From a782e2f200677432f975db0c2838223bc071d426 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Mon, 30 Sep 2024 19:03:12 -0400
Subject: [PATCH] Fixes for 6.1

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...esting-fix-admv8818-attr-description.patch |  37 ++
 queue-6.1/acpi-cppc-fix-mask_val-usage.patch  | 147 +++++
 ...-unneeded-check-in-tps68470_pmic_opr.patch |  49 ++
 ...exsystem-don-t-nag-user-about-every-.patch |  60 ++
 ...-acpi_warning_once-and-acpi_error_on.patch |  61 ++
 ...a-hda-cs35l41-fix-module-autoloading.patch |  36 ++
 ...i-rmu2-fix-ethernet-phy-pinctrl-prop.patch |  38 ++
 ...microchip-sam9x60-fix-rtc-rtt-clocks.patch |  54 ++
 ...-dts-microchip-sama7g5-fix-rtt-clock.patch |  37 ++
 ...ile-fix-of-node-leak-in-cpus-prepare.patch |  37 ++
 ...-exynos7885-jackpotlte-correct-ram-a.patch |  38 ++
 ...s-r9a07g043u-correct-gicd-and-gicr-s.patch |  41 ++
 ...s-r9a07g044-correct-gicd-and-gicr-si.patch |  40 ++
 ...s-r9a07g054-correct-gicd-and-gicr-si.patch |  39 ++
 ...j721e-sk-fix-reversed-c6x-carveout-l.patch |  49 ++
 ...urn-devm_of_clk_add_hw_provider-to-t.patch |  41 ++
 ...er-ip-header-in-bareudp_udp_encap_re.patch |  70 +++
 ...bareudp-pull-inner-ip-header-on-xmit.patch |  51 ++
 ...-the-last-bfqq-from-merge-chain-in-b.patch |  61 ++
 ...-break-merge-chain-in-bfq_split_bfqq.patch |  66 ++
 ...ssible-uaf-for-bfqq-bic-with-merge-c.patch | 225 +++++++
 ...ial-invalid-pointer-dereference-in-b.patch |  54 ++
 ...olic-error-name-instead-of-error-cod.patch |  44 ++
 ...-fix-not-handling-zpl-short-transfer.patch |  45 ++
 ...re-fix-sending-mgmt_ev_connect_faile.patch |  90 +++
 ...nc-ignore-errors-from-hci_op_remote_.patch |  40 ++
 ...cessary-warnings-and-logs-from-bond_.patch |  66 ++
 ...ndle-malformed-bpf_core_type_id_loca.patch |  71 +++
 ...ol-and-bpf_strtoul-helpers-for-32bit.patch |  74 +++
 ...k_raw_mode_ok-test-for-mem_uninit-ta.patch |  80 +++
 ...arg_ptr_to_-long-int-args-in-case-of.patch | 169 ++++++
 ...-bcm_proc_read-after-remove_proc_ent.patch |  99 +++
 ...use-correct-function-name-in-comment.patch |  44 ++
 ...able-napi-before-enabling-interrupts.patch | 102 ++++
 ...close-stop-clocks-after-device-has-b.patch |  50 ++
 ...ove-repeated-check-for-is_peripheral.patch |  40 ++
 ...osite-7ulp-check-the-pcc-present-bit.patch |  52 ++
 ...e-8m-enable-gate-clk-with-mcore_boot.patch | 113 ++++
 ...e-8m-less-function-calls-in-__imx8m_.patch |  81 +++
 ...pll-fix-fractional-part-of-pll-getti.patch |  43 ++
 ...-imx-fracn-gppll-support-integer-pll.patch | 184 ++++++
 ...ix-clock-tree-update-of-tf-a-managed.patch |  61 ++
 ...parent-should-be-initialized-earlier.patch |  57 ++
 ...register-dc0_bypass0_clk-before-disp.patch |  46 ++
 ...sm8250-use-special-function-for-luci.patch | 124 ++++
 ...-parent-rate-for-dclk_vop-clock-on-r.patch |  42 ++
 ...clk-ti-dra7-atl-fix-leak-of-of_nodes.patch |  39 ++
 ...ers-qcom-add-missing-iounmap-on-erro.patch |  51 ++
 ...oresight-tmc-sg-do-not-leak-sg_table.patch |  73 +++
 ...eq-introduce-quirks-to-handle-syscon.patch |  89 +++
 ...-hpre-enable-sva-error-interrupt-eve.patch |  47 ++
 ...icon-hpre-mask-cluster-timeout-error.patch | 115 ++++
 ...hisilicon-qm-fix-coding-style-issues.patch | 142 +++++
 ...-qm-inject-error-before-stopping-que.patch | 108 ++++
 ...n-qm-reset-device-before-enabling-it.patch | 434 +++++++++++++
 ...crypto-xor-fix-template-benchmarking.patch | 105 ++++
 ...t-range-register-decoding-from-cxl_h.patch | 162 +++++
 ...i-fix-to-record-only-non-zero-ranges.patch |  66 ++
 ...os_drm_gsc-fix-wrong-assignment-in-g.patch |  36 ++
 ...b-frontends-rtl2830-fix-an-out-of-bo.patch |  43 ++
 ...b-frontends-rtl2832-fix-an-out-of-bo.patch |  44 ++
 ...-ali_drw_pmu-driver-interrupt-status.patch |  44 ++
 ...i_pcie-record-hardware-counts-correc.patch |  66 ++
 ...gpu-properly-tune-the-size-of-struct.patch |  55 ++
 ...add-null-check-for-set_output_gamma-.patch | 103 ++++
 ...operly-handle-vbios-fake-edid-sizing.patch |  79 +++
 ...ce-one-element-array-with-flexible-a.patch |  68 +++
 ...um-lt8912b-validate-mode-in-drm_brid.patch |  97 +++
 ...-missing-configuration-flags-in-mtk_.patch | 143 +++++
 ...-spin_lock_irqsave-for-crtc-event-lo.patch |  49 ++
 ...able-preemption-in-submits-by-defaul.patch |  52 ++
 ...-races-in-preemption-evaluation-stag.patch | 124 ++++
 ...perly-clear-preemption-records-on-re.patch |  41 ++
 ...karound-early-ring-buffer-emptiness-.patch |  99 +++
 ...rrect-file-name-output-in-adreno_req.patch |  44 ++
 .../drm-msm-fix-s-null-argument-error.patch   |  48 ++
 ...reen_cs-fix-int-overflow-errors-in-c.patch | 225 +++++++
 ...operly-handle-vbios-fake-edid-sizing.patch |  79 +++
 ...ce-one-element-array-with-flexible-a.patch |  69 +++
 ...hdmi-fix-reading-edid-when-using-a-f.patch |  45 ++
 ...kchip-vop-allow-4096px-width-scaling.patch |  43 ++
 ...rror-handling-path-in-stm_drm_platfo.patch |  45 ++
 ...heck-memory-returned-by-devm_kzalloc.patch |  38 ++
 ...dle-error-case-of-pm_runtime_resume_.patch |  61 ++
 ...asahi-kasei-ak8975-drop-incorrect-ak.patch |  41 ++
 ...x-ecc-status-and-irq-control-race-co.patch | 174 ++++++
 ...x-error-injection-on-zynq-ultrascale.patch | 113 ++++
 ...-off-by-one-in-ep93xx_div_recalc_rat.patch |  42 ++
 ...er_head-leak-in-ext4_mark_inode_used.patch |  51 ++
 ...ive-min_clusters-in-find_group_orlov.patch |  41 ++
 ...hen-system.data-xattr-changes-undern.patch | 146 +++++
 ...tial-buffer_head-leak-in-__ext4_new_.patch |  49 ++
 ...group_info_was_trimmed_bit-even-moun.patch |  69 +++
 ...turn-error-on-ext4_find_inline_entry.patch |  54 ++
 ...to-truncate-pagecache-before-on-disk.patch |  38 ++
 queue-6.1/f2fs-clean-up-w-dotdot_name.patch   |  50 ++
 ...read-write-tracing-logic-into-a-help.patch | 110 ++++
 ...d-racing-in-between-read-and-opu-dio.patch |  66 ++
 ...to-update-i_ctime-in-__f2fs_setxattr.patch |  57 ++
 ...-page-writeback-before-setting-gcing.patch |  57 ++
 ...online-repaire-on-corrupted-director.patch | 214 +++++++
 ...pensive-checkpoint-trigger-frequency.patch | 131 ++++
 ...eded-check-condition-in-__f2fs_setxa.patch |  36 ++
 ...n-error-handling-path-in-hpfb_dio_pr.patch |  36 ++
 ...i-fix-double-free-in-optee-transport.patch |  45 ++
 ...fs-namespace-fnic-switch-to-use-pttd.patch |  46 ++
 ...-warn-about-dropped-packets-for-firs.patch |  66 ++
 ...t-sequence-numbers-smaller-than-16-b.patch |  50 ++
 .../hwmon-max16065-fix-alarm-attributes.patch |  70 +++
 ...ix-overflows-seen-when-writing-limit.patch |  46 ++
 ...-max16065-remove-use-of-i2c_match_id.patch |  70 +++
 ...tc_thermistor-fix-module-autoloading.patch |  36 ++
 queue-6.1/i2c-add-i2c_get_match_data.patch    |  69 +++
 ...b_cache_setup_one-error-flow-cleanup.patch | 102 ++++
 ...c-ad7606-fix-oversampling-gpio-array.patch |  72 +++
 ...ix-standby-gpio-state-to-match-the-d.patch |  48 ++
 ...680-fix-read-write-ops-to-device-by-.patch |  77 +++
 ...-ak8975-convert-enum-pointer-for-dat.patch | 143 +++++
 ...-ak8975-drop-incorrect-ak09116-compa.patch |  39 ++
 ...i2c-add-report-id-message-validation.patch |  50 ++
 ...i2c-avoid-wrong-input-subsystem-sync.patch |  71 +++
 ...se-irqf_no_autoen-flag-in-request_ir.patch |  49 ++
 ...-set-the-d-bit-on-amd-v2-table-entri.patch |  38 ++
 ...t-advertise-deprecated-sysfs-entries.patch |  39 ++
 ...ble-null-deref-in-rt6_uncached_list_.patch | 110 ++++
 ...ut-of-bounds-in-dbnextag-and-dialloc.patch |  68 +++
 ...actually-test-sme-vector-length-chan.patch |  72 +++
 ...don-t-pass-headers-to-the-compiler-a.patch |  56 ++
 ...fix-enumeration-of-systems-without-1.patch |  44 ++
 ...signal-fix-refactor-sve-vector-lengt.patch | 570 ++++++++++++++++++
 ...verify-simultaneous-ssve-and-za-cont.patch | 193 ++++++
 ...-state-in-kthread-worker-if-being-fr.patch |  91 +++
 ...p-define-swap_lock-as-raw_spinlock_t.patch |  65 ++
 ...f-convert-st_ops-data-to-shadow-type.patch | 117 ++++
 ...bpf_link-in-bpf_map__attach_struct_o.patch | 180 ++++++
 ...e-direct-pointers-into-btf-data-from.patch | 125 ++++
 ...ensure-fd-3-during-bpf_map__reuse_fd.patch |  56 ++
 ...ect-module-btfs-for-struct_ops-maps-.patch | 216 +++++++
 ...s-autoload-with-maps-autocreate-for-.patch | 117 ++++
 ...ibbpf-use-stable-map-placeholder-fds.patch | 285 +++++++++
 ...ernel_clone_args.flags-in-m68k_clone.patch |  54 ++
 ...rly-complex-min-max-macro-arguments-.patch |  77 +++
 ...dle-oom-on-mnt_warn_timestamp_expiry.patch |  61 ++
 ...-check-devm_kasprintf-returned-value.patch |  38 ++
 ...factorize-out-the-logic-cleaning-mtk.patch |  79 +++
 .../mtd-rawnand-mtk-fix-init-error-path.patch |  44 ++
 ...tk-use-for_each_child_of_node_scoped.patch |  46 ++
 ...-break-after-errors-in-parsing-the-m.patch |  72 +++
 ...etween-timeout-and-normal-completion.patch |  64 ++
 ...e-irqf_no_autoen-flag-in-request_irq.patch |  43 ++
 ...ptunnel-fix-memory-leak-in-rpl_input.patch |  57 ++
 ...ect-dst_cache-from-ipv6_rpl_lwtunnel.patch |  44 ++
 ...te-packets-cloning-when-broadcasting.patch |  49 ++
 ...-after-free-vulnerability-in-ether3-.patch |  57 ++
 ...-loongson-init-ref-and-ptp-clocks-ra.patch |  44 ++
 ...p_flag_dma_sync_dev-only-if-xdp-is-e.patch |  48 ++
 ...et-tipc-avoid-possible-garbage-value.patch |  47 ++
 ...t-xilinx-axienet-fix-packet-counting.patch |  98 +++
 ...x-axienet-schedule-napi-in-two-steps.patch |  60 ++
 ...ink-compile-ctnetlink_label_size-wit.patch |  86 +++
 ...ect_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch | 191 ++++++
 ...les-elements-with-timeout-below-conf.patch |  37 ++
 ...les-keep-deleted-flowtable-hooks-unt.patch |  38 ++
 ...les-reject-element-expiration-with-n.patch |  40 ++
 ...les-reject-expiration-higher-than-ti.patch |  36 ++
 ...les-remove-annotation-to-access-set-.patch |  44 ++
 ...put-if-xdr_reserve_space-returns-nul.patch |  58 ++
 ...t-leak-when-file-is-unhashed-after-b.patch |  37 ++
 ...eded-eexist-error-check-in-nfsd_do_f.patch |  37 ++
 ...nfsd-return-einval-when-namelen-is-0.patch |  95 +++
 ...rmine-empty-node-blocks-as-corrupted.patch |  47 ++
 ...tial-null-ptr-deref-in-nilfs_btree_i.patch |  66 ++
 ...tial-oob-read-in-nilfs_btree_check_d.patch |  68 +++
 ...ally-contiguous-allocation-of-rx-rin.patch |  88 +++
 ...e-null-vs-is_err-bug-for-debugfs_cre.patch |  37 ++
 queue-6.1/ntb_perf-fix-printk-format.patch    |  35 ++
 ...nvdimm-fix-devs-leaks-in-scan_labels.patch | 127 ++++
 ...ystem-fails-to-create-generic-nvme-d.patch |  42 ++
 ...-caller-s-alignment-in-case-of-chunk.patch |  51 ++
 ...-if-statement-expression-in-ks_pcie_.patch |  45 ++
 ...ffer-overflow-in-kirin_pcie_parse_po.patch |  55 ++
 ...bridge_wait_for_secondary_bus-timeou.patch | 142 +++++
 ...i-pm-increase-wait-time-after-resume.patch |  56 ++
 ...nk-before-restoring-downstream-buses.patch |  69 +++
 ...lean-up-clock-on-probe-failure-remov.patch |  85 +++
 ...-xilinx-nwl-fix-register-misspelling.patch |  62 ++
 ...arm-cmn-ensure-dtm_idx-is-big-enough.patch |  50 ++
 ...rove-debugfs-pretty-printing-for-lar.patch |  75 +++
 ...cmn-refactor-node-id-handling.-again.patch | 261 ++++++++
 ...rf-arm-cmn-rework-dtc-counters-again.patch | 339 +++++++++++
 ...leader-sampling-inserting-additional.patch | 129 ++++
 ...e-allocated-sort-string-fixing-a-lea.patch |  45 ++
 ...ist-fix-missing-free-of-session-in-p.patch |  49 ++
