec);
+
+ int (*online)(struct device *dev);
+ int (*offline)(struct device *dev);
+--
+2.39.5
+
--- /dev/null
+From 9c9e4a93b7413558cb81bcfdabb297a2ba01ae92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Apr 2025 18:11:12 +0200
+Subject: dt-bindings: soc: fsl: fsl,ls1028a-reset: Fix maintainer entry
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit d5f49921707cc73376ad6cf8410218b438fcd233 ]
+
+make dt_binding_check:
+
+ Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml: maintainers:0: 'Frank Li' does not match '@'
+ from schema $id: http://devicetree.org/meta-schemas/base.yaml#
+
+Fix this by adding Frank's email address.
+
+Fixes: 9ca5a7d9d2e05de6 ("dt-bindings: soc: fsl: Add fsl,ls1028a-reset for reset syscon node")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/185e1e06692dc5b08abcde2d3dd137c78e979d08.1744301283.git.geert+renesas@glider.be
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml b/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml
+index 31295be910130..234089b5954dd 100644
+--- a/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml
++++ b/Documentation/devicetree/bindings/soc/fsl/fsl,ls1028a-reset.yaml
+@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml#
+ title: Freescale Layerscape Reset Registers Module
+
+ maintainers:
+- - Frank Li
++ - Frank Li <Frank.Li@nxp.com>
+
+ description:
+ Reset Module includes chip reset, service processor control and Reset Control
+--
+2.39.5
+
--- /dev/null
+From 9c59d6d6473a407f4ff7285a62da87c0d42a861b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 07:32:10 -0700
+Subject: eth: bnxt: fix missing ring index trim on error path
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 12f2d033fae957d84c2c0ce604d2a077e61fa2c0 ]
+
+Commit under Fixes converted tx_prod to be free running but missed
+masking it on the Tx error path. This crashes on error conditions,
+for example when DMA mapping fails.
+
+Fixes: 6d1add95536b ("bnxt_en: Modify TX ring indexing logic.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250414143210.458625-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index e7580df13229a..016dcfec8d496 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -758,7 +758,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ dev_kfree_skb_any(skb);
+ tx_kick_pending:
+ if (BNXT_TX_PTP_IS_SET(lflags)) {
+- txr->tx_buf_ring[txr->tx_prod].is_ts_pkt = 0;
++ txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].is_ts_pkt = 0;
+ atomic64_inc(&bp->ptp_cfg->stats.ts_err);
+ if (!(bp->fw_cap & BNXT_FW_CAP_TX_TS_CMP))
+ /* set SKB to err so PTP worker will clean up */
+@@ -766,7 +766,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+ if (txr->kick_pending)
+ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
+- txr->tx_buf_ring[txr->tx_prod].skb = NULL;
++ txr->tx_buf_ring[RING_TX(bp, txr->tx_prod)].skb = NULL;
+ dev_core_stats_tx_dropped_inc(dev);
+ return NETDEV_TX_OK;
+ }
+--
+2.39.5
+
--- /dev/null
+From d7da901aef42c951c0da21de1c486223da7daa17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 10:33:12 -0700
+Subject: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
+
+From: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
+
+[ Upstream commit f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3 ]
+
+rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct
+size of rpl is sizeof(*rpl) which should be just 1 byte. Using the
+pointer size instead can cause stack corruption:
+
+Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100
+CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24
+Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023
+Workqueue: events module_flash_fw_work
+Call Trace:
+ <TASK>
+ panic+0x339/0x360
+ ? ethtool_cmis_wait_for_cond+0xf4/0x100
+ ? __pfx_status_success+0x10/0x10
+ ? __pfx_status_fail+0x10/0x10
+ __stack_chk_fail+0x10/0x10
+ ethtool_cmis_wait_for_cond+0xf4/0x100
+ ethtool_cmis_cdb_execute_cmd+0x1fc/0x330
+ ? __pfx_status_fail+0x10/0x10
+ cmis_cdb_module_features_get+0x6d/0xd0
+ ethtool_cmis_cdb_init+0x8a/0xd0
+ ethtool_cmis_fw_update+0x46/0x1d0
+ module_flash_fw_work+0x17/0xa0
+ process_one_work+0x179/0x390
+ worker_thread+0x239/0x340
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xcc/0x100
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x2d/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands")
+Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250409173312.733012-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/cmis_cdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ethtool/cmis_cdb.c b/net/ethtool/cmis_cdb.c
+index 4d55811479520..8bf99295bfbe9 100644
+--- a/net/ethtool/cmis_cdb.c
++++ b/net/ethtool/cmis_cdb.c
+@@ -346,7 +346,7 @@ ethtool_cmis_module_poll(struct net_device *dev,
+ struct netlink_ext_ack extack = {};
+ int err;
+
+- ethtool_cmis_page_init(&page_data, 0, offset, sizeof(rpl));
++ ethtool_cmis_page_init(&page_data, 0, offset, sizeof(*rpl));
+ page_data.data = (u8 *)rpl;
+
+ err = ops->get_module_eeprom_by_page(dev, &page_data, &extack);
+--
+2.39.5
+
--- /dev/null
+From dad48b9ff4aea1cf3e46f031f10e3d935689f473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:34 -0700
+Subject: igc: add lock preventing multiple simultaneous PTM transactions
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit 1a931c4f5e6862e61a4b130cb76b422e1415f644 ]
+
+Add a mutex around the PTM transaction to prevent multiple transactors
+
+Multiple processes try to initiate a PTM transaction, one or all may
+fail. This can be reproduced by running two instances of the
+following:
+
+$ sudo phc2sys -O 0 -i tsn0 -m
+
+PHC2SYS exits with:
+
+"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
+ fails
+
+Note: Normally two instance of PHC2SYS will not run, but one process
+ should not break another.
+
+Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()")
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc.h | 1 +
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 20 ++++++++++++++++++--
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
+index eac0f966e0e4c..323db1e2be388 100644
+--- a/drivers/net/ethernet/intel/igc/igc.h
++++ b/drivers/net/ethernet/intel/igc/igc.h
+@@ -319,6 +319,7 @@ struct igc_adapter {
+ struct timespec64 prev_ptp_time; /* Pre-reset PTP clock */
+ ktime_t ptp_reset_start; /* Reset time in clock mono */
+ struct system_time_snapshot snapshot;
++ struct mutex ptm_lock; /* Only allow one PTM transaction at a time */
+
+ char fw_version[32];
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index 343205bffc355..612ed26a29c5d 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -974,6 +974,7 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat)
+ }
+ }
+
++/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_trigger() */
+ static void igc_ptm_trigger(struct igc_hw *hw)
+ {
+ u32 ctrl;
+@@ -990,6 +991,7 @@ static void igc_ptm_trigger(struct igc_hw *hw)
+ wrfl();
+ }
+
++/* The PTM lock: adapter->ptm_lock must be held when calling igc_ptm_reset() */
+ static void igc_ptm_reset(struct igc_hw *hw)
+ {
+ u32 ctrl;
+@@ -1068,9 +1070,16 @@ static int igc_ptp_getcrosststamp(struct ptp_clock_info *ptp,
+ {
+ struct igc_adapter *adapter = container_of(ptp, struct igc_adapter,
+ ptp_caps);
++ int ret;
+
+- return get_device_system_crosststamp(igc_phc_get_syncdevicetime,
+- adapter, &adapter->snapshot, cts);
++ /* This blocks until any in progress PTM transactions complete */
++ mutex_lock(&adapter->ptm_lock);
++
++ ret = get_device_system_crosststamp(igc_phc_get_syncdevicetime,
++ adapter, &adapter->snapshot, cts);
++ mutex_unlock(&adapter->ptm_lock);
++
++ return ret;
+ }
+
+ static int igc_ptp_getcyclesx64(struct ptp_clock_info *ptp,
+@@ -1169,6 +1178,7 @@ void igc_ptp_init(struct igc_adapter *adapter)
+ spin_lock_init(&adapter->ptp_tx_lock);
+ spin_lock_init(&adapter->free_timer_lock);
+ spin_lock_init(&adapter->tmreg_lock);
++ mutex_init(&adapter->ptm_lock);
+
+ adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE;
+ adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF;
+@@ -1181,6 +1191,7 @@ void igc_ptp_init(struct igc_adapter *adapter)
+ if (IS_ERR(adapter->ptp_clock)) {
+ adapter->ptp_clock = NULL;
+ netdev_err(netdev, "ptp_clock_register failed\n");
++ mutex_destroy(&adapter->ptm_lock);
+ } else if (adapter->ptp_clock) {
+ netdev_info(netdev, "PHC added\n");
+ adapter->ptp_flags |= IGC_PTP_ENABLED;
+@@ -1210,10 +1221,12 @@ static void igc_ptm_stop(struct igc_adapter *adapter)
+ struct igc_hw *hw = &adapter->hw;
+ u32 ctrl;
+
++ mutex_lock(&adapter->ptm_lock);
+ ctrl = rd32(IGC_PTM_CTRL);
+ ctrl &= ~IGC_PTM_CTRL_EN;
+
+ wr32(IGC_PTM_CTRL, ctrl);
++ mutex_unlock(&adapter->ptm_lock);
+ }
+
+ /**
+@@ -1255,6 +1268,7 @@ void igc_ptp_stop(struct igc_adapter *adapter)
+ netdev_info(adapter->netdev, "PHC removed\n");
+ adapter->ptp_flags &= ~IGC_PTP_ENABLED;
+ }
++ mutex_destroy(&adapter->ptm_lock);
+ }
+
+ /**
+@@ -1294,6 +1308,7 @@ void igc_ptp_reset(struct igc_adapter *adapter)
+ if (!igc_is_crosststamp_supported(adapter))
+ break;
+
++ mutex_lock(&adapter->ptm_lock);
+ wr32(IGC_PCIE_DIG_DELAY, IGC_PCIE_DIG_DELAY_DEFAULT);
+ wr32(IGC_PCIE_PHY_DELAY, IGC_PCIE_PHY_DELAY_DEFAULT);
+
+@@ -1317,6 +1332,7 @@ void igc_ptp_reset(struct igc_adapter *adapter)
+ netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n");
+
+ igc_ptm_reset(hw);
++ mutex_unlock(&adapter->ptm_lock);
+ break;
+ default:
+ /* No work to do. */
+--
+2.39.5
+
--- /dev/null
+From 73391cc3832234cb178a6c8304e7498ceedbf248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:33 -0700
+Subject: igc: cleanup PTP module if probe fails
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit 1f025759ba394dd53e434d2668cb0597886d9b69 ]
+
+Make sure that the PTP module is cleaned up if the igc_probe() fails by
+calling igc_ptp_stop() on exit.
+
+Fixes: d89f88419f99 ("igc: Add skeletal frame for Intel(R) 2.5G Ethernet Controller support")
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 1ec9e8cc99d94..082b0baf5d37c 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -7173,6 +7173,7 @@ static int igc_probe(struct pci_dev *pdev,
+
+ err_register:
+ igc_release_hw_control(adapter);
++ igc_ptp_stop(adapter);
+ err_eeprom:
+ if (!igc_check_reset_block(hw))
+ igc_reset_phy(hw);
+--
+2.39.5
+
--- /dev/null
+From 116c1033433bdd3732ac2d8fccda12f15a87aaf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:29 -0700
+Subject: igc: fix PTM cycle trigger logic
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit 8e404ad95d2c10c261e2ef6992c7c12dde03df0e ]
+
+Writing to clear the PTM status 'valid' bit while the PTM cycle is
+triggered results in unreliable PTM operation. To fix this, clear the
+PTM 'trigger' and status after each PTM transaction.
+
+The issue can be reproduced with the following:
+
+$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m
+
+Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to
+quickly reproduce the issue.
+
+PHC2SYS exits with:
+
+"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
+ fails
+
+This patch also fixes a hang in igc_probe() when loading the igc
+driver in the kdump kernel on systems supporting PTM.
+
+The igc driver running in the base kernel enables PTM trigger in
+igc_probe(). Therefore the driver is always in PTM trigger mode,
+except in brief periods when manually triggering a PTM cycle.
+
+When a crash occurs, the NIC is reset while PTM trigger is enabled.
+Due to a hardware problem, the NIC is subsequently in a bad busmaster
+state and doesn't handle register reads/writes. When running
+igc_probe() in the kdump kernel, the first register access to a NIC
+register hangs driver probing and ultimately breaks kdump.
+
+With this patch, igc has PTM trigger disabled most of the time,
+and the trigger is only enabled for very brief (10 - 100 us) periods
+when manually triggering a PTM cycle. Chances that a crash occurs
+during a PTM trigger are not 0, but extremely reduced.
+
+Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Corinna Vinschen <vinschen@redhat.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_defines.h | 1 +
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 70 ++++++++++++--------
+ 2 files changed, 42 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h
+index 8e449904aa7db..2ff292f5f63be 100644
+--- a/drivers/net/ethernet/intel/igc/igc_defines.h
++++ b/drivers/net/ethernet/intel/igc/igc_defines.h
+@@ -593,6 +593,7 @@
+ #define IGC_PTM_STAT_T4M1_OVFL BIT(3) /* T4 minus T1 overflow */
+ #define IGC_PTM_STAT_ADJUST_1ST BIT(4) /* 1588 timer adjusted during 1st PTM cycle */
+ #define IGC_PTM_STAT_ADJUST_CYC BIT(5) /* 1588 timer adjusted during non-1st PTM cycle */
++#define IGC_PTM_STAT_ALL GENMASK(5, 0) /* Used to clear all status */
+
+ /* PCIe PTM Cycle Control */
+ #define IGC_PTM_CYCLE_CTRL_CYC_TIME(msec) ((msec) & 0x3ff) /* PTM Cycle Time (msec) */
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index 946edbad43022..c640e346342be 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -974,13 +974,40 @@ static void igc_ptm_log_error(struct igc_adapter *adapter, u32 ptm_stat)
+ }
+ }
+
++static void igc_ptm_trigger(struct igc_hw *hw)
++{
++ u32 ctrl;
++
++ /* To "manually" start the PTM cycle we need to set the
++ * trigger (TRIG) bit
++ */
++ ctrl = rd32(IGC_PTM_CTRL);
++ ctrl |= IGC_PTM_CTRL_TRIG;
++ wr32(IGC_PTM_CTRL, ctrl);
++ /* Perform flush after write to CTRL register otherwise
++ * transaction may not start
++ */
++ wrfl();
++}
++
++static void igc_ptm_reset(struct igc_hw *hw)
++{
++ u32 ctrl;
++
++ ctrl = rd32(IGC_PTM_CTRL);
++ ctrl &= ~IGC_PTM_CTRL_TRIG;
++ wr32(IGC_PTM_CTRL, ctrl);
++ /* Write to clear all status */
++ wr32(IGC_PTM_STAT, IGC_PTM_STAT_ALL);
++}
++
+ static int igc_phc_get_syncdevicetime(ktime_t *device,
+ struct system_counterval_t *system,
+ void *ctx)
+ {
+- u32 stat, t2_curr_h, t2_curr_l, ctrl;
+ struct igc_adapter *adapter = ctx;
+ struct igc_hw *hw = &adapter->hw;
++ u32 stat, t2_curr_h, t2_curr_l;
+ int err, count = 100;
+ ktime_t t1, t2_curr;
+
+@@ -994,25 +1021,13 @@ static int igc_phc_get_syncdevicetime(ktime_t *device,
+ * are transitory. Repeating the process returns valid
+ * data eventually.
+ */
+-
+- /* To "manually" start the PTM cycle we need to clear and
+- * then set again the TRIG bit.
+- */
+- ctrl = rd32(IGC_PTM_CTRL);
+- ctrl &= ~IGC_PTM_CTRL_TRIG;
+- wr32(IGC_PTM_CTRL, ctrl);
+- ctrl |= IGC_PTM_CTRL_TRIG;
+- wr32(IGC_PTM_CTRL, ctrl);
+-
+- /* The cycle only starts "for real" when software notifies
+- * that it has read the registers, this is done by setting
+- * VALID bit.
+- */
+- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID);
++ igc_ptm_trigger(hw);
+
+ err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat,
+ stat, IGC_PTM_STAT_SLEEP,
+ IGC_PTM_STAT_TIMEOUT);
++ igc_ptm_reset(hw);
++
+ if (err < 0) {
+ netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n");
+ return err;
+@@ -1021,15 +1036,7 @@ static int igc_phc_get_syncdevicetime(ktime_t *device,
+ if ((stat & IGC_PTM_STAT_VALID) == IGC_PTM_STAT_VALID)
+ break;
+
+- if (stat & ~IGC_PTM_STAT_VALID) {
+- /* An error occurred, log it. */
+- igc_ptm_log_error(adapter, stat);
+- /* The STAT register is write-1-to-clear (W1C),
+- * so write the previous error status to clear it.
+- */
+- wr32(IGC_PTM_STAT, stat);
+- continue;
+- }
++ igc_ptm_log_error(adapter, stat);
+ } while (--count);
+
+ if (!count) {
+@@ -1255,7 +1262,7 @@ void igc_ptp_stop(struct igc_adapter *adapter)
+ void igc_ptp_reset(struct igc_adapter *adapter)
+ {
+ struct igc_hw *hw = &adapter->hw;
+- u32 cycle_ctrl, ctrl;
++ u32 cycle_ctrl, ctrl, stat;
+ unsigned long flags;
+ u32 timadj;
+
+@@ -1290,14 +1297,19 @@ void igc_ptp_reset(struct igc_adapter *adapter)
+ ctrl = IGC_PTM_CTRL_EN |
+ IGC_PTM_CTRL_START_NOW |
+ IGC_PTM_CTRL_SHRT_CYC(IGC_PTM_SHORT_CYC_DEFAULT) |
+- IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT) |
+- IGC_PTM_CTRL_TRIG;
++ IGC_PTM_CTRL_PTM_TO(IGC_PTM_TIMEOUT_DEFAULT);
+
+ wr32(IGC_PTM_CTRL, ctrl);
+
+ /* Force the first cycle to run. */
+- wr32(IGC_PTM_STAT, IGC_PTM_STAT_VALID);
++ igc_ptm_trigger(hw);
++
++ if (readx_poll_timeout_atomic(rd32, IGC_PTM_STAT, stat,
++ stat, IGC_PTM_STAT_SLEEP,
++ IGC_PTM_STAT_TIMEOUT))
++ netdev_err(adapter->netdev, "Timeout reading IGC_PTM_STAT register\n");
+
++ igc_ptm_reset(hw);
+ break;
+ default:
+ /* No work to do. */
+--
+2.39.5
+
--- /dev/null
+From eaf3a60c647a070a4c63c5923018e1d4337e27d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:32 -0700
+Subject: igc: handle the IGC_PTP_ENABLED flag correctly
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit 26a3910afd111f7c1a96dace6dc02f3225063896 ]
+
+All functions in igc_ptp.c called from igc_main.c should check the
+IGC_PTP_ENABLED flag. Adding check for this flag to stop and reset
+functions.
+
+Fixes: 5f2958052c58 ("igc: Add basic skeleton for PTP")
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index 516abe7405dee..343205bffc355 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -1244,8 +1244,12 @@ void igc_ptp_suspend(struct igc_adapter *adapter)
+ **/
+ void igc_ptp_stop(struct igc_adapter *adapter)
+ {
++ if (!(adapter->ptp_flags & IGC_PTP_ENABLED))
++ return;
++
+ igc_ptp_suspend(adapter);
+
++ adapter->ptp_flags &= ~IGC_PTP_ENABLED;
+ if (adapter->ptp_clock) {
+ ptp_clock_unregister(adapter->ptp_clock);
+ netdev_info(adapter->netdev, "PHC removed\n");
+@@ -1266,6 +1270,9 @@ void igc_ptp_reset(struct igc_adapter *adapter)
+ unsigned long flags;
+ u32 timadj;
+
++ if (!(adapter->ptp_flags & IGC_PTP_ENABLED))
++ return;
++
+ /* reset the tstamp_config */
+ igc_ptp_set_timestamp_mode(adapter, &adapter->tstamp_config);
+
+--
+2.39.5
+
--- /dev/null
+From 8e757dd3a5482c958db2fef036f5a1067b29edc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:30 -0700
+Subject: igc: increase wait time before retrying PTM
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit 714cd033da6fea4cf54a11b3cfd070afde3f31df ]
+
+The i225/i226 hardware retries if it receives an inappropriate response
+from the upstream device. If the device retries too quickly, the root
+port does not respond.
+
+The wait between attempts was reduced from 10us to 1us in commit
+6b8aa753a9f9 ("igc: Decrease PTM short interval from 10 us to 1 us"), which
+said:
+
+ With the 10us interval, we were seeing PTM transactions take around
+ 12us. Hardware team suggested this interval could be lowered to 1us
+ which was confirmed with PCIe sniffer. With the 1us interval, PTM
+ dialogs took around 2us.
+
+While a 1us short cycle time was thought to be theoretically sufficient, it
+turns out in practice it is not quite long enough. It is unclear if the
+problem is in the root port or an issue in i225/i226.
+
+Increase the wait from 1us to 4us. Increasing to 2us appeared to work in
+practice on the setups we have available. A value of 4us was chosen due to
+the limited hardware available for testing, with a goal of ensuring we wait
+long enough without overly penalizing the response time when unnecessary.
+
+The issue can be reproduced with the following:
+
+$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m
+
+Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to
+quickly reproduce the issue.
+
+PHC2SYS exits with:
+
+"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
+ fails
+
+Fixes: 6b8aa753a9f9 ("igc: Decrease PTM short interval from 10 us to 1 us")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_defines.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h
+index 2ff292f5f63be..d19325b0e6e0b 100644
+--- a/drivers/net/ethernet/intel/igc/igc_defines.h
++++ b/drivers/net/ethernet/intel/igc/igc_defines.h
+@@ -574,7 +574,10 @@
+ #define IGC_PTM_CTRL_SHRT_CYC(usec) (((usec) & 0x3f) << 2)
+ #define IGC_PTM_CTRL_PTM_TO(usec) (((usec) & 0xff) << 8)
+
+-#define IGC_PTM_SHORT_CYC_DEFAULT 1 /* Default short cycle interval */
++/* A short cycle time of 1us theoretically should work, but appears to be too
++ * short in practice.
