--- /dev/null
+From fd89fa7b37d97e54f9a8ca4f43dfb04c35fb9a1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 12:41:45 +1000
+Subject: ACPI: battery: negate current when discharging
+
+From: Peter Marheine <pmarheine@chromium.org>
+
+[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ]
+
+The ACPI specification requires that battery rate is always positive,
+but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW
+(Documentation/ABI/testing/sysfs-class-power) specifies that it should
+be negative when a battery is discharging. When reporting CURRENT_NOW,
+massage the value to match the documented ABI.
+
+This only changes the sign of `current_now` and not `power_now` because
+documentation doesn't describe any particular meaning for `power_now` so
+leaving `power_now` unchanged is less likely to confuse userspace
+unnecessarily, whereas becoming consistent with the documented ABI is
+worth potentially confusing clients that read `current_now`.
+
+Signed-off-by: Peter Marheine <pmarheine@chromium.org>
+Link: https://patch.msgid.link/20250508024146.1436129-1-pmarheine@chromium.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 8bb0f4d06adc0..b0a5d077db905 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -250,10 +250,23 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ break;
+ case POWER_SUPPLY_PROP_CURRENT_NOW:
+ case POWER_SUPPLY_PROP_POWER_NOW:
+- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
++ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) {
+ ret = -ENODEV;
+- else
+- val->intval = battery->rate_now * 1000;
++ break;
++ }
++
++ val->intval = battery->rate_now * 1000;
++ /*
++ * When discharging, the current should be reported as a
++ * negative number as per the power supply class interface
++ * definition.
++ */
++ if (psp == POWER_SUPPLY_PROP_CURRENT_NOW &&
++ (battery->state & ACPI_BATTERY_STATE_DISCHARGING) &&
++ acpi_battery_handle_discharging(battery)
++ == POWER_SUPPLY_STATUS_DISCHARGING)
++ val->intval = -val->intval;
++
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN:
+ case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN:
+--
+2.39.5
+
--- /dev/null
+From 200ebeaf7da9aa3d8718c9b98bd7616dd0f926ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 May 2025 20:51:11 +0200
+Subject: ACPI: bus: Bail out if acpi_kobj registration fails
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 94a370fc8def6038dbc02199db9584b0b3690f1a ]
+
+The ACPI sysfs code will fail to initialize if acpi_kobj is NULL,
+together with some ACPI drivers.
+
+Follow the other firmware subsystems and bail out if the kobject
+cannot be registered.
+
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20250518185111.3560-2-W_Armin@gmx.de
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/bus.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 9bc5bc5bc359b..ea63b8f272892 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1335,8 +1335,10 @@ static int __init acpi_init(void)
+ }
+
+ acpi_kobj = kobject_create_and_add("acpi", firmware_kobj);
+- if (!acpi_kobj)
+- pr_debug("%s: kset create error\n", __func__);
++ if (!acpi_kobj) {
++ pr_err("Failed to register kobject\n");
++ return -ENOMEM;
++ }
+
+ init_prmt();
+ result = acpi_bus_init();
+--
+2.39.5
+
--- /dev/null
+From 0b36c33eb3bda4c7139a11e19689489c917e1fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 21:30:27 +0200
+Subject: ACPICA: Avoid sequence overread in call to strncmp()
+
+From: Ahmed Salem <x0rw3ll@gmail.com>
+
+[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]
+
+ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c
+
+ap_get_table_length() checks if tables are valid by
+calling ap_is_valid_header(). The latter then calls
+ACPI_VALIDATE_RSDP_SIG(Table->Signature).
+
+ap_is_valid_header() accepts struct acpi_table_header as an argument, so
+the signature size is always fixed to 4 bytes.
+
+The problem is when the string comparison is between ACPI-defined table
+signature and ACPI_SIG_RSDP. Common ACPI table header specifies the
+Signature field to be 4 bytes long[1], with the exception of the RSDP
+structure whose signature is 8 bytes long "RSD PTR " (including the
+trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would
+then result in a sequence overread[3] as sig would be smaller (4 bytes)
+than the specified bound (8 bytes).
+
+As a workaround, pass the bound conditionally based on the size of the
+signature being passed.
+
+Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1]
+Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2]
+Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3]
+Link: https://github.com/acpica/acpica/commit/8b83a8d8
+Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/actypes.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index cefbb7ad253e0..ea50b9c469c9d 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -524,7 +524,7 @@ typedef u64 acpi_integer;
+
+ /* Support for the special RSDP signature (8 characters) */
+
+-#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8))
++#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8))
+ #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))
+
+ /* Support for OEMx signature (x can be any character) */
+--
+2.39.5
+
--- /dev/null
+From 212bb5ab67d4dc8432cbee1983e0f79588c4feaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 21:05:24 +0100
+Subject: ACPICA: fix acpi operand cache leak in dswstate.c
+
+From: Seunghun Han <kkamagui@gmail.com>
+
+[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ]
+
+ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732
+
+I found an ACPI cache leak in ACPI early termination and boot continuing case.
+
+When early termination occurs due to malicious ACPI table, Linux kernel
+terminates ACPI function and continues to boot process. While kernel terminates
+ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
+
+Boot log of ACPI operand cache leak is as follows:
+>[ 0.585957] ACPI: Added _OSI(Module Device)
+>[ 0.587218] ACPI: Added _OSI(Processor Device)
+>[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)
+>[ 0.589790] ACPI: Added _OSI(Processor Aggregator Device)
+>[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)
+>[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)
+>[ 0.597858] ACPI: Unable to start the ACPI Interpreter
+>[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+>[ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
+>[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
+>[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006
+>[ 0.609177] Call Trace:
+>[ 0.610063] ? dump_stack+0x5c/0x81
+>[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0
+>[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27
+>[ 0.613906] ? acpi_os_delete_cache+0xa/0x10
+>[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b
+>[ 0.619293] ? acpi_terminate+0xa/0x14
+>[ 0.620394] ? acpi_init+0x2af/0x34f
+>[ 0.621616] ? __class_create+0x4c/0x80
+>[ 0.623412] ? video_setup+0x7f/0x7f
+>[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27
+>[ 0.625861] ? do_one_initcall+0x4e/0x1a0
+>[ 0.627513] ? kernel_init_freeable+0x19e/0x21f
+>[ 0.628972] ? rest_init+0x80/0x80
+>[ 0.630043] ? kernel_init+0xa/0x100
+>[ 0.631084] ? ret_from_fork+0x25/0x30
+>[ 0.633343] vgaarb: loaded
+>[ 0.635036] EDAC MC: Ver: 3.0.0
+>[ 0.638601] PCI: Probing PCI hardware
+>[ 0.639833] PCI host bridge to bus 0000:00
+>[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff]
+> ... Continue to boot and log is omitted ...
+
+I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_
+delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()
+function uses walk_state->operand_index for start position of the top, but
+acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.
+Therefore, this causes acpi operand memory leak.
+
+This cache leak causes a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+I made a patch to fix ACPI operand cache leak.
+
+Link: https://github.com/acpica/acpica/commit/987a3b5c
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/4999480.31r3eYUQgx@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsutils.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
+index fb9ed5e1da89d..2bdae8a25e084 100644
+--- a/drivers/acpi/acpica/dsutils.c
++++ b/drivers/acpi/acpica/dsutils.c
+@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS];
+ u32 arg_count = 0;
+ u32 index = walk_state->num_operands;
++ u32 prev_num_operands = walk_state->num_operands;
++ u32 new_num_operands;
+ u32 i;
+
+ ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg);
+@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+
+ /* Create the interpreter arguments, in reverse order */
+
++ new_num_operands = index;
+ index--;
+ for (i = 0; i < arg_count; i++) {
+ arg = arguments[index];
+@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
+ * pop everything off of the operand stack and delete those
+ * objects
+ */
+- acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state);
++ walk_state->num_operands = i;
++ acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state);
++
++ /* Restore operand count */
++ walk_state->num_operands = prev_num_operands;
+
+ ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index));
+ return_ACPI_STATUS(status);
+--
+2.39.5
+
--- /dev/null
+From 9f57808fb19bd9829df7194dd8a6aa63a2f332d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 21:06:21 +0100
+Subject: ACPICA: fix acpi parse and parseext cache leaks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Seunghun Han <kkamagui@gmail.com>
+
+[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ]
+
+ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5
+
+I'm Seunghun Han, and I work for National Security Research Institute of
+South Korea.
+
+I have been doing a research on ACPI and found an ACPI cache leak in ACPI
+early abort cases.
+
+Boot log of ACPI cache leak is as follows:
+[ 0.352414] ACPI: Added _OSI(Module Device)
+[ 0.353182] ACPI: Added _OSI(Processor Device)
+[ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)
+[ 0.353182] ACPI: Added _OSI(Processor Aggregator Device)
+[ 0.356028] ACPI: Unable to start the ACPI Interpreter
+[ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects
+[ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #10
+[ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.361873] Call Trace:
+[ 0.362243] ? dump_stack+0x5c/0x81
+[ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.362944] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.363296] ? acpi_os_delete_cache+0xa/0x10
+[ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b
+[ 0.364000] ? acpi_terminate+0xa/0x14
+[ 0.364000] ? acpi_init+0x2af/0x34f
+[ 0.364000] ? __class_create+0x4c/0x80
+[ 0.364000] ? video_setup+0x7f/0x7f
+[ 0.364000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.364000] ? do_one_initcall+0x4e/0x1a0
+[ 0.364000] ? kernel_init_freeable+0x189/0x20a
+[ 0.364000] ? rest_init+0xc0/0xc0
+[ 0.364000] ? kernel_init+0xa/0x100
+[ 0.364000] ? ret_from_fork+0x25/0x30
+
+I analyzed this memory leak in detail. I found that “Acpi-State” cache and
+“Acpi-Parse” cache were merged because the size of cache objects was same
+slab cache size.
+
+I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked
+using SLAB_NEVER_MERGE flag in kmem_cache_create() function.
+
+Real ACPI cache leak point is as follows:
+[ 0.360101] ACPI: Added _OSI(Module Device)
+[ 0.360101] ACPI: Added _OSI(Processor Device)
+[ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)
+[ 0.361043] ACPI: Added _OSI(Processor Aggregator Device)
+[ 0.364016] ACPI: Unable to start the ACPI Interpreter
+[ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)
+[ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects
+[ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #8
+[ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.372000] Call Trace:
+[ 0.372000] ? dump_stack+0x5c/0x81
+[ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.372000] ? acpi_os_delete_cache+0xa/0x10
+[ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b
+[ 0.372000] ? acpi_terminate+0xa/0x14
+[ 0.372000] ? acpi_init+0x2af/0x34f
+[ 0.372000] ? __class_create+0x4c/0x80
+[ 0.372000] ? video_setup+0x7f/0x7f
+[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.372000] ? do_one_initcall+0x4e/0x1a0
+[ 0.372000] ? kernel_init_freeable+0x189/0x20a
+[ 0.372000] ? rest_init+0xc0/0xc0
+[ 0.372000] ? kernel_init+0xa/0x100
+[ 0.372000] ? ret_from_fork+0x25/0x30
+[ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects
+[ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W
+4.12.0-rc4-next-20170608+ #8
+[ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
+virtual_box 12/01/2006
+[ 0.392000] Call Trace:
+[ 0.392000] ? dump_stack+0x5c/0x81
+[ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0
+[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.392000] ? acpi_os_delete_cache+0xa/0x10
+[ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b
+[ 0.392000] ? acpi_terminate+0xa/0x14
+[ 0.392000] ? acpi_init+0x2af/0x34f
+[ 0.392000] ? __class_create+0x4c/0x80
+[ 0.392000] ? video_setup+0x7f/0x7f
+[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27
+[ 0.392000] ? do_one_initcall+0x4e/0x1a0
+[ 0.392000] ? kernel_init_freeable+0x189/0x20a
+[ 0.392000] ? rest_init+0xc0/0xc0
+[ 0.392000] ? kernel_init+0xa/0x100
+[ 0.392000] ? ret_from_fork+0x25/0x30
+
+When early abort is occurred due to invalid ACPI information, Linux kernel
+terminates ACPI by calling acpi_terminate() function. The function calls
+acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_
+cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache).
+
+But the deletion codes in acpi_ut_delete_caches() function only delete
+slab caches using kmem_cache_destroy() function, therefore the cache
+objects should be flushed before acpi_ut_delete_caches() function.
+
+"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse
+function, acpi_ps_parse_loop(). The function should complete all ops
+using acpi_ps_complete_final_op() when an error occurs due to invalid
+AML codes.
+However, the current implementation of acpi_ps_complete_final_op() does not
+complete all ops when it meets some errors and this cause cache leak.
+
+This cache leak has a security threat because an old kernel (<= 4.9) shows
+memory locations of kernel functions in stack dump. Some malicious users
+could use this information to neutralize kernel ASLR.
+
+To fix ACPI cache leak for enhancing security, I made a patch to complete all
+ops unconditionally for acpi_ps_complete_final_op() function.
+
+I hope that this patch improves the security of Linux kernel.
+
+Thank you.
+
+Link: https://github.com/acpica/acpica/commit/8829e70e
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/2363774.ElGaqSPkdT@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------
+ 1 file changed, 15 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c
+index e4420cd6d2814..8fd191b363066 100644
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -636,7 +636,8 @@ acpi_status
+ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ union acpi_parse_object *op, acpi_status status)
+ {
+- acpi_status status2;
++ acpi_status return_status = status;
++ u8 ascending = TRUE;
+
+ ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state);
+
+@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ op));
+ do {
+ if (op) {
+- if (walk_state->ascending_callback != NULL) {
++ if (ascending && walk_state->ascending_callback != NULL) {
+ walk_state->op = op;
+ walk_state->op_info =
+ acpi_ps_get_opcode_info(op->common.
+@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+ }
+
+ if (status == AE_CTRL_TERMINATE) {
+- status = AE_OK;
+-
+- /* Clean up */
+- do {
+- if (op) {
+- status2 =
+- acpi_ps_complete_this_op
+- (walk_state, op);
+- if (ACPI_FAILURE
+- (status2)) {
+- return_ACPI_STATUS
+- (status2);
+- }
+- }
+-
+- acpi_ps_pop_scope(&
+- (walk_state->
+- parser_state),
+- &op,
+- &walk_state->
+- arg_types,
+- &walk_state->
+- arg_count);
+-
+- } while (op);
+-
+- return_ACPI_STATUS(status);
++ ascending = FALSE;
++ return_status = AE_CTRL_TERMINATE;
+ }
+
+ else if (ACPI_FAILURE(status)) {
+
+ /* First error is most important */
+
+- (void)
+- acpi_ps_complete_this_op(walk_state,
+- op);
+- return_ACPI_STATUS(status);
++ ascending = FALSE;
++ return_status = status;
+ }
+ }
+
+- status2 = acpi_ps_complete_this_op(walk_state, op);
+- if (ACPI_FAILURE(status2)) {
+- return_ACPI_STATUS(status2);
++ status = acpi_ps_complete_this_op(walk_state, op);
++ if (ACPI_FAILURE(status)) {
++ ascending = FALSE;
++ if (ACPI_SUCCESS(return_status) ||
++ return_status == AE_CTRL_TERMINATE) {
++ return_status = status;
++ }
+ }
+ }
+
+@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
+
+ } while (op);
+
+- return_ACPI_STATUS(status);
++ return_ACPI_STATUS(return_status);
+ }
+--
+2.39.5
+
--- /dev/null
+From fbf0ccd0db9214c941264db55a21b03579f2b875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 21:21:52 +0200
+Subject: ACPICA: utilities: Fix overflow check in vsnprintf()
+
+From: gldrk <me@rarity.fan>
+
+[ Upstream commit 12b660251007e00a3e4d47ec62dbe3a7ace7023e ]
+
+ACPICA commit d9d59b7918514ae55063b93f3ec041b1a569bf49
+
+The old version breaks sprintf on 64-bit systems for buffers
+outside [0..UINT32_MAX].
+
+Link: https://github.com/acpica/acpica/commit/d9d59b79
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/4994935.GXAFRqVoOG@rjwysocki.net
+Signed-off-by: gldrk <me@rarity.fan>
+[ rjw: Added the tag from gldrk ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/utprint.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/acpica/utprint.c b/drivers/acpi/acpica/utprint.c
+index 05426596d1f4a..f910714b51f34 100644
+--- a/drivers/acpi/acpica/utprint.c
++++ b/drivers/acpi/acpica/utprint.c
+@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args)
+
+ pos = string;
+
+- if (size != ACPI_UINT32_MAX) {
+- end = string + size;
+- } else {
+- end = ACPI_CAST_PTR(char, ACPI_UINT32_MAX);
+- }
++ size = ACPI_MIN(size, ACPI_PTR_DIFF(ACPI_MAX_PTR, string));
++ end = string + size;
+
+ for (; *format; ++format) {
+ if (*format != '%') {
+--
+2.39.5
+
--- /dev/null
+From 6d1e76918d1dca67921b25b053fbee77e9199b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 16:00:39 -0700
+Subject: ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
+
+From: Sukrut Bellary <sbellary@baylibre.com>
+
+[ Upstream commit 47fe74098f3dadba2f9cc1e507d813a4aa93f5f3 ]
+
+Don't put the l4ls clk domain to sleep in case of standby.
+Since CM3 PM FW[1](ti-v4.1.y) doesn't wake-up/enable the l4ls clk domain
+upon wake-up, CM3 PM FW fails to wake-up the MPU.
+
+[1] https://git.ti.com/cgit/processor-firmware/ti-amx3-cm3-pm-firmware/
+
+Signed-off-by: Sukrut Bellary <sbellary@baylibre.com>
+Tested-by: Judith Mendez <jm@ti.com>
+Link: https://lore.kernel.org/r/20250318230042.3138542-2-sbellary@baylibre.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/clockdomain.h | 1 +
+ arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +-
+ arch/arm/mach-omap2/cm33xx.c | 14 +++++++++++++-
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h
+index 68550b23c938d..eb6ca2ea80679 100644
+--- a/arch/arm/mach-omap2/clockdomain.h
++++ b/arch/arm/mach-omap2/clockdomain.h
+@@ -48,6 +48,7 @@
+ #define CLKDM_NO_AUTODEPS (1 << 4)
+ #define CLKDM_ACTIVE_WITH_MPU (1 << 5)
+ #define CLKDM_MISSING_IDLE_REPORTING (1 << 6)
++#define CLKDM_STANDBY_FORCE_WAKEUP BIT(7)
+
+ #define CLKDM_CAN_HWSUP (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO)
+ #define CLKDM_CAN_SWSUP (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP)
+diff --git a/arch/arm/mach-omap2/clockdomains33xx_data.c b/arch/arm/mach-omap2/clockdomains33xx_data.c
+index b4d5144df4454..c53df9d42ecf8 100644
+--- a/arch/arm/mach-omap2/clockdomains33xx_data.c
++++ b/arch/arm/mach-omap2/clockdomains33xx_data.c
+@@ -27,7 +27,7 @@ static struct clockdomain l4ls_am33xx_clkdm = {
+ .pwrdm = { .name = "per_pwrdm" },
+ .cm_inst = AM33XX_CM_PER_MOD,
+ .clkdm_offs = AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET,
+- .flags = CLKDM_CAN_SWSUP,
++ .flags = CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP,
+ };
+
+ static struct clockdomain l3s_am33xx_clkdm = {
+diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
+index ac4882ebdca33..be84c6750026e 100644
+--- a/arch/arm/mach-omap2/cm33xx.c
++++ b/arch/arm/mach-omap2/cm33xx.c
+@@ -28,6 +28,9 @@
+ #include "cm-regbits-34xx.h"
+ #include "cm-regbits-33xx.h"
+ #include "prm33xx.h"
++#if IS_ENABLED(CONFIG_SUSPEND)
++#include <linux/suspend.h>
++#endif
+
+ /*
+ * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield:
+@@ -336,8 +339,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm)
+ {
+ bool hwsup = false;
+
++#if IS_ENABLED(CONFIG_SUSPEND)
++ /*
++ * In case of standby, Don't put the l4ls clk domain to sleep.
++ * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain
++ * upon wake-up, CM3 PM FW fails to wake-up th MPU.
++ */
++ if (pm_suspend_target_state == PM_SUSPEND_STANDBY &&
++ (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP))
++ return 0;
++#endif
+ hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs);
+-
+ if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP))
+ am33xx_clkdm_sleep(clkdm);
+
+--
+2.39.5
+
--- /dev/null
+From e9b2851f4a4a64e7d5903f968fdd4aea124615c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 14:29:47 +0800
+Subject: arm64/cpuinfo: only show one cpu's info in c_show()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 7bb797757bf5720543f1c5115b40a8d646d5c1cc ]
+
+Currently, when ARM64 displays CPU information, every call to c_show()
+assembles all CPU information. However, as the number of CPUs increases,
+this can lead to insufficient buffer space due to excessive assembly in
+a single call, causing repeated expansion and multiple calls to c_show().
+
+To prevent this invalid c_show() call, only one CPU's information is
+assembled each time c_show() is called.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20250421062947.4072855-1-yebin@huaweicloud.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpuinfo.c | 111 ++++++++++++++++++------------------
+ 1 file changed, 55 insertions(+), 56 deletions(-)
+
+diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
+index 591c18a889a56..bed260961d606 100644
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -138,80 +138,79 @@ static const char *const compat_hwcap2_str[] = {
+
+ static int c_show(struct seq_file *m, void *v)
+ {
+- int i, j;
++ int j;
++ int cpu = m->index;
+ bool compat = personality(current->personality) == PER_LINUX32;
++ struct cpuinfo_arm64 *cpuinfo = v;
++ u32 midr = cpuinfo->reg_midr;
+
+- for_each_online_cpu(i) {
+- struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
+- u32 midr = cpuinfo->reg_midr;
+-
+- /*
+- * glibc reads /proc/cpuinfo to determine the number of
+- * online processors, looking for lines beginning with
+- * "processor". Give glibc what it expects.
+- */
+- seq_printf(m, "processor\t: %d\n", i);
+- if (compat)
+- seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n",
+- MIDR_REVISION(midr), COMPAT_ELF_PLATFORM);
+-
+- seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
+- loops_per_jiffy / (500000UL/HZ),
+- loops_per_jiffy / (5000UL/HZ) % 100);
+-
+- /*
+- * Dump out the common processor features in a single line.
+- * Userspace should read the hwcaps with getauxval(AT_HWCAP)
+- * rather than attempting to parse this, but there's a body of
+- * software which does already (at least for 32-bit).
+- */
+- seq_puts(m, "Features\t:");
+- if (compat) {
++ /*
++ * glibc reads /proc/cpuinfo to determine the number of
++ * online processors, looking for lines beginning with
++ * "processor". Give glibc what it expects.
++ */
++ seq_printf(m, "processor\t: %d\n", cpu);
++ if (compat)
++ seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n",
++ MIDR_REVISION(midr), COMPAT_ELF_PLATFORM);
++
++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n",
++ loops_per_jiffy / (500000UL/HZ),
++ loops_per_jiffy / (5000UL/HZ) % 100);
++
++ /*
++ * Dump out the common processor features in a single line.
++ * Userspace should read the hwcaps with getauxval(AT_HWCAP)
++ * rather than attempting to parse this, but there's a body of
++ * software which does already (at least for 32-bit).
++ */
++ seq_puts(m, "Features\t:");
++ if (compat) {
+ #ifdef CONFIG_COMPAT
+- for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) {
+- if (compat_elf_hwcap & (1 << j)) {
+- /*
+- * Warn once if any feature should not
+- * have been present on arm64 platform.
+- */
+- if (WARN_ON_ONCE(!compat_hwcap_str[j]))
+- continue;
+-
+- seq_printf(m, " %s", compat_hwcap_str[j]);
+- }
++ for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) {
++ if (compat_elf_hwcap & (1 << j)) {
++ /*
++ * Warn once if any feature should not
++ * have been present on arm64 platform.
++ */
++ if (WARN_ON_ONCE(!compat_hwcap_str[j]))
++ continue;
++
++ seq_printf(m, " %s", compat_hwcap_str[j]);
+ }
++ }
+
+- for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++)
+- if (compat_elf_hwcap2 & (1 << j))
+- seq_printf(m, " %s", compat_hwcap2_str[j]);
++ for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++)
++ if (compat_elf_hwcap2 & (1 << j))
++ seq_printf(m, " %s", compat_hwcap2_str[j]);
+ #endif /* CONFIG_COMPAT */
+- } else {
+- for (j = 0; j < ARRAY_SIZE(hwcap_str); j++)
+- if (cpu_have_feature(j))
+- seq_printf(m, " %s", hwcap_str[j]);
+- }
+- seq_puts(m, "\n");
+-
+- seq_printf(m, "CPU implementer\t: 0x%02x\n",
+- MIDR_IMPLEMENTOR(midr));
+- seq_printf(m, "CPU architecture: 8\n");
+- seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr));
+- seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr));
+- seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
++ } else {
++ for (j = 0; j < ARRAY_SIZE(hwcap_str); j++)
++ if (cpu_have_feature(j))
++ seq_printf(m, " %s", hwcap_str[j]);
+ }
++ seq_puts(m, "\n");
++
++ seq_printf(m, "CPU implementer\t: 0x%02x\n",
++ MIDR_IMPLEMENTOR(midr));
++ seq_puts(m, "CPU architecture: 8\n");
++ seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr));
++ seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr));
++ seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
+
+ return 0;
+ }
+
+ static void *c_start(struct seq_file *m, loff_t *pos)
+ {
+- return *pos < 1 ? (void *)1 : NULL;
++ *pos = cpumask_next(*pos - 1, cpu_online_mask);
++ return *pos < nr_cpu_ids ? &per_cpu(cpu_data, *pos) : NULL;
+ }
+
+ static void *c_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+ ++*pos;
+- return NULL;
++ return c_start(m, pos);
+ }
+
+ static void c_stop(struct seq_file *m, void *v)
+--
+2.39.5
+
--- /dev/null
+From 6f4c256988240877d36eeb8e4d14449d6545d679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Apr 2025 09:15:05 +1000
+Subject: ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ]
+
+The ISENSE/VSENSE blocks are only powered up when the amplifier
+transitions from shutdown to active. This means that if those controls
+are flipped on while the amplifier is already playing back audio, they
+will have no effect.
+
+Fix this by forcing a power cycle around transitions in those controls.
+
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: James Calligeros <jcalligeros99@gmail.com>
+Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index 4e71dc1cf588f..48bef7e5e4002 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch =
+ static const struct snd_kcontrol_new vsense_switch =
+ SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1);
+
++static int sense_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component);
++
++ /*
++ * Powering up ISENSE/VSENSE requires a trip through the shutdown state.
++ * Do that here to ensure that our changes are applied properly, otherwise
++ * we might end up with non-functional IVSENSE if playback started earlier,
++ * which would break software speaker protection.
++ */
++ switch (event) {
++ case SND_SOC_DAPM_PRE_REG:
++ return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL,
++ TAS2770_PWR_CTRL_MASK,
++ TAS2770_PWR_CTRL_SHUTDOWN);
++ case SND_SOC_DAPM_POST_REG:
++ return tas2770_update_pwr_ctrl(tas2770);
++ default:
++ return 0;
++ }
++}
++
+ static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux),
+- SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch),
+- SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch),
++ SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch,
++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG),
++ SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch,
++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG),
+ SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_OUTPUT("OUT"),
+--
+2.39.5
+
--- /dev/null
+From 8a81bc2160229c2cf3f7aced9356efeaa419a8dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 20:37:44 +0800
+Subject: ASoC: tegra210_ahub: Add check to of_device_get_match_data()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit 04cb269c204398763a620d426cbee43064854000 ]
+
+In tegra_ahub_probe(), check the result of function
+of_device_get_match_data(), return an error code in case it fails.
+
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/tegra/tegra210_ahub.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c
+index 1b2f7cb8c6adc..686c8ff46ec8a 100644
+--- a/sound/soc/tegra/tegra210_ahub.c
++++ b/sound/soc/tegra/tegra210_ahub.c
+@@ -607,6 +607,8 @@ static int tegra_ahub_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ ahub->soc_data = of_device_get_match_data(&pdev->dev);
++ if (!ahub->soc_data)
++ return -ENODEV;
+
+ platform_set_drvdata(pdev, ahub);
+
+--
+2.39.5
+
--- /dev/null
+From a6300d8ede6ef8ffee7e647a59c6bcd9588e2246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Apr 2025 22:21:20 +0800
+Subject: bpf, sockmap: Fix data lost during EAGAIN retries
+
+From: Jiayuan Chen <jiayuan.chen@linux.dev>
+
+[ Upstream commit 7683167196bd727ad5f3c3fc6a9ca70f54520a81 ]
+
+We call skb_bpf_redirect_clear() to clean _sk_redir before handling skb in
+backlog, but when sk_psock_handle_skb() return EAGAIN due to sk_rcvbuf
+limit, the redirect info in _sk_redir is not recovered.
+
+Fix skb redir loss during EAGAIN retries by restoring _sk_redir
+information using skb_bpf_set_redir().
+
+Before this patch:
+'''
+./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress
+Setting up benchmark 'sockmap'...
+create socket fd c1:13 p1:14 c2:15 p2:16
+Benchmark 'sockmap' started.
+Send Speed 1343.172 MB/s, BPF Speed 1343.238 MB/s, Rcv Speed 65.271 MB/s
+Send Speed 1352.022 MB/s, BPF Speed 1352.088 MB/s, Rcv Speed 0 MB/s
+Send Speed 1354.105 MB/s, BPF Speed 1354.105 MB/s, Rcv Speed 0 MB/s
+Send Speed 1355.018 MB/s, BPF Speed 1354.887 MB/s, Rcv Speed 0 MB/s
+'''
+Due to the high send rate, the RX processing path may frequently hit the
+sk_rcvbuf limit. Once triggered, incorrect _sk_redir will cause the flow
+to mistakenly enter the "!ingress" path, leading to send failures.
+(The Rcv speed depends on tcp_rmem).
+
+After this patch:
+'''
+./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress
+Setting up benchmark 'sockmap'...
+create socket fd c1:13 p1:14 c2:15 p2:16
+Benchmark 'sockmap' started.
+Send Speed 1347.236 MB/s, BPF Speed 1347.367 MB/s, Rcv Speed 65.402 MB/s
+Send Speed 1353.320 MB/s, BPF Speed 1353.320 MB/s, Rcv Speed 65.536 MB/s
+Send Speed 1353.186 MB/s, BPF Speed 1353.121 MB/s, Rcv Speed 65.536 MB/s
+'''
+
+Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
+Link: https://lore.kernel.org/r/20250407142234.47591-2-jiayuan.chen@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 8a0a23079d902..b3d675c3c1ec4 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -672,7 +672,8 @@ static void sk_psock_backlog(struct work_struct *work)
+ if (ret <= 0) {
+ if (ret == -EAGAIN) {
+ sk_psock_skb_state(psock, state, len, off);
+-
++ /* Restore redir info we cleared before */
++ skb_bpf_set_redir(skb, psock->sk, ingress);
+ /* Delay slightly to prioritize any
+ * other work that might be here.
+ */
+--
+2.39.5
+
--- /dev/null
+From 88deb24705f8f59d28a6bc4da11668875c60f05e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 13:58:14 +0300
+Subject: bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 23d060136841c58c2f9ee8c08ad945d1879ead4b ]
+
+In case the MC firmware runs in debug mode with extensive prints pushed
+to the console, the current timeout of 500ms is not enough.
+Increase the timeout value so that we don't have any chance of wrongly
+assuming that the firmware is not responding when it's just taking more
+time.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20250408105814.2837951-7-ioana.ciornei@nxp.com
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/mc-sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c
+index f2052cd0a0517..b22c59d57c8f0 100644
+--- a/drivers/bus/fsl-mc/mc-sys.c
++++ b/drivers/bus/fsl-mc/mc-sys.c
+@@ -19,7 +19,7 @@
+ /*
+ * Timeout in milliseconds to wait for the completion of an MC command
+ */
+-#define MC_CMD_COMPLETION_TIMEOUT_MS 500
++#define MC_CMD_COMPLETION_TIMEOUT_MS 15000
+
+ /*
+ * usleep_range() min and max values used to throttle down polling
+--
+2.39.5
+
--- /dev/null
+From aeec9501d5d2025a3344b0c6cc36bfc9015061d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 May 2025 22:25:31 +0200
+Subject: clk: rockchip: rk3036: mark ddrphy as critical
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 596a977b34a722c00245801a5774aa79cec4e81d ]
+
+The ddrphy is supplied by the dpll, but due to the limited number of PLLs
+on the rk3036, the dpll also is used for other periperhals, like the GPU.
+
+So it happened, when the Lima driver turned off the gpu clock, this in
+turn also disabled the dpll and thus the ram.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250503202532.992033-4-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3036.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
+index d644bc155ec6e..f5f27535087a3 100644
+--- a/drivers/clk/rockchip/clk-rk3036.c
++++ b/drivers/clk/rockchip/clk-rk3036.c
+@@ -431,6 +431,7 @@ static const char *const rk3036_critical_clocks[] __initconst = {
+ "hclk_peri",
+ "pclk_peri",
+ "pclk_ddrupctl",
++ "ddrphy",
+ };
+
+ static void __init rk3036_clk_init(struct device_node *np)
+--
+2.39.5
+
--- /dev/null
+From 7c76eac4d1111f1daaf8d0d429137f3af21a5c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 14:36:24 -0300
+Subject: clocksource: Fix the CPUs' choice in the watchdog per CPU
+ verification
+
+From: Guilherme G. Piccoli <gpiccoli@igalia.com>
+
+[ Upstream commit 08d7becc1a6b8c936e25d827becabfe3bff72a36 ]
+
+Right now, if the clocksource watchdog detects a clocksource skew, it might
+perform a per CPU check, for example in the TSC case on x86. In other
+words: supposing TSC is detected as unstable by the clocksource watchdog
+running at CPU1, as part of marking TSC unstable the kernel will also run a
+check of TSC readings on some CPUs to be sure it is synced between them
+all.
+
+But that check happens only on some CPUs, not all of them; this choice is
+based on the parameter "verify_n_cpus" and in some random cpumask
+calculation. So, the watchdog runs such per CPU checks on up to
+"verify_n_cpus" random CPUs among all online CPUs, with the risk of
+repeating CPUs (that aren't double checked) in the cpumask random
+calculation.
+
+But if "verify_n_cpus" > num_online_cpus(), it should skip the random
+calculation and just go ahead and check the clocksource sync between
+all online CPUs, without the risk of skipping some CPUs due to
+duplicity in the random cpumask calculation.
+
+Tests in a 4 CPU laptop with TSC skew detected led to some cases of the per
+CPU verification skipping some CPU even with verify_n_cpus=8, due to the
+duplicity on random cpumask generation. Skipping the randomization when the
+number of online CPUs is smaller than verify_n_cpus, solves that.
+
+Suggested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Link: https://lore.kernel.org/all/20250323173857.372390-1-gpiccoli@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/clocksource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 32efc87c41f20..57575be840c5a 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -279,7 +279,7 @@ static void clocksource_verify_choose_cpus(void)
+ {
+ int cpu, i, n = verify_n_cpus;
+
+- if (n < 0) {
++ if (n < 0 || n >= num_online_cpus()) {
+ /* Check all of the CPUs. */
+ cpumask_copy(&cpus_chosen, cpu_online_mask);
+ cpumask_clear_cpu(smp_processor_id(), &cpus_chosen);
+--
+2.39.5
+
--- /dev/null
+From b3e0ac7a97e37d86e6284ebc5b55cc6a37c676de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Apr 2025 21:50:18 +0530
+Subject: cpufreq: Force sync policy boost with global boost on sysfs update
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 121baab7b88ed865532dadb7ef1aee6e2bea86f5 ]
+
+If the global boost flag is enabled and policy boost flag is disabled, a
+call to `cpufreq_boost_trigger_state(true)` must enable the policy's
+boost state.
+
+The current code misses that because of an optimization. Fix it.
+
+Suggested-by: Lifeng Zheng <zhenglifeng1@huawei.com>
+Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Link: https://patch.msgid.link/852ff11c589e6300730d207baac195b2d9d8b95f.1745511526.git.viresh.kumar@linaro.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 2c98ddf2c8db1..bbb0cbb2eb8c2 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2698,8 +2698,10 @@ int cpufreq_boost_trigger_state(int state)
+ unsigned long flags;
+ int ret = 0;
+
+- if (cpufreq_driver->boost_enabled == state)
+- return 0;
++ /*
++ * Don't compare 'cpufreq_driver->boost_enabled' with 'state' here to
++ * make sure all policies are in sync with global boost flag.
++ */
+
+ write_lock_irqsave(&cpufreq_driver_lock, flags);
+ cpufreq_driver->boost_enabled = state;
+--
+2.39.5
+
--- /dev/null
+From b31dd5aa34245dd87b0de327a3adec4b98556352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 20:53:12 -0700
+Subject: cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
+
+From: Mike Tipton <quic_mdtipton@quicinc.com>
+
+[ Upstream commit 6c9bb86922728c7a4cceb99f131e00dd87514f20 ]
+
+Currently, all SCMI devices with performance domains attempt to register
+a cpufreq driver, even if their performance domains aren't used to
+control the CPUs. The cpufreq framework only supports registering a
+single driver, so only the first device will succeed. And if that device
+isn't used for the CPUs, then cpufreq will scale the wrong domains.
+
+To avoid this, return early from scmi_cpufreq_probe() if the probing
+SCMI device isn't referenced by the CPU device phandles.
+
+This keeps the existing assumption that all CPUs are controlled by a
+single SCMI device.
+
+Signed-off-by: Mike Tipton <quic_mdtipton@quicinc.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 36 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 8c9c2f710790f..1f12109526fa6 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -288,6 +288,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = {
+ .register_em = scmi_cpufreq_register_em,
+ };
+
++static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
++{
++ struct device_node *scmi_np = dev_of_node(scmi_dev);
++ struct device_node *cpu_np, *np;
++ struct device *cpu_dev;
++ int cpu, idx;
++
++ if (!scmi_np)
++ return false;
++
++ for_each_possible_cpu(cpu) {
++ cpu_dev = get_cpu_device(cpu);
++ if (!cpu_dev)
++ continue;
++
++ cpu_np = dev_of_node(cpu_dev);
++
++ np = of_parse_phandle(cpu_np, "clocks", 0);
++ of_node_put(np);
++
++ if (np == scmi_np)
++ return true;
++
++ idx = of_property_match_string(cpu_np, "power-domain-names", "perf");
++ np = of_parse_phandle(cpu_np, "power-domains", idx);
++ of_node_put(np);
++
++ if (np == scmi_np)
++ return true;
++ }
++
++ return false;
++}
++
+ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+ {
+ int ret;
+@@ -296,7 +330,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+
+ handle = sdev->handle;
+
+- if (!handle)
++ if (!handle || !scmi_dev_used_by_cpus(dev))
+ return -ENODEV;
+
+ perf_ops = handle->devm_protocol_get(sdev, SCMI_PROTOCOL_PERF, &ph);
+--
+2.39.5
+
--- /dev/null
+From cea3062170bc06cabe9f1389b63ff1a152f4810a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 00:57:19 +0530
+Subject: drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ]
+
+This commit updates the dm_force_atomic_commit function to replace the
+usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after
+retrieving the Connector (drm_atomic_get_connector_state), CRTC
+(drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state)
+states.
+
+The function utilized PTR_ERR_OR_ZERO for error checking. However, this
+approach is inappropriate in this context because the respective
+functions do not return NULL; they return pointers that encode errors.
+
+This change ensures that error pointers are properly checked using
+IS_ERR before attempting to dereference.