 ...ist-fixed-timestamp-error-when-unabl.patch |  99 +++
 ...tat-display-iostat-headers-correctly.patch |  66 ++
 ...f-time-utils-fix-32-bit-nsec-parsing.patch |  70 +++
 ...x-devinit_dove_pinctrl_probe-functio.patch | 119 ++++
 ...e-devm_platform_get_and_ioremap_reso.patch |  39 ++
 ...-fix-missing-error-code-in-pcs_probe.patch |  37 ++
 ...rden-inter-column-space-in-debug-sum.patch |  38 ++
 ...20x_battery-remove-design-from-min-a.patch |  82 +++
 ...17042_battery-fix-soc-threshold-calc.patch |  59 ++
 ...werpc-8xx-fix-initial-memory-mapping.patch |  48 ++
 ...ix-kernel-vs-user-address-comparison.patch |  63 ++
 ...-vdso-data-access-when-running-in-a-.patch | 120 ++++
 ...isable-aldps-per-default-for-rtl8125.patch |  51 ++
 ...throttling-hrtimer-armed-from-offlin.patch |  73 +++
 ...gb4-added-null-check-for-lookup_atid.patch |  52 ++
 ...ma-return-qp-state-in-erdma_query_qp.patch |  71 +++
 ...odify-rq-next-block-addr-in-hip09-qp.patch |  49 ++
 ...it-ecc-recovery-address-in-non-4k-os.patch |  41 ++
 ...n_unlock_irqrestore-called-with-irqs.patch |  97 +++
 ...-overflow-risk-of-hem_list_calc_ba_r.patch |  77 +++
 ...ix-use-after-free-of-rsv_qp-on-hip08.patch |  51 ++
 ...triggering-pf-reset-in-abnormal-inte.patch |  51 ++
 ...-optimize-hem-allocation-performance.patch |  57 ++
 ...rror-message-in-irdma_modify_qp_roce.patch |  40 ++
 ...rning-at_kernel-workqueue.c-check_fl.patch |  83 +++
 ...set-cid-to-con_num-1-to-stay-in-boun.patch |  47 ++
 ...hb_missed_cnt-after-receiving-other-.patch |  68 +++
 ...-actual-error-in-of_regulator_bulk_g.patch |  41 ++
 ...x_rproc-correct-ddr-alias-for-i.mx8m.patch |  40 ++
 ...x_rproc-initialize-workqueue-earlier.patch |  48 ++
 ...fix-of-node-leak-in-probe-error-path.patch |  46 ++
 ...fix-of-node-leak-in-probe-error-path.patch |  47 ++
 ...e-io-if-mapping-table-not-yet-availa.patch |  84 +++
 ...biret-init-before-forwarding-to-user.patch |  48 ++
 ...alignment-bug-in-perf_callchain_user.patch |  46 ++
 ...fix-potential-use-after-free-in-efc_.patch |  43 ++
 ...ck-for-phase-match-during-pdma-fixup.patch | 135 +++++
 ...vert-propagate-the-multipath-failure.patch |  93 +++
 ...d-a-cgroup-prog-bpf_get_ns_current_p.patch | 145 +++++
 ...d-selftest-deny_namespace-to-s390x-d.patch |  45 ++
 ...d-tests-for-_opts-variants-of-bpf_-_.patch | 185 ++++++
 ...x-c-compile-error-from-missing-_bool.patch |  55 ++
 ...x-compile-error-from-rlim_t-in-sk_st.patch |  57 ++
 ...x-compile-if-backtrace-support-missi.patch |  69 +++
 ...x-compiling-core_reloc.c-with-musl-l.patch |  43 ++
 ...x-compiling-flow_dissector.c-with-mu.patch |  46 ++
 ...x-compiling-kfree_skb.c-with-musl-li.patch |  41 ++
 ...x-compiling-tcp_rtt.c-with-musl-libc.patch |  43 ++
 ...x-error-compiling-bpf_iter_setsockop.patch |  59 ++
 ...f-fix-error-compiling-test_lru_map.c.patch |  46 ++
 ...x-errors-compiling-cg_storage_multi..patch |  49 ++
 ...tests-bpf-fix-include-of-sys-fcntl.h.patch |  43 ++
 ...x-missing-array_size-definition-in-b.patch |  42 ++
 ...fix-missing-build_bug_on-declaration.patch |  42 ++
 ...x-missing-uint_max-definitions-in-be.patch |  48 ++
 ...ve-test_progs-helpers-to-testing_hel.patch | 247 ++++++++
 ...factor-out-some-functions-in-ns_curr.patch | 158 +++++
 ...place-check-with-assert_-in-ns_curre.patch | 121 ++++
 ...place-extract_build_id-with-read_bui.patch | 181 ++++++
 ...e-pid_t-consistently-in-test_progs.c.patch |  45 ++
 ...rkaround-strict-bpf_lsm-return-value.patch |  47 ++
 ...ix-elf-hash-table-entry-size-for-s39.patch |  78 +++
 ...tests-vdso-fix-vdso-name-for-powerpc.patch |  52 ++
 ...ix-vdso-symbols-lookup-for-powerpc64.patch | 108 ++++
 ...sts-vdso-fix-vdso_config-for-powerpc.patch |  52 ++
 ...ftests-vdso-fix-vdso_config-for-s390.patch |  51 ++
 queue-6.1/series                              | 291 +++++++++
 ...assign_pointer-to-ensure-safe-assign.patch |  49 ++
 ...add-a-cond_resched-in-sock_hash_free.patch |  41 ++
 ...i-undo-runtime-pm-changes-at-driver-.patch |  41 ++
 ...-returning-0-when-failed-to-parse-an.patch |  50 ++
 ...x-handle-irq_of_parse_and_map-errors.patch |  39 ++
 ...i-undo-runtime-pm-changes-at-driver-.patch |  41 ++
 ...-skb-is-non-null-in-tcp_rto_delta_us.patch | 351 +++++++++++
 ...n-up-tpm-space-after-command-failure.patch |  57 ++
 ...2-skip-clock-gating-on-broadcom-socs.patch |  72 +++
 ...pa-add-eventfd-for-the-vdpa-callback.patch |  77 +++
 ...n-irq-bypass-producer-token-correctl.patch |  95 +++
 ..._sc_wdt-don-t-disable-wdt-in-suspend.patch |  73 +++
 ...-parameter-check-in-ath9k_init_debug.patch |  41 ++
 ...e-error-checks-when-creating-debugfs.patch |  68 +++
 ...x-two-more-possible-ubsan-detected-o.patch |  57 ++
 ...x-ubsan-noise-in-cfg80211_wext_siwsc.patch |  69 +++
 ...-increase-the-time-between-ranging-m.patch |  39 ++
 ...n-t-use-rate-mask-for-offchannel-tx-.patch | 117 ++++
 ...e-two-phase-skb-reclamation-in-ieee8.patch | 103 ++++
 ...-fix-rx-filter-setting-for-bfee-func.patch |  38 ++
 ...s-wait-for-both-firmware-loading-att.patch |  58 ++
 ...move-cpt-execution-branch-never-used.patch |  95 +++
 ...x-potential-rcu-dereference-issue-in.patch |  69 +++
 ...fix-deadlock-in-sgx-numa-node-search.patch |  85 +++
 ...ty-to-remap-non-ram-pages-to-differe.patch | 130 ++++
 ...neric-helper-checking-for-memory-map.patch | 138 +++++
 ...-in-xen_memory_setup-out-of-function.patch | 195 ++++++
 ...-add-alignment-check-for-dma-buffers.patch |  52 ++
 .../xen-swiotlb-fix-allocated-size.patch      |  49 ++
 ...i-nvs-memory-overlapping-with-xen-al.patch | 161 +++++
 ...end-address-of-kernel-for-conflict-c.patch |  51 ++
 .../xz-cleanup-crc32-edits-from-2018.patch    |  78 +++
 292 files changed, 22976 insertions(+)
 create mode 100644 queue-6.1/abi-testing-fix-admv8818-attr-description.patch
 create mode 100644 queue-6.1/acpi-cppc-fix-mask_val-usage.patch
 create mode 100644 queue-6.1/acpi-pmic-remove-unneeded-check-in-tps68470_pmic_opr.patch
 create mode 100644 queue-6.1/acpica-executer-exsystem-don-t-nag-user-about-every-.patch
 create mode 100644 queue-6.1/acpica-implement-acpi_warning_once-and-acpi_error_on.patch
 create mode 100644 queue-6.1/alsa-hda-cs35l41-fix-module-autoloading.patch
 create mode 100644 queue-6.1/arm-dts-imx7d-zii-rmu2-fix-ethernet-phy-pinctrl-prop.patch
 create mode 100644 queue-6.1/arm-dts-microchip-sam9x60-fix-rtc-rtt-clocks.patch
 create mode 100644 queue-6.1/arm-dts-microchip-sama7g5-fix-rtt-clock.patch
 create mode 100644 queue-6.1/arm-versatile-fix-of-node-leak-in-cpus-prepare.patch
 create mode 100644 queue-6.1/arm64-dts-exynos-exynos7885-jackpotlte-correct-ram-a.patch
 create mode 100644 queue-6.1/arm64-dts-renesas-r9a07g043u-correct-gicd-and-gicr-s.patch
 create mode 100644 queue-6.1/arm64-dts-renesas-r9a07g044-correct-gicd-and-gicr-si.patch
 create mode 100644 queue-6.1/arm64-dts-renesas-r9a07g054-correct-gicd-and-gicr-si.patch
 create mode 100644 queue-6.1/arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-carveout-l.patch
 create mode 100644 queue-6.1/asoc-rt5682s-return-devm_of_clk_add_hw_provider-to-t.patch
 create mode 100644 queue-6.1/bareudp-pull-inner-ip-header-in-bareudp_udp_encap_re.patch
 create mode 100644 queue-6.1/bareudp-pull-inner-ip-header-on-xmit.patch
 create mode 100644 queue-6.1/block-bfq-choose-the-last-bfqq-from-merge-chain-in-b.patch
 create mode 100644 queue-6.1/block-bfq-don-t-break-merge-chain-in-bfq_split_bfqq.patch
 create mode 100644 queue-6.1/block-bfq-fix-possible-uaf-for-bfqq-bic-with-merge-c.patch
 create mode 100644 queue-6.1/block-fix-potential-invalid-pointer-dereference-in-b.patch
 create mode 100644 queue-6.1/block-print-symbolic-error-name-instead-of-error-cod.patch
 create mode 100644 queue-6.1/bluetooth-btusb-fix-not-handling-zpl-short-transfer.patch
 create mode 100644 queue-6.1/bluetooth-hci_core-fix-sending-mgmt_ev_connect_faile.patch
 create mode 100644 queue-6.1/bluetooth-hci_sync-ignore-errors-from-hci_op_remote_.patch
 create mode 100644 queue-6.1/bonding-fix-unnecessary-warnings-and-logs-from-bond_.patch
 create mode 100644 queue-6.1/bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch
 create mode 100644 queue-6.1/bpf-fix-bpf_strtol-and-bpf_strtoul-helpers-for-32bit.patch
 create mode 100644 queue-6.1/bpf-improve-check_raw_mode_ok-test-for-mem_uninit-ta.patch
 create mode 100644 queue-6.1/bpf-zero-former-arg_ptr_to_-long-int-args-in-case-of.patch
 create mode 100644 queue-6.1/can-bcm-clear-bo-bcm_proc_read-after-remove_proc_ent.patch
 create mode 100644 queue-6.1/can-j1939-use-correct-function-name-in-comment.patch
 create mode 100644 queue-6.1/can-m_can-enable-napi-before-enabling-interrupts.patch
 create mode 100644 queue-6.1/can-m_can-m_can_close-stop-clocks-after-device-has-b.patch
 create mode 100644 queue-6.1/can-m_can-remove-repeated-check-for-is_peripheral.patch
 create mode 100644 queue-6.1/clk-imx-composite-7ulp-check-the-pcc-present-bit.patch
 create mode 100644 queue-6.1/clk-imx-composite-8m-enable-gate-clk-with-mcore_boot.patch
 create mode 100644 queue-6.1/clk-imx-composite-8m-less-function-calls-in-__imx8m_.patch
 create mode 100644 queue-6.1/clk-imx-fracn-gppll-fix-fractional-part-of-pll-getti.patch
 create mode 100644 queue-6.1/clk-imx-fracn-gppll-support-integer-pll.patch
 create mode 100644 queue-6.1/clk-imx-imx8mp-fix-clock-tree-update-of-tf-a-managed.patch
 create mode 100644 queue-6.1/clk-imx-imx8qxp-parent-should-be-initialized-earlier.patch
 create mode 100644 queue-6.1/clk-imx-imx8qxp-register-dc0_bypass0_clk-before-disp.patch
 create mode 100644 queue-6.1/clk-qcom-dispcc-sm8250-use-special-function-for-luci.patch
 create mode 100644 queue-6.1/clk-rockchip-set-parent-rate-for-dclk_vop-clock-on-r.patch
 create mode 100644 queue-6.1/clk-ti-dra7-atl-fix-leak-of-of_nodes.patch
 create mode 100644 queue-6.1/clocksource-drivers-qcom-add-missing-iounmap-on-erro.patch
 create mode 100644 queue-6.1/coresight-tmc-sg-do-not-leak-sg_table.patch
 create mode 100644 queue-6.1/cpufreq-ti-cpufreq-introduce-quirks-to-handle-syscon.patch
 create mode 100644 queue-6.1/crypto-hisilicon-hpre-enable-sva-error-interrupt-eve.patch
 create mode 100644 queue-6.1/crypto-hisilicon-hpre-mask-cluster-timeout-error.patch
 create mode 100644 queue-6.1/crypto-hisilicon-qm-fix-coding-style-issues.patch
 create mode 100644 queue-6.1/crypto-hisilicon-qm-inject-error-before-stopping-que.patch
 create mode 100644 queue-6.1/crypto-hisilicon-qm-reset-device-before-enabling-it.patch
 create mode 100644 queue-6.1/crypto-xor-fix-template-benchmarking.patch
 create mode 100644 queue-6.1/cxl-pci-break-out-range-register-decoding-from-cxl_h.patch
 create mode 100644 queue-6.1/cxl-pci-fix-to-record-only-non-zero-ranges.patch
 create mode 100644 queue-6.1/drivers-drm-exynos_drm_gsc-fix-wrong-assignment-in-g.patch
 create mode 100644 queue-6.1/drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch
 create mode 100644 queue-6.1/drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch
 create mode 100644 queue-6.1/drivers-perf-fix-ali_drw_pmu-driver-interrupt-status.patch
 create mode 100644 queue-6.1/drivers-perf-hisi_pcie-record-hardware-counts-correc.patch
 create mode 100644 queue-6.1/drm-amd-amdgpu-properly-tune-the-size-of-struct.patch
 create mode 100644 queue-6.1/drm-amd-display-add-null-check-for-set_output_gamma-.patch