++ */
++#define IGC_PTM_SHORT_CYC_DEFAULT 4 /* Default short cycle interval */
+ #define IGC_PTM_CYC_TIME_DEFAULT 5 /* Default PTM cycle time */
+ #define IGC_PTM_TIMEOUT_DEFAULT 255 /* Default timeout for PTM errors */
+
+--
+2.39.5
+
--- /dev/null
+From dc84825eebc83f124269817f32275f72cc2783b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 16:35:31 -0700
+Subject: igc: move ktime snapshot into PTM retry loop
+
+From: Christopher S M Hall <christopher.s.hall@intel.com>
+
+[ Upstream commit cd7f7328d691937102732f39f97ead35b15bf803 ]
+
+Move ktime_get_snapshot() into the loop. If a retry does occur, a more
+recent snapshot will result in a more accurate cross-timestamp.
+
+Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
+Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
+Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index c640e346342be..516abe7405dee 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -1011,16 +1011,16 @@ static int igc_phc_get_syncdevicetime(ktime_t *device,
+ int err, count = 100;
+ ktime_t t1, t2_curr;
+
+- /* Get a snapshot of system clocks to use as historic value. */
+- ktime_get_snapshot(&adapter->snapshot);
+-
++ /* Doing this in a loop because in the event of a
++ * badly timed (ha!) system clock adjustment, we may
++ * get PTM errors from the PCI root, but these errors
++ * are transitory. Repeating the process returns valid
++ * data eventually.
++ */
+ do {
+- /* Doing this in a loop because in the event of a
+- * badly timed (ha!) system clock adjustment, we may
+- * get PTM errors from the PCI root, but these errors
+- * are transitory. Repeating the process returns valid
+- * data eventually.
+- */
++ /* Get a snapshot of system clocks to use as historic value. */
++ ktime_get_snapshot(&adapter->snapshot);
++
+ igc_ptm_trigger(hw);
+
+ err = readx_poll_timeout(rd32, IGC_PTM_STAT, stat,
+--
+2.39.5
+
--- /dev/null
+From ef7c16c61f98a12386442b6b58beb02c0adfeb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 13:46:17 -0400
+Subject: ipv6: add exception routes to GC list in rt6_insert_exception
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit cfe82469a00f0c0983bf4652de3a2972637dfc56 ]
+
+Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list
+of routes.") introduced a separated list for managing route expiration via
+the GC timer.
+
+However, it missed adding exception routes (created by ip6_rt_update_pmtu()
+and rt6_do_redirect()) to this GC list. As a result, these exceptions were
+never considered for expiration and removal, leading to stale entries
+persisting in the routing table.
+
+This patch fixes the issue by calling fib6_add_gc_list() in
+rt6_insert_exception(), ensuring that exception routes are properly tracked
+and garbage collected when expired.
+
+Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.")
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/837e7506ffb63f47faa2b05d9b85481aad28e1a4.1744134377.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index bae8ece3e881e..d9ab070e78e05 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1771,6 +1771,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,
+ if (!err) {
+ spin_lock_bh(&f6i->fib6_table->tb6_lock);
+ fib6_update_sernum(net, f6i);
++ fib6_add_gc_list(f6i);
+ spin_unlock_bh(&f6i->fib6_table->tb6_lock);
+ fib6_force_start_gc(net);
+ }
+--
+2.39.5
+
--- /dev/null
+From 693dac3e28852d63340fe9ad88f5e53f9075ed67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Apr 2025 10:58:03 +0200
+Subject: kunit: qemu_configs: SH: Respect kunit cmdline
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit b26c1a85f3fc3cc749380ff94199377fc2d0c203 ]
+
+The default SH kunit configuration sets CONFIG_CMDLINE_OVERWRITE which
+completely disregards the cmdline passed from the bootloader/QEMU in favor
+of the builtin CONFIG_CMDLINE.
+However the kunit tool needs to pass arguments to the in-kernel kunit core,
+for filters and other runtime parameters.
+
+Enable CONFIG_CMDLINE_EXTEND instead, so kunit arguments are respected.
+
+Link: https://lore.kernel.org/r/20250407-kunit-sh-v1-1-f5432a54cf2f@linutronix.de
+Fixes: 8110a3cab05e ("kunit: tool: Add support for SH under QEMU")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/kunit/qemu_configs/sh.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/kunit/qemu_configs/sh.py b/tools/testing/kunit/qemu_configs/sh.py
+index 78a474a5b95f3..f00cb89fdef6a 100644
+--- a/tools/testing/kunit/qemu_configs/sh.py
++++ b/tools/testing/kunit/qemu_configs/sh.py
+@@ -7,7 +7,9 @@ CONFIG_CPU_SUBTYPE_SH7751R=y
+ CONFIG_MEMORY_START=0x0c000000
+ CONFIG_SH_RTS7751R2D=y
+ CONFIG_RTS7751R2D_PLUS=y
+-CONFIG_SERIAL_SH_SCI=y''',
++CONFIG_SERIAL_SH_SCI=y
++CONFIG_CMDLINE_EXTEND=y
++''',
+ qemu_arch='sh4',
+ kernel_path='arch/sh/boot/zImage',
+ kernel_command_line='console=ttySC1',
+--
+2.39.5
+
--- /dev/null
+From 47786f8fbac4ec5e2932d434dddfe396e83fc16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 11:01:59 +0800
+Subject: loop: aio inherit the ioprio of original request
+
+From: Yunlong Xing <yunlong.xing@unisoc.com>
+
+[ Upstream commit 1fdb8188c3d505452b40cdb365b1bb32be533a8e ]
+
+Set cmd->iocb.ki_ioprio to the ioprio of loop device's request.
+The purpose is to inherit the original request ioprio in the aio
+flow.
+
+Signed-off-by: Yunlong Xing <yunlong.xing@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250414030159.501180-1-yunlong.xing@unisoc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f2fed441c69b ("loop: stop using vfs_iter_{read,write} for buffered I/O")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 86cc3b19faae8..7e17d533227d2 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -462,7 +462,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+ cmd->iocb.ki_filp = file;
+ cmd->iocb.ki_complete = lo_rw_aio_complete;
+ cmd->iocb.ki_flags = IOCB_DIRECT;
+- cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0);
++ cmd->iocb.ki_ioprio = req_get_ioprio(rq);
+
+ if (rw == ITER_SOURCE)
+ ret = file->f_op->write_iter(&cmd->iocb, &iter);
+--
+2.39.5
+
--- /dev/null
+From 939555556d273bf0b36be65e80ee62291e3d3816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 15:09:40 +0200
+Subject: loop: stop using vfs_iter_{read,write} for buffered I/O
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit f2fed441c69b9237760840a45a004730ff324faf ]
+
+vfs_iter_{read,write} always perform direct I/O when the file has the
+O_DIRECT flag set, which breaks disabling direct I/O using the
+LOOP_SET_STATUS / LOOP_SET_STATUS64 ioctls.
+
+This was recenly reported as a regression, but as far as I can tell
+was only uncovered by better checking for block sizes and has been
+around since the direct I/O support was added.
+
+Fix this by using the existing aio code that calls the raw read/write
+iter methods instead. Note that despite the comments there is no need
+for block drivers to ever call flush_dcache_page themselves, and the
+call is a left-over from prehistoric times.
+
+Fixes: ab1cb278bc70 ("block: loop: introduce ioctl command of LOOP_SET_DIRECT_IO")
+Reported-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Tested-by: Darrick J. Wong <djwong@kernel.org>
+Link: https://lore.kernel.org/r/20250409130940.3685677-1-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 112 +++++++------------------------------------
+ 1 file changed, 17 insertions(+), 95 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 7e17d533227d2..0be518b9ed648 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -233,72 +233,6 @@ static void loop_set_size(struct loop_device *lo, loff_t size)
+ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE);
+ }
+
+-static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos)
+-{
+- struct iov_iter i;
+- ssize_t bw;
+-
+- iov_iter_bvec(&i, ITER_SOURCE, bvec, 1, bvec->bv_len);
+-
+- bw = vfs_iter_write(file, &i, ppos, 0);
+-
+- if (likely(bw == bvec->bv_len))
+- return 0;
+-
+- printk_ratelimited(KERN_ERR
+- "loop: Write error at byte offset %llu, length %i.\n",
+- (unsigned long long)*ppos, bvec->bv_len);
+- if (bw >= 0)
+- bw = -EIO;
+- return bw;
+-}
+-
+-static int lo_write_simple(struct loop_device *lo, struct request *rq,
+- loff_t pos)
+-{
+- struct bio_vec bvec;
+- struct req_iterator iter;
+- int ret = 0;
+-
+- rq_for_each_segment(bvec, rq, iter) {
+- ret = lo_write_bvec(lo->lo_backing_file, &bvec, &pos);
+- if (ret < 0)
+- break;
+- cond_resched();
+- }
+-
+- return ret;
+-}
+-
+-static int lo_read_simple(struct loop_device *lo, struct request *rq,
+- loff_t pos)
+-{
+- struct bio_vec bvec;
+- struct req_iterator iter;
+- struct iov_iter i;
+- ssize_t len;
+-
+- rq_for_each_segment(bvec, rq, iter) {
+- iov_iter_bvec(&i, ITER_DEST, &bvec, 1, bvec.bv_len);
+- len = vfs_iter_read(lo->lo_backing_file, &i, &pos, 0);
+- if (len < 0)
+- return len;
+-
+- flush_dcache_page(bvec.bv_page);
+-
+- if (len != bvec.bv_len) {
+- struct bio *bio;
+-
+- __rq_for_each_bio(bio, rq)
+- zero_fill_bio(bio);
+- break;
+- }
+- cond_resched();
+- }
+-
+- return 0;
+-}
+-
+ static void loop_clear_limits(struct loop_device *lo, int mode)
+ {
+ struct queue_limits lim = queue_limits_start_update(lo->lo_queue);
+@@ -357,7 +291,7 @@ static void lo_complete_rq(struct request *rq)
+ struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+ blk_status_t ret = BLK_STS_OK;
+
+- if (!cmd->use_aio || cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) ||
++ if (cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) ||
+ req_op(rq) != REQ_OP_READ) {
+ if (cmd->ret < 0)
+ ret = errno_to_blk_status(cmd->ret);
+@@ -373,14 +307,13 @@ static void lo_complete_rq(struct request *rq)
+ cmd->ret = 0;
+ blk_mq_requeue_request(rq, true);
+ } else {
+- if (cmd->use_aio) {
+- struct bio *bio = rq->bio;
++ struct bio *bio = rq->bio;
+
+- while (bio) {
+- zero_fill_bio(bio);
+- bio = bio->bi_next;
+- }
++ while (bio) {
++ zero_fill_bio(bio);
++ bio = bio->bi_next;
+ }
++
+ ret = BLK_STS_IOERR;
+ end_io:
+ blk_mq_end_request(rq, ret);
+@@ -460,9 +393,14 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+
+ cmd->iocb.ki_pos = pos;
+ cmd->iocb.ki_filp = file;
+- cmd->iocb.ki_complete = lo_rw_aio_complete;
+- cmd->iocb.ki_flags = IOCB_DIRECT;
+ cmd->iocb.ki_ioprio = req_get_ioprio(rq);
++ if (cmd->use_aio) {
++ cmd->iocb.ki_complete = lo_rw_aio_complete;
++ cmd->iocb.ki_flags = IOCB_DIRECT;
++ } else {
++ cmd->iocb.ki_complete = NULL;
++ cmd->iocb.ki_flags = 0;
++ }
+
+ if (rw == ITER_SOURCE)
+ ret = file->f_op->write_iter(&cmd->iocb, &iter);
+@@ -473,7 +411,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+
+ if (ret != -EIOCBQUEUED)
+ lo_rw_aio_complete(&cmd->iocb, ret);
+- return 0;
++ return -EIOCBQUEUED;
+ }
+
+ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+@@ -481,15 +419,6 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+ loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset;
+
+- /*
+- * lo_write_simple and lo_read_simple should have been covered
+- * by io submit style function like lo_rw_aio(), one blocker
+- * is that lo_read_simple() need to call flush_dcache_page after
+- * the page is written from kernel, and it isn't easy to handle
+- * this in io submit style function which submits all segments
+- * of the req at one time. And direct read IO doesn't need to
+- * run flush_dcache_page().
+- */
+ switch (req_op(rq)) {
+ case REQ_OP_FLUSH:
+ return lo_req_flush(lo, rq);
+@@ -505,15 +434,9 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ case REQ_OP_DISCARD:
+ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE);
+ case REQ_OP_WRITE:
+- if (cmd->use_aio)
+- return lo_rw_aio(lo, cmd, pos, ITER_SOURCE);
+- else
+- return lo_write_simple(lo, rq, pos);
++ return lo_rw_aio(lo, cmd, pos, ITER_SOURCE);
+ case REQ_OP_READ:
+- if (cmd->use_aio)
+- return lo_rw_aio(lo, cmd, pos, ITER_DEST);
+- else
+- return lo_read_simple(lo, rq, pos);
++ return lo_rw_aio(lo, cmd, pos, ITER_DEST);
+ default:
+ WARN_ON_ONCE(1);
+ return -EIO;
+@@ -1888,7 +1811,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
+ struct loop_device *lo = rq->q->queuedata;
+ int ret = 0;
+ struct mem_cgroup *old_memcg = NULL;
+- const bool use_aio = cmd->use_aio;
+
+ if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
+ ret = -EIO;
+@@ -1918,7 +1840,7 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
+ }
+ failed:
+ /* complete non-aio request */
+- if (!use_aio || ret) {
++ if (ret != -EIOCBQUEUED) {
+ if (ret == -EOPNOTSUPP)
+ cmd->ret = ret;
+ else
+--
+2.39.5
+
--- /dev/null
+From 681836093cf1823f1337217276f9d5488e9dd17c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 09:53:22 +0800
+Subject: md/md-bitmap: fix stats collection for external bitmaps
+
+From: Zheng Qixing <zhengqixing@huawei.com>
+
+[ Upstream commit 6ec1f0239485028445d213d91cfee5242f3211ba ]
+
+The bitmap_get_stats() function incorrectly returns -ENOENT for external
+bitmaps.
+
+Remove the external bitmap check as the statistics should be available
+regardless of bitmap storage location.
+
+Return -EINVAL only for invalid bitmap with no storage (neither in
+superblock nor in external file).
+
+Note: "bitmap_info.external" here refers to a bitmap stored in a separate
+file (bitmap_file), not to external metadata.
+
+Fixes: 8d28d0ddb986 ("md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime")
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Link: https://lore.kernel.org/linux-raid/20250403015322.2873369-1-zhengqixing@huaweicloud.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-bitmap.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 2e3087556adb3..fbb4f57010da6 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -2355,9 +2355,8 @@ static int bitmap_get_stats(void *data, struct md_bitmap_stats *stats)
+
+ if (!bitmap)
+ return -ENOENT;
+- if (bitmap->mddev->bitmap_info.external)
+- return -ENOENT;
+- if (!bitmap->storage.sb_page) /* no superblock */
++ if (!bitmap->mddev->bitmap_info.external &&
++ !bitmap->storage.sb_page)
+ return -EINVAL;
+ sb = kmap_local_page(bitmap->storage.sb_page);
+ stats->sync_size = le64_to_cpu(sb->sync_size);
+--
+2.39.5
+
--- /dev/null
+From 78d048e2d099768794144ff5e20581ed50043106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 09:57:46 +0800
+Subject: md/raid10: fix missing discard IO accounting
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit d05af90d6218e9c8f1c2026990c3f53c1b41bfb0 ]
+
+md_account_bio() is not called from raid10_handle_discard(), now that we
+handle bitmap inside md_account_bio(), also fix missing
+bitmap_startwrite for discard.
+
+Test whole disk discard for 20G raid10:
+
+Before:
+Device d/s dMB/s drqm/s %drqm d_await dareq-sz
+md0 48.00 16.00 0.00 0.00 5.42 341.33
+
+After:
+Device d/s dMB/s drqm/s %drqm d_await dareq-sz
+md0 68.00 20462.00 0.00 0.00 2.65 308133.65
+
+Link: https://lore.kernel.org/linux-raid/20250325015746.3195035-1-yukuai1@huaweicloud.com
+Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Coly Li <colyli@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index a214fed4f1622..cc194f6ec18da 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1687,6 +1687,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
+ * The discard bio returns only first r10bio finishes
+ */
+ if (first_copy) {
++ md_account_bio(mddev, &bio);
+ r10_bio->master_bio = bio;
+ set_bit(R10BIO_Discard, &r10_bio->state);
+ first_copy = false;
+--
+2.39.5
+
--- /dev/null
+From 09241b696a56a7e6b5f4f43ff21f5538c7c65493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 22:04:34 +0200
+Subject: net: b53: enable BPDU reception for management port
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 36355ddfe8955f226a88a543ed354b9f6b84cd70 ]
+
+For STP to work, receiving BPDUs is essential, but the appropriate bit
+was never set. Without GC_RX_BPDU_EN, the switch chip will filter all
+BPDUs, even if an appropriate PVID VLAN was setup.
+
+Fixes: ff39c2d68679 ("net: dsa: b53: Add bridge support")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20250414200434.194422-1-jonas.gorski@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index c39cb119e760d..d4600ab0b70b3 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -737,6 +737,15 @@ static void b53_enable_mib(struct b53_device *dev)
+ b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
+ }
+
++static void b53_enable_stp(struct b53_device *dev)
++{
++ u8 gc;
++
++ b53_read8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, &gc);
++ gc |= GC_RX_BPDU_EN;
++ b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
++}
++
+ static u16 b53_default_pvid(struct b53_device *dev)
+ {
+ if (is5325(dev) || is5365(dev))
+@@ -876,6 +885,7 @@ static int b53_switch_reset(struct b53_device *dev)
+ }
+
+ b53_enable_mib(dev);
++ b53_enable_stp(dev);
+
+ return b53_flush_arl(dev, FAST_AGE_STATIC);
+ }
+--
+2.39.5
+
--- /dev/null
+From 839a25c7762cc5aa75444b654130b7bf8e85eb25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 22:00:20 +0200
+Subject: net: bridge: switchdev: do not notify new brentries as changed
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit eb25de13bd9cf025413a04f25e715d0e99847e30 ]
+
+When adding a bridge vlan that is pvid or untagged after the vlan has
+already been added to any other switchdev backed port, the vlan change
+will be propagated as changed, since the flags change.
+
+This causes the vlan to not be added to the hardware for DSA switches,
+since the DSA handler ignores any vlans for the CPU or DSA ports that
+are changed.
+
+E.g. the following order of operations would work:
+
+$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0
+$ ip link set lan1 master swbridge
+$ bridge vlan add dev swbridge vid 1 pvid untagged self
+$ bridge vlan add dev lan1 vid 1 pvid untagged
+
+but this order would break:
+
+$ ip link add swbridge type bridge vlan_filtering 1 vlan_default_pvid 0
+$ ip link set lan1 master swbridge
+$ bridge vlan add dev lan1 vid 1 pvid untagged
+$ bridge vlan add dev swbridge vid 1 pvid untagged self
+
+Additionally, the vlan on the bridge itself would become undeletable:
+
+$ bridge vlan
+port vlan-id
+lan1 1 PVID Egress Untagged
+swbridge 1 PVID Egress Untagged
+$ bridge vlan del dev swbridge vid 1 self
+$ bridge vlan
+port vlan-id
+lan1 1 PVID Egress Untagged
+swbridge 1 Egress Untagged
+
+since the vlan was never added to DSA's vlan list, so deleting it will
+cause an error, causing the bridge code to not remove it.
+
+Fix this by checking if flags changed only for vlans that are already
+brentry and pass changed as false for those that become brentries, as
+these are a new vlan (member) from the switchdev point of view.
+
+Since *changed is set to true for becomes_brentry = true regardless of
+would_change's value, this will not change any rtnetlink notification
+delivery, just the value passed on to switchdev in vlan->changed.
+
+Fixes: 8d23a54f5bee ("net: bridge: switchdev: differentiate new VLANs from changed ones")
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250414200020.192715-1-jonas.gorski@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 89f51ea4cabec..f2efb58d152bc 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -715,8 +715,8 @@ static int br_vlan_add_existing(struct net_bridge *br,
+ u16 flags, bool *changed,
+ struct netlink_ext_ack *extack)
+ {
+- bool would_change = __vlan_flags_would_change(vlan, flags);
+ bool becomes_brentry = false;
++ bool would_change = false;
+ int err;
+
+ if (!br_vlan_is_brentry(vlan)) {
+@@ -725,6 +725,8 @@ static int br_vlan_add_existing(struct net_bridge *br,
+ return -EINVAL;
+
+ becomes_brentry = true;
++ } else {
++ would_change = __vlan_flags_would_change(vlan, flags);
+ }
+
+ /* Master VLANs that aren't brentries weren't notified before,
+--
+2.39.5
+
--- /dev/null
+From 72b17be975ce349fe30ef23c3a5c20a952b30790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 00:30:20 +0300
+Subject: net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del()
+ fails
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 514eff7b0aa1c5eb645ddbb8676ef3e2d88a8b99 ]
+
+This is very similar to the problem and solution from commit
+232deb3f9567 ("net: dsa: avoid refcount warnings when
+->port_{fdb,mdb}_del returns error"), except for the
+dsa_port_do_tag_8021q_vlan_del() operation.
+
+Fixes: c64b9c05045a ("net: dsa: tag_8021q: add proper cross-chip notifier support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250414213020.2959021-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_8021q.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c
+index 3ee53e28ec2e9..53e03fd8071b4 100644
+--- a/net/dsa/tag_8021q.c
++++ b/net/dsa/tag_8021q.c
+@@ -197,7 +197,7 @@ static int dsa_port_do_tag_8021q_vlan_del(struct dsa_port *dp, u16 vid)
+
+ err = ds->ops->tag_8021q_vlan_del(ds, port, vid);
+ if (err) {
+- refcount_inc(&v->refcount);
++ refcount_set(&v->refcount, 1);
+ return err;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 6f003727202e6541d9f41ab47b6b749245ee0c9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 00:29:30 +0300
+Subject: net: dsa: clean up FDB, MDB, VLAN entries on unbind
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 7afb5fb42d4950f33af2732b8147c552659f79b7 ]
+
+As explained in many places such as commit b117e1e8a86d ("net: dsa:
+delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written given
+the assumption that higher layers have balanced additions/deletions.
+As such, it only makes sense to be extremely vocal when those
+assumptions are violated and the driver unbinds with entries still
+present.