+
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index e9f592bdac27f..24bb7063670ae 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10044,16 +10044,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+ */
+ conn_state = drm_atomic_get_connector_state(state, connector);
+
+- ret = PTR_ERR_OR_ZERO(conn_state);
+- if (ret)
++ /* Check for error in getting connector state */
++ if (IS_ERR(conn_state)) {
++ ret = PTR_ERR(conn_state);
+ goto out;
++ }
+
+ /* Attach crtc to drm_atomic_state*/
+ crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base);
+
+- ret = PTR_ERR_OR_ZERO(crtc_state);
+- if (ret)
++ /* Check for error in getting crtc state */
++ if (IS_ERR(crtc_state)) {
++ ret = PTR_ERR(crtc_state);
+ goto out;
++ }
+
+ /* force a restore */
+ crtc_state->mode_changed = true;
+@@ -10061,9 +10065,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+ /* Attach plane to drm_atomic_state */
+ plane_state = drm_atomic_get_plane_state(state, plane);
+
+- ret = PTR_ERR_OR_ZERO(plane_state);
+- if (ret)
++ /* Check for error in getting plane state */
++ if (IS_ERR(plane_state)) {
++ ret = PTR_ERR(plane_state);
+ goto out;
++ }
+
+ /* Call commit internally with the state we just constructed */
+ ret = drm_atomic_commit(state);
+--
+2.39.5
+
--- /dev/null
+From 792fb6e855b04caf1c74a41ef0406d179d36715c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:58:03 -0400
+Subject: drm/amdgpu/gfx10: fix CSIB handling
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 683308af030cd9b8d3f1de5cbc1ee51788878feb ]
+
+We shouldn't return after the last section.
+We need to update the rest of the CSIB.
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 938f13956aeef..d8926d510b3c6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4438,8 +4438,6 @@ static void gfx_v10_0_get_csb_buffer(struct amdgpu_device *adev,
+ PACKET3_SET_CONTEXT_REG_START);
+ for (i = 0; i < ext->reg_count; i++)
+ buffer[count++] = cpu_to_le32(ext->extent[i]);
+- } else {
+- return;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 69a2765ff9e7c469f0dae16181e337b8d3d2326f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:56:02 -0400
+Subject: drm/amdgpu/gfx6: fix CSIB handling
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 8307ebc15c1ea98a8a0b7837af1faa6c01514577 ]
+
+We shouldn't return after the last section.
+We need to update the rest of the CSIB.
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+index 6a8dadea40f92..79074d22959b9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+@@ -2897,8 +2897,6 @@ static void gfx_v6_0_get_csb_buffer(struct amdgpu_device *adev,
+ buffer[count++] = cpu_to_le32(ext->reg_index - 0xa000);
+ for (i = 0; i < ext->reg_count; i++)
+ buffer[count++] = cpu_to_le32(ext->extent[i]);
+- } else {
+- return;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From c95f86b3d9e3f6a0a8cef3e3e590b1305ce9beda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:57:19 -0400
+Subject: drm/amdgpu/gfx7: fix CSIB handling
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit be7652c23d833d1ab2c67b16e173b1a4e69d1ae6 ]
+
+We shouldn't return after the last section.
+We need to update the rest of the CSIB.
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+index 37b4a3db63602..b6e5599c8b3cd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -4005,8 +4005,6 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev,
+ buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START);
+ for (i = 0; i < ext->reg_count; i++)
+ buffer[count++] = cpu_to_le32(ext->extent[i]);
+- } else {
+- return;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 4480a7582583aa6c575cd87cb6d373e0dfbd40ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:57:34 -0400
+Subject: drm/amdgpu/gfx8: fix CSIB handling
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c8b8d7a4f1c5cdfbd61d75302fb3e3cdefb1a7ab ]
+
+We shouldn't return after the last section.
+We need to update the rest of the CSIB.
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index e0302c23e9a7e..4f54b0cf51336 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -1277,8 +1277,6 @@ static void gfx_v8_0_get_csb_buffer(struct amdgpu_device *adev,
+ PACKET3_SET_CONTEXT_REG_START);
+ for (i = 0; i < ext->reg_count; i++)
+ buffer[count++] = cpu_to_le32(ext->extent[i]);
+- } else {
+- return;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From ce2da19e22cb761f8a62bcd5bd34ca86bbb9b96b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 11:57:49 -0400
+Subject: drm/amdgpu/gfx9: fix CSIB handling
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit a4a4c0ae6742ec7d6bf1548d2c6828de440814a0 ]
+
+We shouldn't return after the last section.
+We need to update the rest of the CSIB.
+
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 811cacacc2090..6cc382197378d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1782,8 +1782,6 @@ static void gfx_v9_0_get_csb_buffer(struct amdgpu_device *adev,
+ PACKET3_SET_CONTEXT_REG_START);
+ for (i = 0; i < ext->reg_count; i++)
+ buffer[count++] = cpu_to_le32(ext->extent[i]);
+- } else {
+- return;
+ }
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 22828c80a9218041f2fa351575c1fe3c942e121e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 15:54:19 -0400
+Subject: drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit ab9fcc6362e0699fc1150aa1d8503c40fce2c1e1 ]
+
+When submitting MQD to CP, set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB bit so
+it'll allow SDMA preemption if there is a massive command buffer of
+long-running SDMA commands.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+index ddaafcd7b8256..d3503072654f3 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -403,6 +403,10 @@ static void update_mqd_sdma(struct mqd_manager *mm, void *mqd,
+ m->sdma_engine_id = q->sdma_engine_id;
+ m->sdma_queue_id = q->sdma_queue_id;
+ m->sdmax_rlcx_dummy_reg = SDMA_RLC_DUMMY_DEFAULT;
++ /* Allow context switch so we don't cross-process starve with a massive
++ * command buffer of long-running SDMA commands
++ */
++ m->sdmax_rlcx_ib_cntl |= SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK;
+
+ q->is_active = QUEUE_IS_ACTIVE(*q);
+ }
+--
+2.39.5
+
--- /dev/null
+From 0368a1d2661cc680c05ad253533a81a0565c8a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 18:41:02 +0800
+Subject: drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of
+ calling disable_irq()
+
+From: Damon Ding <damon.ding@rock-chips.com>
+
+[ Upstream commit efab13e7d13a641a22c7508cde6e1a5285161944 ]
+
+The IRQF_NO_AUTOEN can be used for the drivers that don't want
+interrupts to be enabled automatically via devm_request_threaded_irq().
+Using this flag can provide be more robust compared to the way of
+calling disable_irq() after devm_request_threaded_irq() without the
+IRQF_NO_AUTOEN flag.
+
+Suggested-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
+Link: https://lore.kernel.org/r/20250310104114.2608063-2-damon.ding@rock-chips.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index f0305f833b6c0..8c35bc016dbcc 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1771,10 +1771,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)
+ * that we can get the current state of the GPIO.
+ */
+ dp->irq = gpiod_to_irq(dp->hpd_gpiod);
+- irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING;
++ irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN;
+ } else {
+ dp->irq = platform_get_irq(pdev, 0);
+- irq_flags = 0;
++ irq_flags = IRQF_NO_AUTOEN;
+ }
+
+ if (dp->irq == -ENXIO) {
+@@ -1791,7 +1791,6 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)
+ dev_err(&pdev->dev, "failed to request irq\n");
+ goto err_disable_clk;
+ }
+- disable_irq(dp->irq);
+
+ return dp;
+
+--
+2.39.5
+
--- /dev/null
+From c98474fa2005fc7bfee2b327212736e670c1bcc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 15:12:45 +0530
+Subject: drm/bridge: anx7625: change the gpiod_set_value API
+
+From: Ayushi Makhija <quic_amakhija@quicinc.com>
+
+[ Upstream commit 50935044e58e563cdcfd556d62f27bc8744dd64e ]
+
+Use gpiod_set_value_cansleep() instead of gpiod_set_value()
+to fix the below call trace in the boot log:
+
+[ 5.690534] Call trace:
+[ 5.690536] gpiod_set_value+0x40/0xa4
+[ 5.690540] anx7625_runtime_pm_resume+0xa0/0x324 [anx7625]
+[ 5.690545] __rpm_callback+0x48/0x1d8
+[ 5.690549] rpm_callback+0x6c/0x78
+
+Certain GPIO controllers require access via message-based buses
+such as I2C or SPI, which may cause the GPIOs to enter a sleep
+state. Therefore, use the gpiod_set_value_cansleep().
+
+Signed-off-by: Ayushi Makhija <quic_amakhija@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250505094245.2660750-7-quic_amakhija@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 01612d2c034af..257f69b5e1783 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -920,10 +920,10 @@ static void anx7625_power_on(struct anx7625_data *ctx)
+ usleep_range(11000, 12000);
+
+ /* Power on pin enable */
+- gpiod_set_value(ctx->pdata.gpio_p_on, 1);
++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 1);
+ usleep_range(10000, 11000);
+ /* Power reset pin enable */
+- gpiod_set_value(ctx->pdata.gpio_reset, 1);
++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 1);
+ usleep_range(10000, 11000);
+
+ DRM_DEV_DEBUG_DRIVER(dev, "power on !\n");
+@@ -943,9 +943,9 @@ static void anx7625_power_standby(struct anx7625_data *ctx)
+ return;
+ }
+
+- gpiod_set_value(ctx->pdata.gpio_reset, 0);
++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 0);
+ usleep_range(1000, 1100);
+- gpiod_set_value(ctx->pdata.gpio_p_on, 0);
++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 0);
+ usleep_range(1000, 1100);
+
+ ret = regulator_bulk_disable(ARRAY_SIZE(ctx->pdata.supplies),
+--
+2.39.5
+
--- /dev/null
+From 15f2b35442f9449996041fed31edd6100985c30d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Apr 2025 20:21:31 +0530
+Subject: drm/msm/a6xx: Increase HFI response timeout
+
+From: Akhil P Oommen <quic_akhilpo@quicinc.com>
+
+[ Upstream commit 5f02f5e78ec9688e29b6857813185b1181796abe ]
+
+When ACD feature is enabled, it triggers some internal calibrations
+which result in a pretty long delay during the first HFI perf vote.
+So, increase the HFI response timeout to match the downstream driver.
+
+Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Tested-by: Maya Matuszczyk <maccraft123mc@gmail.com>
+Tested-by: Anthony Ruhier <aruhier@mailbox.org>
+Patchwork: https://patchwork.freedesktop.org/patch/649344/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c
+index d4c65bf0a1b7f..a40ad74877623 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c
+@@ -102,7 +102,7 @@ static int a6xx_hfi_wait_for_ack(struct a6xx_gmu *gmu, u32 id, u32 seqnum,
+
+ /* Wait for a response */
+ ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO, val,
+- val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 5000);
++ val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 1000000);
+
+ if (ret) {
+ DRM_DEV_ERROR(gmu->dev,
+--
+2.39.5
+
--- /dev/null
+From b37d8a391c91941166712b674b43473468782cff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 08:24:53 +0200
+Subject: drm/msm/dpu: don't select single flush for active CTL blocks
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit e93eee524bb78f3ee4b78654d0083382f98b3d23 ]
+
+In case of ACTIVE CTLs, a single CTL is being used for flushing all INTF
+blocks. Don't skip programming the CTL on those targets.
+
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/641585/
+Link: https://lore.kernel.org/r/20250307-dpu-active-ctl-v3-5-5d20655f10ca@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+index 7c58e9ba71b77..7ddb4df885b0f 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+@@ -360,7 +360,8 @@ static void dpu_encoder_phys_vid_underrun_irq(void *arg, int irq_idx)
+ static bool dpu_encoder_phys_vid_needs_single_flush(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- return phys_enc->split_role != ENC_ROLE_SOLO;
++ return !(phys_enc->hw_ctl->caps->features & BIT(DPU_CTL_ACTIVE_CFG)) &&
++ phys_enc->split_role != ENC_ROLE_SOLO;
+ }
+
+ static void dpu_encoder_phys_vid_mode_set(
+--
+2.39.5
+
--- /dev/null
+From 6719da31b7c261e95498a675c6d2aff96b07fd3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 03:14:52 +0300
+Subject: drm/msm/hdmi: add runtime PM calls to DDC transfer function
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 531b4e2c206e5f7dead04d9da84dfa693ac57481 ]
+
+We must be sure that the HDMI controller is powered on, while performing
+the DDC transfer. Add corresponding runtime PM calls to
+msm_hdmi_i2c_xfer().
+
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/651727/
+Link: https://lore.kernel.org/r/20250505-fd-hdmi-hpd-v5-8-48541f76318c@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c
+index de182c0048434..9c78c6c528bea 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c
+@@ -107,11 +107,15 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,
+ if (num == 0)
+ return num;
+
++ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev);
++ if (ret)
++ return ret;
++
+ init_ddc(hdmi_i2c);
+
+ ret = ddc_clear_irq(hdmi_i2c);
+ if (ret)
+- return ret;
++ goto fail;
+
+ for (i = 0; i < num; i++) {
+ struct i2c_msg *p = &msgs[i];
+@@ -169,7 +173,7 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,
+ hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS),
+ hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS),
+ hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL));
+- return ret;
++ goto fail;
+ }
+
+ ddc_status = hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS);
+@@ -202,7 +206,13 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c,
+ }
+ }
+
++ pm_runtime_put(&hdmi->pdev->dev);
++
+ return i;
++
++fail:
++ pm_runtime_put(&hdmi->pdev->dev);
++ return ret;
+ }
+
+ static u32 msm_hdmi_i2c_func(struct i2c_adapter *adapter)
+--
+2.39.5
+
--- /dev/null
+From 74bf3bf8155f9d8eb307268670c8d02b63797ed7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 May 2025 07:17:19 -0700
+Subject: emulex/benet: correct command version selection in be_cmd_get_stats()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ]
+
+Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip,
+even if it is BE2. Use 'else if' to prevent multiple assignments, setting
+version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others.
+Fixes potential incorrect version setting when BE2_chip and
+BE3_chip/lancer_chip checks could both be true.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250519141731.691136-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index 88f69c486ed09..1cdb7ca019f57 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -1608,7 +1608,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
+ /* version 1 of the cmd is not supported only by BE2 */
+ if (BE2_chip(adapter))
+ hdr->version = 0;
+- if (BE3_chip(adapter) || lancer_chip(adapter))
++ else if (BE3_chip(adapter) || lancer_chip(adapter))
+ hdr->version = 1;
+ else
+ hdr->version = 2;
+--
+2.39.5
+
--- /dev/null
+From 9e1890c06d2924e4037f0291be6ac8ef51487ecb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 13:50:39 +0900
+Subject: exfat: fix double free in delayed_free
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 ]
+
+The double free could happen in the following path.
+
+exfat_create_upcase_table()
+ exfat_create_upcase_table() : return error
+ exfat_free_upcase_table() : free ->vol_utbl
+ exfat_load_default_upcase_table : return error
+ exfat_kill_sb()
+ delayed_free()
+ exfat_free_upcase_table() <--------- double free
+This patch set ->vol_util as NULL after freeing it.
+
+Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/nls.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c
+index 314d5407a1be5..a75d5fb2404c7 100644
+--- a/fs/exfat/nls.c
++++ b/fs/exfat/nls.c
+@@ -804,4 +804,5 @@ int exfat_create_upcase_table(struct super_block *sb)
+ void exfat_free_upcase_table(struct exfat_sb_info *sbi)
+ {
+ kvfree(sbi->vol_utbl);
++ sbi->vol_utbl = NULL;
+ }
+--
+2.39.5
+
--- /dev/null
+From a576315ed497b1e0de3bd85fad5bf752e07f6a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 16:52:49 +0800
+Subject: ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in
+ ext4_ext_remove_space()
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 53ce42accd2002cc490fc86000ac532530507a74 ]
+
+When removing space, we should use EXT4_EX_NOCACHE because we don't
+need to cache extents, and we should also use EXT4_EX_NOFAIL to prevent
+metadata inconsistencies that may arise from memory allocation failures.
+While ext4_ext_remove_space() already uses these two flags in most
+places, they are missing in ext4_ext_search_right() and
+read_extent_tree_block() calls. Unify the flags to ensure consistent
+behavior throughout the extent removal process.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Link: https://patch.msgid.link/20250423085257.122685-2-yi.zhang@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 461a698794d22..e41a6d642472b 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -1531,7 +1531,7 @@ static int ext4_ext_search_left(struct inode *inode,
+ static int ext4_ext_search_right(struct inode *inode,
+ struct ext4_ext_path *path,
+ ext4_lblk_t *logical, ext4_fsblk_t *phys,
+- struct ext4_extent *ret_ex)
++ struct ext4_extent *ret_ex, int flags)
+ {
+ struct buffer_head *bh = NULL;
+ struct ext4_extent_header *eh;
+@@ -1605,7 +1605,8 @@ static int ext4_ext_search_right(struct inode *inode,
+ ix++;
+ while (++depth < path->p_depth) {
+ /* subtract from p_depth to get proper eh_depth */
+- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0);
++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth,
++ flags);
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
+ eh = ext_block_hdr(bh);
+@@ -1613,7 +1614,7 @@ static int ext4_ext_search_right(struct inode *inode,
+ put_bh(bh);
+ }
+
+- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0);
++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, flags);
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
+ eh = ext_block_hdr(bh);
+@@ -2799,6 +2800,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
+ struct partial_cluster partial;
+ handle_t *handle;
+ int i = 0, err = 0;
++ int flags = EXT4_EX_NOCACHE | EXT4_EX_NOFAIL;
+
+ partial.pclu = 0;
+ partial.lblk = 0;
+@@ -2829,8 +2831,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
+ ext4_fsblk_t pblk;
+
+ /* find extent for or closest extent to this block */
+- path = ext4_find_extent(inode, end, NULL,
+- EXT4_EX_NOCACHE | EXT4_EX_NOFAIL);
++ path = ext4_find_extent(inode, end, NULL, flags);
+ if (IS_ERR(path)) {
+ ext4_journal_stop(handle);
+ return PTR_ERR(path);
+@@ -2895,7 +2896,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
+ */
+ lblk = ex_end + 1;
+ err = ext4_ext_search_right(inode, path, &lblk, &pblk,
+- NULL);
++ NULL, flags);
+ if (err < 0)
+ goto out;
+ if (pblk) {
+@@ -2972,8 +2973,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
+ i + 1, ext4_idx_pblock(path[i].p_idx));
+ memset(path + i + 1, 0, sizeof(*path));
+ bh = read_extent_tree_block(inode, path[i].p_idx,
+- depth - i - 1,
+- EXT4_EX_NOCACHE);
++ depth - i - 1, flags);
+ if (IS_ERR(bh)) {
+ /* should we reset i_size? */
+ err = PTR_ERR(bh);
+@@ -4276,7 +4276,8 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
+ if (err)
+ goto out;
+ ar.lright = map->m_lblk;
+- err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright, &ex2);
++ err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright,
++ &ex2, 0);
+ if (err < 0)
+ goto out;
+
+--
+2.39.5
+
--- /dev/null
+From cd17d121c0232ea8c6111f5c327aa00b4918a1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 16:52:53 +0800
+Subject: ext4: prevent stale extent cache entries caused by concurrent get
+ es_cache
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit f22a0ef2231a7d8374bb021eb86404d0e9de5a02 ]
+
+The EXT4_IOC_GET_ES_CACHE and EXT4_IOC_PRECACHE_EXTENTS currently
+invokes ext4_ext_precache() to preload the extent cache without holding
+the inode's i_rwsem. This can result in stale extent cache entries when
+competing with operations such as ext4_collapse_range() which calls
+ext4_ext_remove_space() or ext4_ext_shift_extents().
+
+The problem arises when ext4_ext_remove_space() temporarily releases
+i_data_sem due to insufficient journal credits. During this interval, a
+concurrent EXT4_IOC_GET_ES_CACHE or EXT4_IOC_PRECACHE_EXTENTS may cache
+extent entries that are about to be deleted. As a result, these cached
+entries become stale and inconsistent with the actual extents.