 create mode 100644 queue-6.1/drm-amdgpu-properly-handle-vbios-fake-edid-sizing.patch
 create mode 100644 queue-6.1/drm-amdgpu-replace-one-element-array-with-flexible-a.patch
 create mode 100644 queue-6.1/drm-bridge-lontium-lt8912b-validate-mode-in-drm_brid.patch
 create mode 100644 queue-6.1/drm-mediatek-fix-missing-configuration-flags-in-mtk_.patch
 create mode 100644 queue-6.1/drm-mediatek-use-spin_lock_irqsave-for-crtc-event-lo.patch
 create mode 100644 queue-6.1/drm-msm-a5xx-disable-preemption-in-submits-by-defaul.patch
 create mode 100644 queue-6.1/drm-msm-a5xx-fix-races-in-preemption-evaluation-stag.patch
 create mode 100644 queue-6.1/drm-msm-a5xx-properly-clear-preemption-records-on-re.patch
 create mode 100644 queue-6.1/drm-msm-a5xx-workaround-early-ring-buffer-emptiness-.patch
 create mode 100644 queue-6.1/drm-msm-fix-incorrect-file-name-output-in-adreno_req.patch
 create mode 100644 queue-6.1/drm-msm-fix-s-null-argument-error.patch
 create mode 100644 queue-6.1/drm-radeon-evergreen_cs-fix-int-overflow-errors-in-c.patch
 create mode 100644 queue-6.1/drm-radeon-properly-handle-vbios-fake-edid-sizing.patch
 create mode 100644 queue-6.1/drm-radeon-replace-one-element-array-with-flexible-a.patch
 create mode 100644 queue-6.1/drm-rockchip-dw_hdmi-fix-reading-edid-when-using-a-f.patch
 create mode 100644 queue-6.1/drm-rockchip-vop-allow-4096px-width-scaling.patch
 create mode 100644 queue-6.1/drm-stm-fix-an-error-handling-path-in-stm_drm_platfo.patch
 create mode 100644 queue-6.1/drm-stm-ltdc-check-memory-returned-by-devm_kzalloc.patch
 create mode 100644 queue-6.1/drm-vc4-hdmi-handle-error-case-of-pm_runtime_resume_.patch
 create mode 100644 queue-6.1/dt-bindings-iio-asahi-kasei-ak8975-drop-incorrect-ak.patch
 create mode 100644 queue-6.1/edac-synopsys-fix-ecc-status-and-irq-control-race-co.patch
 create mode 100644 queue-6.1/edac-synopsys-fix-error-injection-on-zynq-ultrascale.patch
 create mode 100644 queue-6.1/ep93xx-clock-fix-off-by-one-in-ep93xx_div_recalc_rat.patch
 create mode 100644 queue-6.1/ext4-avoid-buffer_head-leak-in-ext4_mark_inode_used.patch
 create mode 100644 queue-6.1/ext4-avoid-negative-min_clusters-in-find_group_orlov.patch
 create mode 100644 queue-6.1/ext4-avoid-oob-when-system.data-xattr-changes-undern.patch
 create mode 100644 queue-6.1/ext4-avoid-potential-buffer_head-leak-in-__ext4_new_.patch
 create mode 100644 queue-6.1/ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch
 create mode 100644 queue-6.1/ext4-return-error-on-ext4_find_inline_entry.patch
 create mode 100644 queue-6.1/f2fs-atomic-fix-to-truncate-pagecache-before-on-disk.patch
 create mode 100644 queue-6.1/f2fs-clean-up-w-dotdot_name.patch
 create mode 100644 queue-6.1/f2fs-factor-the-read-write-tracing-logic-into-a-help.patch
 create mode 100644 queue-6.1/f2fs-fix-to-avoid-racing-in-between-read-and-opu-dio.patch
 create mode 100644 queue-6.1/f2fs-fix-to-update-i_ctime-in-__f2fs_setxattr.patch
 create mode 100644 queue-6.1/f2fs-fix-to-wait-page-writeback-before-setting-gcing.patch
 create mode 100644 queue-6.1/f2fs-get-rid-of-online-repaire-on-corrupted-director.patch
 create mode 100644 queue-6.1/f2fs-reduce-expensive-checkpoint-trigger-frequency.patch
 create mode 100644 queue-6.1/f2fs-remove-unneeded-check-condition-in-__f2fs_setxa.patch
 create mode 100644 queue-6.1/fbdev-hpfb-fix-an-error-handling-path-in-hpfb_dio_pr.patch
 create mode 100644 queue-6.1/firmware-arm_scmi-fix-double-free-in-optee-transport.patch
 create mode 100644 queue-6.1/fs-namespace-fnic-switch-to-use-pttd.patch
 create mode 100644 queue-6.1/hid-wacom-do-not-warn-about-dropped-packets-for-firs.patch
 create mode 100644 queue-6.1/hid-wacom-support-sequence-numbers-smaller-than-16-b.patch
 create mode 100644 queue-6.1/hwmon-max16065-fix-alarm-attributes.patch
 create mode 100644 queue-6.1/hwmon-max16065-fix-overflows-seen-when-writing-limit.patch
 create mode 100644 queue-6.1/hwmon-max16065-remove-use-of-i2c_match_id.patch
 create mode 100644 queue-6.1/hwmon-ntc_thermistor-fix-module-autoloading.patch
 create mode 100644 queue-6.1/i2c-add-i2c_get_match_data.patch
 create mode 100644 queue-6.1/ib-core-fix-ib_cache_setup_one-error-flow-cleanup.patch
 create mode 100644 queue-6.1/iio-adc-ad7606-fix-oversampling-gpio-array.patch
 create mode 100644 queue-6.1/iio-adc-ad7606-fix-standby-gpio-state-to-match-the-d.patch
 create mode 100644 queue-6.1/iio-chemical-bme680-fix-read-write-ops-to-device-by-.patch
 create mode 100644 queue-6.1/iio-magnetometer-ak8975-convert-enum-pointer-for-dat.patch
 create mode 100644 queue-6.1/iio-magnetometer-ak8975-drop-incorrect-ak09116-compa.patch
 create mode 100644 queue-6.1/input-ilitek_ts_i2c-add-report-id-message-validation.patch
 create mode 100644 queue-6.1/input-ilitek_ts_i2c-avoid-wrong-input-subsystem-sync.patch
 create mode 100644 queue-6.1/input-ps2-gpio-use-irqf_no_autoen-flag-in-request_ir.patch
 create mode 100644 queue-6.1/iommu-amd-do-not-set-the-d-bit-on-amd-v2-table-entri.patch
 create mode 100644 queue-6.1/ipmi-docs-don-t-advertise-deprecated-sysfs-entries.patch
 create mode 100644 queue-6.1/ipv6-avoid-possible-null-deref-in-rt6_uncached_list_.patch
 create mode 100644 queue-6.1/jfs-fix-out-of-bounds-in-dbnextag-and-dialloc.patch
 create mode 100644 queue-6.1/kselftest-arm64-actually-test-sme-vector-length-chan.patch
 create mode 100644 queue-6.1/kselftest-arm64-don-t-pass-headers-to-the-compiler-a.patch
 create mode 100644 queue-6.1/kselftest-arm64-fix-enumeration-of-systems-without-1.patch
 create mode 100644 queue-6.1/kselftest-arm64-signal-fix-refactor-sve-vector-lengt.patch
 create mode 100644 queue-6.1/kselftest-arm64-verify-simultaneous-ssve-and-za-cont.patch
 create mode 100644 queue-6.1/kthread-fix-task-state-in-kthread-worker-if-being-fr.patch
 create mode 100644 queue-6.1/lib-sbitmap-define-swap_lock-as-raw_spinlock_t.patch
 create mode 100644 queue-6.1/libbpf-convert-st_ops-data-to-shadow-type.patch
 create mode 100644 queue-6.1/libbpf-create-a-bpf_link-in-bpf_map__attach_struct_o.patch
 create mode 100644 queue-6.1/libbpf-don-t-take-direct-pointers-into-btf-data-from.patch
 create mode 100644 queue-6.1/libbpf-ensure-fd-3-during-bpf_map__reuse_fd.patch
 create mode 100644 queue-6.1/libbpf-find-correct-module-btfs-for-struct_ops-maps-.patch
 create mode 100644 queue-6.1/libbpf-sync-progs-autoload-with-maps-autocreate-for-.patch
 create mode 100644 queue-6.1/libbpf-use-stable-map-placeholder-fds.patch
 create mode 100644 queue-6.1/m68k-fix-kernel_clone_args.flags-in-m68k_clone.patch
 create mode 100644 queue-6.1/minmax-avoid-overly-complex-min-max-macro-arguments-.patch
 create mode 100644 queue-6.1/mount-handle-oom-on-mnt_warn_timestamp_expiry.patch
 create mode 100644 queue-6.1/mtd-powernv-add-check-devm_kasprintf-returned-value.patch
 create mode 100644 queue-6.1/mtd-rawnand-mtk-factorize-out-the-logic-cleaning-mtk.patch
 create mode 100644 queue-6.1/mtd-rawnand-mtk-fix-init-error-path.patch
 create mode 100644 queue-6.1/mtd-rawnand-mtk-use-for_each_child_of_node_scoped.patch
 create mode 100644 queue-6.1/mtd-slram-insert-break-after-errors-in-parsing-the-m.patch
 create mode 100644 queue-6.1/nbd-fix-race-between-timeout-and-normal-completion.patch
 create mode 100644 queue-6.1/net-enetc-use-irqf_no_autoen-flag-in-request_irq.patch
 create mode 100644 queue-6.1/net-ipv6-rpl_iptunnel-fix-memory-leak-in-rpl_input.patch
 create mode 100644 queue-6.1/net-ipv6-select-dst_cache-from-ipv6_rpl_lwtunnel.patch
 create mode 100644 queue-6.1/net-qrtr-update-packets-cloning-when-broadcasting.patch
 create mode 100644 queue-6.1/net-seeq-fix-use-after-free-vulnerability-in-ether3-.patch
 create mode 100644 queue-6.1/net-stmmac-dwmac-loongson-init-ref-and-ptp-clocks-ra.patch
 create mode 100644 queue-6.1/net-stmmac-set-pp_flag_dma_sync_dev-only-if-xdp-is-e.patch
 create mode 100644 queue-6.1/net-tipc-avoid-possible-garbage-value.patch
 create mode 100644 queue-6.1/net-xilinx-axienet-fix-packet-counting.patch
 create mode 100644 queue-6.1/net-xilinx-axienet-schedule-napi-in-two-steps.patch
 create mode 100644 queue-6.1/netfilter-ctnetlink-compile-ctnetlink_label_size-wit.patch
 create mode 100644 queue-6.1/netfilter-nf_reject_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-elements-with-timeout-below-conf.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-keep-deleted-flowtable-hooks-unt.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-reject-element-expiration-with-n.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-reject-expiration-higher-than-ti.patch
 create mode 100644 queue-6.1/netfilter-nf_tables-remove-annotation-to-access-set-.patch
 create mode 100644 queue-6.1/nfsd-call-cache_put-if-xdr_reserve_space-returns-nul.patch
 create mode 100644 queue-6.1/nfsd-fix-refcount-leak-when-file-is-unhashed-after-b.patch
 create mode 100644 queue-6.1/nfsd-remove-unneeded-eexist-error-check-in-nfsd_do_f.patch
 create mode 100644 queue-6.1/nfsd-return-einval-when-namelen-is-0.patch
 create mode 100644 queue-6.1/nilfs2-determine-empty-node-blocks-as-corrupted.patch
 create mode 100644 queue-6.1/nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_i.patch
 create mode 100644 queue-6.1/nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch
 create mode 100644 queue-6.1/ntb-force-physically-contiguous-allocation-of-rx-rin.patch
 create mode 100644 queue-6.1/ntb-intel-fix-the-null-vs-is_err-bug-for-debugfs_cre.patch
 create mode 100644 queue-6.1/ntb_perf-fix-printk-format.patch
 create mode 100644 queue-6.1/nvdimm-fix-devs-leaks-in-scan_labels.patch
 create mode 100644 queue-6.1/nvme-multipath-system-fails-to-create-generic-nvme-d.patch
 create mode 100644 queue-6.1/padata-honor-the-caller-s-alignment-in-case-of-chunk.patch
 create mode 100644 queue-6.1/pci-keystone-fix-if-statement-expression-in-ks_pcie_.patch
 create mode 100644 queue-6.1/pci-kirin-fix-buffer-overflow-in-kirin_pcie_parse_po.patch
 create mode 100644 queue-6.1/pci-pm-drop-pci_bridge_wait_for_secondary_bus-timeou.patch
 create mode 100644 queue-6.1/pci-pm-increase-wait-time-after-resume.patch
 create mode 100644 queue-6.1/pci-wait-for-link-before-restoring-downstream-buses.patch
 create mode 100644 queue-6.1/pci-xilinx-nwl-clean-up-clock-on-probe-failure-remov.patch
 create mode 100644 queue-6.1/pci-xilinx-nwl-fix-register-misspelling.patch
 create mode 100644 queue-6.1/perf-arm-cmn-ensure-dtm_idx-is-big-enough.patch
 create mode 100644 queue-6.1/perf-arm-cmn-improve-debugfs-pretty-printing-for-lar.patch
 create mode 100644 queue-6.1/perf-arm-cmn-refactor-node-id-handling.-again.patch
 create mode 100644 queue-6.1/perf-arm-cmn-rework-dtc-counters-again.patch
 create mode 100644 queue-6.1/perf-inject-fix-leader-sampling-inserting-additional.patch
 create mode 100644 queue-6.1/perf-mem-free-the-allocated-sort-string-fixing-a-lea.patch
 create mode 100644 queue-6.1/perf-sched-timehist-fix-missing-free-of-session-in-p.patch
 create mode 100644 queue-6.1/perf-sched-timehist-fixed-timestamp-error-when-unabl.patch
 create mode 100644 queue-6.1/perf-stat-display-iostat-headers-correctly.patch
 create mode 100644 queue-6.1/perf-time-utils-fix-32-bit-nsec-parsing.patch
 create mode 100644 queue-6.1/pinctrl-mvebu-fix-devinit_dove_pinctrl_probe-functio.patch