+
+But Ido Schimmel points out a very simple situation where that is wrong:
+https://lore.kernel.org/netdev/ZDazSM5UsPPjQuKr@shredder/
+(also briefly discussed by me in the aforementioned commit).
+
+Basically, while the bridge bypass operations are not something that DSA
+explicitly documents, and for the majority of DSA drivers this API
+simply causes them to go to promiscuous mode, that isn't the case for
+all drivers. Some have the necessary requirements for bridge bypass
+operations to do something useful - see dsa_switch_supports_uc_filtering().
+
+Although in tools/testing/selftests/net/forwarding/local_termination.sh,
+we made an effort to popularize better mechanisms to manage address
+filters on DSA interfaces from user space - namely macvlan for unicast,
+and setsockopt(IP_ADD_MEMBERSHIP) - through mtools - for multicast, the
+fact is that 'bridge fdb add ... self static local' also exists as
+kernel UAPI, and might be useful to someone, even if only for a quick
+hack.
+
+It seems counter-productive to block that path by implementing shim
+.ndo_fdb_add and .ndo_fdb_del operations which just return -EOPNOTSUPP
+in order to prevent the ndo_dflt_fdb_add() and ndo_dflt_fdb_del() from
+running, although we could do that.
+
+Accepting that cleanup is necessary seems to be the only option.
+Especially since we appear to be coming back at this from a different
+angle as well. Russell King is noticing that the WARN_ON() triggers even
+for VLANs:
+https://lore.kernel.org/netdev/Z_li8Bj8bD4-BYKQ@shell.armlinux.org.uk/
+
+What happens in the bug report above is that dsa_port_do_vlan_del() fails,
+then the VLAN entry lingers on, and then we warn on unbind and leak it.
+
+This is not a straight revert of the blamed commit, but we now add an
+informational print to the kernel log (to still have a way to see
+that bugs exist), and some extra comments gathered from past years'
+experience, to justify the logic.
+
+Fixes: 0832cd9f1f02 ("net: dsa: warn if port lists aren't empty in dsa_port_teardown")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250414212930.2956310-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa.c | 38 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 35 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
+index 1664547deffd0..b20be568b9d3b 100644
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -1478,12 +1478,44 @@ static int dsa_switch_parse(struct dsa_switch *ds, struct dsa_chip_data *cd)
+
+ static void dsa_switch_release_ports(struct dsa_switch *ds)
+ {
++ struct dsa_mac_addr *a, *tmp;
+ struct dsa_port *dp, *next;
++ struct dsa_vlan *v, *n;
+
+ dsa_switch_for_each_port_safe(dp, next, ds) {
+- WARN_ON(!list_empty(&dp->fdbs));
+- WARN_ON(!list_empty(&dp->mdbs));
+- WARN_ON(!list_empty(&dp->vlans));
++ /* These are either entries that upper layers lost track of
++ * (probably due to bugs), or installed through interfaces
++ * where one does not necessarily have to remove them, like
++ * ndo_dflt_fdb_add().
++ */
++ list_for_each_entry_safe(a, tmp, &dp->fdbs, list) {
++ dev_info(ds->dev,
++ "Cleaning up unicast address %pM vid %u from port %d\n",
++ a->addr, a->vid, dp->index);
++ list_del(&a->list);
++ kfree(a);
++ }
++
++ list_for_each_entry_safe(a, tmp, &dp->mdbs, list) {
++ dev_info(ds->dev,
++ "Cleaning up multicast address %pM vid %u from port %d\n",
++ a->addr, a->vid, dp->index);
++ list_del(&a->list);
++ kfree(a);
++ }
++
++ /* These are entries that upper layers have lost track of,
++ * probably due to bugs, but also due to dsa_port_do_vlan_del()
++ * having failed and the VLAN entry still lingering on.
++ */
++ list_for_each_entry_safe(v, n, &dp->vlans, list) {
++ dev_info(ds->dev,
++ "Cleaning up vid %u from port %d\n",
++ v->vid, dp->index);
++ list_del(&v->list);
++ kfree(v);
++ }
++
+ list_del(&dp->list);
+ kfree(dp);
+ }
+--
+2.39.5
+
--- /dev/null
+From dd3fb04ee6bb3a5f8fb24a418f43e7da917df5ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 00:30:01 +0300
+Subject: net: dsa: free routing table on probe failure
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 8bf108d7161ffc6880ad13a0cc109de3cf631727 ]
+
+If complete = true in dsa_tree_setup(), it means that we are the last
+switch of the tree which is successfully probing, and we should be
+setting up all switches from our probe path.
+
+After "complete" becomes true, dsa_tree_setup_cpu_ports() or any
+subsequent function may fail. If that happens, the entire tree setup is
+in limbo: the first N-1 switches have successfully finished probing
+(doing nothing but having allocated persistent memory in the tree's
+dst->ports, and maybe dst->rtable), and switch N failed to probe, ending
+the tree setup process before anything is tangible from the user's PoV.
+
+If switch N fails to probe, its memory (ports) will be freed and removed
+from dst->ports. However, the dst->rtable elements pointing to its ports,
+as created by dsa_link_touch(), will remain there, and will lead to
+use-after-free if dereferenced.
+
+If dsa_tree_setup_switches() returns -EPROBE_DEFER, which is entirely
+possible because that is where ds->ops->setup() is, we get a kasan
+report like this:
+
+==================================================================
+BUG: KASAN: slab-use-after-free in mv88e6xxx_setup_upstream_port+0x240/0x568
+Read of size 8 at addr ffff000004f56020 by task kworker/u8:3/42
+
+Call trace:
+ __asan_report_load8_noabort+0x20/0x30
+ mv88e6xxx_setup_upstream_port+0x240/0x568
+ mv88e6xxx_setup+0xebc/0x1eb0
+ dsa_register_switch+0x1af4/0x2ae0
+ mv88e6xxx_register_switch+0x1b8/0x2a8
+ mv88e6xxx_probe+0xc4c/0xf60
+ mdio_probe+0x78/0xb8
+ really_probe+0x2b8/0x5a8
+ __driver_probe_device+0x164/0x298
+ driver_probe_device+0x78/0x258
+ __device_attach_driver+0x274/0x350
+
+Allocated by task 42:
+ __kasan_kmalloc+0x84/0xa0
+ __kmalloc_cache_noprof+0x298/0x490
+ dsa_switch_touch_ports+0x174/0x3d8
+ dsa_register_switch+0x800/0x2ae0
+ mv88e6xxx_register_switch+0x1b8/0x2a8
+ mv88e6xxx_probe+0xc4c/0xf60
+ mdio_probe+0x78/0xb8
+ really_probe+0x2b8/0x5a8
+ __driver_probe_device+0x164/0x298
+ driver_probe_device+0x78/0x258
+ __device_attach_driver+0x274/0x350
+
+Freed by task 42:
+ __kasan_slab_free+0x48/0x68
+ kfree+0x138/0x418
+ dsa_register_switch+0x2694/0x2ae0
+ mv88e6xxx_register_switch+0x1b8/0x2a8
+ mv88e6xxx_probe+0xc4c/0xf60
+ mdio_probe+0x78/0xb8
+ really_probe+0x2b8/0x5a8
+ __driver_probe_device+0x164/0x298
+ driver_probe_device+0x78/0x258
+ __device_attach_driver+0x274/0x350
+
+The simplest way to fix the bug is to delete the routing table in its
+entirety. dsa_tree_setup_routing_table() has no problem in regenerating
+it even if we deleted links between ports other than those of switch N,
+because dsa_link_touch() first checks whether the port pair already
+exists in dst->rtable, allocating if not.
+
+The deletion of the routing table in its entirety already exists in
+dsa_tree_teardown(), so refactor that into a function that can also be
+called from the tree setup error path.
+
+In my analysis of the commit to blame, it is the one which added
+dsa_link elements to dst->rtable. Prior to that, each switch had its own
+ds->rtable which is freed when the switch fails to probe. But the tree
+is potentially persistent memory.
+
+Fixes: c5f51765a1f6 ("net: dsa: list DSA links in the fabric")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250414213001.2957964-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
+index b20be568b9d3b..ac3a252969cb6 100644
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -862,6 +862,16 @@ static void dsa_tree_teardown_lags(struct dsa_switch_tree *dst)
+ kfree(dst->lags);
+ }
+
++static void dsa_tree_teardown_routing_table(struct dsa_switch_tree *dst)
++{
++ struct dsa_link *dl, *next;
++
++ list_for_each_entry_safe(dl, next, &dst->rtable, list) {
++ list_del(&dl->list);
++ kfree(dl);
++ }
++}
++
+ static int dsa_tree_setup(struct dsa_switch_tree *dst)
+ {
+ bool complete;
+@@ -879,7 +889,7 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst)
+
+ err = dsa_tree_setup_cpu_ports(dst);
+ if (err)
+- return err;
++ goto teardown_rtable;
+
+ err = dsa_tree_setup_switches(dst);
+ if (err)
+@@ -911,14 +921,14 @@ static int dsa_tree_setup(struct dsa_switch_tree *dst)
+ dsa_tree_teardown_switches(dst);
+ teardown_cpu_ports:
+ dsa_tree_teardown_cpu_ports(dst);
++teardown_rtable:
++ dsa_tree_teardown_routing_table(dst);
+
+ return err;
+ }
+
+ static void dsa_tree_teardown(struct dsa_switch_tree *dst)
+ {
+- struct dsa_link *dl, *next;
+-
+ if (!dst->setup)
+ return;
+
+@@ -932,10 +942,7 @@ static void dsa_tree_teardown(struct dsa_switch_tree *dst)
+
+ dsa_tree_teardown_cpu_ports(dst);
+
+- list_for_each_entry_safe(dl, next, &dst->rtable, list) {
+- list_del(&dl->list);
+- kfree(dl);
+- }
++ dsa_tree_teardown_routing_table(dst);
+
+ pr_info("DSA: tree %d torn down\n", dst->index);
+
+--
+2.39.5
+
--- /dev/null
+From ae6e39d034c3d1173afb9db8e7e73849626096b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 00:28:50 +0300
+Subject: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were
+ never registered
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c84f6ce918a9e6f4996597cbc62536bbf2247c96 ]
+
+Russell King reports that a system with mv88e6xxx dereferences a NULL
+pointer when unbinding this driver:
+https://lore.kernel.org/netdev/Z_lRkMlTJ1KQ0kVX@shell.armlinux.org.uk/
+
+The crash seems to be in devlink_region_destroy(), which is not NULL
+tolerant but is given a NULL devlink global region pointer.
+
+At least on some chips, some devlink regions are conditionally registered
+since the blamed commit, see mv88e6xxx_setup_devlink_regions_global():
+
+ if (cond && !cond(chip))
+ continue;
+
+These are MV88E6XXX_REGION_STU and MV88E6XXX_REGION_PVT. If the chip
+does not have an STU or PVT, it should crash like this.
+
+To fix the issue, avoid unregistering those regions which are NULL, i.e.
+were skipped at mv88e6xxx_setup_devlink_regions_global() time.
+
+Fixes: 836021a2d0e0 ("net: dsa: mv88e6xxx: Export cross-chip PVT as devlink region")
+Tested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250414212850.2953957-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/devlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/devlink.c b/drivers/net/dsa/mv88e6xxx/devlink.c
+index a08dab75e0c0c..f57fde02077d2 100644
+--- a/drivers/net/dsa/mv88e6xxx/devlink.c
++++ b/drivers/net/dsa/mv88e6xxx/devlink.c
+@@ -743,7 +743,8 @@ void mv88e6xxx_teardown_devlink_regions_global(struct dsa_switch *ds)
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(mv88e6xxx_regions); i++)
+- dsa_devlink_region_destroy(chip->regions[i]);
++ if (chip->regions[i])
++ dsa_devlink_region_destroy(chip->regions[i]);
+ }
+
+ void mv88e6xxx_teardown_devlink_regions_port(struct dsa_switch *ds, int port)
+--
+2.39.5
+
--- /dev/null
+From 4aaa7c0be06249c62351537dd8d5aaf0c7633efd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 00:29:13 +0300
+Subject: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is
+ unsupported
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit ea08dfc35f83cfc73493c52f63ae4f2e29edfe8d ]
+
+Russell King reports that on the ZII dev rev B, deleting a bridge VLAN
+from a user port fails with -ENOENT:
+https://lore.kernel.org/netdev/Z_lQXNP0s5-IiJzd@shell.armlinux.org.uk/
+
+This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(),
+which tries to find an MST entry in &chip->msts associated with the SID,
+but fails and returns -ENOENT as such.
+
+But we know that this chip does not support MST at all, so that is not
+surprising. The question is why does the guard in mv88e6xxx_mst_put()
+not exit early:
+
+ if (!sid)
+ return 0;
+
+And the answer seems to be simple: the sid comes from vlan.sid which
+supposedly was previously populated by mv88e6xxx_vtu_get().
+But some chip->info->ops->vtu_getnext() implementations do not populate
+vlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case,
+later in mv88e6xxx_port_vlan_leave() we are using a garbage sid which is
+just residual stack memory.
+
+Testing for sid == 0 covers all cases of a non-bridge VLAN or a bridge
+VLAN mapped to the default MSTI. For some chips, SID 0 is valid and
+installed by mv88e6xxx_stu_setup(). A chip which does not support the
+STU would implicitly only support mapping all VLANs to the default MSTI,
+so although SID 0 is not valid, it would be sufficient, if we were to
+zero-initialize the vlan structure, to fix the bug, due to the
+coincidence that a test for vlan.sid == 0 already exists and leads to
+the same (correct) behavior.
+
+Another option which would be sufficient would be to add a test for
+mv88e6xxx_has_stu() inside mv88e6xxx_mst_put(), symmetric to the one
+which already exists in mv88e6xxx_mst_get(). But that placement means
+the caller will have to dereference vlan.sid, which means it will access
+uninitialized memory, which is not nice even if it ignores it later.
+
+So we end up making both modifications, in order to not rely just on the
+sid == 0 coincidence, but also to avoid having uninitialized structure
+fields which might get temporarily accessed.
+
+Fixes: acaf4d2e36b3 ("net: dsa: mv88e6xxx: MST Offloading")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250414212913.2955253-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index e20d9d62032e3..df1df60154121 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -1878,6 +1878,8 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid,
+ if (!chip->info->ops->vtu_getnext)
+ return -EOPNOTSUPP;
+
++ memset(entry, 0, sizeof(*entry));
++
+ entry->vid = vid ? vid - 1 : mv88e6xxx_max_vid(chip);
+ entry->valid = false;
+
+@@ -2013,7 +2015,16 @@ static int mv88e6xxx_mst_put(struct mv88e6xxx_chip *chip, u8 sid)
+ struct mv88e6xxx_mst *mst, *tmp;
+ int err;
+
+- if (!sid)
++ /* If the SID is zero, it is for a VLAN mapped to the default MSTI,
++ * and mv88e6xxx_stu_setup() made sure it is always present, and thus,
++ * should not be removed here.
++ *
++ * If the chip lacks STU support, numerically the "sid" variable will
++ * happen to also be zero, but we don't want to rely on that fact, so
++ * we explicitly test that first. In that case, there is also nothing
++ * to do here.
++ */
++ if (!mv88e6xxx_has_stu(chip) || !sid)
+ return 0;
+
+ list_for_each_entry_safe(mst, tmp, &chip->msts, node) {
+--
+2.39.5
+
--- /dev/null
+From 41b8c0cbc164107c5b9c8468defaeccd548a7cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 01:51:07 +0100
+Subject: net: ethernet: mtk_eth_soc: correct the max weight of the queue limit
+ for 100Mbps
+
+From: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+
+[ Upstream commit 6b02eb372c6776c9abb8bc81cf63f96039c24664 ]
+
+Without this patch, the maximum weight of the queue limit will be
+incorrect when linked at 100Mbps due to an apparent typo.
+
+Fixes: f63959c7eec31 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues")
+Signed-off-by: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/74111ba0bdb13743313999ed467ce564e8189006.1744764277.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 82af9bddc12fb..941c7c380870b 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -734,7 +734,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+ case SPEED_100:
+ val |= MTK_QTX_SCH_MAX_RATE_EN |
+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 103) |
+- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3);
++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 3) |
+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
+ break;
+ case SPEED_1000:
+@@ -757,7 +757,7 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+ case SPEED_100:
+ val |= MTK_QTX_SCH_MAX_RATE_EN |
+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
+- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5);
++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) |
+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 1);
+ break;
+ case SPEED_1000:
+--
+2.39.5
+
--- /dev/null
+From d388b48dce86a2363cc3211bc5d5435ae6906e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 01:50:46 +0100
+Subject: net: ethernet: mtk_eth_soc: reapply mdc divider on reset
+
+From: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+
+[ Upstream commit 6bc2b6c6f16d8e60de518d26da1bc6bc436cf71d ]
+
+In the current method, the MDC divider was reset to the default setting
+of 2.5MHz after the NETSYS SER. Therefore, we need to reapply the MDC
+divider configuration function in mtk_hw_init() after reset.
+
+Fixes: c0a440031d431 ("net: ethernet: mtk_eth_soc: set MDIO bus clock frequency")
+Signed-off-by: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/8ab7381447e6cdcb317d5b5a6ddd90a1734efcb0.1744764277.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 39 +++++++++++++--------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 +
+ 2 files changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index ed7313c10a052..82af9bddc12fb 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -823,9 +823,25 @@ static const struct phylink_mac_ops mtk_phylink_ops = {
+ .mac_link_up = mtk_mac_link_up,
+ };
+
++static void mtk_mdio_config(struct mtk_eth *eth)
++{
++ u32 val;
++
++ /* Configure MDC Divider */
++ val = FIELD_PREP(PPSC_MDC_CFG, eth->mdc_divider);
++
++ /* Configure MDC Turbo Mode */
++ if (mtk_is_netsys_v3_or_greater(eth))
++ mtk_m32(eth, 0, MISC_MDC_TURBO, MTK_MAC_MISC_V3);
++ else
++ val |= PPSC_MDC_TURBO;
++
++ mtk_m32(eth, PPSC_MDC_CFG, val, MTK_PPSC);
++}
++
+ static int mtk_mdio_init(struct mtk_eth *eth)
+ {
+- unsigned int max_clk = 2500000, divider;
++ unsigned int max_clk = 2500000;
+ struct device_node *mii_np;
+ int ret;
+ u32 val;
+@@ -865,20 +881,9 @@ static int mtk_mdio_init(struct mtk_eth *eth)
+ }
+ max_clk = val;
+ }
+- divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
+-
+- /* Configure MDC Turbo Mode */
+- if (mtk_is_netsys_v3_or_greater(eth))
+- mtk_m32(eth, 0, MISC_MDC_TURBO, MTK_MAC_MISC_V3);
+-
+- /* Configure MDC Divider */
+- val = FIELD_PREP(PPSC_MDC_CFG, divider);
+- if (!mtk_is_netsys_v3_or_greater(eth))
+- val |= PPSC_MDC_TURBO;
+- mtk_m32(eth, PPSC_MDC_CFG, val, MTK_PPSC);
+-
+- dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / divider);
+-
++ eth->mdc_divider = min_t(unsigned int, DIV_ROUND_UP(MDC_MAX_FREQ, max_clk), 63);
++ mtk_mdio_config(eth);
++ dev_dbg(eth->dev, "MDC is running on %d Hz\n", MDC_MAX_FREQ / eth->mdc_divider);
+ ret = of_mdiobus_register(eth->mii_bus, mii_np);
+
+ err_put_node:
+@@ -3928,6 +3933,10 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ else
+ mtk_hw_reset(eth);
+
++ /* No MT7628/88 support yet */
++ if (reset && !MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
++ mtk_mdio_config(eth);
++
+ if (mtk_is_netsys_v3_or_greater(eth)) {
+ /* Set FE to PDMAv2 if necessary */
+ val = mtk_r32(eth, MTK_FE_GLO_MISC);
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+index 0d5225f1d3eef..8d7b6818d8601 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1260,6 +1260,7 @@ struct mtk_eth {
+ struct clk *clks[MTK_CLK_MAX];
+
+ struct mii_bus *mii_bus;
++ unsigned int mdc_divider;
+ struct work_struct pending_work;
+ unsigned long state;
+
+--
+2.39.5
+
--- /dev/null
+From 46b5c24ae4993583736034991f07de85e4a06ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 01:51:25 +0100
+Subject: net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
+
+From: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+
+[ Upstream commit 1b66124135f5f8640bd540fadda4b20cdd23114b ]
+
+The QDMA packet scheduler suffers from a performance issue.
+Fix this by picking up changes from MediaTek's SDK which change to use
+Token Bucket instead of Leaky Bucket and fix the SPEED_1000 configuration.
+
+Fixes: 160d3a9b1929 ("net: ethernet: mtk_eth_soc: introduce MTK_NETSYS_V2 support")
+Signed-off-by: Bo-Cun Chen <bc-bocun.chen@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/18040f60f9e2f5855036b75b28c4332a2d2ebdd8.1744764277.git.daniel@makrotopia.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 941c7c380870b..d408dcda76d79 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -762,8 +762,8 @@ static void mtk_set_queue_speed(struct mtk_eth *eth, unsigned int idx,
+ break;
+ case SPEED_1000:
+ val |= MTK_QTX_SCH_MAX_RATE_EN |
+- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 10) |
+- FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 5) |
++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_MAN, 1) |
++ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_EXP, 6) |
+ FIELD_PREP(MTK_QTX_SCH_MAX_RATE_WEIGHT, 10);
+ break;
+ default:
+@@ -3274,7 +3274,7 @@ static int mtk_start_dma(struct mtk_eth *eth)
+ if (mtk_is_netsys_v2_or_greater(eth))
+ val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
+ MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
+- MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
++ MTK_CHK_DDONE_EN;
+ else
+ val |= MTK_RX_BT_32DWORDS;
+ mtk_w32(eth, val, reg_map->qdma.glo_cfg);
+--
+2.39.5
+
--- /dev/null
+From 5a67b090472ba5dbf5831a61bb260e0c35d1cb10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 10:39:42 +0200
+Subject: net: ethernet: ti: am65-cpsw: fix port_np reference counting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit 903d2b9f9efc5b3339d74015fcfc0d9fff276c4c ]
+
+A reference to the device tree node is stored in a private struct, thus
+the reference count has to be incremented. Also, decrement the count on
+device removal and in the error path.