+
+Loading the extents cache without holding the inode's i_rwsem or the
+mapping's invalidate_lock is not permitted besides during the writeback.
+Fix this by holding the i_rwsem during EXT4_IOC_GET_ES_CACHE and
+EXT4_IOC_PRECACHE_EXTENTS.
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Link: https://patch.msgid.link/20250423085257.122685-6-yi.zhang@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 2 ++
+ fs/ext4/ioctl.c | 8 +++++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index e41a6d642472b..35bc58a26f7f4 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -5041,7 +5041,9 @@ int ext4_get_es_cache(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ }
+
+ if (fieinfo->fi_flags & FIEMAP_FLAG_CACHE) {
++ inode_lock_shared(inode);
+ error = ext4_ext_precache(inode);
++ inode_unlock_shared(inode);
+ if (error)
+ return error;
+ fieinfo->fi_flags &= ~FIEMAP_FLAG_CACHE;
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 18002b0a908ce..bd90b454c6213 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1130,8 +1130,14 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ return 0;
+ }
+ case EXT4_IOC_PRECACHE_EXTENTS:
+- return ext4_ext_precache(inode);
++ {
++ int ret;
+
++ inode_lock_shared(inode);
++ ret = ext4_ext_precache(inode);
++ inode_unlock_shared(inode);
++ return ret;
++ }
+ case FS_IOC_SET_ENCRYPTION_POLICY:
+ if (!ext4_has_feature_encrypt(sb))
+ return -EOPNOTSUPP;
+--
+2.39.5
+
--- /dev/null
+From 5d0f4ea67e159f472c5bac0bfc6a7310851f076e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Apr 2025 10:33:03 +0800
+Subject: i2c: designware: Invoke runtime suspend on quick slave
+ re-registration
+
+From: Tan En De <ende.tan@starfivetech.com>
+
+[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ]
+
+Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure
+the runtime suspend is invoked immediately when unregistering a slave.
+This prevents a race condition where suspend was skipped when
+unregistering and registering slave in quick succession.
+
+For example, consider the rapid sequence of
+`delete_device -> new_device -> delete_device -> new_device`.
+In this sequence, it is observed that the dw_i2c_plat_runtime_suspend()
+might not be invoked after `delete_device` operation.
+
+This is because after `delete_device` operation, when the
+pm_runtime_put() is about to trigger suspend, the following `new_device`
+operation might race and cancel the suspend.
+
+If that happens, during the `new_device` operation,
+dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which
+means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped.
+Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is
+skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect
+the interrupt mask register using devmem, it will show as zero.
+
+Example shell script to reproduce the issue:
+```
+ #!/bin/sh
+
+ SLAVE_LADDR=0x1010
+ SLAVE_BUS=13
+ NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device
+ DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device
+
+ # Create initial device
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+ sleep 2
+
+ # Rapid sequence of
+ # delete_device -> new_device -> delete_device -> new_device
+ echo $SLAVE_LADDR > $DELETE_DEVICE
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+ echo $SLAVE_LADDR > $DELETE_DEVICE
+ echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE
+
+ # Using devmem to inspect IC_INTR_MASK will show as zero
+```
+
+Signed-off-by: Tan En De <ende.tan@starfivetech.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-slave.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
+index 5b54a9b9ed1a3..09b8ccc040c6e 100644
+--- a/drivers/i2c/busses/i2c-designware-slave.c
++++ b/drivers/i2c/busses/i2c-designware-slave.c
+@@ -97,7 +97,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
+ dev->disable(dev);
+ synchronize_irq(dev->irq);
+ dev->slave = NULL;
+- pm_runtime_put(dev->dev);
++ pm_runtime_put_sync_suspend(dev->dev);
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From ccea92b6967b4ea00d30fcc4462e041d7e9302be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 19:32:50 +0000
+Subject: i2c: npcm: Add clock toggle recovery
+
+From: Tali Perry <tali.perry1@gmail.com>
+
+[ Upstream commit 38010591a0fc3203f1cee45b01ab358b72dd9ab2 ]
+
+During init of the bus, the module checks that the bus is idle.
+If one of the lines are stuck try to recover them first before failing.
+Sometimes SDA and SCL are low if improper reset occurs (e.g., reboot).
+
+Signed-off-by: Tali Perry <tali.perry1@gmail.com>
+Signed-off-by: Mohammed Elbadry <mohammed.0.elbadry@gmail.com>
+Reviewed-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Link: https://lore.kernel.org/r/20250328193252.1570811-1-mohammed.0.elbadry@gmail.com
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c
+index d97694ac29ca9..3f30c3cff7201 100644
+--- a/drivers/i2c/busses/i2c-npcm7xx.c
++++ b/drivers/i2c/busses/i2c-npcm7xx.c
+@@ -1950,10 +1950,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode,
+
+ /* check HW is OK: SDA and SCL should be high at this point. */
+ if ((npcm_i2c_get_SDA(&bus->adap) == 0) || (npcm_i2c_get_SCL(&bus->adap) == 0)) {
+- dev_err(bus->dev, "I2C%d init fail: lines are low\n", bus->num);
+- dev_err(bus->dev, "SDA=%d SCL=%d\n", npcm_i2c_get_SDA(&bus->adap),
+- npcm_i2c_get_SCL(&bus->adap));
+- return -ENXIO;
++ dev_warn(bus->dev, " I2C%d SDA=%d SCL=%d, attempting to recover\n", bus->num,
++ npcm_i2c_get_SDA(&bus->adap), npcm_i2c_get_SCL(&bus->adap));
++ if (npcm_i2c_recovery_tgclk(&bus->adap)) {
++ dev_err(bus->dev, "I2C%d init fail: SDA=%d SCL=%d\n",
++ bus->num, npcm_i2c_get_SDA(&bus->adap),
++ npcm_i2c_get_SCL(&bus->adap));
++ return -ENXIO;
++ }
+ }
+
+ npcm_i2c_int_enable(bus, true);
+--
+2.39.5
+
--- /dev/null
+From 7650410f5be56cb204d8e4df08ef6d69fab7a87d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 14:16:02 +0900
+Subject: i40e: fix MMIO write access to an invalid page in i40e_clear_hw
+
+From: Kyungwook Boo <bookyungwook@gmail.com>
+
+[ Upstream commit 015bac5daca978448f2671478c553ce1f300c21e ]
+
+When the device sends a specific input, an integer underflow can occur, leading
+to MMIO write access to an invalid page.
+
+Prevent the integer underflow by changing the type of related variables.
+
+Signed-off-by: Kyungwook Boo <bookyungwook@gmail.com>
+Link: https://lore.kernel.org/lkml/ffc91764-1142-4ba2-91b6-8c773f6f7095@gmail.com/T/
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 99dd8187476ba..fe8e6db53f23b 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -1061,10 +1061,11 @@ int i40e_pf_reset(struct i40e_hw *hw)
+ void i40e_clear_hw(struct i40e_hw *hw)
+ {
+ u32 num_queues, base_queue;
+- u32 num_pf_int;
+- u32 num_vf_int;
++ s32 num_pf_int;
++ s32 num_vf_int;
+ u32 num_vfs;
+- u32 i, j;
++ s32 i;
++ u32 j;
+ u32 val;
+ u32 eol = 0x7ff;
+
+--
+2.39.5
+
--- /dev/null
+From d9138ad956087377936b8494e57898eab8b7807c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 20:10:48 -0700
+Subject: iommu/amd: Ensure GA log notifier callbacks finish running before
+ module unload
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 94c721ea03c7078163f41dbaa101ac721ddac329 ]
+
+Synchronize RCU when unregistering KVM's GA log notifier to ensure all
+in-flight interrupt handlers complete before KVM-the module is unloaded.
+
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Link: https://lore.kernel.org/r/20250315031048.2374109-1-seanjc@google.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 7d38cc5c04e68..714c78bf69db0 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -679,6 +679,14 @@ int amd_iommu_register_ga_log_notifier(int (*notifier)(u32))
+ {
+ iommu_ga_log_notifier = notifier;
+
++ /*
++ * Ensure all in-flight IRQ handlers run to completion before returning
++ * to the caller, e.g. to ensure module code isn't unloaded while it's
++ * being executed in the IRQ handler.
++ */
++ if (!notifier)
++ synchronize_rcu();
++
+ return 0;
+ }
+ EXPORT_SYMBOL(amd_iommu_register_ga_log_notifier);
+--
+2.39.5
+
--- /dev/null
+From e461fb22e49106a70945cb76070bf4976aefea42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 11:27:24 +0200
+Subject: ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ]
+
+The statistics are incremented with raw_cpu_inc() assuming it always
+happens with bottom half disabled. Without per-CPU locking in
+local_bh_disable() on PREEMPT_RT this is no longer true.
+
+Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about
+preemption.
+
+Cc: David Ahern <dsahern@kernel.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://patch.msgid.link/20250512092736.229935-4-bigeasy@linutronix.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index a4884d434038e..cbc584c386e9e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -200,7 +200,11 @@ const __u8 ip_tos2prio[16] = {
+ EXPORT_SYMBOL(ip_tos2prio);
+
+ static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
++#ifndef CONFIG_PREEMPT_RT
+ #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
++#else
++#define RT_CACHE_STAT_INC(field) this_cpu_inc(rt_cache_stat.field)
++#endif
+
+ #ifdef CONFIG_PROC_FS
+ static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
+--
+2.39.5
+
--- /dev/null
+From 2afcb553311d44713e662a780c95ab92e1aa99b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 20:59:16 +0530
+Subject: jfs: fix array-index-out-of-bounds read in add_missing_indices
+
+From: Aditya Dutt <duttaditya18@gmail.com>
+
+[ Upstream commit 5dff41a86377563f7a2b968aae00d25b4ceb37c9 ]
+
+stbl is s8 but it must contain offsets into slot which can go from 0 to
+127.
+
+Added a bound check for that error and return -EIO if the check fails.
+Also make jfs_readdir return with error if add_missing_indices returns
+with an error.
+
+Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b
+Signed-off-by: Aditya Dutt <duttaditya18@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dtree.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 417d1c2fc2911..27ca98614b0bb 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -2909,7 +2909,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)
+ * fsck.jfs should really fix this, but it currently does not.
+ * Called from jfs_readdir when bad index is detected.
+ */
+-static void add_missing_indices(struct inode *inode, s64 bn)
++static int add_missing_indices(struct inode *inode, s64 bn)
+ {
+ struct ldtentry *d;
+ struct dt_lock *dtlck;
+@@ -2918,7 +2918,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
+ struct lv *lv;
+ struct metapage *mp;
+ dtpage_t *p;
+- int rc;
++ int rc = 0;
+ s8 *stbl;
+ tid_t tid;
+ struct tlock *tlck;
+@@ -2943,6 +2943,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)
+
+ stbl = DT_GETSTBL(p);
+ for (i = 0; i < p->header.nextindex; i++) {
++ if (stbl[i] < 0) {
++ jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",
++ i, stbl[i], (long)inode->i_ino, (long long)bn);
++ rc = -EIO;
++
++ DT_PUTPAGE(mp);
++ txAbort(tid, 0);
++ goto end;
++ }
++
+ d = (struct ldtentry *) &p->slot[stbl[i]];
+ index = le32_to_cpu(d->index);
+ if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
+@@ -2960,6 +2970,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
+ (void) txCommit(tid, 1, &inode, 0);
+ end:
+ txEnd(tid);
++ return rc;
+ }
+
+ /*
+@@ -3313,7 +3324,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
+ }
+
+ if (fix_page) {
+- add_missing_indices(ip, bn);
++ if ((rc = add_missing_indices(ip, bn)))
++ goto out;
+ page_fixed = 1;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From d990199c39eabd75de3a7c1c97a66905317aa48b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 16:02:00 +0800
+Subject: jfs: Fix null-ptr-deref in jfs_ioc_trim
+
+From: Dylan Wolff <wolffd@comp.nus.edu.sg>
+
+[ Upstream commit a4685408ff6c3e2af366ad9a7274f45ff3f394ee ]
+
+[ Syzkaller Report ]
+
+Oops: general protection fault, probably for non-canonical address
+0xdffffc0000000087: 0000 [#1
+KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f]
+CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted
+6.13.0-rc6-gfbfd64d25c7a-dirty #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Sched_ext: serialise (enabled+all), task: runnable_at=-30ms
+RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
+Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
+90 82 fe ff 4c 89 ff 31 f6
+RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
+RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a
+RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
+RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000
+R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000
+R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438
+FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+<TASK>
+? __die_body+0x61/0xb0
+? die_addr+0xb1/0xe0
+? exc_general_protection+0x333/0x510
+? asm_exc_general_protection+0x26/0x30
+? jfs_ioc_trim+0x34b/0x8f0
+jfs_ioctl+0x3c8/0x4f0
+? __pfx_jfs_ioctl+0x10/0x10
+? __pfx_jfs_ioctl+0x10/0x10
+__se_sys_ioctl+0x269/0x350
+? __pfx___se_sys_ioctl+0x10/0x10
+? do_syscall_64+0xfb/0x210
+do_syscall_64+0xee/0x210
+? syscall_exit_to_user_mode+0x1e0/0x330
+entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7fe51f4903ad
+Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
+89 f7 48 89 d6 48 89 ca 4d
+RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad
+RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005
+RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640
+R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000
+</TASK>
+Modules linked in:
+---[ end trace 0000000000000000 ]---
+RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
+Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
+90 82 fe ff 4c 89 ff 31 f6
+RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
+RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a
+RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
+RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000
+R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000
+R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438
+FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Kernel panic - not syncing: Fatal exception
+
+[ Analysis ]
+
+We believe that we have found a concurrency bug in the `fs/jfs` module
+that results in a null pointer dereference. There is a closely related
+issue which has been fixed:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234
+
+... but, unfortunately, the accepted patch appears to still be
+susceptible to a null pointer dereference under some interleavings.
+
+To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set
+to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This
+bug manifests quite rarely under normal circumstances, but is
+triggereable from a syz-program.
+
+Reported-and-tested-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg>
+Reported-and-tested-by: Jiacheng Xu <stitch@zju.edu.cn>
+Signed-off-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg>
+Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_discard.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c
+index 5f4b305030ad5..4b660296caf39 100644
+--- a/fs/jfs/jfs_discard.c
++++ b/fs/jfs/jfs_discard.c
+@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
+ down_read(&sb->s_umount);
+ bmp = JFS_SBI(ip->i_sb)->bmap;
+
+- if (minlen > bmp->db_agsize ||
++ if (bmp == NULL ||
++ minlen > bmp->db_agsize ||
+ start >= bmp->db_mapsize ||
+ range->len < sb->s_blocksize) {
+ up_read(&sb->s_umount);
+--
+2.39.5
+
--- /dev/null
+From 868cfa6356fe779a38736bbb6790c78030135662 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 17:10:42 +0100
+Subject: libbpf: Add identical pointer detection to btf_dedup_is_equiv()
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 8e64c387c942229c551d0f23de4d9993d3a2acb6 ]
+
+Recently as a side-effect of
+
+commit ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro")
+
+issues were observed in deduplication between modules and kernel BTF
+such that a large number of kernel types were not deduplicated so
+were found in module BTF (task_struct, bpf_prog etc). The root cause
+appeared to be a failure to dedup struct types, specifically those
+with members that were pointers with __percpu annotations.
+
+The issue in dedup is at the point that we are deduplicating structures,
+we have not yet deduplicated reference types like pointers. If multiple
+copies of a pointer point at the same (deduplicated) integer as in this
+case, we do not see them as identical. Special handling already exists
+to deal with structures and arrays, so add pointer handling here too.
+
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index fd23095129782..4d29bd28520ae 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -3770,6 +3770,19 @@ static bool btf_dedup_identical_structs(struct btf_dedup *d, __u32 id1, __u32 id
+ return true;
+ }
+
++static bool btf_dedup_identical_ptrs(struct btf_dedup *d, __u32 id1, __u32 id2)
++{
++ struct btf_type *t1, *t2;
++
++ t1 = btf_type_by_id(d->btf, id1);
++ t2 = btf_type_by_id(d->btf, id2);
++
++ if (!btf_is_ptr(t1) || !btf_is_ptr(t2))
++ return false;
++
++ return t1->type == t2->type;
++}
++
+ /*
+ * Check equivalence of BTF type graph formed by candidate struct/union (we'll
+ * call it "candidate graph" in this description for brevity) to a type graph
+@@ -3902,6 +3915,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
+ */
+ if (btf_dedup_identical_structs(d, hypot_type_id, cand_id))
+ return 1;
++ /* A similar case is again observed for PTRs. */
++ if (btf_dedup_identical_ptrs(d, hypot_type_id, cand_id))
++ return 1;
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 77e7df348ac7e012656e6855ba8164d03528628e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 14:27:58 +0200
+Subject: media: ccs-pll: Better validate VT PLL branch
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit cd9cb0313a42ae029cd5af9293b0add984ed252e ]
+
+Check that the VT PLL dividers are actually found, don't trust they always
+are even though they should be.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ccs-pll.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/ccs-pll.c b/drivers/media/i2c/ccs-pll.c
+index c876ea851ed7c..fe9e3a90749de 100644
+--- a/drivers/media/i2c/ccs-pll.c
++++ b/drivers/media/i2c/ccs-pll.c
+@@ -442,7 +442,7 @@ static int ccs_pll_calculate_vt_tree(struct device *dev,
+ return -EINVAL;
+ }
+
+-static void
++static int
+ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim,
+ const struct ccs_pll_branch_limits_bk *op_lim_bk,
+ struct ccs_pll *pll, struct ccs_pll_branch_fr *pll_fr,
+@@ -565,6 +565,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim,
+ if (best_pix_div < SHRT_MAX >> 1)
+ break;
+ }
++ if (best_pix_div == SHRT_MAX >> 1)
++ return -EINVAL;
+
+ pll->vt_bk.sys_clk_div = DIV_ROUND_UP(vt_div, best_pix_div);
+ pll->vt_bk.pix_clk_div = best_pix_div;
+@@ -577,6 +579,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim,
+ out_calc_pixel_rate:
+ pll->pixel_rate_pixel_array =
+ pll->vt_bk.pix_clk_freq_hz * pll->vt_lanes;
++
++ return 0;
+ }
+
+ /*
+@@ -852,8 +856,10 @@ int ccs_pll_calculate(struct device *dev, const struct ccs_pll_limits *lim,
+ if (pll->flags & CCS_PLL_FLAG_DUAL_PLL)
+ break;
+
+- ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr,
+- op_pll_bk, cphy, phy_const);
++ rval = ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr,
++ op_pll_bk, cphy, phy_const);
++ if (rval)
++ continue;
+
+ rval = check_bk_bounds(dev, lim, pll, PLL_VT);
+ if (rval)
+--
+2.39.5
+
--- /dev/null
+From 84d442ee7cdce5c2b0f50825cf49074a7b2143b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Mar 2025 11:13:29 +0530
+Subject: media: i2c: imx334: Enable runtime PM before sub-device registration
+
+From: Tarang Raval <tarang.raval@siliconsignals.io>
+
+[ Upstream commit 01dfdf6a80c57151af0589af0db7adbbdd1361c7 ]
+
+Runtime PM is fully initialized before calling
+v4l2_async_register_subdev_sensor(). Moving the runtime PM initialization
+earlier prevents potential access to an uninitialized or powered-down
+device.