 create mode 100644 queue-6.1/pinctrl-mvebu-use-devm_platform_get_and_ioremap_reso.patch
 create mode 100644 queue-6.1/pinctrl-single-fix-missing-error-code-in-pcs_probe.patch
 create mode 100644 queue-6.1/pmdomain-core-harden-inter-column-space-in-debug-sum.patch
 create mode 100644 queue-6.1/power-supply-axp20x_battery-remove-design-from-min-a.patch
 create mode 100644 queue-6.1/power-supply-max17042_battery-fix-soc-threshold-calc.patch
 create mode 100644 queue-6.1/powerpc-8xx-fix-initial-memory-mapping.patch
 create mode 100644 queue-6.1/powerpc-8xx-fix-kernel-vs-user-address-comparison.patch
 create mode 100644 queue-6.1/powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch
 create mode 100644 queue-6.1/r8169-disable-aldps-per-default-for-rtl8125.patch
 create mode 100644 queue-6.1/rcu-nocb-fix-rt-throttling-hrtimer-armed-from-offlin.patch
 create mode 100644 queue-6.1/rdma-cxgb4-added-null-check-for-lookup_atid.patch
 create mode 100644 queue-6.1/rdma-erdma-return-qp-state-in-erdma_query_qp.patch
 create mode 100644 queue-6.1/rdma-hns-don-t-modify-rq-next-block-addr-in-hip09-qp.patch
 create mode 100644 queue-6.1/rdma-hns-fix-1bit-ecc-recovery-address-in-non-4k-os.patch
 create mode 100644 queue-6.1/rdma-hns-fix-spin_unlock_irqrestore-called-with-irqs.patch
 create mode 100644 queue-6.1/rdma-hns-fix-the-overflow-risk-of-hem_list_calc_ba_r.patch
 create mode 100644 queue-6.1/rdma-hns-fix-use-after-free-of-rsv_qp-on-hip08.patch
 create mode 100644 queue-6.1/rdma-hns-fix-vf-triggering-pf-reset-in-abnormal-inte.patch
 create mode 100644 queue-6.1/rdma-hns-optimize-hem-allocation-performance.patch
 create mode 100644 queue-6.1/rdma-irdma-fix-error-message-in-irdma_modify_qp_roce.patch
 create mode 100644 queue-6.1/rdma-iwcm-fix-warning-at_kernel-workqueue.c-check_fl.patch
 create mode 100644 queue-6.1/rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch
 create mode 100644 queue-6.1/rdma-rtrs-reset-hb_missed_cnt-after-receiving-other-.patch
 create mode 100644 queue-6.1/regulator-return-actual-error-in-of_regulator_bulk_g.patch
 create mode 100644 queue-6.1/remoteproc-imx_rproc-correct-ddr-alias-for-i.mx8m.patch
 create mode 100644 queue-6.1/remoteproc-imx_rproc-initialize-workqueue-earlier.patch
 create mode 100644 queue-6.1/reset-berlin-fix-of-node-leak-in-probe-error-path.patch
 create mode 100644 queue-6.1/reset-k210-fix-of-node-leak-in-probe-error-path.patch
 create mode 100644 queue-6.1/revert-dm-requeue-io-if-mapping-table-not-yet-availa.patch
 create mode 100644 queue-6.1/risc-v-kvm-fix-sbiret-init-before-forwarding-to-user.patch
 create mode 100644 queue-6.1/riscv-fix-fp-alignment-bug-in-perf_callchain_user.patch
 create mode 100644 queue-6.1/scsi-elx-libefc-fix-potential-use-after-free-in-efc_.patch
 create mode 100644 queue-6.1/scsi-ncr5380-check-for-phase-match-during-pdma-fixup.patch
 create mode 100644 queue-6.1/scsi-smartpqi-revert-propagate-the-multipath-failure.patch
 create mode 100644 queue-6.1/selftests-bpf-add-a-cgroup-prog-bpf_get_ns_current_p.patch
 create mode 100644 queue-6.1/selftests-bpf-add-selftest-deny_namespace-to-s390x-d.patch
 create mode 100644 queue-6.1/selftests-bpf-add-tests-for-_opts-variants-of-bpf_-_.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-c-compile-error-from-missing-_bool.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compile-error-from-rlim_t-in-sk_st.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compile-if-backtrace-support-missi.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compiling-core_reloc.c-with-musl-l.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compiling-flow_dissector.c-with-mu.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compiling-kfree_skb.c-with-musl-li.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-compiling-tcp_rtt.c-with-musl-libc.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-error-compiling-bpf_iter_setsockop.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-error-compiling-test_lru_map.c.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-errors-compiling-cg_storage_multi..patch
 create mode 100644 queue-6.1/selftests-bpf-fix-include-of-sys-fcntl.h.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-missing-array_size-definition-in-b.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-missing-build_bug_on-declaration.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-missing-uint_max-definitions-in-be.patch
 create mode 100644 queue-6.1/selftests-bpf-move-test_progs-helpers-to-testing_hel.patch
 create mode 100644 queue-6.1/selftests-bpf-refactor-out-some-functions-in-ns_curr.patch
 create mode 100644 queue-6.1/selftests-bpf-replace-check-with-assert_-in-ns_curre.patch
 create mode 100644 queue-6.1/selftests-bpf-replace-extract_build_id-with-read_bui.patch
 create mode 100644 queue-6.1/selftests-bpf-use-pid_t-consistently-in-test_progs.c.patch
 create mode 100644 queue-6.1/selftests-bpf-workaround-strict-bpf_lsm-return-value.patch
 create mode 100644 queue-6.1/selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
 create mode 100644 queue-6.1/selftests-vdso-fix-vdso-name-for-powerpc.patch
 create mode 100644 queue-6.1/selftests-vdso-fix-vdso-symbols-lookup-for-powerpc64.patch
 create mode 100644 queue-6.1/selftests-vdso-fix-vdso_config-for-powerpc.patch
 create mode 100644 queue-6.1/selftests-vdso-fix-vdso_config-for-s390.patch
 create mode 100644 queue-6.1/series
 create mode 100644 queue-6.1/smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch
 create mode 100644 queue-6.1/sock_map-add-a-cond_resched-in-sock_hash_free.patch
 create mode 100644 queue-6.1/spi-atmel-quadspi-undo-runtime-pm-changes-at-driver-.patch
 create mode 100644 queue-6.1/spi-ppc4xx-avoid-returning-0-when-failed-to-parse-an.patch
 create mode 100644 queue-6.1/spi-ppc4xx-handle-irq_of_parse_and_map-errors.patch
 create mode 100644 queue-6.1/spi-spi-fsl-lpspi-undo-runtime-pm-changes-at-driver-.patch
 create mode 100644 queue-6.1/tcp-check-skb-is-non-null-in-tcp_rto_delta_us.patch
 create mode 100644 queue-6.1/tpm-clean-up-tpm-space-after-command-failure.patch
 create mode 100644 queue-6.1/usb-dwc2-skip-clock-gating-on-broadcom-socs.patch
 create mode 100644 queue-6.1/vdpa-add-eventfd-for-the-vdpa-callback.patch
 create mode 100644 queue-6.1/vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
 create mode 100644 queue-6.1/watchdog-imx_sc_wdt-don-t-disable-wdt-in-suspend.patch
 create mode 100644 queue-6.1/wifi-ath9k-fix-parameter-check-in-ath9k_init_debug.patch
 create mode 100644 queue-6.1/wifi-ath9k-remove-error-checks-when-creating-debugfs.patch
 create mode 100644 queue-6.1/wifi-cfg80211-fix-two-more-possible-ubsan-detected-o.patch
 create mode 100644 queue-6.1/wifi-cfg80211-fix-ubsan-noise-in-cfg80211_wext_siwsc.patch
 create mode 100644 queue-6.1/wifi-iwlwifi-mvm-increase-the-time-between-ranging-m.patch
 create mode 100644 queue-6.1/wifi-mac80211-don-t-use-rate-mask-for-offchannel-tx-.patch
 create mode 100644 queue-6.1/wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch
 create mode 100644 queue-6.1/wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch
 create mode 100644 queue-6.1/wifi-rtw88-always-wait-for-both-firmware-loading-att.patch
 create mode 100644 queue-6.1/wifi-rtw88-remove-cpt-execution-branch-never-used.patch
 create mode 100644 queue-6.1/wifi-wilc1000-fix-potential-rcu-dereference-issue-in.patch
 create mode 100644 queue-6.1/x86-sgx-fix-deadlock-in-sgx-numa-node-search.patch
 create mode 100644 queue-6.1/xen-add-capability-to-remap-non-ram-pages-to-differe.patch
 create mode 100644 queue-6.1/xen-introduce-generic-helper-checking-for-memory-map.patch
 create mode 100644 queue-6.1/xen-move-max_pfn-in-xen_memory_setup-out-of-function.patch
 create mode 100644 queue-6.1/xen-swiotlb-add-alignment-check-for-dma-buffers.patch
 create mode 100644 queue-6.1/xen-swiotlb-fix-allocated-size.patch
 create mode 100644 queue-6.1/xen-tolerate-acpi-nvs-memory-overlapping-with-xen-al.patch
 create mode 100644 queue-6.1/xen-use-correct-end-address-of-kernel-for-conflict-c.patch
 create mode 100644 queue-6.1/xz-cleanup-crc32-edits-from-2018.patch

diff --git a/queue-6.1/abi-testing-fix-admv8818-attr-description.patch b/queue-6.1/abi-testing-fix-admv8818-attr-description.patch
new file mode 100644
index 00000000000..4279015d63a
--- /dev/null
+++ b/queue-6.1/abi-testing-fix-admv8818-attr-description.patch
@@ -0,0 +1,37 @@
+From 5d603f5085e62e718e8a404db14b864968f7d5b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 11:18:50 +0300
+Subject: ABI: testing: fix admv8818 attr description
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+[ Upstream commit 7d34b4ad8cd2867b130b5b8d7d76d0d6092bd019 ]
+
+Fix description of the filter_mode_available attribute by pointing to
+the correct name of the attribute that can be written with valid values.
+
+Fixes: bf92d87d7c67 ("iio:filter:admv8818: Add sysfs ABI documentation")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Link: https://patch.msgid.link/20240702081851.4663-1-antoniu.miclaus@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818 b/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818
+index f6c0357526397..bc9bb4d834272 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818
++++ b/Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818
+@@ -3,7 +3,7 @@ KernelVersion:
+ Contact:	linux-iio@vger.kernel.org
+ Description:
+ 		Reading this returns the valid values that can be written to the
+-		on_altvoltage0_mode attribute:
++		filter_mode attribute:
+ 
+ 		- auto -> Adjust bandpass filter to track changes in input clock rate.
+ 		- manual -> disable/unregister the clock rate notifier / input clock tracking.
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-cppc-fix-mask_val-usage.patch b/queue-6.1/acpi-cppc-fix-mask_val-usage.patch
new file mode 100644
index 00000000000..0c91c55a459
--- /dev/null
+++ b/queue-6.1/acpi-cppc-fix-mask_val-usage.patch
@@ -0,0 +1,147 @@
+From 385ed7b5958479a3c1d8377bae4f39a6da230e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 12:16:44 +0200
+Subject: ACPI: CPPC: Fix MASK_VAL() usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <cleger@rivosinc.com>
+
+[ Upstream commit 60949b7b805424f21326b450ca4f1806c06d982e ]
+
+MASK_VAL() was added as a way to handle bit_offset and bit_width for
+registers located in system memory address space. However, while suited
+for reading, it does not work for writing and result in corrupted
+registers when writing values with bit_offset > 0. Moreover, when a
+register is collocated with another one at the same address but with a
+different mask, the current code results in the other registers being
+overwritten with 0s. The write procedure for SYSTEM_MEMORY registers
+should actually read the value, mask it, update it and write it with the
+updated value. Moreover, since registers can be located in the same
+word, we must take care of locking the access before doing it. We should
+potentially use a global lock since we don't know in if register
+addresses aren't shared with another _CPC package but better not
+encourage vendors to do so. Assume that registers can use the same word
+inside a _CPC package and thus, use a per _CPC package lock.