+
+Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250414083942.4015060-1-mwalle@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 308a2b72a65de..a21e7c0afbfdc 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2680,7 +2680,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)
+ of_property_read_bool(port_np, "ti,mac-only");
+
+ /* get phy/link info */
+- port->slave.port_np = port_np;
++ port->slave.port_np = of_node_get(port_np);
+ ret = of_get_phy_mode(port_np, &port->slave.phy_if);
+ if (ret) {
+ dev_err(dev, "%pOF read phy-mode err %d\n",
+@@ -2741,6 +2741,17 @@ static void am65_cpsw_nuss_phylink_cleanup(struct am65_cpsw_common *common)
+ }
+ }
+
++static void am65_cpsw_remove_dt(struct am65_cpsw_common *common)
++{
++ struct am65_cpsw_port *port;
++ int i;
++
++ for (i = 0; i < common->port_num; i++) {
++ port = &common->ports[i];
++ of_node_put(port->slave.port_np);
++ }
++}
++
+ static int
+ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)
+ {
+@@ -3647,6 +3658,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)
+ am65_cpsw_nuss_cleanup_ndev(common);
+ am65_cpsw_nuss_phylink_cleanup(common);
+ am65_cpts_release(common->cpts);
++ am65_cpsw_remove_dt(common);
+ err_of_clear:
+ if (common->mdio_dev)
+ of_platform_device_destroy(common->mdio_dev, NULL);
+@@ -3686,6 +3698,7 @@ static void am65_cpsw_nuss_remove(struct platform_device *pdev)
+ am65_cpsw_nuss_phylink_cleanup(common);
+ am65_cpts_release(common->cpts);
+ am65_cpsw_disable_serdes_phy(common);
++ am65_cpsw_remove_dt(common);
+
+ if (common->mdio_dev)
+ of_platform_device_destroy(common->mdio_dev, NULL);
+--
+2.39.5
+
--- /dev/null
+From 71d40edbcba37425c3190ef744e8eeb65ac187ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Apr 2025 11:53:19 +0800
+Subject: net: mctp: Set SOCK_RCU_FREE
+
+From: Matt Johnston <matt@codeconstruct.com.au>
+
+[ Upstream commit 52024cd6ec71a6ca934d0cc12452bd8d49850679 ]
+
+Bind lookup runs under RCU, so ensure that a socket doesn't go away in
+the middle of a lookup.
+
+Fixes: 833ef3b91de6 ("mctp: Populate socket implementation")
+Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
+Link: https://patch.msgid.link/20250410-mctp-rcu-sock-v1-1-872de9fdc877@codeconstruct.com.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mctp/af_mctp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
+index f6de136008f6f..57850d4dac5db 100644
+--- a/net/mctp/af_mctp.c
++++ b/net/mctp/af_mctp.c
+@@ -630,6 +630,9 @@ static int mctp_sk_hash(struct sock *sk)
+ {
+ struct net *net = sock_net(sk);
+
++ /* Bind lookup runs under RCU, remain live during that. */
++ sock_set_flag(sk, SOCK_RCU_FREE);
++
+ mutex_lock(&net->mctp.bind_lock);
+ sk_add_node_rcu(sk, &net->mctp.binds);
+ mutex_unlock(&net->mctp.bind_lock);
+--
+2.39.5
+
--- /dev/null
+From 7b927b55759466a0272f1d079690ba8a1c2e0de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 21:19:24 +0530
+Subject: net: ngbe: fix memory leak in ngbe_probe() error path
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 88fa80021b77732bc98f73fb69d69c7cc37b9f0d ]
+
+When ngbe_sw_init() is called, memory is allocated for wx->rss_key
+in wx_init_rss_key(). However, in ngbe_probe() function, the subsequent
+error paths after ngbe_sw_init() don't free the rss_key. Fix that by
+freeing it in error path along with wx->mac_table.
+
+Also change the label to which execution jumps when ngbe_sw_init()
+fails, because otherwise, it could lead to a double free for rss_key,
+when the mac_table allocation fails in wx_sw_init().
+
+Fixes: 02338c484ab6 ("net: ngbe: Initialize sw info and register netdev")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Link: https://patch.msgid.link/20250412154927.25908-1-abdun.nihaal@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
+index 53aeae2f884b0..1be2a5cc4a83c 100644
+--- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
++++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
+@@ -607,7 +607,7 @@ static int ngbe_probe(struct pci_dev *pdev,
+ /* setup the private structure */
+ err = ngbe_sw_init(wx);
+ if (err)
+- goto err_free_mac_table;
++ goto err_pci_release_regions;
+
+ /* check if flash load is done after hw power up */
+ err = wx_check_flash_load(wx, NGBE_SPI_ILDR_STATUS_PERST);
+@@ -701,6 +701,7 @@ static int ngbe_probe(struct pci_dev *pdev,
+ err_clear_interrupt_scheme:
+ wx_clear_interrupt_scheme(wx);
+ err_free_mac_table:
++ kfree(wx->rss_key);
+ kfree(wx->mac_table);
+ err_pci_release_regions:
+ pci_release_selected_regions(pdev,
+--
+2.39.5
+
--- /dev/null
+From 86e1c2c04787a039464fcb5bccbb5e2a29a43c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 12:40:18 +0200
+Subject: net: openvswitch: fix nested key length validation in the set()
+ action
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit 65d91192aa66f05710cfddf6a14b5a25ee554dba ]
+
+It's not safe to access nla_len(ovs_key) if the data is smaller than
+the netlink header. Check that the attribute is OK first.
+
+Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
+Reported-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b07a9da40df1576b8048
+Tested-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
+Acked-by: Aaron Conole <aconole@redhat.com>
+Link: https://patch.msgid.link/20250412104052.2073688-1-i.maximets@ovn.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/flow_netlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 0df89240b7336..305daf57a4f9d 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2876,7 +2876,8 @@ static int validate_set(const struct nlattr *a,
+ size_t key_len;
+
+ /* There can be only one key in a action */
+- if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
++ if (!nla_ok(ovs_key, nla_len(a)) ||
++ nla_total_size(nla_len(ovs_key)) != nla_len(a))
+ return -EINVAL;
+
+ key_len = nla_len(ovs_key);
+--
+2.39.5
+
--- /dev/null
+From a1b77e04a7d4cea006cd96c2bd7c6f2179a0a06b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 16:27:53 +0530
+Subject: net: ti: icss-iep: Add phase offset configuration for perout signal
+
+From: Meghana Malladi <m-malladi@ti.com>
+
+[ Upstream commit 220cb1be647a7ca4e60241405c66f8f612c9b046 ]
+
+icss_iep_perout_enable_hw() is a common function for generating
+both pps and perout signals. When enabling pps, the application needs
+to only pass enable/disable argument, whereas for perout it supports
+different flags to configure the signal.
+
+In case the app passes a valid phase offset value, the signal should
+start toggling after that phase offset, else start immediately or
+as soon as possible. ICSS_IEP_SYNC_START_REG register take number of
+clock cycles to wait before starting the signal after activation time.
+Set appropriate value to this register to support phase offset.
+
+Signed-off-by: Meghana Malladi <m-malladi@ti.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20250304105753.1552159-3-m-malladi@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/icssg/icss_iep.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c
+index 2981c19c48b18..b4a34c57b7b48 100644
+--- a/drivers/net/ethernet/ti/icssg/icss_iep.c
++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c
+@@ -407,6 +407,7 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ struct ptp_perout_request *req, int on)
+ {
+ struct timespec64 ts;
++ u64 ns_start;
+ u64 ns_width;
+ int ret;
+ u64 cmp;
+@@ -416,6 +417,14 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ ts.tv_nsec = req->on.nsec;
+ ns_width = timespec64_to_ns(&ts);
+
++ if (req->flags & PTP_PEROUT_PHASE) {
++ ts.tv_sec = req->phase.sec;
++ ts.tv_nsec = req->phase.nsec;
++ ns_start = timespec64_to_ns(&ts);
++ } else {
++ ns_start = 0;
++ }
++
+ if (iep->ops && iep->ops->perout_enable) {
+ ret = iep->ops->perout_enable(iep->clockops_data, req, on, &cmp);
+ if (ret)
+@@ -430,7 +439,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
+ div_u64(ns_width, iep->def_inc));
+ regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0);
+- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, 0);
++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
++ div_u64(ns_start, iep->def_inc));
+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */
+ /* Enable CMP 1 */
+ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+@@ -457,6 +467,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+
+ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
+ div_u64(ns_width, iep->def_inc));
++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
++ div_u64(ns_start, iep->def_inc));
+ /* Enable Sync in single shot mode */
+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG,
+ IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN);
+@@ -487,7 +499,8 @@ static int icss_iep_perout_enable(struct icss_iep *iep,
+ int ret = 0;
+
+ /* Reject requests with unsupported flags */
+- if (req->flags & ~PTP_PEROUT_DUTY_CYCLE)
++ if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE |
++ PTP_PEROUT_PHASE))
+ return -EOPNOTSUPP;
+
+ mutex_lock(&iep->ptp_clk_mutex);
+@@ -588,6 +601,7 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on)
+ if (on) {
+ ns = icss_iep_gettime(iep, NULL);
+ ts = ns_to_timespec64(ns);
++ rq.perout.flags = 0;
+ rq.perout.period.sec = 1;
+ rq.perout.period.nsec = 0;
+ rq.perout.start.sec = ts.tv_sec + 2;
+--
+2.39.5
+
--- /dev/null
+From 7b3a8821d8471f7903ffb136322acbf4e15d191e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 16:27:52 +0530
+Subject: net: ti: icss-iep: Add pwidth configuration for perout signal
+
+From: Meghana Malladi <m-malladi@ti.com>
+
+[ Upstream commit e5b456a14215e3c0e84844c2926861b972e03632 ]
+
+icss_iep_perout_enable_hw() is a common function for generating
+both pps and perout signals. When enabling pps, the application needs
+to only pass enable/disable argument, whereas for perout it supports
+different flags to configure the signal.
+
+But icss_iep_perout_enable_hw() function is missing to hook the
+configuration params passed by the app, causing perout to behave
+same a pps (except being able to configure the period). As duty cycle
+is also one feature which can configured for perout, incorporate this
+in the function to get the expected signal.
+
+Signed-off-by: Meghana Malladi <m-malladi@ti.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20250304105753.1552159-2-m-malladi@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 7349c9e99793 ("net: ti: icss-iep: Fix possible NULL pointer dereference for perout request")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/icssg/icss_iep.c | 47 ++++++++++++++++++++++--
+ 1 file changed, 44 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c
+index d59c1744840af..2981c19c48b18 100644
+--- a/drivers/net/ethernet/ti/icssg/icss_iep.c
++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c
+@@ -406,9 +406,16 @@ static void icss_iep_update_to_next_boundary(struct icss_iep *iep, u64 start_ns)
+ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ struct ptp_perout_request *req, int on)
+ {
++ struct timespec64 ts;
++ u64 ns_width;
+ int ret;
+ u64 cmp;
+
++ /* Calculate width of the signal for PPS/PEROUT handling */
++ ts.tv_sec = req->on.sec;
++ ts.tv_nsec = req->on.nsec;
++ ns_width = timespec64_to_ns(&ts);
++
+ if (iep->ops && iep->ops->perout_enable) {
+ ret = iep->ops->perout_enable(iep->clockops_data, req, on, &cmp);
+ if (ret)
+@@ -419,8 +426,9 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp));
+ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
+ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp));
+- /* Configure SYNC, 1ms pulse width */
+- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG, 1000000);
++ /* Configure SYNC, based on req on width */
++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
++ div_u64(ns_width, iep->def_inc));
+ regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0);
+ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG, 0);
+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */
+@@ -447,6 +455,8 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ + req->period.nsec;
+ icss_iep_update_to_next_boundary(iep, start_ns);
+
++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
++ div_u64(ns_width, iep->def_inc));
+ /* Enable Sync in single shot mode */
+ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG,
+ IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN);
+@@ -474,7 +484,36 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ static int icss_iep_perout_enable(struct icss_iep *iep,
+ struct ptp_perout_request *req, int on)
+ {
+- return -EOPNOTSUPP;
++ int ret = 0;
++
++ /* Reject requests with unsupported flags */
++ if (req->flags & ~PTP_PEROUT_DUTY_CYCLE)
++ return -EOPNOTSUPP;
++
++ mutex_lock(&iep->ptp_clk_mutex);
++
++ if (iep->pps_enabled) {
++ ret = -EBUSY;
++ goto exit;
++ }
++
++ if (iep->perout_enabled == !!on)
++ goto exit;
++
++ /* Set default "on" time (1ms) for the signal if not passed by the app */
++ if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) {
++ req->on.sec = 0;
++ req->on.nsec = NSEC_PER_MSEC;
++ }
++
++ ret = icss_iep_perout_enable_hw(iep, req, on);
++ if (!ret)
++ iep->perout_enabled = !!on;
++
++exit:
++ mutex_unlock(&iep->ptp_clk_mutex);
++
++ return ret;
+ }
+
+ static void icss_iep_cap_cmp_work(struct work_struct *work)
+@@ -553,6 +592,8 @@ static int icss_iep_pps_enable(struct icss_iep *iep, int on)
+ rq.perout.period.nsec = 0;
+ rq.perout.start.sec = ts.tv_sec + 2;
+ rq.perout.start.nsec = 0;
++ rq.perout.on.sec = 0;
++ rq.perout.on.nsec = NSEC_PER_MSEC;
+ ret = icss_iep_perout_enable_hw(iep, &rq.perout, on);
+ } else {
+ ret = icss_iep_perout_enable_hw(iep, &rq.perout, on);
+--
+2.39.5
+
--- /dev/null
+From e55866ac12db8dfbae4b474bf8ec8ba791995059 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 14:35:43 +0530
+Subject: net: ti: icss-iep: Fix possible NULL pointer dereference for perout
+ request
+
+From: Meghana Malladi <m-malladi@ti.com>
+
+[ Upstream commit 7349c9e9979333abfce42da5f9025598083b59c9 ]
+
+The ICSS IEP driver tracks perout and pps enable state with flags.
+Currently when disabling pps and perout signals during icss_iep_exit(),
+results in NULL pointer dereference for perout.
+
+To fix the null pointer dereference issue, the icss_iep_perout_enable_hw
+function can be modified to directly clear the IEP CMP registers when
+disabling PPS or PEROUT, without referencing the ptp_perout_request
+structure, as its contents are irrelevant in this case.
+
+Fixes: 9b115361248d ("net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/7b1c7c36-363a-4085-b26c-4f210bee1df6@stanley.mountain/
+Signed-off-by: Meghana Malladi <m-malladi@ti.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250415090543.717991-4-m-malladi@ti.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/icssg/icss_iep.c | 121 +++++++++++------------
+ 1 file changed, 58 insertions(+), 63 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c
+index b4a34c57b7b48..2a1c43316f462 100644
+--- a/drivers/net/ethernet/ti/icssg/icss_iep.c
++++ b/drivers/net/ethernet/ti/icssg/icss_iep.c
+@@ -412,6 +412,22 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ int ret;
+ u64 cmp;
+
++ if (!on) {
++ /* Disable CMP 1 */
++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
++ IEP_CMP_CFG_CMP_EN(1), 0);
++
++ /* clear CMP regs */
++ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0);
++ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
++ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0);
++
++ /* Disable sync */
++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0);
++
++ return 0;
++ }
++
+ /* Calculate width of the signal for PPS/PEROUT handling */
+ ts.tv_sec = req->on.sec;
+ ts.tv_nsec = req->on.nsec;
+@@ -430,64 +446,39 @@ static int icss_iep_perout_enable_hw(struct icss_iep *iep,
+ if (ret)
+ return ret;
+
+- if (on) {
+- /* Configure CMP */
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp));
+- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp));
+- /* Configure SYNC, based on req on width */
+- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
+- div_u64(ns_width, iep->def_inc));
+- regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0);
+- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
+- div_u64(ns_start, iep->def_inc));
+- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */
+- /* Enable CMP 1 */
+- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1));
+- } else {
+- /* Disable CMP 1 */
+- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+- IEP_CMP_CFG_CMP_EN(1), 0);
+-
+- /* clear regs */
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0);
+- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0);
+- }
++ /* Configure CMP */
++ regmap_write(iep->map, ICSS_IEP_CMP1_REG0, lower_32_bits(cmp));
++ if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
++ regmap_write(iep->map, ICSS_IEP_CMP1_REG1, upper_32_bits(cmp));
++ /* Configure SYNC, based on req on width */
++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
++ div_u64(ns_width, iep->def_inc));
++ regmap_write(iep->map, ICSS_IEP_SYNC0_PERIOD_REG, 0);
++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
++ div_u64(ns_start, iep->def_inc));
++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0); /* one-shot mode */
++ /* Enable CMP 1 */
++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
++ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1));
+ } else {
+- if (on) {
+- u64 start_ns;
+-
+- iep->period = ((u64)req->period.sec * NSEC_PER_SEC) +
+- req->period.nsec;
+- start_ns = ((u64)req->period.sec * NSEC_PER_SEC)
+- + req->period.nsec;
+- icss_iep_update_to_next_boundary(iep, start_ns);
+-
+- regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
+- div_u64(ns_width, iep->def_inc));
+- regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
+- div_u64(ns_start, iep->def_inc));
+- /* Enable Sync in single shot mode */
+- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG,
+- IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN);
+- /* Enable CMP 1 */
+- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+- IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1));
+- } else {
+- /* Disable CMP 1 */
+- regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
+- IEP_CMP_CFG_CMP_EN(1), 0);
+-
+- /* clear CMP regs */
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG0, 0);
+- if (iep->plat_data->flags & ICSS_IEP_64BIT_COUNTER_SUPPORT)
+- regmap_write(iep->map, ICSS_IEP_CMP1_REG1, 0);
+-
+- /* Disable sync */
+- regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG, 0);
+- }
++ u64 start_ns;
++
++ iep->period = ((u64)req->period.sec * NSEC_PER_SEC) +
++ req->period.nsec;
++ start_ns = ((u64)req->period.sec * NSEC_PER_SEC)
++ + req->period.nsec;
++ icss_iep_update_to_next_boundary(iep, start_ns);
++
++ regmap_write(iep->map, ICSS_IEP_SYNC_PWIDTH_REG,
++ div_u64(ns_width, iep->def_inc));
++ regmap_write(iep->map, ICSS_IEP_SYNC_START_REG,
++ div_u64(ns_start, iep->def_inc));
++ /* Enable Sync in single shot mode */
++ regmap_write(iep->map, ICSS_IEP_SYNC_CTRL_REG,
++ IEP_SYNC_CTRL_SYNC_N_EN(0) | IEP_SYNC_CTRL_SYNC_EN);
++ /* Enable CMP 1 */
++ regmap_update_bits(iep->map, ICSS_IEP_CMP_CFG_REG,
++ IEP_CMP_CFG_CMP_EN(1), IEP_CMP_CFG_CMP_EN(1));
+ }
+
+ return 0;
+@@ -498,11 +489,21 @@ static int icss_iep_perout_enable(struct icss_iep *iep,
+ {
+ int ret = 0;
+
++ if (!on)
++ goto disable;
++
+ /* Reject requests with unsupported flags */
+ if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE |
+ PTP_PEROUT_PHASE))
+ return -EOPNOTSUPP;
+
++ /* Set default "on" time (1ms) for the signal if not passed by the app */
++ if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) {
++ req->on.sec = 0;
++ req->on.nsec = NSEC_PER_MSEC;
++ }
++
++disable:
+ mutex_lock(&iep->ptp_clk_mutex);
+
+ if (iep->pps_enabled) {
+@@ -513,12 +514,6 @@ static int icss_iep_perout_enable(struct icss_iep *iep,
+ if (iep->perout_enabled == !!on)
+ goto exit;
+
+- /* Set default "on" time (1ms) for the signal if not passed by the app */
+- if (!(req->flags & PTP_PEROUT_DUTY_CYCLE)) {
+- req->on.sec = 0;
+- req->on.nsec = NSEC_PER_MSEC;
+- }
+-
+ ret = icss_iep_perout_enable_hw(iep, req, on);
+ if (!ret)
+ iep->perout_enabled = !!on;
+--
+2.39.5
+
--- /dev/null
+From 61c62170987a26e2268b754d64b9f92bc1f00d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 08:59:09 +0530
+Subject: net: txgbe: fix memory leak in txgbe_probe() error path
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit b2727326d0a53709380aa147018085d71a6d4843 ]
+
+When txgbe_sw_init() is called, memory is allocated for wx->rss_key
+in wx_init_rss_key(). However, in txgbe_probe() function, the subsequent
+error paths after txgbe_sw_init() don't free the rss_key. Fix that by
+freeing it in error path along with wx->mac_table.
+
+Also change the label to which execution jumps when txgbe_sw_init()
+fails, because otherwise, it could lead to a double free for rss_key,
+when the mac_table allocation fails in wx_sw_init().
+
+Fixes: 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number")
+Reported-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250415032910.13139-1-abdun.nihaal@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
+index f774502680364..7e352837184fa 100644
+--- a/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
++++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_main.c
+@@ -559,7 +559,7 @@ static int txgbe_probe(struct pci_dev *pdev,
+ /* setup the private structure */
+ err = txgbe_sw_init(wx);
+ if (err)
+- goto err_free_mac_table;
++ goto err_pci_release_regions;
+
+ /* check if flash load is done after hw power up */
+ err = wx_check_flash_load(wx, TXGBE_SPI_ILDR_STATUS_PERST);
+@@ -717,6 +717,7 @@ static int txgbe_probe(struct pci_dev *pdev,
+ wx_clear_interrupt_scheme(wx);
+ wx_control_hw(wx, false);
+ err_free_mac_table:
++ kfree(wx->rss_key);
+ kfree(wx->mac_table);
+ err_pci_release_regions:
+ pci_release_selected_regions(pdev,
+--
+2.39.5
+
--- /dev/null
+From 535a8bbee60e565c1f91d77289d970e3d3673096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 07:55:41 -0700
+Subject: netlink: specs: ovs_vport: align with C codegen capabilities
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 747fb8413aaa36e4c988d45c4fe20d4c2b0778cd ]
+
+We started generating C code for OvS a while back, but actually
+C codegen only supports fixed headers specified at the family
+level right now (schema also allows specifying them per op).
+ovs_flow and ovs_datapath already specify the fixed header
+at the family level but ovs_vport does it per op.
+Move the property, all ops use the same header.