+
+Signed-off-by: Tarang Raval <tarang.raval@siliconsignals.io>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx334.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c
+index 062125501788a..57b7416bbfab3 100644
+--- a/drivers/media/i2c/imx334.c
++++ b/drivers/media/i2c/imx334.c
+@@ -1058,6 +1058,9 @@ static int imx334_probe(struct i2c_client *client)
+ goto error_handler_free;
+ }
+
++ pm_runtime_set_active(imx334->dev);
++ pm_runtime_enable(imx334->dev);
++
+ ret = v4l2_async_register_subdev_sensor(&imx334->sd);
+ if (ret < 0) {
+ dev_err(imx334->dev,
+@@ -1065,13 +1068,13 @@ static int imx334_probe(struct i2c_client *client)
+ goto error_media_entity;
+ }
+
+- pm_runtime_set_active(imx334->dev);
+- pm_runtime_enable(imx334->dev);
+ pm_runtime_idle(imx334->dev);
+
+ return 0;
+
+ error_media_entity:
++ pm_runtime_disable(imx334->dev);
++ pm_runtime_set_suspended(imx334->dev);
+ media_entity_cleanup(&imx334->sd.entity);
+ error_handler_free:
+ v4l2_ctrl_handler_free(imx334->sd.ctrl_handler);
+--
+2.39.5
+
--- /dev/null
+From 5006da10235254b9876d42ffcfc5fd0d04d31139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Mar 2025 11:13:28 +0530
+Subject: media: i2c: imx334: Fix runtime PM handling in remove function
+
+From: Tarang Raval <tarang.raval@siliconsignals.io>
+
+[ Upstream commit b493cd3c03641f9bbaa9787e43ca92163cb50051 ]
+
+pm_runtime_suspended() only checks the current runtime PM status and does
+not modify it, making it ineffective in this context. This could result in
+improper power management if the device remains active when removed.
+
+This patch fixes the issue by introducing a check with
+pm_runtime_status_suspended() to determine if the device is already
+suspended. If it is not, it calls imx334_power_off() to power down the
+device and then uses pm_runtime_set_suspended() to correctly update the
+runtime PM status to suspended.
+
+Signed-off-by: Tarang Raval <tarang.raval@siliconsignals.io>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx334.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c
+index 57b7416bbfab3..af09aafeddf78 100644
+--- a/drivers/media/i2c/imx334.c
++++ b/drivers/media/i2c/imx334.c
+@@ -1102,7 +1102,10 @@ static int imx334_remove(struct i2c_client *client)
+ v4l2_ctrl_handler_free(sd->ctrl_handler);
+
+ pm_runtime_disable(&client->dev);
+- pm_runtime_suspended(&client->dev);
++ if (!pm_runtime_status_suspended(&client->dev)) {
++ imx334_power_off(&client->dev);
++ pm_runtime_set_suspended(&client->dev);
++ }
+
+ mutex_destroy(&imx334->mutex);
+
+--
+2.39.5
+
--- /dev/null
+From 6faa6b1e10f26a32c691e4982a3824130f3c244a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 10:44:41 +0530
+Subject: media: i2c: imx334: update mode_3840x2160_regs array
+
+From: Shravan Chippa <shravan.chippa@microchip.com>
+
+[ Upstream commit 35132d039c566b0e9d8e53f76f512b22607c2405 ]
+
+The 3840x2160 mode operates with the imx334 reset values.
+If we switch to other modes and then return to the 3840x2160 mode,
+it should function correctly. so updated the mode_3840x2160_regs
+array with the imx334 reset values.
+
+Signed-off-by: Shravan Chippa <shravan.chippa@microchip.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx334.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c
+index af09aafeddf78..88ce5ec9c1822 100644
+--- a/drivers/media/i2c/imx334.c
++++ b/drivers/media/i2c/imx334.c
+@@ -168,6 +168,12 @@ static const struct imx334_reg mode_3840x2160_regs[] = {
+ {0x302c, 0x3c},
+ {0x302e, 0x00},
+ {0x302f, 0x0f},
++ {0x3074, 0xb0},
++ {0x3075, 0x00},
++ {0x308e, 0xb1},
++ {0x308f, 0x00},
++ {0x30d8, 0x20},
++ {0x30d9, 0x12},
+ {0x3076, 0x70},
+ {0x3077, 0x08},
+ {0x3090, 0x70},
+--
+2.39.5
+
--- /dev/null
+From 15eb3d63976814b9ef39bca823761e049d345310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 10:13:45 +0800
+Subject: media: platform: exynos4-is: Add hardware sync wait to
+ fimc_is_hw_change_mode()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit bd9f6ce7d512fa21249415c16af801a4ed5d97b6 ]
+
+In fimc_is_hw_change_mode(), the function changes camera modes without
+waiting for hardware completion, risking corrupted data or system hangs
+if subsequent operations proceed before the hardware is ready.
+
+Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring
+hardware state synchronization and stable interrupt handling.
+
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/fimc-is-regs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/exynos4-is/fimc-is-regs.c b/drivers/media/platform/exynos4-is/fimc-is-regs.c
+index 366e6393817d2..5f9c44e825a5f 100644
+--- a/drivers/media/platform/exynos4-is/fimc-is-regs.c
++++ b/drivers/media/platform/exynos4-is/fimc-is-regs.c
+@@ -164,6 +164,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is)
+ if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd)))
+ return -EINVAL;
+
++ fimc_is_hw_wait_intmsr0_intmsd0(is);
+ mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0));
+ mcuctl_write(is->sensor_index, is, MCUCTL_REG_ISSR(1));
+ mcuctl_write(is->setfile.sub_index, is, MCUCTL_REG_ISSR(2));
+--
+2.39.5
+
--- /dev/null
+From 39c853c50c077335977ee2c823081880aa697c55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 15:55:48 -0400
+Subject: media: rkvdec: Initialize the m2m context before the controls
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit d43d7db3c8a1868dcbc6cb8de90a3cdf309d6cbb ]
+
+Setting up the control handler calls into .s_ctrl ops. While validating
+the controls the ops may need to access some of the context state, which
+could lead to a crash if not properly initialized.
+
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index 9c85370fd81bc..41b93f09e6df0 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -794,24 +794,24 @@ static int rkvdec_open(struct file *filp)
+ rkvdec_reset_decoded_fmt(ctx);
+ v4l2_fh_init(&ctx->fh, video_devdata(filp));
+
+- ret = rkvdec_init_ctrls(ctx);
+- if (ret)
+- goto err_free_ctx;
+-
+ ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(rkvdec->m2m_dev, ctx,
+ rkvdec_queue_init);
+ if (IS_ERR(ctx->fh.m2m_ctx)) {
+ ret = PTR_ERR(ctx->fh.m2m_ctx);
+- goto err_cleanup_ctrls;
++ goto err_free_ctx;
+ }
+
++ ret = rkvdec_init_ctrls(ctx);
++ if (ret)
++ goto err_cleanup_m2m_ctx;
++
+ filp->private_data = &ctx->fh;
+ v4l2_fh_add(&ctx->fh);
+
+ return 0;
+
+-err_cleanup_ctrls:
+- v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
++err_cleanup_m2m_ctx:
++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+
+ err_free_ctx:
+ kfree(ctx);
+--
+2.39.5
+
--- /dev/null
+From 1935f6f105524cb775f5d34e564bef5ab31559c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 11:54:17 +0200
+Subject: media: tc358743: ignore video while HPD is low
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit 6829c5b5d26b1be31880d74ec24cb32d2d75f1ae ]
+
+If the HPD is low (happens if there is no EDID or the
+EDID is being updated), then return -ENOLINK in
+tc358743_get_detected_timings() instead of detecting video.
+
+This avoids userspace thinking that it can start streaming when
+the HPD is low.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Tested-by: Maxime Ripard <mripard@kernel.org>
+Link: https://lore.kernel.org/linux-media/20240628-stoic-bettong-of-fortitude-e25611@houat/
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 6f5ca3d63dbdb..87feada1f6020 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -309,6 +309,10 @@ static int tc358743_get_detected_timings(struct v4l2_subdev *sd,
+
+ memset(timings, 0, sizeof(struct v4l2_dv_timings));
+
++ /* if HPD is low, ignore any video */
++ if (!(i2c_rd8(sd, HPD_CTL) & MASK_HPD_OUT0))
++ return -ENOLINK;
++
+ if (no_signal(sd)) {
+ v4l2_dbg(1, debug, sd, "%s: no valid signal\n", __func__);
+ return -ENOLINK;
+--
+2.39.5
+
--- /dev/null
+From aa87c25c24a0d234c810732cad80ae8a790fd860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 13:34:02 +0200
+Subject: media: ti: cal: Fix wrong goto on error path
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit a5b18fd769b7dc2e77a9e6a390844cbf50626ae8 ]
+
+If pm_runtime_resume_and_get() fails, we should unprepare the context,
+but currently we skip that as we goto to a later line.
+
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/cal-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/ti-vpe/cal-video.c b/drivers/media/platform/ti-vpe/cal-video.c
+index d87177d04e921..2e93c1b8f3597 100644
+--- a/drivers/media/platform/ti-vpe/cal-video.c
++++ b/drivers/media/platform/ti-vpe/cal-video.c
+@@ -744,7 +744,7 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
+
+ ret = pm_runtime_resume_and_get(ctx->cal->dev);
+ if (ret < 0)
+- goto error_pipeline;
++ goto error_unprepare;
+
+ cal_ctx_set_dma_addr(ctx, addr);
+ cal_ctx_start(ctx);
+@@ -761,8 +761,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
+ error_stop:
+ cal_ctx_stop(ctx);
+ pm_runtime_put_sync(ctx->cal->dev);
++error_unprepare:
+ cal_ctx_unprepare(ctx);
+-
+ error_pipeline:
+ media_pipeline_stop(&ctx->vdev.entity);
+ error_release_buffers:
+--
+2.39.5
+
--- /dev/null
+From 4810866108fc230cfe71f50b47354c111db0a466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2024 15:10:32 +0900
+Subject: media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
+
+From: Nas Chung <nas.chung@chipsnmedia.com>
+
+[ Upstream commit ad2698efce37e910dcf3c3914263e6cb3e86f8cd ]
+
+Explicitly compare a buffer type only with valid buffer types,
+to avoid matching a buffer type outside of the valid buffer type set.
+
+Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
+Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 4e305496edf27..96802f9b0955d 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -153,10 +153,18 @@ enum v4l2_buf_type {
+ V4L2_BUF_TYPE_SDR_OUTPUT = 12,
+ V4L2_BUF_TYPE_META_CAPTURE = 13,
+ V4L2_BUF_TYPE_META_OUTPUT = 14,
++ /*
++ * Note: V4L2_TYPE_IS_VALID and V4L2_TYPE_IS_OUTPUT must
++ * be updated if a new type is added.
++ */
+ /* Deprecated, do not use */
+ V4L2_BUF_TYPE_PRIVATE = 0x80,
+ };
+
++#define V4L2_TYPE_IS_VALID(type) \
++ ((type) >= V4L2_BUF_TYPE_VIDEO_CAPTURE &&\
++ (type) <= V4L2_BUF_TYPE_META_OUTPUT)
++
+ #define V4L2_TYPE_IS_MULTIPLANAR(type) \
+ ((type) == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE \
+ || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+@@ -170,7 +178,8 @@ enum v4l2_buf_type {
+ || (type) == V4L2_BUF_TYPE_SDR_OUTPUT \
+ || (type) == V4L2_BUF_TYPE_META_OUTPUT)
+
+-#define V4L2_TYPE_IS_CAPTURE(type) (!V4L2_TYPE_IS_OUTPUT(type))
++#define V4L2_TYPE_IS_CAPTURE(type) \
++ (V4L2_TYPE_IS_VALID(type) && !V4L2_TYPE_IS_OUTPUT(type))
+
+ enum v4l2_tuner_type {
+ V4L2_TUNER_RADIO = 1,
+--
+2.39.5
+
--- /dev/null
+From c61ece18b2c25e9f43478886145dde79b75d8a9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2024 15:10:34 +0900
+Subject: media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
+
+From: Nas Chung <nas.chung@chipsnmedia.com>
+
+[ Upstream commit f81f69a0e3da141bdd73a16b8676f4e542533d87 ]
+
+V4L2_TYPE_IS_OUTPUT() returns true for V4L2_BUF_TYPE_VIDEO_OVERLAY
+which definitely belongs to CAPTURE.
+
+Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/videodev2.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index f5c6758464f25..4e305496edf27 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -164,7 +164,6 @@ enum v4l2_buf_type {
+ #define V4L2_TYPE_IS_OUTPUT(type) \
+ ((type) == V4L2_BUF_TYPE_VIDEO_OUTPUT \
+ || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE \
+- || (type) == V4L2_BUF_TYPE_VIDEO_OVERLAY \
+ || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY \
+ || (type) == V4L2_BUF_TYPE_VBI_OUTPUT \
+ || (type) == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT \
+--
+2.39.5
+
--- /dev/null
+From 0d6ec3605ed8cff9b637a54e1da482aa238b5970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 21:48:10 +0800
+Subject: net: atlantic: generate software timestamp just before the doorbell
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit 285ad7477559b6b5ceed10ba7ecfed9d17c0e7c6 ]
+
+Make sure the call of skb_tx_timestamp is as close as possible to the
+doorbell.
+
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Link: https://patch.msgid.link/20250510134812.48199-2-kerneljasonxing@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 -
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index 45ed097bfe49a..026e628664a9d 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -117,7 +117,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd
+ }
+ #endif
+
+- skb_tx_timestamp(skb);
+ return aq_nic_xmit(aq_nic, skb);
+ }
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 25349a2ae5cfe..2afa61e9bf8c6 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -751,6 +751,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
+
+ frags = aq_nic_map_skb(self, skb, ring);
+
++ skb_tx_timestamp(skb);
++
+ if (likely(frags)) {
+ err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw,
+ ring, frags);
+--
+2.39.5
+
--- /dev/null
+From be3f616778ee9fcb74d6b87d5c323f62da997ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 15:43:12 +0200
+Subject: net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
+ functions
+
+From: Yong Wang <yongwang@nvidia.com>
+
+[ Upstream commit 4b30ae9adb047dd0a7982975ec3933c529537026 ]
+
+When a bridge port STP state is changed from BLOCKING/DISABLED to
+FORWARDING, the port's igmp query timer will NOT re-arm itself if the
+bridge has been configured as per-VLAN multicast snooping.
+
+Solve this by choosing the correct multicast context(s) to enable/disable
+port multicast based on whether per-VLAN multicast snooping is enabled or
+not, i.e. using per-{port, VLAN} context in case of per-VLAN multicast
+snooping by re-implementing br_multicast_enable_port() and
+br_multicast_disable_port() functions.
+
+Before the patch, the IGMP query does not happen in the last step of the
+following test sequence, i.e. no growth for tx counter:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # bridge link set dev swp1 state 0
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge link set dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+
+After the patch, the IGMP query happens in the last step of the test:
+ # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1
+ # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0
+ # ip link add name swp1 up master br1 type dummy
+ # bridge link set dev swp1 state 0
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # sleep 1
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+1
+ # bridge link set dev swp1 state 3
+ # sleep 2
+ # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]'
+3
+
+Signed-off-by: Yong Wang <yongwang@nvidia.com>
+Reviewed-by: Andy Roulin <aroulin@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_multicast.c | 77 +++++++++++++++++++++++++++++++++++----
+ 1 file changed, 69 insertions(+), 8 deletions(-)
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 3cd2b648408d6..085c9e706bc47 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1931,12 +1931,17 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ }
+ }
+
+-void br_multicast_enable_port(struct net_bridge_port *port)
++static void br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ {
+- struct net_bridge *br = port->br;
++ struct net_bridge *br = pmctx->port->br;
+
+ spin_lock_bh(&br->multicast_lock);
+- __br_multicast_enable_port_ctx(&port->multicast_ctx);
++ if (br_multicast_port_ctx_is_vlan(pmctx) &&
++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) {
++ spin_unlock_bh(&br->multicast_lock);
++ return;
++ }
++ __br_multicast_enable_port_ctx(pmctx);
+ spin_unlock_bh(&br->multicast_lock);
+ }
+
+@@ -1963,11 +1968,67 @@ static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx)
+ br_multicast_rport_del_notify(pmctx, del);
+ }
+
++static void br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx)
++{
++ struct net_bridge *br = pmctx->port->br;
++
++ spin_lock_bh(&br->multicast_lock);
++ if (br_multicast_port_ctx_is_vlan(pmctx) &&
++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) {
++ spin_unlock_bh(&br->multicast_lock);
++ return;
++ }
++
++ __br_multicast_disable_port_ctx(pmctx);
++ spin_unlock_bh(&br->multicast_lock);
++}
++
++static void br_multicast_toggle_port(struct net_bridge_port *port, bool on)
++{
++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
++ if (br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) {
++ struct net_bridge_vlan_group *vg;
++ struct net_bridge_vlan *vlan;
++
++ rcu_read_lock();
++ vg = nbp_vlan_group_rcu(port);
++ if (!vg) {
++ rcu_read_unlock();
++ return;
++ }
++
++ /* iterate each vlan, toggle vlan multicast context */
++ list_for_each_entry_rcu(vlan, &vg->vlan_list, vlist) {
++ struct net_bridge_mcast_port *pmctx =
++ &vlan->port_mcast_ctx;
++ u8 state = br_vlan_get_state(vlan);
++ /* enable vlan multicast context when state is
++ * LEARNING or FORWARDING
++ */
++ if (on && br_vlan_state_allowed(state, true))
++ br_multicast_enable_port_ctx(pmctx);
++ else
++ br_multicast_disable_port_ctx(pmctx);
++ }
++ rcu_read_unlock();
++ return;
++ }
++#endif
++ /* toggle port multicast context when vlan snooping is disabled */
++ if (on)
++ br_multicast_enable_port_ctx(&port->multicast_ctx);
++ else
++ br_multicast_disable_port_ctx(&port->multicast_ctx);
++}
++
++void br_multicast_enable_port(struct net_bridge_port *port)
++{
++ br_multicast_toggle_port(port, true);
++}
++
+ void br_multicast_disable_port(struct net_bridge_port *port)
+ {
+- spin_lock_bh(&port->br->multicast_lock);
+- __br_multicast_disable_port_ctx(&port->multicast_ctx);
+- spin_unlock_bh(&port->br->multicast_lock);
++ br_multicast_toggle_port(port, false);
+ }
+
+ static int __grp_src_delete_marked(struct net_bridge_port_group *pg)
+@@ -4130,9 +4191,9 @@ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on,
+ __br_multicast_open(&br->multicast_ctx);
+ list_for_each_entry(p, &br->port_list, list) {
+ if (on)
+- br_multicast_disable_port(p);
++ br_multicast_disable_port_ctx(&p->multicast_ctx);
+ else
+- br_multicast_enable_port(p);
++ br_multicast_enable_port_ctx(&p->multicast_ctx);
+ }
+
+ list_for_each_entry(vlan, &vg->vlan_list, vlist)
+--
+2.39.5
+
--- /dev/null
+From c2cb5ecd479b7b5162851a0431a4bc697066d1f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 16:53:31 +0900
+Subject: net: dlink: add synchronization for stats update
+
+From: Moon Yeounsu <yyyynoom@gmail.com>
+
+[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ]
+
+This patch synchronizes code that accesses from both user-space
+and IRQ contexts. The `get_stats()` function can be called from both
+context.
+
+`dev->stats.tx_errors` and `dev->stats.collisions` are also updated
+in the `tx_errors()` function. Therefore, these fields must also be
+protected by synchronized.
+
+There is no code that accessses `dev->stats.tx_errors` between the
+previous and updated lines, so the updating point can be moved.