+
+Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses")
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Link: https://patch.msgid.link/20240826101648.95654-1-cleger@rivosinc.com
+[ rjw: Dropped redundant semicolon ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 43 ++++++++++++++++++++++++++++++++++++----
+ include/acpi/cppc_acpi.h |  2 ++
+ 2 files changed, 41 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 49339f37d9405..12296d85a7196 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -167,8 +167,11 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
+ #define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
+ 
+ /* Shift and apply the mask for CPC reads/writes */
+-#define MASK_VAL(reg, val) (((val) >> (reg)->bit_offset) & 			\
++#define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) &				\
+ 					GENMASK(((reg)->bit_width) - 1, 0))
++#define MASK_VAL_WRITE(reg, prev_val, val)						\
++	((((val) & GENMASK(((reg)->bit_width) - 1, 0)) << (reg)->bit_offset) |		\
++	((prev_val) & ~(GENMASK(((reg)->bit_width) - 1, 0) << (reg)->bit_offset)))	\
+ 
+ static ssize_t show_feedback_ctrs(struct kobject *kobj,
+ 		struct kobj_attribute *attr, char *buf)
+@@ -851,6 +854,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
+ 
+ 	/* Store CPU Logical ID */
+ 	cpc_ptr->cpu_id = pr->id;
++	spin_lock_init(&cpc_ptr->rmw_lock);
+ 
+ 	/* Parse PSD data for this CPU */
+ 	ret = acpi_get_psd(cpc_ptr, handle);
+@@ -1056,7 +1060,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val)
+ 	}
+ 
+ 	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+-		*val = MASK_VAL(reg, *val);
++		*val = MASK_VAL_READ(reg, *val);
+ 
+ 	return 0;
+ }
+@@ -1065,9 +1069,11 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
+ {
+ 	int ret_val = 0;
+ 	int size;
++	u64 prev_val;
+ 	void __iomem *vaddr = NULL;
+ 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
+ 	struct cpc_reg *reg = &reg_res->cpc_entry.reg;
++	struct cpc_desc *cpc_desc;
+ 
+ 	size = GET_BIT_WIDTH(reg);
+ 
+@@ -1100,8 +1106,34 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
+ 		return acpi_os_write_memory((acpi_physical_address)reg->address,
+ 				val, size);
+ 
+-	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+-		val = MASK_VAL(reg, val);
++	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
++		cpc_desc = per_cpu(cpc_desc_ptr, cpu);
++		if (!cpc_desc) {
++			pr_debug("No CPC descriptor for CPU:%d\n", cpu);
++			return -ENODEV;
++		}
++
++		spin_lock(&cpc_desc->rmw_lock);
++		switch (size) {
++		case 8:
++			prev_val = readb_relaxed(vaddr);
++			break;
++		case 16:
++			prev_val = readw_relaxed(vaddr);
++			break;
++		case 32:
++			prev_val = readl_relaxed(vaddr);
++			break;
++		case 64:
++			prev_val = readq_relaxed(vaddr);
++			break;
++		default:
++			spin_unlock(&cpc_desc->rmw_lock);
++			return -EFAULT;
++		}
++		val = MASK_VAL_WRITE(reg, prev_val, val);
++		val |= prev_val;
++	}
+ 
+ 	switch (size) {
+ 	case 8:
+@@ -1128,6 +1160,9 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
+ 		break;
+ 	}
+ 
++	if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
++		spin_unlock(&cpc_desc->rmw_lock);
++
+ 	return ret_val;
+ }
+ 
+diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h
+index c5614444031ff..b097bd57b2e47 100644
+--- a/include/acpi/cppc_acpi.h
++++ b/include/acpi/cppc_acpi.h
+@@ -64,6 +64,8 @@ struct cpc_desc {
+ 	int cpu_id;
+ 	int write_cmd_status;
+ 	int write_cmd_id;
++	/* Lock used for RMW operations in cpc_write() */
++	spinlock_t rmw_lock;
+ 	struct cpc_register_resource cpc_regs[MAX_CPC_REG_ENT];
+ 	struct acpi_psd_package domain_info;
+ 	struct kobject kobj;
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-pmic-remove-unneeded-check-in-tps68470_pmic_opr.patch b/queue-6.1/acpi-pmic-remove-unneeded-check-in-tps68470_pmic_opr.patch
new file mode 100644
index 00000000000..951f221fae8
--- /dev/null
+++ b/queue-6.1/acpi-pmic-remove-unneeded-check-in-tps68470_pmic_opr.patch
@@ -0,0 +1,49 @@
+From 733deb198fad7725cee0d06642afb40ac3481ce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2024 01:53:39 +0300
+Subject: ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
+
+From: Aleksandr Mishin <amishin@t-argos.ru>
+
+[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
+
+In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which
+is useless.
+
+Fix this issue by removing unneeded check.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: e13452ac3790 ("ACPI / PMIC: Add TI PMIC TPS68470 operation region driver")
+Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://patch.msgid.link/20240730225339.13165-1-amishin@t-argos.ru
+[ rjw: Subject edit ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pmic/tps68470_pmic.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/acpi/pmic/tps68470_pmic.c b/drivers/acpi/pmic/tps68470_pmic.c
+index ebd03e4729555..0d1a82eeb4b0b 100644
+--- a/drivers/acpi/pmic/tps68470_pmic.c
++++ b/drivers/acpi/pmic/tps68470_pmic.c
+@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)
+ 	struct tps68470_pmic_opregion *opregion;
+ 	acpi_status status;
+ 
+-	if (!dev || !tps68470_regmap) {
+-		dev_warn(dev, "dev or regmap is NULL\n");
+-		return -EINVAL;
+-	}
++	if (!tps68470_regmap)
++		return dev_err_probe(dev, -EINVAL, "regmap is missing\n");
+ 
+ 	if (!handle) {
+ 		dev_warn(dev, "acpi handle is NULL\n");
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpica-executer-exsystem-don-t-nag-user-about-every-.patch b/queue-6.1/acpica-executer-exsystem-don-t-nag-user-about-every-.patch
new file mode 100644
index 00000000000..1b0fabf9c2f
--- /dev/null
+++ b/queue-6.1/acpica-executer-exsystem-don-t-nag-user-about-every-.patch
@@ -0,0 +1,60 @@
+From 806f68a60e9794e99ab0a80ee102ac7786c74416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2024 21:12:40 -0700
+Subject: ACPICA: executer/exsystem: Don't nag user about every Stall()
+ violating the spec
+
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+
+[ Upstream commit c82c507126c9c9db350be28f14c83fad1c7969ae ]
+
+ACPICA commit 129b75516fc49fe1fd6b8c5798f86c13854630b3
+
+Stop nagging user about every Stall() that violates the spec
+
+On my Dell XPS 15 7590 I get hundreds of these warnings after few hours of
+uptime:
+
+$ dmesg | grep "fix the firmware" | wc -l
+261
+
+I cannot fix the firmware and I doubt that Dell cares about 4 year old
+laptop either
+
+Fixes: ace8f1c54a02 ("ACPICA: executer/exsystem: Inform users about ACPI spec violation")
+Link: https://github.com/acpica/acpica/commit/129b7551
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/exsystem.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/acpica/exsystem.c b/drivers/acpi/acpica/exsystem.c
+index 7b5470f404f3f..104e6e96c31ea 100644
+--- a/drivers/acpi/acpica/exsystem.c
++++ b/drivers/acpi/acpica/exsystem.c
+@@ -133,14 +133,15 @@ acpi_status acpi_ex_system_do_stall(u32 how_long_us)
+ 		 * (ACPI specifies 100 usec as max, but this gives some slack in
+ 		 * order to support existing BIOSs)
+ 		 */
+-		ACPI_ERROR((AE_INFO,
+-			    "Time parameter is too large (%u)", how_long_us));
++		ACPI_ERROR_ONCE((AE_INFO,
++				 "Time parameter is too large (%u)",
++				 how_long_us));
+ 		status = AE_AML_OPERAND_VALUE;
+ 	} else {
+ 		if (how_long_us > 100) {
+-			ACPI_WARNING((AE_INFO,
+-				      "Time parameter %u us > 100 us violating ACPI spec, please fix the firmware.",
+-				      how_long_us));
++			ACPI_WARNING_ONCE((AE_INFO,
++					   "Time parameter %u us > 100 us violating ACPI spec, please fix the firmware.",
++					   how_long_us));
+ 		}
+ 		acpi_os_stall(how_long_us);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpica-implement-acpi_warning_once-and-acpi_error_on.patch b/queue-6.1/acpica-implement-acpi_warning_once-and-acpi_error_on.patch
new file mode 100644
index 00000000000..d7101f80268
--- /dev/null
+++ b/queue-6.1/acpica-implement-acpi_warning_once-and-acpi_error_on.patch
@@ -0,0 +1,61 @@
+From 3d3cea34180a26402a03335d1f496b8921848840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2024 21:09:45 -0700
+Subject: ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
+
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+
+[ Upstream commit 632b746b108e3c62e0795072d00ed597371c738a ]
+
+ACPICA commit 2ad4e6e7c4118f4cdfcad321c930b836cec77406
+
+In some cases it is not practical nor useful to nag user about some
+firmware errors that they cannot fix. Add a macro that will print a
+warning or error only once to be used in these cases.
+
+Link: https://github.com/acpica/acpica/commit/2ad4e6e7
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c82c507126c9 ("ACPICA: executer/exsystem: Don't nag user about every Stall() violating the spec")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/acoutput.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/include/acpi/acoutput.h b/include/acpi/acoutput.h
+index 73781aae21192..eaef8471177af 100644
+--- a/include/acpi/acoutput.h
++++ b/include/acpi/acoutput.h
+@@ -193,6 +193,7 @@
+  */
+ #ifndef ACPI_NO_ERROR_MESSAGES
+ #define AE_INFO                         _acpi_module_name, __LINE__
++#define ACPI_ONCE(_fn, _plist)                  { static char _done; if (!_done) { _done = 1; _fn _plist; } }
+ 
+ /*
+  * Error reporting. Callers module and line number are inserted by AE_INFO,
+@@ -201,8 +202,10 @@
+  */
+ #define ACPI_INFO(plist)                acpi_info plist
+ #define ACPI_WARNING(plist)             acpi_warning plist
++#define ACPI_WARNING_ONCE(plist)        ACPI_ONCE(acpi_warning, plist)
+ #define ACPI_EXCEPTION(plist)           acpi_exception plist
+ #define ACPI_ERROR(plist)               acpi_error plist
++#define ACPI_ERROR_ONCE(plist)          ACPI_ONCE(acpi_error, plist)
+ #define ACPI_BIOS_WARNING(plist)        acpi_bios_warning plist
+ #define ACPI_BIOS_EXCEPTION(plist)      acpi_bios_exception plist
+ #define ACPI_BIOS_ERROR(plist)          acpi_bios_error plist
+@@ -214,8 +217,10 @@
+ 
+ #define ACPI_INFO(plist)
+ #define ACPI_WARNING(plist)
++#define ACPI_WARNING_ONCE(plist)
+ #define ACPI_EXCEPTION(plist)
+ #define ACPI_ERROR(plist)
++#define ACPI_ERROR_ONCE(plist)
+ #define ACPI_BIOS_WARNING(plist)
+ #define ACPI_BIOS_EXCEPTION(plist)
+ #define ACPI_BIOS_ERROR(plist)
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-hda-cs35l41-fix-module-autoloading.patch b/queue-6.1/alsa-hda-cs35l41-fix-module-autoloading.patch
new file mode 100644
index 00000000000..85a9fd8c640
--- /dev/null
+++ b/queue-6.1/alsa-hda-cs35l41-fix-module-autoloading.patch
@@ -0,0 +1,36 @@
+From 54f147e78124c42be25b45733f07025a00896f88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2024 09:13:12 +0000
+Subject: ALSA: hda: cs35l41: fix module autoloading
+
+From: Yuntao Liu <liuyuntao12@huawei.com>
+
+[ Upstream commit 48f1434a4632c7da1a6a94e159512ebddbe13392 ]
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
+based on the alias from spi_device_id table.
+
+Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems")
+Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
+Link: https://patch.msgid.link/20240815091312.757139-1-liuyuntao12@huawei.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda_spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/cs35l41_hda_spi.c b/sound/pci/hda/cs35l41_hda_spi.c
+index 71979cfb4d7ed..ac01b15f8fc2b 100644
+--- a/sound/pci/hda/cs35l41_hda_spi.c
++++ b/sound/pci/hda/cs35l41_hda_spi.c
+@@ -38,6 +38,7 @@ static const struct spi_device_id cs35l41_hda_spi_id[] = {
+ 	{ "cs35l41-hda", 0 },
+ 	{}
+ };
++MODULE_DEVICE_TABLE(spi, cs35l41_hda_spi_id);
+ 
+ static const struct acpi_device_id cs35l41_acpi_hda_match[] = {
+ 	{ "CSC3551", 0 },
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx7d-zii-rmu2-fix-ethernet-phy-pinctrl-prop.patch b/queue-6.1/arm-dts-imx7d-zii-rmu2-fix-ethernet-phy-pinctrl-prop.patch
new file mode 100644
index 00000000000..79347a86fd7
--- /dev/null
+++ b/queue-6.1/arm-dts-imx7d-zii-rmu2-fix-ethernet-phy-pinctrl-prop.patch
@@ -0,0 +1,38 @@
+From 63996687c0bd7b9214c35ae512e84f3e55b621ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 11:56:36 +0200
+Subject: ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0e49cfe364dea4345551516eb2fe53135a10432b ]
+
+There is no "fsl,phy" property in pin controller pincfg nodes:
+
+  imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,pins' is a required property
+  imx7d-zii-rmu2.dtb: pinctrl@302c0000: enet1phyinterruptgrp: 'fsl,phy' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: f496e6750083 ("ARM: dts: Add ZII support for ZII i.MX7 RMU2 board")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-zii-rmu2.dts b/arch/arm/boot/dts/imx7d-zii-rmu2.dts
+index 1c9f25848bf7f..5b43d1d3d46db 100644
+--- a/arch/arm/boot/dts/imx7d-zii-rmu2.dts
++++ b/arch/arm/boot/dts/imx7d-zii-rmu2.dts
+@@ -350,7 +350,7 @@ MX7D_PAD_SD3_RESET_B__SD3_RESET_B	0x59
+ 
+ &iomuxc_lpsr {
+ 	pinctrl_enet1_phy_interrupt: enet1phyinterruptgrp {
+-		fsl,phy = <
++		fsl,pins = <
+ 			MX7D_PAD_LPSR_GPIO1_IO02__GPIO1_IO2	0x08
+ 		>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-microchip-sam9x60-fix-rtc-rtt-clocks.patch b/queue-6.1/arm-dts-microchip-sam9x60-fix-rtc-rtt-clocks.patch
new file mode 100644
index 00000000000..c6093f9cccc
--- /dev/null
+++ b/queue-6.1/arm-dts-microchip-sam9x60-fix-rtc-rtt-clocks.patch
@@ -0,0 +1,54 @@
+From 68f73f2b6670c67c8aadd4f8d0762c1b113a5748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 07:51:36 +0200
+Subject: ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
+
+From: Alexander Dahl <ada@thorsis.com>
+
+[ Upstream commit d355c895fa4ddd8bec15569eee540baeed7df8c5 ]
+
+The RTC and RTT peripherals use the timing domain slow clock (TD_SLCK),
+sourced from the 32.768 kHz crystal oscillator or slow rc oscillator.
+
+The previously used Monitoring domain slow clock (MD_SLCK) is sourced
+from an internal RC oscillator which is most probably not precise enough
+for real time clock purposes.