+
+This ensures YNL C sees the correct hdr_len:
+
+ const struct ynl_family ynl_ovs_vport_family = {
+ .name = "ovs_vport",
+ - .hdr_len = sizeof(struct genlmsghdr),
+ + .hdr_len = sizeof(struct genlmsghdr) + sizeof(struct ovs_header),
+ };
+
+Fixes: 7c59c9c8f202 ("tools: ynl: generate code for ovs families")
+Link: https://patch.msgid.link/20250409145541.580674-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/ovs_vport.yaml | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/Documentation/netlink/specs/ovs_vport.yaml b/Documentation/netlink/specs/ovs_vport.yaml
+index 86ba9ac2a5210..b538bb99ee9b5 100644
+--- a/Documentation/netlink/specs/ovs_vport.yaml
++++ b/Documentation/netlink/specs/ovs_vport.yaml
+@@ -123,12 +123,12 @@ attribute-sets:
+
+ operations:
+ name-prefix: ovs-vport-cmd-
++ fixed-header: ovs-header
+ list:
+ -
+ name: new
+ doc: Create a new OVS vport
+ attribute-set: vport
+- fixed-header: ovs-header
+ do:
+ request:
+ attributes:
+@@ -141,7 +141,6 @@ operations:
+ name: del
+ doc: Delete existing OVS vport from a data path
+ attribute-set: vport
+- fixed-header: ovs-header
+ do:
+ request:
+ attributes:
+@@ -152,7 +151,6 @@ operations:
+ name: get
+ doc: Get / dump OVS vport configuration and state
+ attribute-set: vport
+- fixed-header: ovs-header
+ do: &vport-get-op
+ request:
+ attributes:
+--
+2.39.5
+
--- /dev/null
+From e1bbf9badd613ee007bd687f0900956f9be64e8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:18:48 -0700
+Subject: netlink: specs: rt-link: add an attr layer around alt-ifname
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit acf4da17deada7f8b120e051aa6c9cac40dbd83b ]
+
+alt-ifname attr is directly placed in requests (as an alternative
+to ifname) but in responses its wrapped up in IFLA_PROP_LIST
+and only there is may be multi-attr. See rtnl_fill_prop_list().
+
+Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages")
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250414211851.602096-6-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/rt_link.yaml | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml
+index 0c4d5d40cae90..11d9abec99bc0 100644
+--- a/Documentation/netlink/specs/rt_link.yaml
++++ b/Documentation/netlink/specs/rt_link.yaml
+@@ -1094,11 +1094,10 @@ attribute-sets:
+ -
+ name: prop-list
+ type: nest
+- nested-attributes: link-attrs
++ nested-attributes: prop-list-link-attrs
+ -
+ name: alt-ifname
+ type: string
+- multi-attr: true
+ -
+ name: perm-address
+ type: binary
+@@ -1137,6 +1136,13 @@ attribute-sets:
+ name: dpll-pin
+ type: nest
+ nested-attributes: link-dpll-pin-attrs
++ -
++ name: prop-list-link-attrs
++ subset-of: link-attrs
++ attributes:
++ -
++ name: alt-ifname
++ multi-attr: true
+ -
+ name: af-spec-attrs
+ attributes:
+@@ -2319,7 +2325,6 @@ operations:
+ - min-mtu
+ - max-mtu
+ - prop-list
+- - alt-ifname
+ - perm-address
+ - proto-down-reason
+ - parent-dev-name
+--
+2.39.5
+
--- /dev/null
+From 4bbf0eda6c96c01bd90a96f2e69b02101bbecb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:18:50 -0700
+Subject: netlink: specs: rt-link: adjust mctp attribute naming
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit beb3c5ad8829b52057f48a776a9d9558b98c157f ]
+
+MCTP attribute naming is inconsistent. In C we have:
+ IFLA_MCTP_NET,
+ IFLA_MCTP_PHYS_BINDING,
+ ^^^^
+
+but in YAML:
+ - mctp-net
+ - phys-binding
+ ^
+ no "mctp"
+
+It's unclear whether the "mctp" part of the name is supposed
+to be a prefix or part of attribute name. Make it a prefix,
+seems cleaner, even tho technically phys-binding was added later.
+
+Fixes: b2f63d904e72 ("doc/netlink: Add spec for rt link messages")
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250414211851.602096-8-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/rt_link.yaml | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netlink/specs/rt_link.yaml
+index 11d9abec99bc0..a048fc30389d6 100644
+--- a/Documentation/netlink/specs/rt_link.yaml
++++ b/Documentation/netlink/specs/rt_link.yaml
+@@ -2077,9 +2077,10 @@ attribute-sets:
+ type: u32
+ -
+ name: mctp-attrs
++ name-prefix: ifla-mctp-
+ attributes:
+ -
+- name: mctp-net
++ name: net
+ type: u32
+ -
+ name: stats-attrs
+--
+2.39.5
+
--- /dev/null
+From 9130ac3fc7b80b7f8144cfd35e0b6d1cf8747fca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 13:07:55 +0100
+Subject: ovl: remove unused forward declaration
+
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+
+[ Upstream commit a6eb9a4a69cc360b930dad9dc8513f8fd9b3577f ]
+
+The ovl_get_verity_xattr() function was never added, only its declaration.
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+Fixes: 184996e92e86 ("ovl: Validate verity xattr when resolving lowerdata")
+Reviewed-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Alexander Larsson <alexl@redhat.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/overlayfs.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 844874b4a91a9..500a9634ad533 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -547,8 +547,6 @@ int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d,
+ bool ovl_is_metacopy_dentry(struct dentry *dentry);
+ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, const struct path *path, int padding);
+ int ovl_ensure_verity_loaded(struct path *path);
+-int ovl_get_verity_xattr(struct ovl_fs *ofs, const struct path *path,
+- u8 *digest_buf, int *buf_length);
+ int ovl_validate_verity(struct ovl_fs *ofs,
+ struct path *metapath,
+ struct path *datapath);
+--
+2.39.5
+
--- /dev/null
+From 049535f050930c038b9cda5227d2c189a22e44ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 11:14:48 +0530
+Subject: pds_core: fix memory leak in pdsc_debugfs_add_qcq()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 8b82f656826c741d032490b089a5638c33f2c91d ]
+
+The memory allocated for intr_ctrl_regset, which is passed to
+debugfs_create_regset32() may not be cleaned up when the driver is
+removed. Fix that by using device managed allocation for it.
+
+Fixes: 45d76f492938 ("pds_core: set up device and adminq")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>
+Link: https://patch.msgid.link/20250409054450.48606-1-abdun.nihaal@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/pds_core/debugfs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/pds_core/debugfs.c b/drivers/net/ethernet/amd/pds_core/debugfs.c
+index ac37a4e738ae7..04c5e3abd8d70 100644
+--- a/drivers/net/ethernet/amd/pds_core/debugfs.c
++++ b/drivers/net/ethernet/amd/pds_core/debugfs.c
+@@ -154,8 +154,9 @@ void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq)
+ debugfs_create_u32("index", 0400, intr_dentry, &intr->index);
+ debugfs_create_u32("vector", 0400, intr_dentry, &intr->vector);
+
+- intr_ctrl_regset = kzalloc(sizeof(*intr_ctrl_regset),
+- GFP_KERNEL);
++ intr_ctrl_regset = devm_kzalloc(pdsc->dev,
++ sizeof(*intr_ctrl_regset),
++ GFP_KERNEL);
+ if (!intr_ctrl_regset)
+ return;
+ intr_ctrl_regset->regs = intr_ctrl_regs;
+--
+2.39.5
+
--- /dev/null
+From 18457028b97bc9b3f755dbf3a095e6afe042daaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 08:31:31 +0300
+Subject: ptp: ocp: fix start time alignment in ptp_ocp_signal_set
+
+From: Sagi Maimon <maimon.sagi@gmail.com>
+
+[ Upstream commit 2a5970d5aaff8f3e33ce3bfaa403ae88c40de40d ]
+
+In ptp_ocp_signal_set, the start time for periodic signals is not
+aligned to the next period boundary. The current code rounds up the
+start time and divides by the period but fails to multiply back by
+the period, causing misaligned signal starts. Fix this by multiplying
+the rounded-up value by the period to ensure the start time is the
+closest next period.
+
+Fixes: 4bd46bb037f8e ("ptp: ocp: Use DIV64_U64_ROUND_UP for rounding.")
+Signed-off-by: Sagi Maimon <maimon.sagi@gmail.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250415053131.129413-1-maimon.sagi@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_ocp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
+index 120db96d9e95d..0eeb503e06c23 100644
+--- a/drivers/ptp/ptp_ocp.c
++++ b/drivers/ptp/ptp_ocp.c
+@@ -2067,6 +2067,7 @@ ptp_ocp_signal_set(struct ptp_ocp *bp, int gen, struct ptp_ocp_signal *s)
+ if (!s->start) {
+ /* roundup() does not work on 32-bit systems */
+ s->start = DIV64_U64_ROUND_UP(start_ns, s->period);
++ s->start *= s->period;
+ s->start = ktime_add(s->start, s->phase);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 81969e553a91fa8aefc3a323bbcd24628c0716ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 14:42:21 +0200
+Subject: RDMA/core: Silence oversized kvmalloc() warning
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 9a0e6f15029e1a8a21e40f06fd05aa52b7f063de ]
+
+syzkaller triggered an oversized kvmalloc() warning.
+Silence it by adding __GFP_NOWARN.
+
+syzkaller log:
+ WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180
+ CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:__kvmalloc_node_noprof+0x175/0x180
+ RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246
+ RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b
+ RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002
+ RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000
+ R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000
+ R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000
+ FS: 00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ ib_umem_odp_get+0x1f6/0x390
+ mlx5_ib_reg_user_mr+0x1e8/0x450
+ ib_uverbs_reg_mr+0x28b/0x440
+ ib_uverbs_write+0x7d3/0xa30
+ vfs_write+0x1ac/0x6c0
+ ksys_write+0x134/0x170
+ ? __sanitizer_cov_trace_pc+0x1c/0x50
+ do_syscall_64+0x50/0x110
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: 37824952dc8f ("RDMA/odp: Use kvcalloc for the dma_list and page_list")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Link: https://patch.msgid.link/c6cb92379de668be94894f49c2cfa40e73f94d56.1742388096.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/umem_odp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
+index e9fa22d31c233..c48ef60830205 100644
+--- a/drivers/infiniband/core/umem_odp.c
++++ b/drivers/infiniband/core/umem_odp.c
+@@ -76,12 +76,14 @@ static inline int ib_init_umem_odp(struct ib_umem_odp *umem_odp,
+
+ npfns = (end - start) >> PAGE_SHIFT;
+ umem_odp->pfn_list = kvcalloc(
+- npfns, sizeof(*umem_odp->pfn_list), GFP_KERNEL);
++ npfns, sizeof(*umem_odp->pfn_list),
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!umem_odp->pfn_list)
+ return -ENOMEM;
+
+ umem_odp->dma_list = kvcalloc(
+- ndmas, sizeof(*umem_odp->dma_list), GFP_KERNEL);
++ ndmas, sizeof(*umem_odp->dma_list),
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!umem_odp->dma_list) {
+ ret = -ENOMEM;
+ goto out_pfn_list;
+--
+2.39.5
+
--- /dev/null
+From 3082c760f224a747516e242ebd7c279817c01eb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 19:47:24 +0800
+Subject: RDMA/hns: Fix wrong maximum DMA segment size
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit 9beb2c91fb86e0be70a5833c6730441fa3c9efa8 ]
+
+Set maximum DMA segment size to 2G instead of UINT_MAX due to HW limit.
+
+Fixes: e0477b34d9d1 ("RDMA: Explicitly pass in the dma_device to ib_register_device")
+Link: https://patch.msgid.link/r/20250327114724.3454268-3-huangjunxian6@hisilicon.com
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index cf89a8db4f64c..8d0b63d4b50a6 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -763,7 +763,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev)
+ if (ret)
+ return ret;
+ }
+- dma_set_max_seg_size(dev, UINT_MAX);
++ dma_set_max_seg_size(dev, SZ_2G);
+ ret = ib_register_device(ib_dev, "hns_%d", dev);
+ if (ret) {
+ dev_err(dev, "ib_register_device failed!\n");
+--
+2.39.5
+
--- /dev/null
+From 2422ef0d02e98ecbd5d76a54a7dca0d487761936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 20:31:32 +0800
+Subject: RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 95ba3850fed03e01b422ab5d7943aeba130c9723 ]
+
+drivers/infiniband/hw/usnic/usnic_ib_main.c:590
+ usnic_ib_pci_probe() warn: passing zero to 'PTR_ERR'
+
+Make usnic_ib_device_add() return NULL on fail path, also remove
+useless NULL check for usnic_ib_discover_pf()
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Link: https://patch.msgid.link/r/20250324123132.2392077-1-yuehaibing@huawei.com
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_ib_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c
+index 13b654ddd3cc8..bcf7d8607d56e 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_main.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c
+@@ -380,7 +380,7 @@ static void *usnic_ib_device_add(struct pci_dev *dev)
+ if (!us_ibdev) {
+ usnic_err("Device %s context alloc failed\n",
+ netdev_name(pci_get_drvdata(dev)));
+- return ERR_PTR(-EFAULT);
++ return NULL;
+ }
+
+ us_ibdev->ufdev = usnic_fwd_dev_alloc(dev);
+@@ -500,8 +500,8 @@ static struct usnic_ib_dev *usnic_ib_discover_pf(struct usnic_vnic *vnic)
+ }
+
+ us_ibdev = usnic_ib_device_add(parent_pci);
+- if (IS_ERR_OR_NULL(us_ibdev)) {
+- us_ibdev = us_ibdev ? us_ibdev : ERR_PTR(-EFAULT);
++ if (!us_ibdev) {
++ us_ibdev = ERR_PTR(-EFAULT);
+ goto out;
+ }
+
+@@ -569,10 +569,10 @@ static int usnic_ib_pci_probe(struct pci_dev *pdev,
+ }
+
+ pf = usnic_ib_discover_pf(vf->vnic);
+- if (IS_ERR_OR_NULL(pf)) {
+- usnic_err("Failed to discover pf of vnic %s with err%ld\n",
+- pci_name(pdev), PTR_ERR(pf));
+- err = pf ? PTR_ERR(pf) : -EFAULT;
++ if (IS_ERR(pf)) {
++ err = PTR_ERR(pf);
++ usnic_err("Failed to discover pf of vnic %s with err%d\n",
++ pci_name(pdev), err);
+ goto out_clean_vnic;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 9d73d7d6ed5938fe93d5a6d701b723c40806f347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 16:13:34 +0200
+Subject: Revert "wifi: mac80211: Update skb's control block key in
+ ieee80211_tx_dequeue()"
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 0937cb5f345c79d702b4d0d744e2a2529b551cb2 ]
+
+This reverts commit a104042e2bf6528199adb6ca901efe7b60c2c27f.
+
+Since the original bug seems to have been around for years,
+but a new issue was report with the fix, revert the fix for
+now. We have a couple of weeks to figure it out for this
+release, if needed.
+
+Reported-by: Bert Karwatzki <spasswolf@web.de>
+Closes: https://lore.kernel.org/linux-wireless/20250410215527.3001-1-spasswolf@web.de
+Fixes: a104042e2bf6 ("wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 9b3a5ef20f29e..0ff8b56f58070 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3892,7 +3892,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
+ * The key can be removed while the packet was queued, so need to call
+ * this here to get the current key.
+ */
+- info->control.hw_key = NULL;
+ r = ieee80211_tx_h_select_key(&tx);
+ if (r != TX_CONTINUE) {
+ ieee80211_free_txskb(&local->hw, skb);
+--
+2.39.5
+
--- /dev/null
+From ef317bdb220368de5c594df84bfb6468bc5546c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 15:32:21 +0800
+Subject: riscv: KGDB: Do not inline arch_kgdb_breakpoint()
+
+From: WangYuli <wangyuli@uniontech.com>
+
+[ Upstream commit 3af4bec9c1db3f003be4d5ae09b6a737e4be1612 ]
+
+The arch_kgdb_breakpoint() function defines the kgdb_compiled_break
+symbol using inline assembly.
+
+There's a potential issue where the compiler might inline
+arch_kgdb_breakpoint(), which would then define the kgdb_compiled_break
+symbol multiple times, leading to fail to link vmlinux.o.
+
+This isn't merely a potential compilation problem. The intent here
+is to determine the global symbol address of kgdb_compiled_break,
+and if this function is inlined multiple times, it would logically
+be a grave error.
+
+Link: https://lore.kernel.org/all/4b4187c1-77e5-44b7-885f-d6826723dd9a@sifive.com/
+Link: https://lore.kernel.org/all/5b0adf9b-2b22-43fe-ab74-68df94115b9a@ghiti.fr/
+Link: https://lore.kernel.org/all/23693e7f-4fff-40f3-a437-e06d827278a5@ghiti.fr/
+Fixes: fe89bd2be866 ("riscv: Add KGDB support")
+Co-developed-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: WangYuli <wangyuli@uniontech.com>
+Link: https://lore.kernel.org/r/F22359AFB6FF9FD8+20250411073222.56820-1-wangyuli@uniontech.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/kgdb.h | 9 +--------
+ arch/riscv/kernel/kgdb.c | 8 ++++++++
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/riscv/include/asm/kgdb.h b/arch/riscv/include/asm/kgdb.h
+index 46677daf708bd..cc11c4544cffd 100644
+--- a/arch/riscv/include/asm/kgdb.h
++++ b/arch/riscv/include/asm/kgdb.h
+@@ -19,16 +19,9 @@
+
+ #ifndef __ASSEMBLY__
+
++void arch_kgdb_breakpoint(void);
+ extern unsigned long kgdb_compiled_break;
+
+-static inline void arch_kgdb_breakpoint(void)
+-{
+- asm(".global kgdb_compiled_break\n"
+- ".option norvc\n"
+- "kgdb_compiled_break: ebreak\n"
+- ".option rvc\n");
+-}
+-
+ #endif /* !__ASSEMBLY__ */
+
+ #define DBG_REG_ZERO "zero"
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 2e0266ae6bd72..5d1ce8dacaf58 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -254,6 +254,14 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
+ regs->epc = pc;
+ }
+
++noinline void arch_kgdb_breakpoint(void)
++{
++ asm(".global kgdb_compiled_break\n"
++ ".option norvc\n"
++ "kgdb_compiled_break: ebreak\n"
++ ".option rvc\n");
++}
++
+ void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer,
+ char *remcom_out_buffer)
+ {
+--
+2.39.5
+
--- /dev/null
+From 9d68e374ebe73e3fcba3b1e33ad13a2520b405e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 15:32:22 +0800
+Subject: riscv: KGDB: Remove ".option norvc/.option rvc" for
+ kgdb_compiled_break
+
+From: WangYuli <wangyuli@uniontech.com>
+
+[ Upstream commit 550c2aa787d1b06efcb11de1877354502a1237f2 ]
+
+[ Quoting Samuel Holland: ]
+
+ This is a separate issue, but using ".option rvc" here is a bug.
+ It will unconditionally enable the C extension for the rest of
+ the file, even if the kernel is being built with CONFIG_RISCV_ISA_C=n.
+
+[ Quoting Palmer Dabbelt: ]
+
+ We're just looking at the address of kgdb_compiled_break, so it's
+ fine if it ends up as a c.ebreak.
+
+[ Quoting Alexandre Ghiti: ]
+
+ .option norvc is used to prevent the assembler from using compressed
+ instructions, but it's generally used when we need to ensure the
+ size of the instructions that are used, which is not the case here
+ as noted by Palmer since we only care about the address. So yes
+ it will work fine with C enabled :)
+
+So let's just remove them all.
+
+Link: https://lore.kernel.org/all/4b4187c1-77e5-44b7-885f-d6826723dd9a@sifive.com/
+Link: https://lore.kernel.org/all/mhng-69513841-5068-441d-be8f-2aeebdc56a08@palmer-ri-x1c9a/
+Link: https://lore.kernel.org/all/23693e7f-4fff-40f3-a437-e06d827278a5@ghiti.fr/
+Fixes: fe89bd2be866 ("riscv: Add KGDB support")
+Cc: Samuel Holland <samuel.holland@sifive.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Signed-off-by: WangYuli <wangyuli@uniontech.com>
+Link: https://lore.kernel.org/r/8B431C6A4626225C+20250411073222.56820-2-wangyuli@uniontech.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 5d1ce8dacaf58..9f3db3503dabd 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -257,9 +257,7 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
+ noinline void arch_kgdb_breakpoint(void)
+ {
+ asm(".global kgdb_compiled_break\n"
+- ".option norvc\n"
+- "kgdb_compiled_break: ebreak\n"
+- ".option rvc\n");
++ "kgdb_compiled_break: ebreak\n");
+ }
+
+ void kgdb_arch_handle_qxfer_pkt(char *remcom_in_buffer,
+--
+2.39.5
+
--- /dev/null
+From febca858c0d83c1038853ff974e3b202bc464353 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 10:14:50 -0700
+Subject: riscv: module: Allocate PLT entries for R_RISCV_PLT32
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+[ Upstream commit 1ee1313f4722e6d67c6e9447ee81d24d6e3ff4ad ]
+
+apply_r_riscv_plt32_rela() may need to emit a PLT entry for the
+referenced symbol, so there must be space allocated in the PLT.
+
+Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations")
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250409171526.862481-2-samuel.holland@sifive.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/module-sections.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/riscv/kernel/module-sections.c b/arch/riscv/kernel/module-sections.c
+index e264e59e596e8..91d0b355ceeff 100644
+--- a/arch/riscv/kernel/module-sections.c
++++ b/arch/riscv/kernel/module-sections.c
+@@ -73,16 +73,17 @@ static bool duplicate_rela(const Elf_Rela *rela, int idx)
+ static void count_max_entries(Elf_Rela *relas, int num,
+ unsigned int *plts, unsigned int *gots)
+ {
+- unsigned int type, i;
+-
+- for (i = 0; i < num; i++) {
+- type = ELF_RISCV_R_TYPE(relas[i].r_info);
+- if (type == R_RISCV_CALL_PLT) {
++ for (int i = 0; i < num; i++) {
++ switch (ELF_R_TYPE(relas[i].r_info)) {
++ case R_RISCV_CALL_PLT:
++ case R_RISCV_PLT32:
+ if (!duplicate_rela(relas, i))
+ (*plts)++;
+- } else if (type == R_RISCV_GOT_HI20) {
++ break;
++ case R_RISCV_GOT_HI20:
+ if (!duplicate_rela(relas, i))
+ (*gots)++;
++ break;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From a292d7eff709cb44c2c0e0096852dd760b839ed7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 10:14:49 -0700
+Subject: riscv: module: Fix out-of-bounds relocation access
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+[ Upstream commit 0b4cce68efb93e31a8e51795d696df6e379cb41c ]
+
+The current code allows rel[j] to access one element past the end of the
+relocation section. Simplify to num_relocations which is equivalent to
+the existing size expression.