+
+Signed-off-by: Moon Yeounsu <yyyynoom@gmail.com>
+Link: https://patch.msgid.link/20250515075333.48290-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++-
+ drivers/net/ethernet/dlink/dl2k.h | 2 ++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index af0b6fa296e56..09a275eb44487 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent)
+ np->ioaddr = ioaddr;
+ np->chip_id = chip_idx;
+ np->pdev = pdev;
++
++ spin_lock_init(&np->stats_lock);
+ spin_lock_init (&np->tx_lock);
+ spin_lock_init (&np->rx_lock);
+
+@@ -869,7 +871,6 @@ tx_error (struct net_device *dev, int tx_status)
+ frame_id = (tx_status & 0xffff0000);
+ printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n",
+ dev->name, tx_status, frame_id);
+- dev->stats.tx_errors++;
+ /* Ttransmit Underrun */
+ if (tx_status & 0x10) {
+ dev->stats.tx_fifo_errors++;
+@@ -906,9 +907,15 @@ tx_error (struct net_device *dev, int tx_status)
+ rio_set_led_mode(dev);
+ /* Let TxStartThresh stay default value */
+ }
++
++ spin_lock(&np->stats_lock);
+ /* Maximum Collisions */
+ if (tx_status & 0x08)
+ dev->stats.collisions++;
++
++ dev->stats.tx_errors++;
++ spin_unlock(&np->stats_lock);
++
+ /* Restart the Tx */
+ dw32(MACCtrl, dr16(MACCtrl) | TxEnable);
+ }
+@@ -1077,7 +1084,9 @@ get_stats (struct net_device *dev)
+ int i;
+ #endif
+ unsigned int stat_reg;
++ unsigned long flags;
+
++ spin_lock_irqsave(&np->stats_lock, flags);
+ /* All statistics registers need to be acknowledged,
+ else statistic overflow could cause problems */
+
+@@ -1127,6 +1136,9 @@ get_stats (struct net_device *dev)
+ dr16(TCPCheckSumErrors);
+ dr16(UDPCheckSumErrors);
+ dr16(IPCheckSumErrors);
++
++ spin_unlock_irqrestore(&np->stats_lock, flags);
++
+ return &dev->stats;
+ }
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index 0e33e2eaae960..56aff2f0bdbfa 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
++++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -372,6 +372,8 @@ struct netdev_private {
+ struct pci_dev *pdev;
+ void __iomem *ioaddr;
+ void __iomem *eeprom_addr;
++ // To ensure synchronization when stats are updated.
++ spinlock_t stats_lock;
+ spinlock_t tx_lock;
+ spinlock_t rx_lock;
+ unsigned int rx_buf_sz; /* Based on MTU+slack. */
+--
+2.39.5
+
--- /dev/null
+From 0fd63d77aedbbd945e5c81160822b635a8463734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 May 2025 21:20:31 -0600
+Subject: net: macb: Check return value of dma_set_mask_and_coherent()
+
+From: Sergio Perez Gonzalez <sperezglz@gmail.com>
+
+[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ]
+
+Issue flagged by coverity. Add a safety check for the return value
+of dma_set_mask_and_coherent, go to a safe exit if it returns error.
+
+Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754
+Signed-off-by: Sergio Perez Gonzalez <sperezglz@gmail.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 667af80a739b9..2266a3ecc5533 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -4809,7 +4809,11 @@ static int macb_probe(struct platform_device *pdev)
+
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
+- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
++ if (err) {
++ dev_err(&pdev->dev, "failed to set DMA mask\n");
++ goto err_out_free_netdev;
++ }
+ bp->hw_dma_cap |= HW_DMA_CAP_64B;
+ }
+ #endif
+--
+2.39.5
+
--- /dev/null
+From 878a02704c925fc1e5c7d40a22c7770cc6faad41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 May 2025 17:34:42 +0800
+Subject: net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit b86bcfee30576b752302c55693fff97242b35dfd ]
+
+As mlx4 has implemented skb_tx_timestamp() in mlx4_en_xmit(), the
+SOFTWARE flag is surely needed when users are trying to get timestamp
+information.
+
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250510093442.79711-1-kerneljasonxing@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index c3cffb32fb067..d8c1a52d54c67 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1909,6 +1909,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev,
+ if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) {
+ info->so_timestamping |=
+ SOF_TIMESTAMPING_TX_HARDWARE |
++ SOF_TIMESTAMPING_TX_SOFTWARE |
+ SOF_TIMESTAMPING_RX_HARDWARE |
+ SOF_TIMESTAMPING_RAW_HARDWARE;
+
+--
+2.39.5
+
--- /dev/null
+From 9373962426137353a4737cb1b83ff58ef1ac9f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 14:54:22 +0100
+Subject: nios2: force update_mmu_cache on spurious tlb-permission--related
+ pagefaults
+
+From: Simon Schuster <schuster.simon@siemens-energy.com>
+
+[ Upstream commit 2d8a3179ea035f9341b6a73e5ba4029fc67e983d ]
+
+NIOS2 uses a software-managed TLB for virtual address translation. To
+flush a cache line, the original mapping is replaced by one to physical
+address 0x0 with no permissions (rwx mapped to 0) set. This can lead to
+TLB-permission--related traps when such a nominally flushed entry is
+encountered as a mapping for an otherwise valid virtual address within a
+process (e.g. due to an MMU-PID-namespace rollover that previously
+flushed the complete TLB including entries of existing, running
+processes).
+
+The default ptep_set_access_flags implementation from mm/pgtable-generic.c
+only forces a TLB-update when the page-table entry has changed within the
+page table:
+
+ /*
+ * [...] We return whether the PTE actually changed, which in turn
+ * instructs the caller to do things like update__mmu_cache. [...]
+ */
+ int ptep_set_access_flags(struct vm_area_struct *vma,
+ unsigned long address, pte_t *ptep,
+ pte_t entry, int dirty)
+ {
+ int changed = !pte_same(*ptep, entry);
+ if (changed) {
+ set_pte_at(vma->vm_mm, address, ptep, entry);
+ flush_tlb_fix_spurious_fault(vma, address);
+ }
+ return changed;
+ }
+
+However, no cross-referencing with the TLB-state occurs, so the
+flushing-induced pseudo entries that are responsible for the pagefault
+in the first place are never pre-empted from TLB on this code path.
+
+This commit fixes this behaviour by always requesting a TLB-update in
+this part of the pagefault handling, fixing spurious page-faults on the
+way. The handling is a straightforward port of the logic from the MIPS
+architecture via an arch-specific ptep_set_access_flags function ported
+from arch/mips/include/asm/pgtable.h.
+
+Signed-off-by: Simon Schuster <schuster.simon@siemens-energy.com>
+Signed-off-by: Andreas Oetken <andreas.oetken@siemens-energy.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/include/asm/pgtable.h | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/nios2/include/asm/pgtable.h b/arch/nios2/include/asm/pgtable.h
+index 4a995fa628eef..58208325462cd 100644
+--- a/arch/nios2/include/asm/pgtable.h
++++ b/arch/nios2/include/asm/pgtable.h
+@@ -275,4 +275,20 @@ extern void __init mmu_init(void);
+ extern void update_mmu_cache(struct vm_area_struct *vma,
+ unsigned long address, pte_t *pte);
+
++static inline int pte_same(pte_t pte_a, pte_t pte_b);
++
++#define __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
++static inline int ptep_set_access_flags(struct vm_area_struct *vma,
++ unsigned long address, pte_t *ptep,
++ pte_t entry, int dirty)
++{
++ if (!pte_same(*ptep, entry))
++ set_ptes(vma->vm_mm, address, ptep, entry, 1);
++ /*
++ * update_mmu_cache will unconditionally execute, handling both
++ * the case that the PTE changed and the spurious fault case.
++ */
++ return true;
++}
++
+ #endif /* _ASM_NIOS2_PGTABLE_H */
+--
+2.39.5
+
--- /dev/null
+From 1a76e67f6414767c26d4f7ae91155faa5212848c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 11:26:02 +0800
+Subject: octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 9c056ec6dd1654b1420dafbbe2a69718850e6ff2 ]
+
+The cn10k_free_matchall_ipolicer() calls the cn10k_map_unmap_rq_policer()
+for each queue in a for loop without checking for any errors.
+
+Check the return value of the cn10k_map_unmap_rq_policer() function during
+each loop, and report a warning if the function fails.
+
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250408032602.2909-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+index 942ec8f394559..59fef7b50ebb6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+@@ -351,9 +351,12 @@ int cn10k_free_matchall_ipolicer(struct otx2_nic *pfvf)
+ mutex_lock(&pfvf->mbox.lock);
+
+ /* Remove RQ's policer mapping */
+- for (qidx = 0; qidx < hw->rx_queues; qidx++)
+- cn10k_map_unmap_rq_policer(pfvf, qidx,
+- hw->matchall_ipolicer, false);
++ for (qidx = 0; qidx < hw->rx_queues; qidx++) {
++ rc = cn10k_map_unmap_rq_policer(pfvf, qidx, hw->matchall_ipolicer, false);
++ if (rc)
++ dev_warn(pfvf->dev, "Failed to unmap RQ %d's policer (error %d).",
++ qidx, rc);
++ }
+
+ rc = cn10k_free_leaf_profile(pfvf, hw->matchall_ipolicer);
+
+--
+2.39.5
+
--- /dev/null
+From 264f2f3d01dbe23a4aea695c646b3538f280722b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 10:08:24 +0200
+Subject: openvswitch: Stricter validation for the userspace action
+
+From: Eelco Chaudron <echaudro@redhat.com>
+
+[ Upstream commit 88906f55954131ed2d3974e044b7fb48129b86ae ]
+
+This change enhances the robustness of validate_userspace() by ensuring
+that all Netlink attributes are fully contained within the parent
+attribute. The previous use of nla_parse_nested_deprecated() could
+silently skip trailing or malformed attributes, as it stops parsing at
+the first invalid entry.
+
+By switching to nla_parse_deprecated_strict(), we make sure only fully
+validated attributes are copied for later use.
+
+Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Acked-by: Ilya Maximets <i.maximets@ovn.org>
+Link: https://patch.msgid.link/67eb414e2d250e8408bb8afeb982deca2ff2b10b.1747037304.git.echaudro@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/flow_netlink.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 7db0f8938c145..8e7238a4f5339 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -3004,7 +3004,8 @@ static int validate_userspace(const struct nlattr *attr)
+ struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
+ int error;
+
+- error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr,
++ error = nla_parse_deprecated_strict(a, OVS_USERSPACE_ATTR_MAX,
++ nla_data(attr), nla_len(attr),
+ userspace_policy, NULL);
+ if (error)
+ return error;
+--
+2.39.5
+
--- /dev/null
+From 5bfd5bf71a79c95344e9d570c4b9bd932ec484fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:38 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_pmx_set_by_name()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 4229c28323db141eda69cb99427be75d3edba071 ]
+
+The regmap_update_bits() function can fail, so propagate its error
+up to the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-7-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 7ed7b6484d704..e95d30ef5711b 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -354,9 +354,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev,
+
+ val = grp->val[func];
+
+- regmap_update_bits(info->regmap, reg, mask, val);
+-
+- return 0;
++ return regmap_update_bits(info->regmap, reg, mask, val);
+ }
+
+ static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev,
+--
+2.39.5
+
--- /dev/null
+From f7fc6a31a48f9c90ab2a0beea3faa381e3792691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:37 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_gpio_get_direction()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 6481c0a83367b0672951ccc876fbae7ee37b594b ]
+
+The regmap_read() function can fail, so propagate its error up to
+the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-6-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index e95d30ef5711b..3a9a3a1d5d4be 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -396,10 +396,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip,
+ struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
+ unsigned int reg = OUTPUT_EN;
+ unsigned int val, mask;
++ int ret;
+
+ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+- regmap_read(info->regmap, reg, &val);
++ ret = regmap_read(info->regmap, reg, &val);
++ if (ret)
++ return ret;
+
+ if (val & mask)
+ return GPIO_LINE_DIRECTION_OUT;
+--
+2.39.5
+
--- /dev/null
+From cf9f23eed49cb24bc1b2b228279b90403f2c5caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:36 +0200
+Subject: pinctrl: armada-37xx: propagate error from
+ armada_37xx_pmx_gpio_set_direction()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit bfa0ff804ffa8b1246ade8be08de98c9eb19d16f ]
+
+The armada_37xx_gpio_direction_{in,out}put() functions can fail, so
+propagate their error values back to the stack instead of silently
+ignoring those.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-5-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 3a9a3a1d5d4be..9c8ed5a03a825 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -468,16 +468,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
+ {
+ struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
+ struct gpio_chip *chip = range->gc;
++ int ret;
+
+ dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n",
+ offset, range->name, offset, input ? "input" : "output");
+
+ if (input)
+- armada_37xx_gpio_direction_input(chip, offset);
++ ret = armada_37xx_gpio_direction_input(chip, offset);
+ else
+- armada_37xx_gpio_direction_output(chip, offset, 0);
++ ret = armada_37xx_gpio_direction_output(chip, offset, 0);
+
+- return 0;
++ return ret;
+ }
+
+ static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev,
+--
+2.39.5
+
--- /dev/null
+From 7b544ef2661475950058df200d97ec80b10c66b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 21:18:35 +0200
+Subject: pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 57273ff8bb16f3842c2597b5bbcd49e7fa12edf7 ]
+
+The regmap_read() function can fail, so propagate its error up to
+the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-4-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 9c8ed5a03a825..e0dbac0c9227a 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -439,11 +439,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
+ unsigned int reg = INPUT_VAL;
+ unsigned int val, mask;
++ int ret;
+
+ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+
+- regmap_read(info->regmap, reg, &val);
++ ret = regmap_read(info->regmap, reg, &val);
++ if (ret)
++ return ret;
+
+ return (val & mask) != 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 72d510e24433deb8b390148c02200f6117174485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 16:17:45 +0100
+Subject: pinctrl: mcp23s08: Reset all pins to input at probe
+
+From: Mike Looijmans <mike.looijmans@topic.nl>
+
+[ Upstream commit 3ede3f8b4b4b399b0ca41e44959f80d5cf84fc98 ]
+
+At startup, the driver just assumes that all registers have their
+default values. But after a soft reset, the chip will just be in the
+state it was, and some pins may have been configured as outputs. Any
+modification of the output register will cause these pins to be driven
+low, which leads to unexpected/unwanted effects. To prevent this from
+happening, set the chip's IO configuration register to a known safe
+mode (all inputs) before toggling any other bits.
+
+Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
+Link: https://lore.kernel.org/20250314151803.28903-1-mike.looijmans@topic.nl
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-mcp23s08.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index 852354f6681b4..a743d9c6e1c77 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -567,6 +567,14 @@ int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
+
+ mcp->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+
++ /*
++ * Reset the chip - we don't really know what state it's in, so reset
++ * all pins to input first to prevent surprises.
++ */
++ ret = mcp_write(mcp, MCP_IODIR, mcp->chip.ngpio == 16 ? 0xFFFF : 0xFF);
++ if (ret < 0)
++ return ret;
++
+ /* verify MCP_IOCON.SEQOP = 0, so sequential reads work,
+ * and MCP_IOCON.HAEN = 1, so we work with all chips.
+ */
+--
+2.39.5
+
--- /dev/null
+From d99a77de0c8b67937609e105a9e199fc25fc6748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 13:46:56 -0500
+Subject: platform/x86: dell_rbu: Fix list usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 ]
+
+Pass the correct list head to list_for_each_entry*() when looping through
+the packet list.
+
+Without this patch, reading the packet data via sysfs will show the data
+incorrectly (because it starts at the wrong packet), and clearing the
+packet list will result in a NULL pointer dereference.
+
+Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()")
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell_rbu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c
+index e9f4b30dcafab..25a01c728c072 100644
+--- a/drivers/platform/x86/dell/dell_rbu.c
++++ b/drivers/platform/x86/dell/dell_rbu.c
+@@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length)
+ remaining_bytes = *pread_length;
+ bytes_read = rbu_data.packet_read_count;
+
+- list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) {
++ list_for_each_entry(newpacket, &packet_data_head.list, list) {
+ bytes_copied = do_packet_read(pdest, newpacket,
+ remaining_bytes, bytes_read, &temp_count);
+ remaining_bytes -= bytes_copied;
+@@ -315,7 +315,7 @@ static void packet_empty_list(void)
+ {
+ struct packet_data *newpacket, *tmp;
+
+- list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) {
++ list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) {
+ list_del(&newpacket->list);
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From 73a9e5b536d2177f8803c8fdac3f396925585574 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 13:46:58 -0500
+Subject: platform/x86: dell_rbu: Stop overwriting data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 ]
+
+The dell_rbu driver will use memset() to clear the data held by each
+packet when it is no longer needed (when the driver is unloaded, the
+packet size is changed, etc).
+
+The amount of memory that is cleared (before this patch) is the normal
+packet size. However, the last packet in the list may be smaller.
+
+Fix this to only clear the memory actually used by each packet, to prevent
+it from writing past the end of data buffer.
+
+Because the packet data buffers are allocated with __get_free_pages() (in
+page-sized increments), this bug could only result in a buffer being
+overwritten when a packet size larger than one page is used. The only user
+of the dell_rbu module should be the Dell BIOS update program, which uses
+a packet size of 4096, so no issues should be seen without the patch, it
+just blocks the possiblity.
+
+Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver")
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell_rbu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c
+index 25a01c728c072..9fc5d3e9e7934 100644
+--- a/drivers/platform/x86/dell/dell_rbu.c
++++ b/drivers/platform/x86/dell/dell_rbu.c
+@@ -322,7 +322,7 @@ static void packet_empty_list(void)
+ * zero out the RBU packet memory before freeing
+ * to make sure there are no stale RBU packets left in memory
+ */
+- memset(newpacket->data, 0, rbu_data.packetsize);
++ memset(newpacket->data, 0, newpacket->length);
+ set_memory_wb((unsigned long)newpacket->data,
+ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+--
+2.39.5
+
--- /dev/null
+From e5a4c5e83c7989830cb4054bf0b8d2e351d5917e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 12:11:25 +0530
+Subject: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
+
+From: Charan Teja Kalla <quic_charante@quicinc.com>
+
+[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ]
+
+pm_runtime_put_autosuspend() schedules a hrtimer to expire
+at "dev->power.timer_expires". If the hrtimer's callback,
+pm_suspend_timer_fn(), observes that the current time equals
+"dev->power.timer_expires", it unexpectedly bails out instead of
+proceeding with runtime suspend.
+
+pm_suspend_timer_fn():
+
+ if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
+ dev->power.timer_expires = 0;
+ rpm_suspend(..)
+ }
+
+Additionally, as ->timer_expires is not cleared, all the future auto
+suspend requests will not schedule hrtimer to perform auto suspend.
+
+rpm_suspend():
+
+ if ((rpmflags & RPM_AUTO) &&...) {
+ if (!(dev->power.timer_expires && ...) { <-- this will fail.
+ hrtimer_start_range_ns(&dev->power.suspend_timer,...);
+ }
+ }
+
+Fix this by as well checking if current time reaches the set expiration.
+
+Co-developed-by: Patrick Daly <quic_pdaly@quicinc.com>
+Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
+Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
+Link: https://patch.msgid.link/20250515064125.1211561-1-quic_charante@quicinc.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/runtime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index edee7f1af1cec..35e1a090ef901 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -996,7 +996,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer)
+ * If 'expires' is after the current time, we've been called
+ * too early.
+ */
+- if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
++ if (expires > 0 && expires <= ktime_get_mono_fast_ns()) {
+ dev->power.timer_expires = 0;
+ rpm_suspend(dev, dev->power.timer_autosuspends ?
+ (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
+--
+2.39.5
+
--- /dev/null
+From 598b69d9c16ccc4448eecd2af0fa9a50d50e4469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 16:00:40 -0700
+Subject: pmdomain: ti: Fix STANDBY handling of PER power domain
+
+From: Sukrut Bellary <sbellary@baylibre.com>
+
+[ Upstream commit 36795548dcc841c73f03793ed6cf741a88130922 ]
+
+Per AM335x TRM[1](section 8.1.4.3 Power mode), in case of STANDBY,
+PER domain should be ON. So, fix the PER power domain handling on standby.