+
+Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
+Fixes: 5f6b33f46346 ("ARM: dts: sam9x60: add rtt")
+Signed-off-by: Alexander Dahl <ada@thorsis.com>
+Link: https://lore.kernel.org/r/20240821055136.6858-1-ada@thorsis.com
+[claudiu.beznea: removed () around the last commit description paragraph,
+ removed " in front of "timing domain slow clock", described that
+ TD_SLCK can also be sourced from slow rc oscillator]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sam9x60.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sam9x60.dtsi b/arch/arm/boot/dts/sam9x60.dtsi
+index 37a5d96aaf642..d3d49c6144bf6 100644
+--- a/arch/arm/boot/dts/sam9x60.dtsi
++++ b/arch/arm/boot/dts/sam9x60.dtsi
+@@ -690,7 +690,7 @@ rtt: rtc@fffffe20 {
+ 				compatible = "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt";
+ 				reg = <0xfffffe20 0x20>;
+ 				interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>;
+-				clocks = <&clk32k 0>;
++				clocks = <&clk32k 1>;
+ 			};
+ 
+ 			pit: timer@fffffe40 {
+@@ -716,7 +716,7 @@ rtc: rtc@fffffea8 {
+ 				compatible = "microchip,sam9x60-rtc", "atmel,at91sam9x5-rtc";
+ 				reg = <0xfffffea8 0x100>;
+ 				interrupts = <1 IRQ_TYPE_LEVEL_HIGH 7>;
+-				clocks = <&clk32k 0>;
++				clocks = <&clk32k 1>;
+ 			};
+ 
+ 			watchdog: watchdog@ffffff80 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-microchip-sama7g5-fix-rtt-clock.patch b/queue-6.1/arm-dts-microchip-sama7g5-fix-rtt-clock.patch
new file mode 100644
index 00000000000..ab25665c5b7
--- /dev/null
+++ b/queue-6.1/arm-dts-microchip-sama7g5-fix-rtt-clock.patch
@@ -0,0 +1,37 @@
+From 5ea6eef5c61046581e4300ec8a43b76edc5ebf8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 19:53:20 +0300
+Subject: ARM: dts: microchip: sama7g5: Fix RTT clock
+
+From: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+
+[ Upstream commit 867bf1923200e6ad82bad0289f43bf20b4ac7ff9 ]
+
+According to datasheet, Chapter 34. Clock Generator, section 34.2,
+Embedded characteristics, source clock for RTT is the TD_SLCK, registered
+with ID 1 by the slow clock controller driver. Fix RTT clock.
+
+Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek")
+Link: https://lore.kernel.org/r/20240826165320.3068359-1-claudiu.beznea@tuxon.dev
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama7g5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sama7g5.dtsi b/arch/arm/boot/dts/sama7g5.dtsi
+index 7bd8ae8e8d380..9cc0e86544ad4 100644
+--- a/arch/arm/boot/dts/sama7g5.dtsi
++++ b/arch/arm/boot/dts/sama7g5.dtsi
+@@ -221,7 +221,7 @@ rtt: rtc@e001d020 {
+ 			compatible = "microchip,sama7g5-rtt", "microchip,sam9x60-rtt", "atmel,at91sam9260-rtt";
+ 			reg = <0xe001d020 0x30>;
+ 			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&clk32k 0>;
++			clocks = <&clk32k 1>;
+ 		};
+ 
+ 		clk32k: clock-controller@e001d050 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-versatile-fix-of-node-leak-in-cpus-prepare.patch b/queue-6.1/arm-versatile-fix-of-node-leak-in-cpus-prepare.patch
new file mode 100644
index 00000000000..f16548e8d7d
--- /dev/null
+++ b/queue-6.1/arm-versatile-fix-of-node-leak-in-cpus-prepare.patch
@@ -0,0 +1,37 @@
+From 2cb4412f1be54732f3ea410a794f73f40c39bbbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 07:49:33 +0200
+Subject: ARM: versatile: fix OF node leak in CPUs prepare
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit f2642d97f2105ed17b2ece0c597450f2ff95d704 ]
+
+Machine code is leaking OF node reference from of_find_matching_node()
+in realview_smp_prepare_cpus().
+
+Fixes: 5420b4b15617 ("ARM: realview: add an DT SMP boot method")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Link: https://lore.kernel.org/20240826054934.10724-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-versatile/platsmp-realview.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-versatile/platsmp-realview.c b/arch/arm/mach-versatile/platsmp-realview.c
+index 5d363385c8019..059d796b26bc8 100644
+--- a/arch/arm/mach-versatile/platsmp-realview.c
++++ b/arch/arm/mach-versatile/platsmp-realview.c
+@@ -66,6 +66,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)
+ 		return;
+ 	}
+ 	map = syscon_node_to_regmap(np);
++	of_node_put(np);
+ 	if (IS_ERR(map)) {
+ 		pr_err("PLATSMP: No syscon regmap\n");
+ 		return;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-exynos-exynos7885-jackpotlte-correct-ram-a.patch b/queue-6.1/arm64-dts-exynos-exynos7885-jackpotlte-correct-ram-a.patch
new file mode 100644
index 00000000000..5ff7003051c
--- /dev/null
+++ b/queue-6.1/arm64-dts-exynos-exynos7885-jackpotlte-correct-ram-a.patch
@@ -0,0 +1,38 @@
+From 4afad345f1f44b908214189bccb8ba841cf1a3b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jul 2024 19:58:32 +0200
+Subject: arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount to 4GB
+
+From: David Virag <virag.david003@gmail.com>
+
+[ Upstream commit d281814b8f7a710a75258da883fb0dfe1329c031 ]
+
+All known jackpotlte variants have 4GB of RAM, let's use it all.
+RAM was set to 3GB from a mistake in the vendor provided DTS file.
+
+Fixes: 06874015327b ("arm64: dts: exynos: Add initial device tree support for Exynos7885 SoC")
+Signed-off-by: David Virag <virag.david003@gmail.com>
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20240713180607.147942-3-virag.david003@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts b/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts
+index 5db9a81ac7bb5..06791d4f99b89 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7885-jackpotlte.dts
+@@ -31,7 +31,7 @@ memory@80000000 {
+ 		device_type = "memory";
+ 		reg = <0x0 0x80000000 0x3da00000>,
+ 		      <0x0 0xc0000000 0x40000000>,
+-		      <0x8 0x80000000 0x40000000>;
++		      <0x8 0x80000000 0x80000000>;
+ 	};
+ 
+ 	gpio-keys {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-renesas-r9a07g043u-correct-gicd-and-gicr-s.patch b/queue-6.1/arm64-dts-renesas-r9a07g043u-correct-gicd-and-gicr-s.patch
new file mode 100644
index 00000000000..216b57adea7
--- /dev/null
+++ b/queue-6.1/arm64-dts-renesas-r9a07g043u-correct-gicd-and-gicr-s.patch
@@ -0,0 +1,41 @@
+From 8d7c618282cbb6fceae56450cd1fe8c5b0a63a3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2024 13:24:34 +0100
+Subject: arm64: dts: renesas: r9a07g043u: Correct GICD and GICR sizes
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit ab39547f739236e7f16b8b0a51fdca95cc9cadd3 ]
+
+The RZ/G2UL SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB
+for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
+
+Despite the RZ/G2UL SoC being single-core, it has two instances of GICR.
+
+Fixes: cf40c9689e510 ("arm64: dts: renesas: Add initial DTSI for RZ/G2UL SoC")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/20240730122436.350013-3-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
+index 2e7db48462e1f..1276a9487bfb6 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
+@@ -135,8 +135,8 @@ gic: interrupt-controller@11900000 {
+ 		#interrupt-cells = <3>;
+ 		#address-cells = <0>;
+ 		interrupt-controller;
+-		reg = <0x0 0x11900000 0 0x40000>,
+-		      <0x0 0x11940000 0 0x60000>;
++		reg = <0x0 0x11900000 0 0x20000>,
++		      <0x0 0x11940000 0 0x40000>;
+ 		interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-renesas-r9a07g044-correct-gicd-and-gicr-si.patch b/queue-6.1/arm64-dts-renesas-r9a07g044-correct-gicd-and-gicr-si.patch
new file mode 100644
index 00000000000..f26b4b104f4
--- /dev/null
+++ b/queue-6.1/arm64-dts-renesas-r9a07g044-correct-gicd-and-gicr-si.patch
@@ -0,0 +1,40 @@
+From 6e1e60aee24e522ae94bf8b910edbccc2b642602 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2024 13:24:36 +0100
+Subject: arm64: dts: renesas: r9a07g044: Correct GICD and GICR sizes
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 833948fb2b63155847ab691a54800f801555429b ]
+
+The RZ/G2L(C) SoC is equipped with the GIC-600. The GICD is 64KiB +
+64KiB for the MBI alias (in total 128KiB), and the GICR is 128KiB per
+CPU.
+
+Fixes: 68a45525297b2 ("arm64: dts: renesas: Add initial DTSI for RZ/G2{L,LC} SoC's")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/20240730122436.350013-5-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+index 4703fbc9a8e0a..d65f8840ccd88 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+@@ -788,8 +788,8 @@ gic: interrupt-controller@11900000 {
+ 			#interrupt-cells = <3>;
+ 			#address-cells = <0>;
+ 			interrupt-controller;
+-			reg = <0x0 0x11900000 0 0x40000>,
+-			      <0x0 0x11940000 0 0x60000>;
++			reg = <0x0 0x11900000 0 0x20000>,
++			      <0x0 0x11940000 0 0x40000>;
+ 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-renesas-r9a07g054-correct-gicd-and-gicr-si.patch b/queue-6.1/arm64-dts-renesas-r9a07g054-correct-gicd-and-gicr-si.patch
new file mode 100644
index 00000000000..adc8f5063f5
--- /dev/null
+++ b/queue-6.1/arm64-dts-renesas-r9a07g054-correct-gicd-and-gicr-si.patch
@@ -0,0 +1,39 @@
+From 71dfbd34242d0ff4857d4fd8f603bcd7c9ba184b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2024 13:24:35 +0100
+Subject: arm64: dts: renesas: r9a07g054: Correct GICD and GICR sizes
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 45afa9eacb59b258d2e53c7f63430ea1e8344803 ]
+
+The RZ/V2L SoC is equipped with the GIC-600. The GICD is 64KiB + 64KiB
+for the MBI alias (in total 128KiB), and the GICR is 128KiB per CPU.
+
+Fixes: 7c2b8198f4f32 ("arm64: dts: renesas: Add initial DTSI for RZ/V2L SoC")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/20240730122436.350013-4-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+index 60a20a3ca12e3..7a50d1432cc07 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+@@ -794,8 +794,8 @@ gic: interrupt-controller@11900000 {
+ 			#interrupt-cells = <3>;
+ 			#address-cells = <0>;
+ 			interrupt-controller;
+-			reg = <0x0 0x11900000 0 0x40000>,
+-			      <0x0 0x11940000 0 0x60000>;
++			reg = <0x0 0x11900000 0 0x20000>,
++			      <0x0 0x11940000 0 0x40000>;
+ 			interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_LOW>;
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-carveout-l.patch b/queue-6.1/arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-carveout-l.patch
new file mode 100644
index 00000000000..c1a48802480
--- /dev/null
+++ b/queue-6.1/arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-carveout-l.patch
@@ -0,0 +1,49 @@
+From 097850ece2c164b834e097f0fed2334ea26ca8ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2024 13:12:31 -0500
+Subject: arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 9f3814a7c06b7c7296cf8c1622078ad71820454b ]
+
+The DMA carveout for the C6x core 0 is at 0xa6000000 and core 1 is at
+0xa7000000. These are reversed in DT. While both C6x can access either
+region, so this is not normally a problem, but if we start restricting
+the memory each core can access (such as with firewalls) the cores
+accessing the regions for the wrong core will not work. Fix this here.
+
+Fixes: f46d16cf5b43 ("arm64: dts: ti: k3-j721e-sk: Add DDR carveout memory nodes")
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20240801181232.55027-1-afd@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index 80358cba6954c..f4a76926c4e64 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -111,7 +111,7 @@ main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+ 			no-map;
+ 		};
+ 
+-		c66_1_dma_memory_region: c66-dma-memory@a6000000 {
++		c66_0_dma_memory_region: c66-dma-memory@a6000000 {
+ 			compatible = "shared-dma-pool";
+ 			reg = <0x00 0xa6000000 0x00 0x100000>;
+ 			no-map;
+@@ -123,7 +123,7 @@ c66_0_memory_region: c66-memory@a6100000 {
+ 			no-map;
+ 		};
+ 
+-		c66_0_dma_memory_region: c66-dma-memory@a7000000 {
++		c66_1_dma_memory_region: c66-dma-memory@a7000000 {
+ 			compatible = "shared-dma-pool";
+ 			reg = <0x00 0xa7000000 0x00 0x100000>;
+ 			no-map;
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-rt5682s-return-devm_of_clk_add_hw_provider-to-t.patch b/queue-6.1/asoc-rt5682s-return-devm_of_clk_add_hw_provider-to-t.patch
new file mode 100644
index 00000000000..de0652b5750
--- /dev/null
+++ b/queue-6.1/asoc-rt5682s-return-devm_of_clk_add_hw_provider-to-t.patch
@@ -0,0 +1,41 @@
+From 61bc7f831107bad943f19be436a31b08e5fc30c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jul 2024 19:54:36 +0800
+Subject: ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer the
+ error
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+[ Upstream commit 3ff810b9bebe5578a245cfa97c252ab602e703f1 ]
+
+Return devm_of_clk_add_hw_provider() in order to transfer the error, if it
+fails due to resource allocation failure or device tree clock provider
+registration failure.
+
+Fixes: bdd229ab26be ("ASoC: rt5682s: Add driver for ALC5682I-VS codec")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://patch.msgid.link/20240717115436.3449492-1-make24@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index 80c673aa14db8..07d514b4ce707 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -2828,7 +2828,9 @@ static int rt5682s_register_dai_clks(struct snd_soc_component *component)
+ 		}
+ 
+ 		if (dev->of_node) {
+-			devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, dai_clk_hw);
++			ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, dai_clk_hw);
++			if (ret)
++				return ret;
+ 		} else {
+ 			ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw,
+ 							  init.name, dev_name(dev));
+-- 
+2.43.0
+
diff --git a/queue-6.1/bareudp-pull-inner-ip-header-in-bareudp_udp_encap_re.patch b/queue-6.1/bareudp-pull-inner-ip-header-in-bareudp_udp_encap_re.patch
new file mode 100644
index 00000000000..776fa069806
--- /dev/null
+++ b/queue-6.1/bareudp-pull-inner-ip-header-in-bareudp_udp_encap_re.patch
@@ -0,0 +1,70 @@
+From 3829dd70505927463247292e9fd9127e584df21b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 11:20:58 +0200
+Subject: bareudp: Pull inner IP header in bareudp_udp_encap_recv().