+
+Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv")
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20250409171526.862481-1-samuel.holland@sifive.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 0ae34d79b87bd..7f6147c18033b 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -860,7 +860,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
+ }
+
+ j++;
+- if (j > sechdrs[relsec].sh_size / sizeof(*rel))
++ if (j == num_relocations)
+ j = 0;
+
+ } while (j_idx != j);
+--
+2.39.5
+
--- /dev/null
+From a7446fc4400f20c715ab34cdf9bf1100d1ac5b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 20:21:27 +0200
+Subject: riscv: Properly export reserved regions in /proc/iomem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn@rivosinc.com>
+
+[ Upstream commit e94eb7ea6f206e229791761a5fdf9389f8dbd183 ]
+
+The /proc/iomem represents the kernel's memory map. Regions marked
+with "Reserved" tells the user that the range should not be tampered
+with. Kexec-tools, when using the older kexec_load syscall relies on
+the "Reserved" regions to build the memory segments, that will be the
+target of the new kexec'd kernel.
+
+The RISC-V port tries to expose all reserved regions to userland, but
+some regions were not properly exposed: Regions that resided in both
+the "regular" and reserved memory block, e.g. the EFI Memory Map. A
+missing entry could result in reserved memory being overwritten.
+
+It turns out, that arm64, and loongarch had a similar issue a while
+back:
+
+ commit d91680e687f4 ("arm64: Fix /proc/iomem for reserved but not memory regions")
+ commit 50d7ba36b916 ("arm64: export memblock_reserve()d regions via /proc/iomem")
+
+Similar to the other ports, resolve the issue by splitting the regions
+in an arch initcall, since we need a working allocator.
+
+Fixes: ffe0e5261268 ("RISC-V: Improve init_resources()")
+Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20250409182129.634415-1-bjorn@kernel.org
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/setup.c | 36 +++++++++++++++++++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index 7934613a98c88..194bda6d74ce7 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -66,6 +66,9 @@ static struct resource bss_res = { .name = "Kernel bss", };
+ static struct resource elfcorehdr_res = { .name = "ELF Core hdr", };
+ #endif
+
++static int num_standard_resources;
++static struct resource *standard_resources;
++
+ static int __init add_resource(struct resource *parent,
+ struct resource *res)
+ {
+@@ -139,7 +142,7 @@ static void __init init_resources(void)
+ struct resource *res = NULL;
+ struct resource *mem_res = NULL;
+ size_t mem_res_sz = 0;
+- int num_resources = 0, res_idx = 0;
++ int num_resources = 0, res_idx = 0, non_resv_res = 0;
+ int ret = 0;
+
+ /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */
+@@ -195,6 +198,7 @@ static void __init init_resources(void)
+ /* Add /memory regions to the resource tree */
+ for_each_mem_region(region) {
+ res = &mem_res[res_idx--];
++ non_resv_res++;
+
+ if (unlikely(memblock_is_nomap(region))) {
+ res->name = "Reserved";
+@@ -212,6 +216,9 @@ static void __init init_resources(void)
+ goto error;
+ }
+
++ num_standard_resources = non_resv_res;
++ standard_resources = &mem_res[res_idx + 1];
++
+ /* Clean-up any unused pre-allocated resources */
+ if (res_idx >= 0)
+ memblock_free(mem_res, (res_idx + 1) * sizeof(*mem_res));
+@@ -223,6 +230,33 @@ static void __init init_resources(void)
+ memblock_free(mem_res, mem_res_sz);
+ }
+
++static int __init reserve_memblock_reserved_regions(void)
++{
++ u64 i, j;
++
++ for (i = 0; i < num_standard_resources; i++) {
++ struct resource *mem = &standard_resources[i];
++ phys_addr_t r_start, r_end, mem_size = resource_size(mem);
++
++ if (!memblock_is_region_reserved(mem->start, mem_size))
++ continue;
++
++ for_each_reserved_mem_range(j, &r_start, &r_end) {
++ resource_size_t start, end;
++
++ start = max(PFN_PHYS(PFN_DOWN(r_start)), mem->start);
++ end = min(PFN_PHYS(PFN_UP(r_end)) - 1, mem->end);
++
++ if (start > mem->end || end < mem->start)
++ continue;
++
++ reserve_region_with_split(mem, start, end, "Reserved");
++ }
++ }
++
++ return 0;
++}
++arch_initcall(reserve_memblock_reserved_regions);
+
+ static void __init parse_dtb(void)
+ {
+--
+2.39.5
+
--- /dev/null
+From a5f8aa8b7839aa988d0a7ff129e76eafbd5ce02a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 01:14:26 -0700
+Subject: riscv: Use kvmalloc_array on relocation_hashtable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Will Pierce <wgpierce17@gmail.com>
+
+[ Upstream commit 8578b2f7e1fb79d4b92b62fbbe913548bb363654 ]
+
+The number of relocations may be a huge value that is unallocatable
+by kmalloc. Use kvmalloc instead so that it does not fail.
+
+Fixes: 8fd6c5142395 ("riscv: Add remaining module relocations")
+Suggested-by: Clément Léger <cleger@rivosinc.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Will Pierce <wgpierce17@gmail.com>
+Link: https://lore.kernel.org/r/20250402081426.5197-1-wgpierce17@gmail.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/module.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 47d0ebeec93c2..0ae34d79b87bd 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -648,7 +648,7 @@ process_accumulated_relocations(struct module *me,
+ kfree(bucket_iter);
+ }
+
+- kfree(*relocation_hashtable);
++ kvfree(*relocation_hashtable);
+ }
+
+ static int add_relocation_to_accumulate(struct module *me, int type,
+@@ -752,9 +752,10 @@ initialize_relocation_hashtable(unsigned int num_relocations,
+
+ hashtable_size <<= should_double_size;
+
+- *relocation_hashtable = kmalloc_array(hashtable_size,
+- sizeof(**relocation_hashtable),
+- GFP_KERNEL);
++ /* Number of relocations may be large, so kvmalloc it */
++ *relocation_hashtable = kvmalloc_array(hashtable_size,
++ sizeof(**relocation_hashtable),
++ GFP_KERNEL);
+ if (!*relocation_hashtable)
+ return 0;
+
+--
+2.39.5
+
--- /dev/null
+From 63da66f95c96f43d71a6ca9e1063b4542101cfd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 17:51:34 +0800
+Subject: scsi: hisi_sas: Enable force phy when SATA disk directly connected
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 8aa580cd92843b60d4d6331f3b0a9e8409bb70eb ]
+
+when a SATA disk is directly connected the SAS controller determines the
+disk to which I/Os are delivered based on the port ID in the DQ entry.
+
+When many phys are disconnected and reconnect, the port ID of phys were
+changed and used by other link, resulting in I/O being sent to incorrect
+disk. Data inconsistency on the SATA disk may occur during I/O retries
+using the old port ID. So enable force phy, then force the command to be
+executed in a certain phy, and if the actual phy ID of the port does not
+match the phy configured in the command, the chip will stop delivering the
+I/O to disk.
+
+Fixes: ce60689e12dd ("scsi: hisi_sas: add v3 code to send ATA frame")
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Link: https://lore.kernel.org/r/20250312095135.3048379-2-yangxingui@huawei.com
+Reviewed-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 9 +++++++--
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 14 ++++++++++++--
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 342d75f12051d..89ff33daba404 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -2501,6 +2501,7 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba,
+ struct hisi_sas_port *port = to_hisi_sas_port(sas_port);
+ struct sas_ata_task *ata_task = &task->ata_task;
+ struct sas_tmf_task *tmf = slot->tmf;
++ int phy_id;
+ u8 *buf_cmd;
+ int has_data = 0, hdr_tag = 0;
+ u32 dw0, dw1 = 0, dw2 = 0;
+@@ -2508,10 +2509,14 @@ static void prep_ata_v2_hw(struct hisi_hba *hisi_hba,
+ /* create header */
+ /* dw0 */
+ dw0 = port->id << CMD_HDR_PORT_OFF;
+- if (parent_dev && dev_is_expander(parent_dev->dev_type))
++ if (parent_dev && dev_is_expander(parent_dev->dev_type)) {
+ dw0 |= 3 << CMD_HDR_CMD_OFF;
+- else
++ } else {
++ phy_id = device->phy->identify.phy_identifier;
++ dw0 |= (1U << phy_id) << CMD_HDR_PHY_ID_OFF;
++ dw0 |= CMD_HDR_FORCE_PHY_MSK;
+ dw0 |= 4 << CMD_HDR_CMD_OFF;
++ }
+
+ if (tmf && ata_task->force_phy) {
+ dw0 |= CMD_HDR_FORCE_PHY_MSK;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index cd394d8c9f07f..6b4cb560ff304 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -358,6 +358,10 @@
+ #define CMD_HDR_RESP_REPORT_MSK (0x1 << CMD_HDR_RESP_REPORT_OFF)
+ #define CMD_HDR_TLR_CTRL_OFF 6
+ #define CMD_HDR_TLR_CTRL_MSK (0x3 << CMD_HDR_TLR_CTRL_OFF)
++#define CMD_HDR_PHY_ID_OFF 8
++#define CMD_HDR_PHY_ID_MSK (0x1ff << CMD_HDR_PHY_ID_OFF)
++#define CMD_HDR_FORCE_PHY_OFF 17
++#define CMD_HDR_FORCE_PHY_MSK (0x1U << CMD_HDR_FORCE_PHY_OFF)
+ #define CMD_HDR_PORT_OFF 18
+ #define CMD_HDR_PORT_MSK (0xf << CMD_HDR_PORT_OFF)
+ #define CMD_HDR_PRIORITY_OFF 27
+@@ -1425,15 +1429,21 @@ static void prep_ata_v3_hw(struct hisi_hba *hisi_hba,
+ struct hisi_sas_cmd_hdr *hdr = slot->cmd_hdr;
+ struct asd_sas_port *sas_port = device->port;
+ struct hisi_sas_port *port = to_hisi_sas_port(sas_port);
++ int phy_id;
+ u8 *buf_cmd;
+ int has_data = 0, hdr_tag = 0;
+ u32 dw1 = 0, dw2 = 0;
+
+ hdr->dw0 = cpu_to_le32(port->id << CMD_HDR_PORT_OFF);
+- if (parent_dev && dev_is_expander(parent_dev->dev_type))
++ if (parent_dev && dev_is_expander(parent_dev->dev_type)) {
+ hdr->dw0 |= cpu_to_le32(3 << CMD_HDR_CMD_OFF);
+- else
++ } else {
++ phy_id = device->phy->identify.phy_identifier;
++ hdr->dw0 |= cpu_to_le32((1U << phy_id)
++ << CMD_HDR_PHY_ID_OFF);
++ hdr->dw0 |= CMD_HDR_FORCE_PHY_MSK;
+ hdr->dw0 |= cpu_to_le32(4U << CMD_HDR_CMD_OFF);
++ }
+
+ switch (task->data_dir) {
+ case DMA_TO_DEVICE:
+--
+2.39.5
+
--- /dev/null
+From 4c5626fe3e44f8a7eb6a169b6295b8ffa417abff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 17:43:43 +0800
+Subject: scsi: iscsi: Fix missing scsi_host_put() in error path
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 72eea84a1092b50a10eeecfeba4b28ac9f1312ab ]
+
+Add goto to ensure scsi_host_put() is called in all error paths of
+iscsi_set_host_param() function. This fixes a potential memory leak when
+strlen() check fails.
+
+Fixes: ce51c8170084 ("scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20250318094344.91776-1-linmq006@gmail.com
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 9b47f91c5b972..8274fe0ec7146 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -3209,11 +3209,14 @@ iscsi_set_host_param(struct iscsi_transport *transport,
+ }
+
+ /* see similar check in iscsi_if_set_param() */
+- if (strlen(data) > ev->u.set_host_param.len)
+- return -EINVAL;
++ if (strlen(data) > ev->u.set_host_param.len) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ err = transport->set_host_param(shost, ev->u.set_host_param.param,
+ data, ev->u.set_host_param.len);
++out:
+ scsi_host_put(shost);
+ return err;
+ }
+--
+2.39.5
+
--- /dev/null
+From 353ec8b6b469cb0f2270e8d3dd3109b178fbe262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 15:00:13 +0100
+Subject: scsi: replace blk_mq_pci_map_queues with blk_mq_map_hw_queues
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit bd326a5ad6397ccfc67af862606be107c15a43e6 ]
+
+Replace all users of blk_mq_pci_map_queues with the more generic
+blk_mq_map_hw_queues. This in preparation to retire
+blk_mq_pci_map_queues.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Link: https://lore.kernel.org/r/20241202-refactor-blk-affinity-helpers-v6-5-27211e9c2cd5@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: a2d5a0072235 ("scsi: smartpqi: Use is_kdump_kernel() to check for kdump")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_main.c | 3 +--
+ drivers/scsi/hisi_sas/hisi_sas.h | 1 -
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 4 ++--
+ drivers/scsi/megaraid/megaraid_sas_base.c | 3 +--
+ drivers/scsi/mpi3mr/mpi3mr.h | 1 -
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 2 +-
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 3 +--
+ drivers/scsi/pm8001/pm8001_init.c | 2 +-
+ drivers/scsi/pm8001/pm8001_sas.h | 1 -
+ drivers/scsi/qla2xxx/qla_nvme.c | 3 +--
+ drivers/scsi/qla2xxx/qla_os.c | 4 ++--
+ drivers/scsi/smartpqi/smartpqi_init.c | 7 +++----
+ 12 files changed, 13 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
+index adec0df24bc47..1cb517f731f4a 100644
+--- a/drivers/scsi/fnic/fnic_main.c
++++ b/drivers/scsi/fnic/fnic_main.c
+@@ -16,7 +16,6 @@
+ #include <linux/spinlock.h>
+ #include <linux/workqueue.h>
+ #include <linux/if_ether.h>
+-#include <linux/blk-mq-pci.h>
+ #include <scsi/fc/fc_fip.h>
+ #include <scsi/scsi_host.h>
+ #include <scsi/scsi_transport.h>
+@@ -601,7 +600,7 @@ void fnic_mq_map_queues_cpus(struct Scsi_Host *host)
+ return;
+ }
+
+- blk_mq_pci_map_queues(qmap, l_pdev, FNIC_PCI_OFFSET);
++ blk_mq_map_hw_queues(qmap, &l_pdev->dev, FNIC_PCI_OFFSET);
+ }
+
+ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h
+index d223f482488fc..010479a354eee 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas.h
++++ b/drivers/scsi/hisi_sas/hisi_sas.h
+@@ -9,7 +9,6 @@
+
+ #include <linux/acpi.h>
+ #include <linux/blk-mq.h>
+-#include <linux/blk-mq-pci.h>
+ #include <linux/clk.h>
+ #include <linux/debugfs.h>
+ #include <linux/dmapool.h>
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 6b4cb560ff304..2b04556681a1a 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3333,8 +3333,8 @@ static void hisi_sas_map_queues(struct Scsi_Host *shost)
+ if (i == HCTX_TYPE_POLL)
+ blk_mq_map_queues(qmap);
+ else
+- blk_mq_pci_map_queues(qmap, hisi_hba->pci_dev,
+- BASE_VECTORS_V3_HW);
++ blk_mq_map_hw_queues(qmap, hisi_hba->dev,
++ BASE_VECTORS_V3_HW);
+ qoff += qmap->nr_queues;
+ }
+ }
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 50f1dcb6d5846..49abd7dd75a7b 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -37,7 +37,6 @@
+ #include <linux/poll.h>
+ #include <linux/vmalloc.h>
+ #include <linux/irq_poll.h>
+-#include <linux/blk-mq-pci.h>
+
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_cmnd.h>
+@@ -3193,7 +3192,7 @@ static void megasas_map_queues(struct Scsi_Host *shost)
+ map = &shost->tag_set.map[HCTX_TYPE_DEFAULT];
+ map->nr_queues = instance->msix_vectors - offset;
+ map->queue_offset = 0;
+- blk_mq_pci_map_queues(map, instance->pdev, offset);
++ blk_mq_map_hw_queues(map, &instance->pdev->dev, offset);
+ qoff += map->nr_queues;
+ offset += map->nr_queues;
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h
+index ee5a75a4b3bb8..ab7c5f1fc0412 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr.h
++++ b/drivers/scsi/mpi3mr/mpi3mr.h
+@@ -12,7 +12,6 @@
+
+ #include <linux/blkdev.h>
+ #include <linux/blk-mq.h>
+-#include <linux/blk-mq-pci.h>
+ #include <linux/delay.h>
+ #include <linux/dmapool.h>
+ #include <linux/errno.h>
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index 1bef88130d0c0..1e8735538b238 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -4042,7 +4042,7 @@ static void mpi3mr_map_queues(struct Scsi_Host *shost)
+ */
+ map->queue_offset = qoff;
+ if (i != HCTX_TYPE_POLL)
+- blk_mq_pci_map_queues(map, mrioc->pdev, offset);
++ blk_mq_map_hw_queues(map, &mrioc->pdev->dev, offset);
+ else
+ blk_mq_map_queues(map);
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index f2a55aa5fe650..9599d7a500286 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -53,7 +53,6 @@
+ #include <linux/pci.h>
+ #include <linux/interrupt.h>
+ #include <linux/raid_class.h>
+-#include <linux/blk-mq-pci.h>
+ #include <linux/unaligned.h>
+
+ #include "mpt3sas_base.h"
+@@ -11890,7 +11889,7 @@ static void scsih_map_queues(struct Scsi_Host *shost)
+ */
+ map->queue_offset = qoff;
+ if (i != HCTX_TYPE_POLL)
+- blk_mq_pci_map_queues(map, ioc->pdev, offset);
++ blk_mq_map_hw_queues(map, &ioc->pdev->dev, offset);
+ else
+ blk_mq_map_queues(map);
+
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 33e1eba62ca12..b53b1ae5b74c3 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -101,7 +101,7 @@ static void pm8001_map_queues(struct Scsi_Host *shost)
+ struct blk_mq_queue_map *qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT];
+
+ if (pm8001_ha->number_of_intr > 1) {
+- blk_mq_pci_map_queues(qmap, pm8001_ha->pdev, 1);
++ blk_mq_map_hw_queues(qmap, &pm8001_ha->pdev->dev, 1);
+ return;
+ }
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index ced6721380a85..c46470e0cf63b 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -56,7 +56,6 @@
+ #include <scsi/sas_ata.h>
+ #include <linux/atomic.h>
+ #include <linux/blk-mq.h>
+-#include <linux/blk-mq-pci.h>
+ #include "pm8001_defs.h"
+
+ #define DRV_NAME "pm80xx"
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 8f4cc136a9c9c..8ee2e337c9e1b 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -8,7 +8,6 @@
+ #include <linux/delay.h>
+ #include <linux/nvme.h>
+ #include <linux/nvme-fc.h>
+-#include <linux/blk-mq-pci.h>
+ #include <linux/blk-mq.h>
+
+ static struct nvme_fc_port_template qla_nvme_fc_transport;
+@@ -841,7 +840,7 @@ static void qla_nvme_map_queues(struct nvme_fc_local_port *lport,
+ {
+ struct scsi_qla_host *vha = lport->private;
+
+- blk_mq_pci_map_queues(map, vha->hw->pdev, vha->irq_offset);
++ blk_mq_map_hw_queues(map, &vha->hw->pdev->dev, vha->irq_offset);
+ }
+
+ static void qla_nvme_localport_delete(struct nvme_fc_local_port *lport)
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 7ab717ed72327..31535beaaa161 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -13,7 +13,6 @@
+ #include <linux/mutex.h>
+ #include <linux/kobject.h>
+ #include <linux/slab.h>
+-#include <linux/blk-mq-pci.h>
+ #include <linux/refcount.h>
+ #include <linux/crash_dump.h>
+ #include <linux/trace_events.h>
+@@ -8071,7 +8070,8 @@ static void qla2xxx_map_queues(struct Scsi_Host *shost)
+ if (USER_CTRL_IRQ(vha->hw) || !vha->hw->mqiobase)
+ blk_mq_map_queues(qmap);
+ else
+- blk_mq_pci_map_queues(qmap, vha->hw->pdev, vha->irq_offset);
++ blk_mq_map_hw_queues(qmap, &vha->hw->pdev->dev,
++ vha->irq_offset);
+ }
+
+ struct scsi_host_template qla2xxx_driver_template = {
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 870f37b705464..04fb24d77e9b5 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -19,7 +19,6 @@
+ #include <linux/bcd.h>
+ #include <linux/reboot.h>
+ #include <linux/cciss_ioctl.h>
+-#include <linux/blk-mq-pci.h>
+ #include <scsi/scsi_host.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_device.h>
+@@ -6547,10 +6546,10 @@ static void pqi_map_queues(struct Scsi_Host *shost)
+ struct pqi_ctrl_info *ctrl_info = shost_to_hba(shost);
+
+ if (!ctrl_info->disable_managed_interrupts)
+- return blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT],
+- ctrl_info->pci_dev, 0);
++ blk_mq_map_hw_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT],
++ &ctrl_info->pci_dev->dev, 0);
+ else
+- return blk_mq_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT]);
++ blk_mq_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT]);
+ }
+
+ static inline bool pqi_is_tape_changer_device(struct pqi_scsi_dev *device)
+--
+2.39.5
+
--- /dev/null
+From 79bfecc9e393099690f9d1070a2eeb4134ac229d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 23:33:19 +0100
+Subject: scsi: smartpqi: Use is_kdump_kernel() to check for kdump
+
+From: Martin Wilck <mwilck@suse.com>
+
+[ Upstream commit a2d5a0072235a69749ceb04c1a26dc75df66a31a ]
+
+The smartpqi driver checks the reset_devices variable to determine
+whether special adjustments need to be made for kdump. This has the
+effect that after a regular kexec reboot, some driver parameters such as
+max_transfer_size are much lower than usual. More importantly, kexec
+reboot tests have revealed memory corruption caused by the driver log
+being written to system memory after a kexec.