+
+[1] https://www.ti.com/lit/ug/spruh73q/spruh73q.pdf
+
+Signed-off-by: Sukrut Bellary <sbellary@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Judith Mendez <jm@ti.com>
+Link: https://lore.kernel.org/r/20250318230042.3138542-3-sbellary@baylibre.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/omap_prm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
+index 1248d5d56c8d4..544e57fff96ca 100644
+--- a/drivers/soc/ti/omap_prm.c
++++ b/drivers/soc/ti/omap_prm.c
+@@ -19,7 +19,9 @@
+ #include <linux/pm_domain.h>
+ #include <linux/reset-controller.h>
+ #include <linux/delay.h>
+-
++#if IS_ENABLED(CONFIG_SUSPEND)
++#include <linux/suspend.h>
++#endif
+ #include <linux/platform_data/ti-prm.h>
+
+ enum omap_prm_domain_mode {
+@@ -89,6 +91,7 @@ struct omap_reset_data {
+ #define OMAP_PRM_HAS_RSTST BIT(1)
+ #define OMAP_PRM_HAS_NO_CLKDM BIT(2)
+ #define OMAP_PRM_RET_WHEN_IDLE BIT(3)
++#define OMAP_PRM_ON_WHEN_STANDBY BIT(4)
+
+ #define OMAP_PRM_HAS_RESETS (OMAP_PRM_HAS_RSTCTRL | OMAP_PRM_HAS_RSTST)
+
+@@ -405,7 +408,8 @@ static const struct omap_prm_data am3_prm_data[] = {
+ .name = "per", .base = 0x44e00c00,
+ .pwrstctrl = 0xc, .pwrstst = 0x8, .dmap = &omap_prm_noinact,
+ .rstctrl = 0x0, .rstmap = am3_per_rst_map,
+- .flags = OMAP_PRM_HAS_RSTCTRL, .clkdm_name = "pruss_ocp"
++ .flags = OMAP_PRM_HAS_RSTCTRL | OMAP_PRM_ON_WHEN_STANDBY,
++ .clkdm_name = "pruss_ocp",
+ },
+ {
+ .name = "wkup", .base = 0x44e00d00,
+--
+2.39.5
+
--- /dev/null
+From 31ed7b286f0b64b05b83416099636c98d3071143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 11:40:47 +0800
+Subject: power: supply: bq27xxx: Retrieve again when busy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jerry Lv <Jerry.Lv@axis.com>
+
+[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ]
+
+Multiple applications may access the battery gauge at the same time, so
+the gauge may be busy and EBUSY will be returned. The driver will set a
+flag to record the EBUSY state, and this flag will be kept until the next
+periodic update. When this flag is set, bq27xxx_battery_get_property()
+will just return ENODEV until the flag is updated.
+
+Even if the gauge was busy during the last accessing attempt, returning
+ENODEV is not ideal, and can cause confusion in the applications layer.
+
+Instead, retry accessing the I2C to update the flag is as expected, for
+the gauge typically recovers from busy state within a few milliseconds.
+If still failed to access the gauge, the real error code would be returned
+instead of ENODEV (as suggested by Pali Rohár).
+
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jerry Lv <Jerry.Lv@axis.com>
+Link: https://lore.kernel.org/r/20250415-foo-fix-v2-1-5b45a395e4cc@axis.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq27xxx_battery.c | 2 +-
+ drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index b86674df7b3b2..3fb1c912f86a0 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -2044,7 +2044,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,
+ mutex_unlock(&di->lock);
+
+ if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0)
+- return -ENODEV;
++ return di->cache.flags;
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_STATUS:
+diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
+index 4e5d773b3bf8d..4d64275ecdfc6 100644
+--- a/drivers/power/supply/bq27xxx_battery_i2c.c
++++ b/drivers/power/supply/bq27xxx_battery_i2c.c
+@@ -6,6 +6,7 @@
+ * Andrew F. Davis <afd@ti.com>
+ */
+
++#include <linux/delay.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+@@ -32,6 +33,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,
+ struct i2c_msg msg[2];
+ u8 data[2];
+ int ret;
++ int retry = 0;
+
+ if (!client->adapter)
+ return -ENODEV;
+@@ -48,7 +50,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg,
+ else
+ msg[1].len = 2;
+
+- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
++ do {
++ ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
++ if (ret == -EBUSY && ++retry < 3) {
++ /* sleep 10 milliseconds when busy */
++ usleep_range(10000, 11000);
++ continue;
++ }
++ break;
++ } while (1);
++
+ if (ret < 0)
+ return ret;
+
+--
+2.39.5
+
--- /dev/null
+From 6a11b01a54ca74aaa4628c0b10f1767b1bd456dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 02:29:28 -0400
+Subject: powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
+ recovery
+
+From: Narayana Murty N <nnmlinux@linux.ibm.com>
+
+[ Upstream commit 33bc69cf6655cf60829a803a45275f11a74899e5 ]
+
+VFIO EEH recovery for PCI passthrough devices fails on PowerNV and pseries
+platforms due to missing host-side PE bridge reconfiguration. In the
+current implementation, eeh_pe_configure() only performs RTAS or OPAL-based
+bridge reconfiguration for native host devices, but skips it entirely for
+PEs managed through VFIO in guest passthrough scenarios.
+
+This leads to incomplete EEH recovery when a PCI error affects a
+passthrough device assigned to a QEMU/KVM guest. Although VFIO triggers the
+EEH recovery flow through VFIO_EEH_PE_ENABLE ioctl, the platform-specific
+bridge reconfiguration step is silently bypassed. As a result, the PE's
+config space is not fully restored, causing subsequent config space access
+failures or EEH freeze-on-access errors inside the guest.
+
+This patch fixes the issue by ensuring that eeh_pe_configure() always
+invokes the platform's configure_bridge() callback (e.g.,
+pseries_eeh_phb_configure_bridge) even for VFIO-managed PEs. This ensures
+that RTAS or OPAL calls to reconfigure the PE bridge are correctly issued
+on the host side, restoring the PE's configuration space after an EEH
+event.
+
+This fix is essential for reliable EEH recovery in QEMU/KVM guests using
+VFIO PCI passthrough on PowerNV and pseries systems.
+
+Tested with:
+- QEMU/KVM guest using VFIO passthrough (IBM Power9,(lpar)Power11 host)
+- Injected EEH errors with pseries EEH errinjct tool on host, recovery
+ verified on qemu guest.
+- Verified successful config space access and CAP_EXP DevCtl restoration
+ after recovery
+
+Fixes: 212d16cdca2d ("powerpc/eeh: EEH support for VFIO PCI device")
+Signed-off-by: Narayana Murty N <nnmlinux@linux.ibm.com>
+Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Reviewed-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250508062928.146043-1-nnmlinux@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index e9b597ed423cf..209d1a61eb94f 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -1504,6 +1504,8 @@ int eeh_pe_configure(struct eeh_pe *pe)
+ /* Invalid PE ? */
+ if (!pe)
+ return -ENODEV;
++ else
++ ret = eeh_ops->configure_bridge(pe);
+
+ return ret;
+ }
+--
+2.39.5
+
--- /dev/null
+From 795057d6465d99874138527fd0ff330669456716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 11:06:34 +0200
+Subject: Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect
+ devices first"
+
+From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+
+[ Upstream commit 36305857b1ead8f6ca033a913162ebc09bee0b43 ]
+
+This reverts commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6.
+
+It breaks target-module@2b300050 ("ti,sysc-omap2") probe on AM62x in a case
+when minimally-configured system tries to network-boot:
+
+[ 6.888776] probe of 2b300050.target-module returned 517 after 258 usecs
+[ 17.129637] probe of 2b300050.target-module returned 517 after 708 usecs
+[ 17.137397] platform 2b300050.target-module: deferred probe pending: (reason unknown)
+[ 26.878471] Waiting up to 100 more seconds for network.
+
+There are minimal configurations possible when the deferred device is not
+being probed any more (because everything else has been successfully
+probed) and deferral lists are not processed any more.
+
+Stable mmc enumeration can be achieved by filling /aliases node properly
+(4700a00755fb commit's rationale).
+
+After revert:
+
+[ 9.006816] IP-Config: Complete:
+[ 9.010058] device=lan0, ...
+
+Tested-by: Andreas Kemnade <andreas@kemnade.info> # GTA04, Panda, BT200
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Link: https://lore.kernel.org/r/20250401090643.2776793-1-alexander.sverdlin@siemens.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 49 -------------------------------------------
+ 1 file changed, 49 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 05ae577758539..20e0907234855 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -687,51 +687,6 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata)
+ return 0;
+ }
+
+-/* Interconnect instances to probe before l4_per instances */
+-static struct resource early_bus_ranges[] = {
+- /* am3/4 l4_wkup */
+- { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, },
+- /* omap4/5 and dra7 l4_cfg */
+- { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, },
+- /* omap4 l4_wkup */
+- { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, },
+- /* omap5 and dra7 l4_wkup without dra7 dcan segment */
+- { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, },
+-};
+-
+-static atomic_t sysc_defer = ATOMIC_INIT(10);
+-
+-/**
+- * sysc_defer_non_critical - defer non_critical interconnect probing
+- * @ddata: device driver data
+- *
+- * We want to probe l4_cfg and l4_wkup interconnect instances before any
+- * l4_per instances as l4_per instances depend on resources on l4_cfg and
+- * l4_wkup interconnects.
+- */
+-static int sysc_defer_non_critical(struct sysc *ddata)
+-{
+- struct resource *res;
+- int i;
+-
+- if (!atomic_read(&sysc_defer))
+- return 0;
+-
+- for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) {
+- res = &early_bus_ranges[i];
+- if (ddata->module_pa >= res->start &&
+- ddata->module_pa <= res->end) {
+- atomic_set(&sysc_defer, 0);
+-
+- return 0;
+- }
+- }
+-
+- atomic_dec_if_positive(&sysc_defer);
+-
+- return -EPROBE_DEFER;
+-}
+-
+ static struct device_node *stdout_path;
+
+ static void sysc_init_stdout_path(struct sysc *ddata)
+@@ -957,10 +912,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata)
+ if (error)
+ return error;
+
+- error = sysc_defer_non_critical(ddata);
+- if (error)
+- return error;
+-
+ sysc_check_children(ddata);
+
+ if (!of_get_property(np, "reg", NULL))
+--
+2.39.5
+
--- /dev/null
+From 580505b404e25a78d31f76ce03d884830aac13ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:47:59 -0700
+Subject: scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
+ commands
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126 ]
+
+In lpfc_check_sli_ndlp(), the get_job_els_rsp64_did remote_id assignment
+does not apply for GEN_REQUEST64 commands as it only has meaning for a
+ELS_REQUEST64 command. So, if (iocb->ndlp == ndlp) is false, we could
+erroneously return the wrong value. Fix by replacing the fallthrough
+statement with a break statement before the remote_id check.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20250425194806.3585-2-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index d04669ae878bd..413b7adca0211 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -5086,7 +5086,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba,
+ case CMD_GEN_REQUEST64_CR:
+ if (iocb->context_un.ndlp == ndlp)
+ return 1;
+- fallthrough;
++ break;
+ case CMD_ELS_REQUEST64_CR:
+ if (icmd->un.elsreq64.remoteID == ndlp->nlp_DID)
+ return 1;
+--
+2.39.5
+
--- /dev/null
+From 2363ce1be5083aea324578e7b89b4d12573c321a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 13:34:22 +0200
+Subject: scsi: lpfc: Use memcpy() for BIOS version
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit ae82eaf4aeea060bb736c3e20c0568b67c701d7d ]
+
+The strlcat() with FORTIFY support is triggering a panic because it
+thinks the target buffer will overflow although the correct target
+buffer size is passed in.
+
+Anyway, instead of memset() with 0 followed by a strlcat(), just use
+memcpy() and ensure that the resulting buffer is NULL terminated.
+
+BIOSVersion is only used for the lpfc_printf_log() which expects a
+properly terminated string.
+
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Link: https://lore.kernel.org/r/20250409-fix-lpfc-bios-str-v1-1-05dac9e51e13@kernel.org
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 68b015bb6d157..fb139e1e35ca3 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -5926,9 +5926,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba)
+ phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr);
+ phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr);
+
+- memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion));
+- strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str,
++ memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str,
+ sizeof(phba->BIOSVersion));
++ phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0';
+
+ lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+ "3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, "
+--
+2.39.5
+
--- /dev/null
+From 7d89b65784300ee25cb0c09ddcffe5e0777f4bc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 10:17:28 +0200
+Subject: sctp: Do not wake readers in __sctp_write_space()
+
+From: Petr Malat <oss@malat.biz>
+
+[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ]
+
+Function __sctp_write_space() doesn't set poll key, which leads to
+ep_poll_callback() waking up all waiters, not only these waiting
+for the socket being writable. Set the key properly using
+wake_up_interruptible_poll(), which is preferred over the sync
+variant, as writers are not woken up before at least half of the
+queue is available. Also, TCP does the same.
+
+Signed-off-by: Petr Malat <oss@malat.biz>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/20250516081727.1361451-1-oss@malat.biz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 5e84083e50d7a..0aaea911b21ef 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -9092,7 +9092,8 @@ static void __sctp_write_space(struct sctp_association *asoc)
+ wq = rcu_dereference(sk->sk_wq);
+ if (wq) {
+ if (waitqueue_active(&wq->wait))
+- wake_up_interruptible(&wq->wait);
++ wake_up_interruptible_poll(&wq->wait, EPOLLOUT |
++ EPOLLWRNORM | EPOLLWRBAND);
+
+ /* Note that we try to include the Async I/O support
+ * here by modeling from the current TCP/UDP code.
+--
+2.39.5
+
iio-accel-fxls8962af-fix-temperature-scan-element-sign.patch
iio-imu-inv_icm42600-fix-temperature-calculation.patch
iio-adc-ad7606_spi-fix-reg-write-value-mask.patch
+acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch
+clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch
+acpica-avoid-sequence-overread-in-call-to-strncmp.patch
+asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch
+acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch
+acpica-fix-acpi-parse-and-parseext-cache-leaks.patch
+power-supply-bq27xxx-retrieve-again-when-busy.patch
+acpica-utilities-fix-overflow-check-in-vsnprintf.patch
+asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch
+pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch
+acpi-battery-negate-current-when-discharging.patch
+drm-amdgpu-gfx6-fix-csib-handling.patch
+sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch
+drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch
+exfat-fix-double-free-in-delayed_free.patch
+arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch
+drm-bridge-anx7625-change-the-gpiod_set_value-api.patch
+media-i2c-imx334-enable-runtime-pm-before-sub-device.patch
+drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch
+media-uapi-v4l-fix-v4l2_type_is_output-condition.patch
+drm-amd-display-add-null-pointer-checks-in-dm_force_.patch
+drm-msm-a6xx-increase-hfi-response-timeout.patch
+media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch
+drm-amdgpu-gfx10-fix-csib-handling.patch
+media-ccs-pll-better-validate-vt-pll-branch.patch
+media-uapi-v4l-change-v4l2_type_is_capture-condition.patch
+drm-amdgpu-gfx7-fix-csib-handling.patch
+ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch
+jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch
+media-ti-cal-fix-wrong-goto-on-error-path.patch
+media-rkvdec-initialize-the-m2m-context-before-the-c.patch
+sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch
+ext4-prevent-stale-extent-cache-entries-caused-by-co.patch
+drm-amdgpu-gfx8-fix-csib-handling.patch
+drm-amdgpu-gfx9-fix-csib-handling.patch
+jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch
+drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch
+drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch
+media-tc358743-ignore-video-while-hpd-is-low.patch
+media-platform-exynos4-is-add-hardware-sync-wait-to-.patch
+media-i2c-imx334-update-mode_3840x2160_regs-array.patch
+nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch
+pmdomain-ti-fix-standby-handling-of-per-power-domain.patch
+thermal-drivers-qcom-tsens-update-conditions-to-stri.patch
+cpufreq-force-sync-policy-boost-with-global-boost-on.patch
+net-macb-check-return-value-of-dma_set_mask_and_cohe.patch
+tipc-use-kfree_sensitive-for-aead-cleanup.patch
+i2c-designware-invoke-runtime-suspend-on-quick-slave.patch
+emulex-benet-correct-command-version-selection-in-be.patch
+wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch
+sctp-do-not-wake-readers-in-__sctp_write_space.patch
+cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch
+i2c-npcm-add-clock-toggle-recovery.patch
+net-dlink-add-synchronization-for-stats-update.patch
+tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch
+tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch
+ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch
+openvswitch-stricter-validation-for-the-userspace-ac.patch
+net-atlantic-generate-software-timestamp-just-before.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-10009
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-1690
+pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-28264
+net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch
+wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch
+clk-rockchip-rk3036-mark-ddrphy-as-critical.patch
+libbpf-add-identical-pointer-detection-to-btf_dedup_.patch
+scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch
+iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch
+net-bridge-mcast-re-implement-br_multicast_-enable-d.patch
+vxlan-do-not-treat-dst-cache-initialization-errors-a.patch
+software-node-correct-a-oob-check-in-software_node_g.patch
+pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch
+scsi-lpfc-use-memcpy-for-bios-version.patch
+sock-correct-error-checking-condition-for-assign-rel.patch
+i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch
+bpf-sockmap-fix-data-lost-during-eagain-retries.patch
+octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch
+watchdog-da9052_wdt-respect-twdmin.patch
+bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch
+arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch
+tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch
+revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch
+platform-x86-dell_rbu-fix-list-usage.patch
+platform-x86-dell_rbu-stop-overwriting-data-buffer.patch
+powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch
--- /dev/null
+From 15d9f45ba09578cfc17be6aff4edd9004d98fba5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Apr 2025 09:01:27 +0800
+Subject: sock: Correct error checking condition for
+ (assign|release)_proto_idx()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit faeefc173be40512341b102cf1568aa0b6571acd ]
+
+(assign|release)_proto_idx() wrongly check find_first_zero_bit() failure
+by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
+
+Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
+
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://patch.msgid.link/20250410-fix_net-v2-1-d69e7c5739a4@quicinc.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 7f7f02a01f2dd..3634a4f1f76c6 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3571,7 +3571,7 @@ static int assign_proto_idx(struct proto *prot)
+ {
+ prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
+
+- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
++ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
+ pr_err("PROTO_INUSE_NR exhausted\n");
+ return -ENOSPC;
+ }
+@@ -3582,7 +3582,7 @@ static int assign_proto_idx(struct proto *prot)
+
+ static void release_proto_idx(struct proto *prot)
+ {
+- if (prot->inuse_idx != PROTO_INUSE_NR - 1)
++ if (prot->inuse_idx != PROTO_INUSE_NR)
+ clear_bit(prot->inuse_idx, proto_inuse_idx);
+ }
+ #else
+--
+2.39.5
+
--- /dev/null
+From 0352a979b41622054b00de7c8f2be3857aed4853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Apr 2025 19:36:52 +0800
+Subject: software node: Correct a OOB check in
+ software_node_get_reference_args()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ]
+
+software_node_get_reference_args() wants to get @index-th element, so
+the property value requires at least '(index + 1) * sizeof(*ref)' bytes
+but that can not be guaranteed by current OOB check, and may cause OOB
+for malformed property.
+
+Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.
+
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index 15f149fc19401..0af6071f86641 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -524,7 +524,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,
+ if (prop->is_inline)
+ return -EINVAL;
+
+- if (index * sizeof(*ref) >= prop->length)
++ if ((index + 1) * sizeof(*ref) > prop->length)
+ return -ENOENT;
+
+ ref_array = prop->pointer;
+--
+2.39.5
+
--- /dev/null
+From 51a32b17198f4a84c0c960cec2e7a269f037a2e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Mar 2025 14:48:36 +0800
+Subject: sunrpc: fix race in cache cleanup causing stale nextcheck time
+
+From: Long Li <leo.lilong@huawei.com>
+
+[ Upstream commit 2298abcbe11e9b553d03c0f1d084da786f7eff88 ]
+
+When cache cleanup runs concurrently with cache entry removal, a race
+condition can occur that leads to incorrect nextcheck times. This can
+delay cache cleanup for the cache_detail by up to 1800 seconds:
+
+1. cache_clean() sets nextcheck to current time plus 1800 seconds
+2. While scanning a non-empty bucket, concurrent cache entry removal can
+ empty that bucket
+3. cache_clean() finds no cache entries in the now-empty bucket to update
+ the nextcheck time
+4. This maybe delays the next scan of the cache_detail by up to 1800
+ seconds even when it should be scanned earlier based on remaining
+ entries
+
+Fix this by moving the hash_lock acquisition earlier in cache_clean().