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 45fa29c85117170b0508790f878b13ec6593c888 ]
+
+Bareudp reads the inner IP header to get the ECN value. Therefore, it
+needs to ensure that it's part of the skb's linear data.
+
+This is similar to the vxlan and geneve fixes for that same problem:
+  * commit f7789419137b ("vxlan: Pull inner IP header in vxlan_rcv().")
+  * commit 1ca1ba465e55 ("geneve: make sure to pull inner header in
+    geneve_rx()")
+
+Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/5205940067c40218a70fbb888080466b2fc288db.1726046181.git.gnault@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bareudp.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c
+index 277493e41b072..d0759d8bf7305 100644
+--- a/drivers/net/bareudp.c
++++ b/drivers/net/bareudp.c
+@@ -67,6 +67,7 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ 	__be16 proto;
+ 	void *oiph;
+ 	int err;
++	int nh;
+ 
+ 	bareudp = rcu_dereference_sk_user_data(sk);
+ 	if (!bareudp)
+@@ -144,10 +145,25 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ 	}
+ 	skb_dst_set(skb, &tun_dst->dst);
+ 	skb->dev = bareudp->dev;
+-	oiph = skb_network_header(skb);
+-	skb_reset_network_header(skb);
+ 	skb_reset_mac_header(skb);
+ 
++	/* Save offset of outer header relative to skb->head,
++	 * because we are going to reset the network header to the inner header
++	 * and might change skb->head.
++	 */
++	nh = skb_network_header(skb) - skb->head;
++
++	skb_reset_network_header(skb);
++
++	if (!pskb_inet_may_pull(skb)) {
++		DEV_STATS_INC(bareudp->dev, rx_length_errors);
++		DEV_STATS_INC(bareudp->dev, rx_errors);
++		goto drop;
++	}
++
++	/* Get the outer header. */
++	oiph = skb->head + nh;
++
+ 	if (!ipv6_mod_enabled() || family == AF_INET)
+ 		err = IP_ECN_decapsulate(oiph, skb);
+ 	else
+-- 
+2.43.0
+
diff --git a/queue-6.1/bareudp-pull-inner-ip-header-on-xmit.patch b/queue-6.1/bareudp-pull-inner-ip-header-on-xmit.patch
new file mode 100644
index 00000000000..e2aa0dd838a
--- /dev/null
+++ b/queue-6.1/bareudp-pull-inner-ip-header-on-xmit.patch
@@ -0,0 +1,51 @@
+From f7e9d16718eb6b71123972f374d35571d05ec9a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 11:21:05 +0200
+Subject: bareudp: Pull inner IP header on xmit.
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit c471236b2359e6b27388475dd04fff0a5e2bf922 ]
+
+Both bareudp_xmit_skb() and bareudp6_xmit_skb() read their skb's inner
+IP header to get its ECN value (with ip_tunnel_ecn_encap()). Therefore
+we need to ensure that the inner IP header is part of the skb's linear
+data.
+
+Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/267328222f0a11519c6de04c640a4f87a38ea9ed.1726046181.git.gnault@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bareudp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c
+index d0759d8bf7305..54767154de265 100644
+--- a/drivers/net/bareudp.c
++++ b/drivers/net/bareudp.c
+@@ -319,6 +319,9 @@ static int bareudp_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 	__be32 saddr;
+ 	int err;
+ 
++	if (!skb_vlan_inet_prepare(skb, skb->protocol != htons(ETH_P_TEB)))
++		return -EINVAL;
++
+ 	if (!sock)
+ 		return -ESHUTDOWN;
+ 
+@@ -382,6 +385,9 @@ static int bareudp6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 	__be16 sport;
+ 	int err;
+ 
++	if (!skb_vlan_inet_prepare(skb, skb->protocol != htons(ETH_P_TEB)))
++		return -EINVAL;
++
+ 	if (!sock)
+ 		return -ESHUTDOWN;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-bfq-choose-the-last-bfqq-from-merge-chain-in-b.patch b/queue-6.1/block-bfq-choose-the-last-bfqq-from-merge-chain-in-b.patch
new file mode 100644
index 00000000000..ce03c8abb9b
--- /dev/null
+++ b/queue-6.1/block-bfq-choose-the-last-bfqq-from-merge-chain-in-b.patch
@@ -0,0 +1,61 @@
+From 31f7d2544ba3ef077ff7e0d9da55aeaf2adb6a6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 21:03:27 +0800
+Subject: block, bfq: choose the last bfqq from merge chain in
+ bfq_setup_cooperator()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 0e456dba86c7f9a19792204a044835f1ca2c8dbb ]
+
+Consider the following merge chain:
+
+Process 1       Process 2       Process 3	Process 4
+ (BIC1)          (BIC2)          (BIC3)		 (BIC4)
+  Λ                |               |               |
+   \--------------\ \-------------\ \-------------\|
+                   V               V		   V
+  bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
+
+IO from Process 1 will get bfqf2 from BIC1 first, then
+bfq_setup_cooperator() will found bfqq2 already merged to bfqq3 and then
+handle this IO from bfqq3. However, the merge chain can be much deeper
+and bfqq3 can be merged to other bfqq as well.
+
+Fix this problem by iterating to the last bfqq in
+bfq_setup_cooperator().
+
+Fixes: 36eca8948323 ("block, bfq: add Early Queue Merge (EQM)")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240902130329.3787024-3-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 30045b28ad63f..7684df94fcc62 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2889,8 +2889,12 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ 	struct bfq_queue *in_service_bfqq, *new_bfqq;
+ 
+ 	/* if a merge has already been setup, then proceed with that first */
+-	if (bfqq->new_bfqq)
+-		return bfqq->new_bfqq;
++	new_bfqq = bfqq->new_bfqq;
++	if (new_bfqq) {
++		while (new_bfqq->new_bfqq)
++			new_bfqq = new_bfqq->new_bfqq;
++		return new_bfqq;
++	}
+ 
+ 	/*
+ 	 * Check delayed stable merge for rotational or non-queueing
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-bfq-don-t-break-merge-chain-in-bfq_split_bfqq.patch b/queue-6.1/block-bfq-don-t-break-merge-chain-in-bfq_split_bfqq.patch
new file mode 100644
index 00000000000..f7e1c71581e
--- /dev/null
+++ b/queue-6.1/block-bfq-don-t-break-merge-chain-in-bfq_split_bfqq.patch
@@ -0,0 +1,66 @@
+From 5c03a1ef6798b35fe6fd4d7e22057837f38e90a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 21:03:28 +0800
+Subject: block, bfq: don't break merge chain in bfq_split_bfqq()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 42c306ed723321af4003b2a41bb73728cab54f85 ]
+
+Consider the following scenario:
+
+    Process 1       Process 2       Process 3       Process 4
+     (BIC1)          (BIC2)          (BIC3)          (BIC4)
+      Λ               |               |                |
+       \-------------\ \-------------\ \--------------\|
+                      V               V                V
+      bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
+ref    0              1               2                4
+
+If Process 1 issue a new IO and bfqq2 is found, and then bfq_init_rq()
+decide to spilt bfqq2 by bfq_split_bfqq(). Howerver, procress reference
+of bfqq2 is 1 and bfq_split_bfqq() just clear the coop flag, which will
+break the merge chain.
+
+Expected result: caller will allocate a new bfqq for BIC1
+
+    Process 1       Process 2       Process 3       Process 4
+     (BIC1)          (BIC2)          (BIC3)          (BIC4)
+                      |               |                |
+                       \-------------\ \--------------\|
+                                      V                V
+      bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
+ref    0              0               1                3
+
+Since the condition is only used for the last bfqq4 when the previous
+bfqq2 and bfqq3 are already splited. Fix the problem by checking if
+bfqq is the last one in the merge chain as well.
+
+Fixes: 36eca8948323 ("block, bfq: add Early Queue Merge (EQM)")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240902130329.3787024-4-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 7684df94fcc62..2be10133b0ace 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6628,7 +6628,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
+ {
+ 	bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");
+ 
+-	if (bfqq_process_refs(bfqq) == 1) {
++	if (bfqq_process_refs(bfqq) == 1 && !bfqq->new_bfqq) {
+ 		bfqq->pid = current->pid;
+ 		bfq_clear_bfqq_coop(bfqq);
+ 		bfq_clear_bfqq_split_coop(bfqq);
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-bfq-fix-possible-uaf-for-bfqq-bic-with-merge-c.patch b/queue-6.1/block-bfq-fix-possible-uaf-for-bfqq-bic-with-merge-c.patch
new file mode 100644
index 00000000000..b89d0b757c3
--- /dev/null
+++ b/queue-6.1/block-bfq-fix-possible-uaf-for-bfqq-bic-with-merge-c.patch
@@ -0,0 +1,225 @@
+From 2367c48850399ccb6053879c630179cd940f435f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 21:03:26 +0800
+Subject: block, bfq: fix possible UAF for bfqq->bic with merge chain
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]
+
+1) initial state, three tasks:
+
+		Process 1       Process 2	Process 3
+		 (BIC1)          (BIC2)		 (BIC3)
+		  |  Λ            |  Λ		  |  Λ
+		  |  |            |  |		  |  |
+		  V  |            V  |		  V  |
+		  bfqq1           bfqq2		  bfqq3
+process ref:	   1		    1		    1
+
+2) bfqq1 merged to bfqq2:
+
+		Process 1       Process 2	Process 3
+		 (BIC1)          (BIC2)		 (BIC3)
+		  |               |		  |  Λ
+		  \--------------\|		  |  |
+		                  V		  V  |
+		  bfqq1--------->bfqq2		  bfqq3
+process ref:	   0		    2		    1
+
+3) bfqq2 merged to bfqq3:
+
+		Process 1       Process 2	Process 3
+		 (BIC1)          (BIC2)		 (BIC3)
+	 here -> Λ                |		  |
+		  \--------------\ \-------------\|
+		                  V		  V
+		  bfqq1--------->bfqq2---------->bfqq3
+process ref:	   0		    1		    3
+
+In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then
+get bfqq3 through merge chain, and finially handle IO by bfqq3.
+Howerver, current code will think bfqq2 is owned by BIC1, like initial
+state, and set bfqq2->bic to BIC1.
+
+bfq_insert_request
+-> by Process 1
+ bfqq = bfq_init_rq(rq)
+  bfqq = bfq_get_bfqq_handle_split
+   bfqq = bic_to_bfqq
+   -> get bfqq2 from BIC1
+ bfqq->ref++
+ rq->elv.priv[0] = bic
+ rq->elv.priv[1] = bfqq
+ if (bfqq_process_refs(bfqq) == 1)
+  bfqq->bic = bic
+  -> record BIC1 to bfqq2
+
+  __bfq_insert_request
+   new_bfqq = bfq_setup_cooperator
+   -> get bfqq3 from bfqq2->new_bfqq
+   bfqq_request_freed(bfqq)
+   new_bfqq->ref++
+   rq->elv.priv[1] = new_bfqq
+   -> handle IO by bfqq3
+
+Fix the problem by checking bfqq is from merge chain fist. And this
+might fix a following problem reported by our syzkaller(unreproducible):
+
+==================================================================
+BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]
+BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]
+BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889
+Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595
+
+CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G             L     6.6.0-07439-gba2303cacfda #6
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+Workqueue: kblockd blk_mq_requeue_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:364 [inline]
+ print_report+0x10d/0x610 mm/kasan/report.c:475
+ kasan_report+0x8e/0xc0 mm/kasan/report.c:588
+ bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]
+ bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]
+ bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889
+ bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757
+ bfq_init_rq block/bfq-iosched.c:6876 [inline]
+ bfq_insert_request block/bfq-iosched.c:6254 [inline]
+ bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304
+ blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593
+ blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502
+ process_one_work kernel/workqueue.c:2627 [inline]
+ process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700
+ worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781
+ kthread+0x33c/0x440 kernel/kthread.c:388
+ ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305
+ </TASK>
+
+Allocated by task 20776:
+ kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328
+ kasan_slab_alloc include/linux/kasan.h:188 [inline]
+ slab_post_alloc_hook mm/slab.h:763 [inline]
+ slab_alloc_node mm/slub.c:3458 [inline]
+ kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503
+ ioc_create_icq block/blk-ioc.c:370 [inline]
+ ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436
+ bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812
+ blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403
+ __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517
+ blk_mq_get_new_requests block/blk-mq.c:2940 [inline]
+ blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042
+ __submit_bio+0x331/0x6f0 block/blk-core.c:624
+ __submit_bio_noacct_mq block/blk-core.c:703 [inline]
+ submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732
+ submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826
+ xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958
+ xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619
+ xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330
+ process_one_work kernel/workqueue.c:2627 [inline]
+ process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700
+ worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781
+ kthread+0x33c/0x440 kernel/kthread.c:388
+ ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305
+
+Freed by task 946:
+ kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522
+ ____kasan_slab_free mm/kasan/common.c:236 [inline]
+ __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244
+ kasan_slab_free include/linux/kasan.h:164 [inline]
+ slab_free_hook mm/slub.c:1815 [inline]
+ slab_free_freelist_hook mm/slub.c:1841 [inline]
+ slab_free mm/slub.c:3786 [inline]
+ kmem_cache_free+0x118/0x6f0 mm/slub.c:3808
+ rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189
+ rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462
+ __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553
+
+Last potentially related work creation:
+ kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
+ __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
+ __call_rcu_common kernel/rcu/tree.c:2712 [inline]
+ call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826
+ ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105
+ ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124
+ process_one_work kernel/workqueue.c:2627 [inline]
+ process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700
+ worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781
+ kthread+0x33c/0x440 kernel/kthread.c:388
+ ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305
+
+Second to last potentially related work creation:
+ kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
+ __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
+ __call_rcu_common kernel/rcu/tree.c:2712 [inline]
+ call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826
+ ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105
+ ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124
+ process_one_work kernel/workqueue.c:2627 [inline]
+ process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700
+ worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781
+ kthread+0x33c/0x440 kernel/kthread.c:388
+ ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305
+
+The buggy address belongs to the object at ffff888123839d68
+ which belongs to the cache bfq_io_cq of size 1360
+The buggy address is located 336 bytes inside of
+ freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)
+
+The buggy address belongs to the physical page:
+page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838
+head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)
+page_type: 0xffffffff()
+raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488
+raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+                                        ^
+ ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+Fixes: 36eca8948323 ("block, bfq: add Early Queue Merge (EQM)")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240902130329.3787024-2-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 52eb79d60a3f3..30045b28ad63f 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6831,7 +6831,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)
+ 	 * addition, if the queue has also just been split, we have to
+ 	 * resume its state.