+
+Fix this by testing is_kdump_kernel() rather than reset_devices where
+appropriate.
+
+Fixes: 058311b72f54 ("scsi: smartpqi: Add fw log to kdump")
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Link: https://lore.kernel.org/r/20250321223319.109250-1-mwilck@suse.com
+Cc: Randy Wright <rwright@hpe.com>
+Acked-by: Don Brace <don.brace@microchip.com>
+Tested-by: Don Brace <don.brace@microchip.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 04fb24d77e9b5..d919a74746a05 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -19,6 +19,7 @@
+ #include <linux/bcd.h>
+ #include <linux/reboot.h>
+ #include <linux/cciss_ioctl.h>
++#include <linux/crash_dump.h>
+ #include <scsi/scsi_host.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_device.h>
+@@ -5246,7 +5247,7 @@ static void pqi_calculate_io_resources(struct pqi_ctrl_info *ctrl_info)
+ ctrl_info->error_buffer_length =
+ ctrl_info->max_io_slots * PQI_ERROR_BUFFER_ELEMENT_LENGTH;
+
+- if (reset_devices)
++ if (is_kdump_kernel())
+ max_transfer_size = min(ctrl_info->max_transfer_size,
+ PQI_MAX_TRANSFER_SIZE_KDUMP);
+ else
+@@ -5275,7 +5276,7 @@ static void pqi_calculate_queue_resources(struct pqi_ctrl_info *ctrl_info)
+ u16 num_elements_per_iq;
+ u16 num_elements_per_oq;
+
+- if (reset_devices) {
++ if (is_kdump_kernel()) {
+ num_queue_groups = 1;
+ } else {
+ int num_cpus;
+@@ -8287,12 +8288,12 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info)
+ u32 product_id;
+
+ if (reset_devices) {
+- if (pqi_is_fw_triage_supported(ctrl_info)) {
++ if (is_kdump_kernel() && pqi_is_fw_triage_supported(ctrl_info)) {
+ rc = sis_wait_for_fw_triage_completion(ctrl_info);
+ if (rc)
+ return rc;
+ }
+- if (sis_is_ctrl_logging_supported(ctrl_info)) {
++ if (is_kdump_kernel() && sis_is_ctrl_logging_supported(ctrl_info)) {
+ sis_notify_kdump(ctrl_info);
+ rc = sis_wait_for_ctrl_logging_completion(ctrl_info);
+ if (rc)
+@@ -8343,7 +8344,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info)
+ ctrl_info->product_id = (u8)product_id;
+ ctrl_info->product_revision = (u8)(product_id >> 8);
+
+- if (reset_devices) {
++ if (is_kdump_kernel()) {
+ if (ctrl_info->max_outstanding_requests >
+ PQI_MAX_OUTSTANDING_REQUESTS_KDUMP)
+ ctrl_info->max_outstanding_requests =
+@@ -8479,7 +8480,7 @@ static int pqi_ctrl_init(struct pqi_ctrl_info *ctrl_info)
+ if (rc)
+ return rc;
+
+- if (ctrl_info->ctrl_logging_supported && !reset_devices) {
++ if (ctrl_info->ctrl_logging_supported && !is_kdump_kernel()) {
+ pqi_host_setup_buffer(ctrl_info, &ctrl_info->ctrl_log_memory, PQI_CTRL_LOG_TOTAL_SIZE, PQI_CTRL_LOG_MIN_SIZE);
+ pqi_host_memory_update(ctrl_info, &ctrl_info->ctrl_log_memory, PQI_VENDOR_GENERAL_CTRL_LOG_MEMORY_UPDATE);
+ }
+--
+2.39.5
+
--- /dev/null
+scsi-hisi_sas-enable-force-phy-when-sata-disk-direct.patch
+wifi-at76c50x-fix-use-after-free-access-in-at76_disc.patch
+wifi-mac80211-update-skb-s-control-block-key-in-ieee.patch
+wifi-mac80211-purge-vif-txq-in-ieee80211_do_stop.patch
+wifi-wl1251-fix-memory-leak-in-wl1251_tx_work.patch
+scsi-iscsi-fix-missing-scsi_host_put-in-error-path.patch
+driver-core-bus-add-irq_get_affinity-callback-to-bus.patch
+blk-mq-introduce-blk_mq_map_hw_queues.patch
+scsi-replace-blk_mq_pci_map_queues-with-blk_mq_map_h.patch
+scsi-smartpqi-use-is_kdump_kernel-to-check-for-kdump.patch
+md-raid10-fix-missing-discard-io-accounting.patch
+md-md-bitmap-fix-stats-collection-for-external-bitma.patch
+asoc-dwc-always-enable-disable-i2s-irqs.patch
+asoc-intel-avs-fix-null-ptr-deref-in-avs_component_p.patch
+crypto-tegra-remove-redundant-error-check-on-ret.patch
+crypto-tegra-do-not-use-fixed-size-buffers.patch
+crypto-tegra-fix-iv-usage-for-aes-ecb.patch
+ovl-remove-unused-forward-declaration.patch
+rdma-usnic-fix-passing-zero-to-ptr_err-in-usnic_ib_p.patch
+rdma-hns-fix-wrong-maximum-dma-segment-size.patch
+alsa-hda-cirrus_scodec_test-don-t-select-dependencie.patch
+alsa-hda-improve-bass-speaker-support-for-asus-zenbo.patch
+alsa-hda-realtek-workaround-for-resume-on-dell-venue.patch
+alsa-hda-realtek-fixed-asus-platform-headset-mic-iss.patch
+asoc-cs42l43-reset-clamp-override-on-jack-removal.patch
+rdma-core-silence-oversized-kvmalloc-warning.patch
+bluetooth-hci_event-fix-sending-mgmt_ev_device_found.patch
+bluetooth-btrtl-prevent-potential-null-dereference.patch
+bluetooth-l2cap-check-encryption-key-size-on-incomin.patch
+ipv6-add-exception-routes-to-gc-list-in-rt6_insert_e.patch
+xen-fix-multicall-debug-feature.patch
+revert-wifi-mac80211-update-skb-s-control-block-key-.patch
+igc-fix-ptm-cycle-trigger-logic.patch
+igc-increase-wait-time-before-retrying-ptm.patch
+igc-move-ktime-snapshot-into-ptm-retry-loop.patch
+igc-handle-the-igc_ptp_enabled-flag-correctly.patch
+igc-cleanup-ptp-module-if-probe-fails.patch
+igc-add-lock-preventing-multiple-simultaneous-ptm-tr.patch
+dt-bindings-soc-fsl-fsl-ls1028a-reset-fix-maintainer.patch
+smc-fix-lockdep-false-positive-for-ipproto_smc.patch
+test-suite-use-zu-to-print-size_t.patch
+pds_core-fix-memory-leak-in-pdsc_debugfs_add_qcq.patch
+ethtool-cmis_cdb-use-correct-rpl-size-in-ethtool_cmi.patch
+net-mctp-set-sock_rcu_free.patch
+block-fix-resource-leak-in-blk_register_queue-error-.patch
+netlink-specs-ovs_vport-align-with-c-codegen-capabil.patch
+net-openvswitch-fix-nested-key-length-validation-in-.patch
+can-rockchip_canfd-fix-broken-quirks-checks.patch
+net-ngbe-fix-memory-leak-in-ngbe_probe-error-path.patch
+net-ethernet-ti-am65-cpsw-fix-port_np-reference-coun.patch
+eth-bnxt-fix-missing-ring-index-trim-on-error-path.patch
+loop-aio-inherit-the-ioprio-of-original-request.patch
+loop-stop-using-vfs_iter_-read-write-for-buffered-i-.patch
+ata-libata-sata-save-all-fields-from-sense-data-desc.patch
+cxgb4-fix-memory-leak-in-cxgb4_init_ethtool_filters-.patch
+tools-ynl-gen-individually-free-previous-values-on-d.patch
+tools-ynl-gen-make-sure-we-validate-subtype-of-array.patch
+netlink-specs-rt-link-add-an-attr-layer-around-alt-i.patch
+netlink-specs-rt-link-adjust-mctp-attribute-naming.patch
+net-b53-enable-bpdu-reception-for-management-port.patch
+net-bridge-switchdev-do-not-notify-new-brentries-as-.patch
+net-txgbe-fix-memory-leak-in-txgbe_probe-error-path.patch
+net-dsa-mv88e6xxx-avoid-unregistering-devlink-region.patch
+net-dsa-mv88e6xxx-fix-enoent-when-deleting-vlans-and.patch
+net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch
+net-dsa-free-routing-table-on-probe-failure.patch
+net-dsa-avoid-refcount-warnings-when-ds-ops-tag_8021.patch
+ptp-ocp-fix-start-time-alignment-in-ptp_ocp_signal_s.patch
+net-ti-icss-iep-add-pwidth-configuration-for-perout-.patch
+net-ti-icss-iep-add-phase-offset-configuration-for-p.patch
+net-ti-icss-iep-fix-possible-null-pointer-dereferenc.patch
+net-ethernet-mtk_eth_soc-reapply-mdc-divider-on-rese.patch
+net-ethernet-mtk_eth_soc-correct-the-max-weight-of-t.patch
+net-ethernet-mtk_eth_soc-revise-qdma-packet-schedule.patch
+riscv-use-kvmalloc_array-on-relocation_hashtable.patch
+riscv-properly-export-reserved-regions-in-proc-iomem.patch
+riscv-module-fix-out-of-bounds-relocation-access.patch
+riscv-module-allocate-plt-entries-for-r_riscv_plt32.patch
+kunit-qemu_configs-sh-respect-kunit-cmdline.patch
+riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch
+riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch
+cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch
--- /dev/null
+From d5f4f0dd4f6e3ee8ab28fe653cc9573739e264e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Apr 2025 10:03:17 -0700
+Subject: smc: Fix lockdep false-positive for IPPROTO_SMC.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 752e2217d789be2c6a6ac66554b981cd71cd9f31 ]
+
+SMC consists of two sockets: smc_sock and kernel TCP socket.
+
+Currently, there are two ways of creating the sockets, and syzbot reported
+a lockdep splat [0] for the newer way introduced by commit d25a92ccae6b
+("net/smc: Introduce IPPROTO_SMC").
+
+ socket(AF_SMC , SOCK_STREAM, SMCPROTO_SMC or SMCPROTO_SMC6)
+ socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_SMC)
+
+When a socket is allocated, sock_lock_init() sets a lockdep lock class to
+sk->sk_lock.slock based on its protocol family. In the IPPROTO_SMC case,
+AF_INET or AF_INET6 lock class is assigned to smc_sock.
+
+The repro sets IPV6_JOIN_ANYCAST for IPv6 UDP and SMC socket and exercises
+smc_switch_to_fallback() for IPPROTO_SMC.
+
+ 1. smc_switch_to_fallback() is called under lock_sock() and holds
+ smc->clcsock_release_lock.
+
+ sk_lock-AF_INET6 -> &smc->clcsock_release_lock
+ (sk_lock-AF_SMC)
+
+ 2. Setting IPV6_JOIN_ANYCAST to SMC holds smc->clcsock_release_lock
+ and calls setsockopt() for the kernel TCP socket, which holds RTNL
+ and the kernel socket's lock_sock().
+
+ &smc->clcsock_release_lock -> rtnl_mutex (-> k-sk_lock-AF_INET6)
+
+ 3. Setting IPV6_JOIN_ANYCAST to UDP holds RTNL and lock_sock().
+
+ rtnl_mutex -> sk_lock-AF_INET6
+
+Then, lockdep detects a false-positive circular locking,
+
+ .-> sk_lock-AF_INET6 -> &smc->clcsock_release_lock -> rtnl_mutex -.
+ `-----------------------------------------------------------------'
+
+but IPPROTO_SMC should have the same locking rule as AF_SMC.
+
+ sk_lock-AF_SMC -> &smc->clcsock_release_lock -> rtnl_mutex -> k-sk_lock-AF_INET6
+
+Let's set the same lock class for smc_sock.
+
+Given AF_SMC uses the same lock class for SMCPROTO_SMC and SMCPROTO_SMC6,
+we do not need to separate the class for AF_INET and AF_INET6.
+
+[0]:
+WARNING: possible circular locking dependency detected
+6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0 Not tainted
+
+syz.4.1528/11571 is trying to acquire lock:
+ffffffff8fef8de8 (rtnl_mutex){+.+.}-{4:4}, at: ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
+
+but task is already holding lock:
+ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+ -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}:
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
+ smc_switch_to_fallback+0x2d/0xa00 net/smc/af_smc.c:903
+ smc_sendmsg+0x13d/0x520 net/smc/af_smc.c:2781
+ sock_sendmsg_nosec net/socket.c:718 [inline]
+ __sock_sendmsg net/socket.c:733 [inline]
+ ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573
+ ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627
+ __sys_sendmsg+0x16e/0x220 net/socket.c:2659
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #1 (sk_lock-AF_INET6){+.+.}-{0:0}:
+ lock_sock_nested+0x3a/0xf0 net/core/sock.c:3645
+ lock_sock include/net/sock.h:1624 [inline]
+ sockopt_lock_sock net/core/sock.c:1133 [inline]
+ sockopt_lock_sock+0x54/0x70 net/core/sock.c:1124
+ do_ipv6_setsockopt+0x2160/0x4520 net/ipv6/ipv6_sockglue.c:567
+ ipv6_setsockopt+0xcb/0x170 net/ipv6/ipv6_sockglue.c:993
+ udpv6_setsockopt+0x7d/0xd0 net/ipv6/udp.c:1850
+ do_sock_setsockopt+0x222/0x480 net/socket.c:2303
+ __sys_setsockopt+0x1a0/0x230 net/socket.c:2328
+ __do_sys_setsockopt net/socket.c:2334 [inline]
+ __se_sys_setsockopt net/socket.c:2331 [inline]
+ __x64_sys_setsockopt+0xbd/0x160 net/socket.c:2331
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (rtnl_mutex){+.+.}-{4:4}:
+ check_prev_add kernel/locking/lockdep.c:3163 [inline]
+ check_prevs_add kernel/locking/lockdep.c:3282 [inline]
+ validate_chain kernel/locking/lockdep.c:3906 [inline]
+ __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
+ lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
+ ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
+ inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485
+ __sock_release net/socket.c:647 [inline]
+ sock_release+0x8e/0x1d0 net/socket.c:675
+ smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34
+ __smc_release+0x5c2/0x880 net/smc/af_smc.c:301
+ smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344
+ __sock_release+0xb0/0x270 net/socket.c:647
+ sock_close+0x1c/0x30 net/socket.c:1398
+ __fput+0x3ff/0xb70 fs/file_table.c:464
+ task_work_run+0x14e/0x250 kernel/task_work.c:227
+ resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
+ exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
+ syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
+ do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+other info that might help us debug this:
+
+Chain exists of:
+ rtnl_mutex --> sk_lock-AF_INET6 --> &smc->clcsock_release_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&smc->clcsock_release_lock);
+ lock(sk_lock-AF_INET6);
+ lock(&smc->clcsock_release_lock);
+ lock(rtnl_mutex);
+
+ *** DEADLOCK ***
+
+2 locks held by syz.4.1528/11571:
+ #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline]
+ #0: ffff888077e88208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:646
+ #1: ffff888027f596a8 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_clcsock_release+0x75/0xe0 net/smc/smc_close.c:30
+
+stack backtrace:
+CPU: 0 UID: 0 PID: 11571 Comm: syz.4.1528 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
+ print_circular_bug+0x490/0x760 kernel/locking/lockdep.c:2076
+ check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2208
+ check_prev_add kernel/locking/lockdep.c:3163 [inline]
+ check_prevs_add kernel/locking/lockdep.c:3282 [inline]
+ validate_chain kernel/locking/lockdep.c:3906 [inline]
+ __lock_acquire+0x249e/0x3c40 kernel/locking/lockdep.c:5228
+ lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730
+ ipv6_sock_ac_close+0xd9/0x110 net/ipv6/anycast.c:220
+ inet6_release+0x47/0x70 net/ipv6/af_inet6.c:485
+ __sock_release net/socket.c:647 [inline]
+ sock_release+0x8e/0x1d0 net/socket.c:675
+ smc_clcsock_release+0xb7/0xe0 net/smc/smc_close.c:34
+ __smc_release+0x5c2/0x880 net/smc/af_smc.c:301
+ smc_release+0x1fc/0x5f0 net/smc/af_smc.c:344
+ __sock_release+0xb0/0x270 net/socket.c:647
+ sock_close+0x1c/0x30 net/socket.c:1398
+ __fput+0x3ff/0xb70 fs/file_table.c:464
+ task_work_run+0x14e/0x250 kernel/task_work.c:227
+ resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
+ exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
+ syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
+ do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7f8b4b38d169
+Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffe4efd22d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
+RAX: 0000000000000000 RBX: 00000000000b14a3 RCX: 00007f8b4b38d169
+RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
+RBP: 00007f8b4b5a7ba0 R08: 0000000000000001 R09: 000000114efd25cf
+R10: 00007f8b4b200000 R11: 0000000000000246 R12: 00007f8b4b5a5fac
+R13: 00007f8b4b5a5fa0 R14: ffffffffffffffff R15: 00007ffe4efd23f0
+ </TASK>
+
+Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC")
+Reported-by: syzbot+be6f4b383534d88989f7@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=be6f4b383534d88989f7
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Link: https://patch.msgid.link/20250407170332.26959-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index ebc41a7b13dbe..78b0e6dba0a2b 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -362,6 +362,9 @@ static void smc_destruct(struct sock *sk)
+ return;
+ }
+
++static struct lock_class_key smc_key;
++static struct lock_class_key smc_slock_key;
++
+ void smc_sk_init(struct net *net, struct sock *sk, int protocol)
+ {
+ struct smc_sock *smc = smc_sk(sk);
+@@ -375,6 +378,8 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol)
+ INIT_WORK(&smc->connect_work, smc_connect_work);
+ INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
+ INIT_LIST_HEAD(&smc->accept_q);
++ sock_lock_init_class_and_name(sk, "slock-AF_SMC", &smc_slock_key,
++ "sk_lock-AF_SMC", &smc_key);
+ spin_lock_init(&smc->accept_q_lock);
+ spin_lock_init(&smc->conn.send_lock);
+ sk->sk_prot->hash(sk);
+--
+2.39.5
+
--- /dev/null
+From a2bc49583899da4d3e4393e710e477d0754651e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 20:33:11 -0400
+Subject: test suite: use %zu to print size_t
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit a30951d09c33c899f0e4aca80eb87fad5f10ecfa ]
+
+On 32-bit, we can't use %lu to print a size_t variable and gcc warns us
+about it. Shame it doesn't warn about it on 64-bit.
+
+Link: https://lkml.kernel.org/r/20250403003311.359917-1-Liam.Howlett@oracle.com
+Fixes: cc86e0c2f306 ("radix tree test suite: add support for slab bulk APIs")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/shared/linux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/shared/linux.c b/tools/testing/shared/linux.c
+index 17263696b5d88..61b3f571f7a70 100644
+--- a/tools/testing/shared/linux.c
++++ b/tools/testing/shared/linux.c
+@@ -147,7 +147,7 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp)
+ void kmem_cache_free_bulk(struct kmem_cache *cachep, size_t size, void **list)
+ {
+ if (kmalloc_verbose)
+- pr_debug("Bulk free %p[0-%lu]\n", list, size - 1);
++ pr_debug("Bulk free %p[0-%zu]\n", list, size - 1);
+
+ pthread_mutex_lock(&cachep->lock);
+ for (int i = 0; i < size; i++)
+@@ -165,7 +165,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *cachep, gfp_t gfp, size_t size,
+ size_t i;
+
+ if (kmalloc_verbose)
+- pr_debug("Bulk alloc %lu\n", size);
++ pr_debug("Bulk alloc %zu\n", size);
+
+ pthread_mutex_lock(&cachep->lock);
+ if (cachep->nr_objs >= size) {
+--
+2.39.5
+
--- /dev/null
+From 624965eab37b774683e2eb8643f22fb85c0f98cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:18:46 -0700
+Subject: tools: ynl-gen: individually free previous values on double set
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit ce6cb8113c842b94e77364b247c4f85c7b34e0c2 ]
+
+When user calls request_attrA_set() multiple times (for the same
+attribute), and attrA is of type which allocates memory -
+we try to free the previously associated values. For array
+types (including multi-attr) we have only freed the array,
+but the array may have contained pointers.
+
+Refactor the code generation for free attr and reuse the generated
+lines in setters to flush out the previous state. Since setters
+are static inlines in the header we need to add forward declarations
+for the free helpers of pure nested structs. Track which types get
+used by arrays and include the right forwad declarations.
+
+At least ethtool string set and bit set would not be freed without
+this. Tho, admittedly, overriding already set attribute twice is likely
+a very very rare thing to do.
+
+Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink")
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250414211851.602096-4-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/ynl-gen-c.py | 62 +++++++++++++++++++++++++++-----------
+ 1 file changed, 45 insertions(+), 17 deletions(-)
+
+diff --git a/tools/net/ynl/ynl-gen-c.py b/tools/net/ynl/ynl-gen-c.py
+index 463f1394ab971..265a0ec0ef811 100755
+--- a/tools/net/ynl/ynl-gen-c.py
++++ b/tools/net/ynl/ynl-gen-c.py
+@@ -126,9 +126,15 @@ class Type(SpecAttr):
+ def free_needs_iter(self):
+ return False
+
+- def free(self, ri, var, ref):
++ def _free_lines(self, ri, var, ref):
+ if self.is_multi_val() or self.presence_type() == 'len':
+- ri.cw.p(f'free({var}->{ref}{self.c_name});')
++ return [f'free({var}->{ref}{self.c_name});']
++ return []
++
++ def free(self, ri, var, ref):
++ lines = self._free_lines(ri, var, ref)
++ for line in lines:
++ ri.cw.p(line)
+
+ def arg_member(self, ri):
+ member = self._complex_member_type(ri)
+@@ -224,6 +230,10 @@ class Type(SpecAttr):
+ var = "req"
+ member = f"{var}->{'.'.join(ref)}"
+
++ local_vars = []
++ if self.free_needs_iter():
++ local_vars += ['unsigned int i;']
++
+ code = []
+ presence = ''
+ for i in range(0, len(ref)):
+@@ -233,6 +243,10 @@ class Type(SpecAttr):
+ if i == len(ref) - 1 and self.presence_type() != 'bit':
+ continue
+ code.append(presence + ' = 1;')
++ ref_path = '.'.join(ref[:-1])
++ if ref_path:
++ ref_path += '.'