+This ensures bucket emptiness checks and nextcheck updates happen
+atomically, preventing the race between cleanup and entry removal.
+
+Signed-off-by: Long Li <leo.lilong@huawei.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/cache.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index e8448e9e03d59..715f7d080f7a2 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -451,24 +451,21 @@ static int cache_clean(void)
+ }
+ }
+
++ spin_lock(¤t_detail->hash_lock);
++
+ /* find a non-empty bucket in the table */
+- while (current_detail &&
+- current_index < current_detail->hash_size &&
++ while (current_index < current_detail->hash_size &&
+ hlist_empty(¤t_detail->hash_table[current_index]))
+ current_index++;
+
+ /* find a cleanable entry in the bucket and clean it, or set to next bucket */
+-
+- if (current_detail && current_index < current_detail->hash_size) {
++ if (current_index < current_detail->hash_size) {
+ struct cache_head *ch = NULL;
+ struct cache_detail *d;
+ struct hlist_head *head;
+ struct hlist_node *tmp;
+
+- spin_lock(¤t_detail->hash_lock);
+-
+ /* Ok, now to clean this strand */
+-
+ head = ¤t_detail->hash_table[current_index];
+ hlist_for_each_entry_safe(ch, tmp, head, cache_list) {
+ if (current_detail->nextcheck > ch->expiry_time)
+@@ -489,8 +486,10 @@ static int cache_clean(void)
+ spin_unlock(&cache_list_lock);
+ if (ch)
+ sunrpc_end_cache_remove_entry(ch, d);
+- } else
++ } else {
++ spin_unlock(¤t_detail->hash_lock);
+ spin_unlock(&cache_list_lock);
++ }
+
+ return rv;
+ }
+--
+2.39.5
+
--- /dev/null
+From 6730491e0b84bf2c3e343956438098e57c810b81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Mar 2025 14:48:35 +0800
+Subject: sunrpc: update nextcheck time when adding new cache entries
+
+From: Long Li <leo.lilong@huawei.com>
+
+[ Upstream commit 5ca00634c8bbb2979c73465588f486b9632f5ed5 ]
+
+The cache_detail structure uses a "nextcheck" field to control hash table
+scanning intervals. When a table scan begins, nextcheck is set to current
+time plus 1800 seconds. During scanning, if cache_detail is not empty and
+a cache entry's expiry time is earlier than the current nextcheck, the
+nextcheck is updated to that expiry time.
+
+This mechanism ensures that:
+1) Empty cache_details are scanned every 1800 seconds to avoid unnecessary
+ scans
+2) Non-empty cache_details are scanned based on the earliest expiry time
+ found
+
+However, when adding a new cache entry to an empty cache_detail, the
+nextcheck time was not being updated, remaining at 1800 seconds. This
+could delay cache cleanup for up to 1800 seconds, potentially blocking
+threads(such as nfsd) that are waiting for cache cleanup.
+
+Fix this by updating the nextcheck time whenever a new cache entry is
+added.
+
+Signed-off-by: Long Li <leo.lilong@huawei.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/cache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 95aab48d32e67..e8448e9e03d59 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -133,6 +133,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,
+
+ hlist_add_head_rcu(&new->cache_list, head);
+ detail->entries++;
++ if (detail->nextcheck > new->expiry_time)
++ detail->nextcheck = new->expiry_time + 1;
+ cache_get(new);
+ spin_unlock(&detail->hash_lock);
+
+--
+2.39.5
+
--- /dev/null
+From d975e1daf0c020ac5f41ac55bc20268225383f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:15 +0000
+Subject: tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ]
+
+tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT
+in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust()
+
+When TCP TS are enabled, tcp_rcv_rtt_update() is using
+EWMA to smooth the samples.
+
+Change this to immediately latch the incoming value if it
+is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust()
+does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 8859a38b45d5e..000557f5c54bc 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -641,10 +641,12 @@ EXPORT_SYMBOL(tcp_initialize_rcv_mss);
+ */
+ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ {
+- u32 new_sample = tp->rcv_rtt_est.rtt_us;
+- long m = sample;
++ u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us;
++ long m = sample << 3;
+
+- if (new_sample != 0) {
++ if (old_sample == 0 || m < old_sample) {
++ new_sample = m;
++ } else {
+ /* If we sample in larger samples in the non-timestamp
+ * case, we could grossly overestimate the RTT especially
+ * with chatty applications or bulk transfer apps which
+@@ -655,17 +657,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ * else with timestamps disabled convergence takes too
+ * long.
+ */
+- if (!win_dep) {
+- m -= (new_sample >> 3);
+- new_sample += m;
+- } else {
+- m <<= 3;
+- if (m < new_sample)
+- new_sample = m;
+- }
+- } else {
+- /* No previous measure. */
+- new_sample = m << 3;
++ if (win_dep)
++ return;
++ new_sample = old_sample - (old_sample >> 3) + sample;
+ }
+
+ tp->rcv_rtt_est.rtt_us = new_sample;
+--
+2.39.5
+
--- /dev/null
+From 3f77ff0062903bf3840400919fc34cd65c700006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 19:39:14 +0000
+Subject: tcp: fix initial tp->rcvq_space.space value for passive TS enabled
+ flows
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ]
+
+tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows
+before the call to tcp_init_transfer() / tcp_init_buffer_space().
+
+Otherwise tp->rcvq_space.space is off by 120 bytes
+(TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED).
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Link: https://patch.msgid.link/20250513193919.1089692-7-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 000557f5c54bc..a52d5b718e6e1 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6573,6 +6573,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ if (!tp->srtt_us)
+ tcp_synack_rtt_meas(sk, req);
+
++ if (tp->rx_opt.tstamp_ok)
++ tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
++
+ if (req) {
+ tcp_rcv_synrecv_state_fastopen(sk);
+ } else {
+@@ -6597,9 +6600,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
+ tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
+
+- if (tp->rx_opt.tstamp_ok)
+- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
+-
+ if (!inet_csk(sk)->icsk_ca_ops->cong_control)
+ tcp_update_pacing_rate(sk);
+
+--
+2.39.5
+
--- /dev/null
+From 09f14ffff91617bcc8de23667ee4194576c96e0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 15:06:43 +0200
+Subject: tee: Prevent size calculation wraparound on 32-bit kernels
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 39bb67edcc582b3b386a9ec983da67fa8a10ec03 ]
+
+The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on
+32-bit kernels: Multiplying a user-provided 32-bit value with the
+size of a structure can wrap around on such platforms.
+
+Fix it by using saturating arithmetic for the size calculation.
+
+This has no security consequences because, in all users of
+TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks
+for wrapping.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/tee_core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index a44e5b53e7a91..a7e89c229fc51 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -10,6 +10,7 @@
+ #include <linux/fs.h>
+ #include <linux/idr.h>
+ #include <linux/module.h>
++#include <linux/overflow.h>
+ #include <linux/slab.h>
+ #include <linux/tee_drv.h>
+ #include <linux/uaccess.h>
+@@ -19,7 +20,7 @@
+
+ #define TEE_NUM_DEVICES 32
+
+-#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
++#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x)))
+
+ #define TEE_UUID_NS_NAME_SIZE 128
+
+@@ -493,7 +494,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx,
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+@@ -571,7 +572,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx,
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+@@ -705,7 +706,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx,
+ if (get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len)
++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+@@ -804,7 +805,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx,
+ get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len)
++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+--
+2.39.5
+
--- /dev/null
+From 71304f53b1a558535fcdffac591d6f9f4575e106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 09:11:36 +0400
+Subject: thermal/drivers/qcom/tsens: Update conditions to strictly evaluate
+ for IP v2+
+
+From: George Moussalem <george.moussalem@outlook.com>
+
+[ Upstream commit e3f90f167a49902cda2408f7e91cca0dcfd5040a ]
+
+TSENS v2.0+ leverage features not available to prior versions such as
+updated interrupts init routine, masked interrupts, and watchdog.
+Currently, the checks in place evaluate whether the IP version is greater
+than v1 which invalidates when updates to v1 or v1 minor versions are
+implemented. As such, update the conditional statements to strictly
+evaluate whether the version is greater than or equal to v2 (inclusive).
+
+Signed-off-by: George Moussalem <george.moussalem@outlook.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Amit Kucheria <amitk@kernel.org>
+Link: https://lore.kernel.org/r/DS7PR19MB8883434CAA053648E22AA8AC9DCC2@DS7PR19MB8883.namprd19.prod.outlook.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index 2f31129cd5471..21f980464e71b 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -266,7 +266,7 @@ static void tsens_set_interrupt(struct tsens_priv *priv, u32 hw_id,
+ dev_dbg(priv->dev, "[%u] %s: %s -> %s\n", hw_id, __func__,
+ irq_type ? ((irq_type == 1) ? "UP" : "CRITICAL") : "LOW",
+ enable ? "en" : "dis");
+- if (tsens_version(priv) > VER_1_X)
++ if (tsens_version(priv) >= VER_2_X)
+ tsens_set_interrupt_v2(priv, hw_id, irq_type, enable);
+ else
+ tsens_set_interrupt_v1(priv, hw_id, irq_type, enable);
+@@ -318,7 +318,7 @@ static int tsens_read_irq_state(struct tsens_priv *priv, u32 hw_id,
+ ret = regmap_field_read(priv->rf[LOW_INT_CLEAR_0 + hw_id], &d->low_irq_clear);
+ if (ret)
+ return ret;
+- if (tsens_version(priv) > VER_1_X) {
++ if (tsens_version(priv) >= VER_2_X) {
+ ret = regmap_field_read(priv->rf[UP_INT_MASK_0 + hw_id], &d->up_irq_mask);
+ if (ret)
+ return ret;
+@@ -362,7 +362,7 @@ static int tsens_read_irq_state(struct tsens_priv *priv, u32 hw_id,
+
+ static inline u32 masked_irq(u32 hw_id, u32 mask, enum tsens_ver ver)
+ {
+- if (ver > VER_1_X)
++ if (ver >= VER_2_X)
+ return mask & (1 << hw_id);
+
+ /* v1, v0.1 don't have a irq mask register */
+@@ -578,7 +578,7 @@ static int tsens_set_trips(void *_sensor, int low, int high)
+ static int tsens_enable_irq(struct tsens_priv *priv)
+ {
+ int ret;
+- int val = tsens_version(priv) > VER_1_X ? 7 : 1;
++ int val = tsens_version(priv) >= VER_2_X ? 7 : 1;
+
+ ret = regmap_field_write(priv->rf[INT_EN], val);
+ if (ret < 0)
+@@ -892,7 +892,7 @@ int __init init_common(struct tsens_priv *priv)
+ }
+ }
+
+- if (tsens_version(priv) > VER_1_X && ver_minor > 2) {
++ if (tsens_version(priv) >= VER_2_X && ver_minor > 2) {
+ /* Watchdog is present only on v2.3+ */
+ priv->feat->has_watchdog = 1;
+ for (i = WDOG_BARK_STATUS; i <= CC_MON_MASK; i++) {
+--
+2.39.5
+
--- /dev/null
+From 011abeaf5998bef27217ee9721f1b102bd83ddb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 May 2025 11:47:17 +0000
+Subject: tipc: use kfree_sensitive() for aead cleanup
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit c8ef20fe7274c5766a317f9193b70bed717b6b3d ]
+
+The tipc_aead_free() function currently uses kfree() to release the aead
+structure. However, this structure contains sensitive information, such
+as key's SALT value, which should be securely erased from memory to
+prevent potential leakage.
+
+To enhance security, replace kfree() with kfree_sensitive() when freeing
+the aead structure. This change ensures that sensitive data is explicitly
+cleared before memory deallocation, aligning with the approach used in
+tipc_aead_init() and adhering to best practices for handling confidential
+information.
+
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
+Link: https://patch.msgid.link/20250523114717.4021518-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index 07f35c48bd3a2..b525e6483881a 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp)
+ }
+ free_percpu(aead->tfm_entry);
+ kfree_sensitive(aead->key);
+- kfree(aead);
++ kfree_sensitive(aead);
+ }
+
+ static int tipc_aead_users(struct tipc_aead __rcu *aead)
+--
+2.39.5
+
--- /dev/null
+From dbc82263d2575bcab0fc28c91c6250b6ed2a87e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 15:11:41 +0300
+Subject: vxlan: Do not treat dst cache initialization errors as fatal
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 20c76dadc783759fd3819d289c72be590660cc8b ]
+
+FDB entries are allocated in an atomic context as they can be added from
+the data path when learning is enabled.
+
+After converting the FDB hash table to rhashtable, the insertion rate
+will be much higher (*) which will entail a much higher rate of per-CPU
+allocations via dst_cache_init().
+
+When adding a large number of entries (e.g., 256k) in a batch, a small
+percentage (< 0.02%) of these per-CPU allocations will fail [1]. This
+does not happen with the current code since the insertion rate is low
+enough to give the per-CPU allocator a chance to asynchronously create
+new chunks of per-CPU memory.
+
+Given that:
+
+a. Only a small percentage of these per-CPU allocations fail.
+
+b. The scenario where this happens might not be the most realistic one.
+
+c. The driver can work correctly without dst caches. The dst_cache_*()
+APIs first check that the dst cache was properly initialized.
+
+d. The dst caches are not always used (e.g., 'tos inherit').
+
+It seems reasonable to not treat these allocation failures as fatal.
+
+Therefore, do not bail when dst_cache_init() fails and suppress warnings
+by specifying '__GFP_NOWARN'.
+
+[1] percpu: allocation failed, size=40 align=8 atomic=1, atomic alloc failed, no space left
+
+(*) 97% reduction in average latency of vxlan_fdb_update() when adding
+256k entries in a batch.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250415121143.345227-14-idosch@nvidia.com
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
+index 9c4d7bedc7641..91122d4d404b7 100644
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -713,10 +713,10 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
+ if (rd == NULL)
+ return -ENOMEM;
+
+- if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) {
+- kfree(rd);
+- return -ENOMEM;
+- }
++ /* The driver can work correctly without a dst cache, so do not treat
++ * dst cache initialization errors as fatal.
++ */
++ dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN);
+
+ rd->remote_ip = *ip;
+ rd->remote_port = port;
+--
+2.39.5
+
--- /dev/null
+From 9774d4d189034b10c6ad419264bec2bbc8220457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 09:29:51 +0100
+Subject: watchdog: da9052_wdt: respect TWDMIN
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 325f510fcd9cda5a44bcb662b74ba4e3dabaca10 ]
+
+We have to wait at least the minimium time for the watchdog window
+(TWDMIN) before writings to the wdt register after the
+watchdog is activated.
+Otherwise the chip will assert TWD_ERROR and power down to reset mode.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-4-a38a560fef0e@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/da9052_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c
+index d708c091bf1b1..180526220d8c4 100644
+--- a/drivers/watchdog/da9052_wdt.c
++++ b/drivers/watchdog/da9052_wdt.c
+@@ -164,6 +164,7 @@ static int da9052_wdt_probe(struct platform_device *pdev)
+ da9052_wdt = &driver_data->wdt;
+
+ da9052_wdt->timeout = DA9052_DEF_TIMEOUT;
++ da9052_wdt->min_hw_heartbeat_ms = DA9052_TWDMIN;
+ da9052_wdt->info = &da9052_wdt_info;
+ da9052_wdt->ops = &da9052_wdt_ops;
+ da9052_wdt->parent = dev;
+--
+2.39.5
+
--- /dev/null
+From a4fed1719c7626ca2d85e3b7e2350bb33f05d901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Apr 2025 21:10:42 +0200
+Subject: wifi: mac80211: do not offer a mesh path if forwarding is disabled
+
+From: Benjamin Berg <benjamin@sipsolutions.net>
+
+[ Upstream commit cf1b684a06170d253b47d6a5287821de976435bd ]
+
+When processing a PREQ the code would always check whether we have a
+mesh path locally and reply accordingly. However, when forwarding is
+disabled then we should not reply with this information as we will not
+forward data packets down that path.
+
+Move the check for dot11MeshForwarding up in the function and skip the
+mesh path lookup in that case. In the else block, set forward to false
+so that the rest of the function becomes a no-op and the
+dot11MeshForwarding check does not need to be duplicated.
+
+This explains an effect observed in the Freifunk community where mesh
+forwarding is disabled. In that case a mesh with three STAs and only bad
+links in between them, individual STAs would occionally have indirect
+mpath entries. This should not have happened.
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Reviewed-by: Rouven Czerwinski <rouven@czerwinskis.de>
+Link: https://patch.msgid.link/20250430191042.3287004-1-benjamin@sipsolutions.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index e6b6a7508ff1b..8bf238afb5442 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -620,7 +620,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ mesh_path_add_gate(mpath);
+ }
+ rcu_read_unlock();
+- } else {
++ } else if (ifmsh->mshcfg.dot11MeshForwarding) {
+ rcu_read_lock();
+ mpath = mesh_path_lookup(sdata, target_addr);
+ if (mpath) {
+@@ -638,6 +638,8 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+ rcu_read_unlock();
++ } else {
++ forward = false;
+ }
+
+ if (reply) {
+@@ -655,7 +657,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+
+- if (forward && ifmsh->mshcfg.dot11MeshForwarding) {
++ if (forward) {
+ u32 preq_id;
+ u8 hopcount;
+
+--
+2.39.5
+
--- /dev/null
+From e144e1b63d05d5e5dd970c5dc964689853237589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Apr 2025 16:39:14 +0200
+Subject: wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
+
+From: Henk Vergonet <henk.vergonet@gmail.com>
+
+[ Upstream commit 3c0e4f606d8693795a2c965d6f4987b1bfc31097 ]
+
+Adds support for:
+ - LiteOn WN4516R
+ - LiteOn WN4519R
+ Both use:
+ - A nonstandard USB connector
+ - Mediatek chipset MT7600U
+ - ASIC revision: 76320044
+
+Disabled VHT support on ASIC revision 76320044:
+
+ This fixes the 5G connectibity issue on LiteOn WN4519R module
+ see https://github.com/openwrt/mt76/issues/971
+
+ And may also fix the 5G issues on the XBox One Wireless Adapter
+ see https://github.com/openwrt/mt76/issues/200
+
+ I have looked at the FCC info related to the MT7632U chip as mentioned in here:
+ https://github.com/openwrt/mt76/issues/459
+ These confirm the chipset does not support 'ac' mode and hence VHT should be turned of.
+
+Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250418143914.31384-1-henk.vergonet@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 ++
+ .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 ++++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+index 09b01e09bcfe0..1f2990d45d9e3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = {
+ { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */
+ { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */
+ { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */
++ { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */
++ { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */
+ { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */
+ { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */
+ { USB_DEVICE(0x045e, 0x02e6) }, /* XBox One Wireless Adapter */
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
+index 85dcdc22fbebf..41b9a99665822 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
+@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev)
+ {
+ struct ieee80211_hw *hw = mt76_hw(dev);
+ struct mt76_usb *usb = &dev->mt76.usb;
++ bool vht;
+ int err;
+
+ INIT_DELAYED_WORK(&dev->cal_work, mt76x2u_phy_calibrate);
+@@ -215,7 +216,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev)
+
+ /* check hw sg support in order to enable AMSDU */
+ hw->max_tx_fragments = dev->mt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1;
+- err = mt76_register_device(&dev->mt76, true, mt76x02_rates,
++ switch (dev->mt76.rev) {
++ case 0x76320044:
++ /* these ASIC revisions do not support VHT */
++ vht = false;
++ break;
++ default:
++ vht = true;
++ break;
++ }
++
++ err = mt76_register_device(&dev->mt76, vht, mt76x02_rates,
+ ARRAY_SIZE(mt76x02_rates));
+ if (err)
+ goto fail;
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