++ code += self._free_lines(ri, var, ref_path)
+ code += self._setter_lines(ri, member, presence)
+
+ func_name = f"{op_prefix(ri, direction, deref=deref)}_set_{'_'.join(ref)}"
+@@ -240,7 +254,8 @@ class Type(SpecAttr):
+ alloc = bool([x for x in code if 'alloc(' in x])
+ if free and not alloc:
+ func_name = '__' + func_name
+- ri.cw.write_func('static inline void', func_name, body=code,
++ ri.cw.write_func('static inline void', func_name, local_vars=local_vars,
++ body=code,
+ args=[f'{type_name(ri, direction, deref=deref)} *{var}'] + self.arg_member(ri))
+
+
+@@ -443,8 +458,7 @@ class TypeString(Type):
+ ['unsigned int len;']
+
+ def _setter_lines(self, ri, member, presence):
+- return [f"free({member});",
+- f"{presence}_len = strlen({self.c_name});",
++ return [f"{presence}_len = strlen({self.c_name});",
+ f"{member} = malloc({presence}_len + 1);",
+ f'memcpy({member}, {self.c_name}, {presence}_len);',
+ f'{member}[{presence}_len] = 0;']
+@@ -490,8 +504,7 @@ class TypeBinary(Type):
+ ['unsigned int len;']
+
+ def _setter_lines(self, ri, member, presence):
+- return [f"free({member});",
+- f"{presence}_len = len;",
++ return [f"{presence}_len = len;",
+ f"{member} = malloc({presence}_len);",
+ f'memcpy({member}, {self.c_name}, {presence}_len);']
+
+@@ -528,12 +541,14 @@ class TypeNest(Type):
+ def _complex_member_type(self, ri):
+ return self.nested_struct_type
+
+- def free(self, ri, var, ref):
++ def _free_lines(self, ri, var, ref):
++ lines = []
+ at = '&'
+ if self.is_recursive_for_op(ri):
+ at = ''
+- ri.cw.p(f'if ({var}->{ref}{self.c_name})')
+- ri.cw.p(f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});')
++ lines += [f'if ({var}->{ref}{self.c_name})']
++ lines += [f'{self.nested_render_name}_free({at}{var}->{ref}{self.c_name});']
++ return lines
+
+ def _attr_typol(self):
+ return f'.type = YNL_PT_NEST, .nest = &{self.nested_render_name}_nest, '
+@@ -586,15 +601,19 @@ class TypeMultiAttr(Type):
+ def free_needs_iter(self):
+ return 'type' not in self.attr or self.attr['type'] == 'nest'
+
+- def free(self, ri, var, ref):
++ def _free_lines(self, ri, var, ref):
++ lines = []
+ if self.attr['type'] in scalars:
+- ri.cw.p(f"free({var}->{ref}{self.c_name});")
++ lines += [f"free({var}->{ref}{self.c_name});"]
+ elif 'type' not in self.attr or self.attr['type'] == 'nest':
+- ri.cw.p(f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)")
+- ri.cw.p(f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);')
+- ri.cw.p(f"free({var}->{ref}{self.c_name});")
++ lines += [
++ f"for (i = 0; i < {var}->{ref}n_{self.c_name}; i++)",
++ f'{self.nested_render_name}_free(&{var}->{ref}{self.c_name}[i]);',
++ f"free({var}->{ref}{self.c_name});",
++ ]
+ else:
+ raise Exception(f"Free of MultiAttr sub-type {self.attr['type']} not supported yet")
++ return lines
+
+ def _attr_policy(self, policy):
+ return self.base_type._attr_policy(policy)
+@@ -620,8 +639,7 @@ class TypeMultiAttr(Type):
+ def _setter_lines(self, ri, member, presence):
+ # For multi-attr we have a count, not presence, hack up the presence
+ presence = presence[:-(len('_present.') + len(self.c_name))] + "n_" + self.c_name
+- return [f"free({member});",
+- f"{member} = {self.c_name};",
++ return [f"{member} = {self.c_name};",
+ f"{presence} = n_{self.c_name};"]
+
+
+@@ -706,6 +724,7 @@ class Struct:
+ self.request = False
+ self.reply = False
+ self.recursive = False
++ self.in_multi_val = False # used by a MultiAttr or and legacy arrays
+
+ self.attr_list = []
+ self.attrs = dict()
+@@ -1071,6 +1090,10 @@ class Family(SpecFamily):
+ if attr in rs_members['reply']:
+ self.pure_nested_structs[nested].reply = True
+
++ if spec.is_multi_val():
++ child = self.pure_nested_structs.get(nested)
++ child.in_multi_val = True
++
+ self._sort_pure_types()
+
+ # Propagate the request / reply / recursive
+@@ -1085,6 +1108,8 @@ class Family(SpecFamily):
+ struct.child_nests.update(child.child_nests)
+ child.request |= struct.request
+ child.reply |= struct.reply
++ if spec.is_multi_val():
++ child.in_multi_val = True
+ if attr_set in struct.child_nests:
+ struct.recursive = True
+
+@@ -2794,6 +2819,9 @@ def main():
+ for attr_set, struct in parsed.pure_nested_structs.items():
+ ri = RenderInfo(cw, parsed, args.mode, "", "", attr_set)
+ print_type_full(ri, struct)
++ if struct.request and struct.in_multi_val:
++ free_rsp_nested_prototype(ri)
++ cw.nl()
+
+ for op_name, op in parsed.ops.items():
+ cw.p(f"/* ============== {op.enum_name} ============== */")
+--
+2.39.5
+
--- /dev/null
+From 0d29e4654faad31df924e67e0609de22cce40449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 14:18:47 -0700
+Subject: tools: ynl-gen: make sure we validate subtype of array-nest
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 57e7dedf2b8c72caa6f04b9e08b19e4f370562fa ]
+
+ArrayNest AKA indexed-array support currently skips inner type
+validation. We count the attributes and then we parse them,
+make sure we call validate, too. Otherwise buggy / unexpected
+kernel response may lead to crashes.
+
+Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink")
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250414211851.602096-5-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/ynl-gen-c.py | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/net/ynl/ynl-gen-c.py b/tools/net/ynl/ynl-gen-c.py
+index 265a0ec0ef811..40f1c3631f985 100755
+--- a/tools/net/ynl/ynl-gen-c.py
++++ b/tools/net/ynl/ynl-gen-c.py
+@@ -665,8 +665,11 @@ class TypeArrayNest(Type):
+ def _attr_get(self, ri, var):
+ local_vars = ['const struct nlattr *attr2;']
+ get_lines = [f'attr_{self.c_name} = attr;',
+- 'ynl_attr_for_each_nested(attr2, attr)',
+- f'\t{var}->n_{self.c_name}++;']
++ 'ynl_attr_for_each_nested(attr2, attr) {',
++ '\tif (ynl_attr_validate(yarg, attr2))',
++ '\t\treturn YNL_PARSE_CB_ERROR;',
++ f'\t{var}->n_{self.c_name}++;',
++ '}']
+ return get_lines, None, local_vars
+
+
+--
+2.39.5
+
--- /dev/null
+From 2b1f6bf3bcb998b271fc2a7dbf521d618fe4ba1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Mar 2025 16:01:10 +0530
+Subject: wifi: at76c50x: fix use after free access in at76_disconnect
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ]
+
+The memory pointed to by priv is freed at the end of at76_delete_device
+function (using ieee80211_free_hw). But the code then accesses the udev
+field of the freed object to put the USB device. This may also lead to a
+memory leak of the usb device. Fix this by using udev from interface.
+
+Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/atmel/at76c50x-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
+index 504e05ea30f29..97ea7ab0f4910 100644
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2552,7 +2552,7 @@ static void at76_disconnect(struct usb_interface *interface)
+
+ wiphy_info(priv->hw->wiphy, "disconnecting\n");
+ at76_delete_device(priv);
+- usb_put_dev(priv->udev);
++ usb_put_dev(interface_to_usbdev(interface));
+ dev_info(&interface->dev, "disconnected\n");
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 47003eef976975b2ca3b0eee4d6106af4c3d4a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 17:28:21 +0100
+Subject: wifi: mac80211: Purge vif txq in ieee80211_do_stop()
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit 378677eb8f44621ecc9ce659f7af61e5baa94d81 ]
+
+After ieee80211_do_stop() SKB from vif's txq could still be processed.
+Indeed another concurrent vif schedule_and_wake_txq call could cause
+those packets to be dequeued (see ieee80211_handle_wake_tx_queue())
+without checking the sdata current state.
+
+Because vif.drv_priv is now cleared in this function, this could lead to
+driver crash.
+
+For example in ath12k, ahvif is store in vif.drv_priv. Thus if
+ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be
+NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to
+trigger the NULL deref below.
+
+ Unable to handle kernel paging request at virtual address dfffffc000000001
+ KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
+ batman_adv: bat0: Interface deactivated: brbh1337
+ Mem abort info:
+ ESR = 0x0000000096000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x04: level 0 translation fault
+ Data abort info:
+ ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+ [dfffffc000000001] address between user and kernel address ranges
+ Internal error: Oops: 0000000096000004 [#1] SMP
+ CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114
+ Hardware name: HW (DT)
+ pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]
+ lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]
+ sp : ffffffc086ace450
+ x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4
+ x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e
+ x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0
+ x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958
+ x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8
+ x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03
+ x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40
+ x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0
+ x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001
+ x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008
+ Call trace:
+ ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)
+ ieee80211_handle_wake_tx_queue+0x16c/0x260
+ ieee80211_queue_skb+0xeec/0x1d20
+ ieee80211_tx+0x200/0x2c8
+ ieee80211_xmit+0x22c/0x338
+ __ieee80211_subif_start_xmit+0x7e8/0xc60
+ ieee80211_subif_start_xmit+0xc4/0xee0
+ __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0
+ ieee80211_subif_start_xmit_8023+0x124/0x488
+ dev_hard_start_xmit+0x160/0x5a8
+ __dev_queue_xmit+0x6f8/0x3120
+ br_dev_queue_push_xmit+0x120/0x4a8
+ __br_forward+0xe4/0x2b0
+ deliver_clone+0x5c/0xd0
+ br_flood+0x398/0x580
+ br_dev_xmit+0x454/0x9f8
+ dev_hard_start_xmit+0x160/0x5a8
+ __dev_queue_xmit+0x6f8/0x3120
+ ip6_finish_output2+0xc28/0x1b60
+ __ip6_finish_output+0x38c/0x638
+ ip6_output+0x1b4/0x338
+ ip6_local_out+0x7c/0xa8
+ ip6_send_skb+0x7c/0x1b0
+ ip6_push_pending_frames+0x94/0xd0
+ rawv6_sendmsg+0x1a98/0x2898
+ inet_sendmsg+0x94/0xe0
+ __sys_sendto+0x1e4/0x308
+ __arm64_sys_sendto+0xc4/0x140
+ do_el0_svc+0x110/0x280
+ el0_svc+0x20/0x60
+ el0t_64_sync_handler+0x104/0x138
+ el0t_64_sync+0x154/0x158
+
+To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could
+be dequeued after ieee80211_do_stop() (new packets cannot be queued
+because SDATA_STATE_RUNNING is cleared at this point).
+
+Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation")
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Link: https://patch.msgid.link/ff7849e268562456274213c0476e09481a48f489.1742833382.git.repk@triplefau.lt
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/iface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index dbcd75c5d778e..7e1e561ef76c1 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -667,6 +667,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ ieee80211_txq_remove_vlan(local, sdata);
+
++ if (sdata->vif.txq)
++ ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq));
++
+ sdata->bss = NULL;
+
+ if (local->open_count == 0)
+--
+2.39.5
+
--- /dev/null
+From 42a56b7998e044290ba10a706b332ddda10f88dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 17:28:20 +0100
+Subject: wifi: mac80211: Update skb's control block key in
+ ieee80211_tx_dequeue()
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit a104042e2bf6528199adb6ca901efe7b60c2c27f ]
+
+The ieee80211 skb control block key (set when skb was queued) could have
+been removed before ieee80211_tx_dequeue() call. ieee80211_tx_dequeue()
+already called ieee80211_tx_h_select_key() to get the current key, but
+the latter do not update the key in skb control block in case it is
+NULL. Because some drivers actually use this key in their TX callbacks
+(e.g. ath1{1,2}k_mac_op_tx()) this could lead to the use after free
+below:
+
+ BUG: KASAN: slab-use-after-free in ath11k_mac_op_tx+0x590/0x61c
+ Read of size 4 at addr ffffff803083c248 by task kworker/u16:4/1440
+
+ CPU: 3 UID: 0 PID: 1440 Comm: kworker/u16:4 Not tainted 6.13.0-ge128f627f404 #2
+ Hardware name: HW (DT)
+ Workqueue: bat_events batadv_send_outstanding_bcast_packet
+ Call trace:
+ show_stack+0x14/0x1c (C)
+ dump_stack_lvl+0x58/0x74
+ print_report+0x164/0x4c0
+ kasan_report+0xac/0xe8
+ __asan_report_load4_noabort+0x1c/0x24
+ ath11k_mac_op_tx+0x590/0x61c
+ ieee80211_handle_wake_tx_queue+0x12c/0x1c8
+ ieee80211_queue_skb+0xdcc/0x1b4c
+ ieee80211_tx+0x1ec/0x2bc
+ ieee80211_xmit+0x224/0x324
+ __ieee80211_subif_start_xmit+0x85c/0xcf8
+ ieee80211_subif_start_xmit+0xc0/0xec4
+ dev_hard_start_xmit+0xf4/0x28c
+ __dev_queue_xmit+0x6ac/0x318c
+ batadv_send_skb_packet+0x38c/0x4b0
+ batadv_send_outstanding_bcast_packet+0x110/0x328
+ process_one_work+0x578/0xc10
+ worker_thread+0x4bc/0xc7c
+ kthread+0x2f8/0x380
+ ret_from_fork+0x10/0x20
+
+ Allocated by task 1906:
+ kasan_save_stack+0x28/0x4c
+ kasan_save_track+0x1c/0x40
+ kasan_save_alloc_info+0x3c/0x4c
+ __kasan_kmalloc+0xac/0xb0
+ __kmalloc_noprof+0x1b4/0x380
+ ieee80211_key_alloc+0x3c/0xb64
+ ieee80211_add_key+0x1b4/0x71c
+ nl80211_new_key+0x2b4/0x5d8
+ genl_family_rcv_msg_doit+0x198/0x240
+ <...>
+
+ Freed by task 1494:
+ kasan_save_stack+0x28/0x4c
+ kasan_save_track+0x1c/0x40
+ kasan_save_free_info+0x48/0x94
+ __kasan_slab_free+0x48/0x60
+ kfree+0xc8/0x31c
+ kfree_sensitive+0x70/0x80
+ ieee80211_key_free_common+0x10c/0x174
+ ieee80211_free_keys+0x188/0x46c
+ ieee80211_stop_mesh+0x70/0x2cc
+ ieee80211_leave_mesh+0x1c/0x60
+ cfg80211_leave_mesh+0xe0/0x280
+ cfg80211_leave+0x1e0/0x244
+ <...>
+
+Reset SKB control block key before calling ieee80211_tx_h_select_key()
+to avoid that.
+
+Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Link: https://patch.msgid.link/06aa507b853ca385ceded81c18b0a6dd0f081bc8.1742833382.git.repk@triplefau.lt
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 0ff8b56f58070..9b3a5ef20f29e 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3892,6 +3892,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
+ * The key can be removed while the packet was queued, so need to call
+ * this here to get the current key.
+ */
++ info->control.hw_key = NULL;
+ r = ieee80211_tx_h_select_key(&tx);
+ if (r != TX_CONTINUE) {
+ ieee80211_free_txskb(&local->hw, skb);
+--
+2.39.5
+
--- /dev/null
+From f18e1e3233ffb5208f11e1311f2f3d76b1961e0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Mar 2025 16:15:32 +0530
+Subject: wifi: wl1251: fix memory leak in wl1251_tx_work
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit a0f0dc96de03ffeefc2a177b7f8acde565cb77f4 ]
+
+The skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails
+with a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.
+
+Fixes: c5483b719363 ("wl12xx: check if elp wakeup failed")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Michael Nemanov <michael.nemanov@ti.com>
+Link: https://patch.msgid.link/20250330104532.44935-1-abdun.nihaal@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wl1251/tx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ti/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c
+index 474b603c121cb..adb4840b04893 100644
+--- a/drivers/net/wireless/ti/wl1251/tx.c
++++ b/drivers/net/wireless/ti/wl1251/tx.c
+@@ -342,8 +342,10 @@ void wl1251_tx_work(struct work_struct *work)
+ while ((skb = skb_dequeue(&wl->tx_queue))) {
+ if (!woken_up) {
+ ret = wl1251_ps_elp_wakeup(wl);
+- if (ret < 0)
++ if (ret < 0) {
++ skb_queue_head(&wl->tx_queue, skb);
+ goto out;
++ }
+ woken_up = true;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 9b5986a47817f93e66e4caeffb3393c376f9fb19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 20:06:02 +0100
+Subject: xen: fix multicall debug feature
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 715ad3e0ec2b13c27335749f27a5c9f0c0e84064 ]
+
+Initializing a percpu variable with the address of a struct tagged as
+.initdata is breaking the build with CONFIG_SECTION_MISMATCH_WARN_ONLY
+not set to "y".
+
+Fix that by using an access function instead returning the .initdata
+struct address if the percpu space of the struct hasn't been
+allocated yet.
+
+Fixes: 368990a7fe30 ("xen: fix multicall debug data referencing")
+Reported-by: Borislav Petkov <bp@alien8.de>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Acked-by: "Borislav Petkov (AMD)" <bp@alien8.de>
+Tested-by: "Borislav Petkov (AMD)" <bp@alien8.de>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250327190602.26015-1-jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/multicalls.c | 26 ++++++++++++++------------
+ arch/x86/xen/smp_pv.c | 1 -
+ arch/x86/xen/xen-ops.h | 3 ---
+ 3 files changed, 14 insertions(+), 16 deletions(-)
+
+diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
+index 10c660fae8b30..7237d56a9d3f0 100644
+--- a/arch/x86/xen/multicalls.c
++++ b/arch/x86/xen/multicalls.c
+@@ -54,14 +54,20 @@ struct mc_debug_data {
+
+ static DEFINE_PER_CPU(struct mc_buffer, mc_buffer);
+ static struct mc_debug_data mc_debug_data_early __initdata;
+-static DEFINE_PER_CPU(struct mc_debug_data *, mc_debug_data) =
+- &mc_debug_data_early;
+ static struct mc_debug_data __percpu *mc_debug_data_ptr;
+ DEFINE_PER_CPU(unsigned long, xen_mc_irq_flags);
+
+ static struct static_key mc_debug __ro_after_init;
+ static bool mc_debug_enabled __initdata;
+
++static struct mc_debug_data * __ref get_mc_debug(void)
++{
++ if (!mc_debug_data_ptr)
++ return &mc_debug_data_early;
++
++ return this_cpu_ptr(mc_debug_data_ptr);
++}
++
+ static int __init xen_parse_mc_debug(char *arg)
+ {
+ mc_debug_enabled = true;
+@@ -71,20 +77,16 @@ static int __init xen_parse_mc_debug(char *arg)
+ }
+ early_param("xen_mc_debug", xen_parse_mc_debug);
+
+-void mc_percpu_init(unsigned int cpu)
+-{
+- per_cpu(mc_debug_data, cpu) = per_cpu_ptr(mc_debug_data_ptr, cpu);
+-}
+-
+ static int __init mc_debug_enable(void)
+ {
+ unsigned long flags;
++ struct mc_debug_data __percpu *mcdb;
+
+ if (!mc_debug_enabled)
+ return 0;
+
+- mc_debug_data_ptr = alloc_percpu(struct mc_debug_data);
+- if (!mc_debug_data_ptr) {
++ mcdb = alloc_percpu(struct mc_debug_data);
++ if (!mcdb) {
+ pr_err("xen_mc_debug inactive\n");
+ static_key_slow_dec(&mc_debug);
+ return -ENOMEM;
+@@ -93,7 +95,7 @@ static int __init mc_debug_enable(void)
+ /* Be careful when switching to percpu debug data. */
+ local_irq_save(flags);
+ xen_mc_flush();
+- mc_percpu_init(0);
++ mc_debug_data_ptr = mcdb;
+ local_irq_restore(flags);
+
+ pr_info("xen_mc_debug active\n");
+@@ -155,7 +157,7 @@ void xen_mc_flush(void)
+ trace_xen_mc_flush(b->mcidx, b->argidx, b->cbidx);
+
+ if (static_key_false(&mc_debug)) {
+- mcdb = __this_cpu_read(mc_debug_data);
++ mcdb = get_mc_debug();
+ memcpy(mcdb->entries, b->entries,
+ b->mcidx * sizeof(struct multicall_entry));
+ }
+@@ -235,7 +237,7 @@ struct multicall_space __xen_mc_entry(size_t args)
+
+ ret.mc = &b->entries[b->mcidx];
+ if (static_key_false(&mc_debug)) {
+- struct mc_debug_data *mcdb = __this_cpu_read(mc_debug_data);
++ struct mc_debug_data *mcdb = get_mc_debug();
+
+ mcdb->caller[b->mcidx] = __builtin_return_address(0);
+ mcdb->argsz[b->mcidx] = args;
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 6863d3da7decf..7ea57f728b89d 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -305,7 +305,6 @@ static int xen_pv_kick_ap(unsigned int cpu, struct task_struct *idle)
+ return rc;
+
+ xen_pmu_init(cpu);
+- mc_percpu_init(cpu);
+
+ /*
+ * Why is this a BUG? If the hypercall fails then everything can be
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 63c13a2ccf556..25e318ef27d6b 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -261,9 +261,6 @@ void xen_mc_callback(void (*fn)(void *), void *data);
+ */
+ struct multicall_space xen_mc_extend_args(unsigned long op, size_t arg_size);
+
+-/* Do percpu data initialization for multicalls. */
+-void mc_percpu_init(unsigned int cpu);
+-
+ extern bool is_xen_pmu;
+
+ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id);
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