+ 	 */
+-	if (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) {
++	if (likely(bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq &&
++	    bfqq_process_refs(bfqq) == 1) {
+ 		bfqq->bic = bic;
+ 		if (split) {
+ 			/*
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-fix-potential-invalid-pointer-dereference-in-b.patch b/queue-6.1/block-fix-potential-invalid-pointer-dereference-in-b.patch
new file mode 100644
index 00000000000..e9c9ecc6e06
--- /dev/null
+++ b/queue-6.1/block-fix-potential-invalid-pointer-dereference-in-b.patch
@@ -0,0 +1,54 @@
+From 8026898710ea2cdcf7e9a318a83901eb00792a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 18:59:54 +0530
+Subject: block: fix potential invalid pointer dereference in blk_add_partition
+
+From: Riyan Dhiman <riyandhiman14@gmail.com>
+
+[ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ]
+
+The blk_add_partition() function initially used a single if-condition
+(IS_ERR(part)) to check for errors when adding a partition. This was
+modified to handle the specific case of -ENXIO separately, allowing the
+function to proceed without logging the error in this case. However,
+this change unintentionally left a path where md_autodetect_dev()
+could be called without confirming that part is a valid pointer.
+
+This commit separates the error handling logic by splitting the
+initial if-condition, improving code readability and handling specific
+error scenarios explicitly. The function now distinguishes the general
+error case from -ENXIO without altering the existing behavior of
+md_autodetect_dev() calls.
+
+Fixes: b72053072c0b (block: allow partitions on host aware zone devices)
+Signed-off-by: Riyan Dhiman <riyandhiman14@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20240911132954.5874-1-riyandhiman14@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/partitions/core.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/block/partitions/core.c b/block/partitions/core.c
+index b71c0c2a6a73d..e4f6f56cadc41 100644
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -580,9 +580,11 @@ static bool blk_add_partition(struct gendisk *disk,
+ 
+ 	part = add_partition(disk, p, from, size, state->parts[p].flags,
+ 			     &state->parts[p].info);
+-	if (IS_ERR(part) && PTR_ERR(part) != -ENXIO) {
+-		printk(KERN_ERR " %s: p%d could not be added: %pe\n",
+-		       disk->disk_name, p, part);
++	if (IS_ERR(part)) {
++		if (PTR_ERR(part) != -ENXIO) {
++			printk(KERN_ERR " %s: p%d could not be added: %pe\n",
++			       disk->disk_name, p, part);
++		}
+ 		return true;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-print-symbolic-error-name-instead-of-error-cod.patch b/queue-6.1/block-print-symbolic-error-name-instead-of-error-cod.patch
new file mode 100644
index 00000000000..20649ff8462
--- /dev/null
+++ b/queue-6.1/block-print-symbolic-error-name-instead-of-error-cod.patch
@@ -0,0 +1,44 @@
+From 527b11e10a9fe3ec2d97be095bea23b8d93accd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 00:15:18 +0100
+Subject: block: print symbolic error name instead of error code
+
+From: Christian Heusel <christian@heusel.eu>
+
+[ Upstream commit 25c1772a0493463408489b1fae65cf77fe46cac1 ]
+
+Utilize the %pe print specifier to get the symbolic error name as a
+string (i.e "-ENOMEM") in the log message instead of the error code to
+increase its readablility.
+
+This change was suggested in
+https://lore.kernel.org/all/92972476-0b1f-4d0a-9951-af3fc8bc6e65@suswa.mountain/
+
+Signed-off-by: Christian Heusel <christian@heusel.eu>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Link: https://lore.kernel.org/r/20240111231521.1596838-1-christian@heusel.eu
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 26e197b7f924 ("block: fix potential invalid pointer dereference in blk_add_partition")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/partitions/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/partitions/core.c b/block/partitions/core.c
+index 3927f4283f6b6..b71c0c2a6a73d 100644
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -581,8 +581,8 @@ static bool blk_add_partition(struct gendisk *disk,
+ 	part = add_partition(disk, p, from, size, state->parts[p].flags,
+ 			     &state->parts[p].info);
+ 	if (IS_ERR(part) && PTR_ERR(part) != -ENXIO) {
+-		printk(KERN_ERR " %s: p%d could not be added: %ld\n",
+-		       disk->disk_name, p, -PTR_ERR(part));
++		printk(KERN_ERR " %s: p%d could not be added: %pe\n",
++		       disk->disk_name, p, part);
+ 		return true;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-btusb-fix-not-handling-zpl-short-transfer.patch b/queue-6.1/bluetooth-btusb-fix-not-handling-zpl-short-transfer.patch
new file mode 100644
index 00000000000..87b74baf483
--- /dev/null
+++ b/queue-6.1/bluetooth-btusb-fix-not-handling-zpl-short-transfer.patch
@@ -0,0 +1,45 @@
+From 895767dad74d5c14fc980756ca5c3f545a35fda2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 16:51:52 -0400
+Subject: Bluetooth: btusb: Fix not handling ZPL/short-transfer
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
+
+Requesting transfers of the exact same size of wMaxPacketSize may result
+in ZPL/short-transfer since the USB stack cannot handle it as we are
+limiting the buffer size to be the same as wMaxPacketSize.
+
+Also, in terms of throughput this change has the same effect to
+interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput
+by increasing the frame size" had for the bulk endpoint, so users of the
+advertisement bearer (e.g. BT Mesh) may benefit from this change.
+
+Fixes: 5e23b923da03 ("[Bluetooth] Add generic driver for Bluetooth USB devices")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Tested-by: Kiran K <kiran.k@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2d8c405a27a6c..dc5150f677236 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1189,7 +1189,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
+ 	if (!urb)
+ 		return -ENOMEM;
+ 
+-	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
++	/* Use maximum HCI Event size so the USB stack handles
++	 * ZPL/short-transfer automatically.
++	 */
++	size = HCI_MAX_EVENT_SIZE;
+ 
+ 	buf = kmalloc(size, mem_flags);
+ 	if (!buf) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-hci_core-fix-sending-mgmt_ev_connect_faile.patch b/queue-6.1/bluetooth-hci_core-fix-sending-mgmt_ev_connect_faile.patch
new file mode 100644
index 00000000000..0d1585faa34
--- /dev/null
+++ b/queue-6.1/bluetooth-hci_core-fix-sending-mgmt_ev_connect_faile.patch
@@ -0,0 +1,90 @@
+From 44130fdc28a209f7888df022bc18cc495964cdb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 17:29:27 -0400
+Subject: Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit d47da6bd4cfa982fe903f33423b9e2ec541e9496 ]
+
+If HCI_CONN_MGMT_CONNECTED has been set then the event shall be
+HCI_CONN_MGMT_DISCONNECTED.
+
+Fixes: b644ba336997 ("Bluetooth: Update device_connected and device_found events to latest API")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h |  4 ++--
+ net/bluetooth/hci_conn.c         |  6 ++----
+ net/bluetooth/mgmt.c             | 13 +++++++++----
+ 3 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 98c0a82bd5338..215b56dc26df2 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -2071,8 +2071,8 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ 			      bool mgmt_connected);
+ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ 			    u8 link_type, u8 addr_type, u8 status);
+-void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+-			 u8 addr_type, u8 status);
++void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn,
++			 u8 status);
+ void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure);
+ void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ 				  u8 status);
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 858c454e35e67..5ec2160108a1f 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -107,8 +107,7 @@ static void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
+ 	 * where a timeout + cancel does indicate an actual failure.
+ 	 */
+ 	if (status && status != HCI_ERROR_UNKNOWN_CONN_ID)
+-		mgmt_connect_failed(hdev, &conn->dst, conn->type,
+-				    conn->dst_type, status);
++		mgmt_connect_failed(hdev, conn, status);
+ 
+ 	/* The connection attempt was doing scan for new RPA, and is
+ 	 * in scan phase. If params are not associated with any other
+@@ -1181,8 +1180,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
+ 		hci_le_conn_failed(conn, status);
+ 		break;
+ 	case ACL_LINK:
+-		mgmt_connect_failed(hdev, &conn->dst, conn->type,
+-				    conn->dst_type, status);
++		mgmt_connect_failed(hdev, conn, status);
+ 		break;
+ 	}
+ 
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index c5a3a336515e7..284a0672dcc38 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -9816,13 +9816,18 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ 	mgmt_pending_remove(cmd);
+ }
+ 
+-void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+-			 u8 addr_type, u8 status)
++void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status)
+ {
+ 	struct mgmt_ev_connect_failed ev;
+ 
+-	bacpy(&ev.addr.bdaddr, bdaddr);
+-	ev.addr.type = link_to_bdaddr(link_type, addr_type);
++	if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
++		mgmt_device_disconnected(hdev, &conn->dst, conn->type,
++					 conn->dst_type, status, true);
++		return;
++	}
++
++	bacpy(&ev.addr.bdaddr, &conn->dst);
++	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
+ 	ev.status = mgmt_status(status);
+ 
+ 	mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-hci_sync-ignore-errors-from-hci_op_remote_.patch b/queue-6.1/bluetooth-hci_sync-ignore-errors-from-hci_op_remote_.patch
new file mode 100644
index 00000000000..1a46785acd3
--- /dev/null
+++ b/queue-6.1/bluetooth-hci_sync-ignore-errors-from-hci_op_remote_.patch
@@ -0,0 +1,40 @@
+From 5b9341620e11c42f91737b8bc119ea0958341972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 12:05:00 -0700
+Subject: Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit cfbfeee61582e638770a1a10deef866c9adb38f5 ]
+
+This ignores errors from HCI_OP_REMOTE_NAME_REQ_CANCEL since it
+shouldn't interfere with the stopping of discovery and in certain
+conditions it seems to be failing.
+
+Link: https://github.com/bluez/bluez/issues/575
+Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 3d6a22812b498..0cc187ff35874 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -5256,7 +5256,10 @@ int hci_stop_discovery_sync(struct hci_dev *hdev)
+ 		if (!e)
+ 			return 0;
+ 
+-		return hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
++		/* Ignore cancel errors since it should interfere with stopping
++		 * of the discovery.
++		 */
++		hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bonding-fix-unnecessary-warnings-and-logs-from-bond_.patch b/queue-6.1/bonding-fix-unnecessary-warnings-and-logs-from-bond_.patch
new file mode 100644
index 00000000000..bf15676958d
--- /dev/null
+++ b/queue-6.1/bonding-fix-unnecessary-warnings-and-logs-from-bond_.patch
@@ -0,0 +1,66 @@
+From 0ce18f73b13a680b36b3919aac04985f9b43db0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2024 14:06:02 +0000
+Subject: bonding: Fix unnecessary warnings and logs from
+ bond_xdp_get_xmit_slave()
+
+From: Jiwon Kim <jiwonaid0@gmail.com>
+
+[ Upstream commit 0cbfd45fbcf0cb26d85c981b91c62fe73cdee01c ]
+
+syzbot reported a WARNING in bond_xdp_get_xmit_slave. To reproduce
+this[1], one bond device (bond1) has xdpdrv, which increases
+bpf_master_redirect_enabled_key. Another bond device (bond0) which is
+unsupported by XDP but its slave (veth3) has xdpgeneric that returns
+XDP_TX. This triggers WARN_ON_ONCE() from the xdp_master_redirect().
+To reduce unnecessary warnings and improve log management, we need to
+delete the WARN_ON_ONCE() and add ratelimit to the netdev_err().
+
+[1] Steps to reproduce:
+    # Needs tx_xdp with return XDP_TX;
+    ip l add veth0 type veth peer veth1
+    ip l add veth3 type veth peer veth4
+    ip l add bond0 type bond mode 6 # BOND_MODE_ALB, unsupported by XDP
+    ip l add bond1 type bond # BOND_MODE_ROUNDROBIN by default
+    ip l set veth0 master bond1
+    ip l set bond1 up
+    # Increases bpf_master_redirect_enabled_key
+    ip l set dev bond1 xdpdrv object tx_xdp.o section xdp_tx
+    ip l set veth3 master bond0
+    ip l set bond0 up
+    ip l set veth4 up
+    # Triggers WARN_ON_ONCE() from the xdp_master_redirect()
+    ip l set veth3 xdpgeneric object tx_xdp.o section xdp_tx
+
+Reported-by: syzbot+c187823a52ed505b2257@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=c187823a52ed505b2257
+Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
+Signed-off-by: Jiwon Kim <jiwonaid0@gmail.com>
+Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20240918140602.18644-1-jiwonaid0@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 375412ce1ea5f..51d6cf0a3fb4e 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -5538,9 +5538,9 @@ bond_xdp_get_xmit_slave(struct net_device *bond_dev, struct xdp_buff *xdp)
+ 		break;
+ 
+ 	default:
+-		/* Should never happen. Mode guarded by bond_xdp_check() */
+-		netdev_err(bond_dev, "Unknown bonding mode %d for xdp xmit\n", BOND_MODE(bond));
+-		WARN_ON_ONCE(1);
++		if (net_ratelimit())
++			netdev_err(bond_dev, "Unknown bonding mode %d for xdp xmit\n",
++				   BOND_MODE(bond));
+ 		return NULL;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch b/queue-6.1/bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch
new file mode 100644
index 00000000000..1a982360b8c
--- /dev/null
+++ b/queue-6.1/bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch
@@ -0,0 +1,71 @@
+From 1ff1636cf6ad12e1109e200512d63eeeccca52d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 01:01:23 -0700
+Subject: bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+[ Upstream commit 3d2786d65aaa954ebd3fcc033ada433e10da21c4 ]
+
+In case of malformed relocation record of kind BPF_CORE_TYPE_ID_LOCAL
+referencing a non-existing BTF type, function bpf_core_calc_relo_insn
+would cause a null pointer deference.
+
+Fix this by adding a proper check upper in call stack, as malformed
+relocation records could be passed from user space.
+
+Simplest reproducer is a program:
+
+    r0 = 0
+    exit
+
+With a single relocation record:
+
+    .insn_off = 0,          /* patch first instruction */
+    .type_id = 100500,      /* this type id does not exist */
+    .access_str_off = 6,    /* offset of string "0" */
+    .kind = BPF_CORE_TYPE_ID_LOCAL,
+
+See the link for original reproducer or next commit for a test case.
+
+Fixes: 74753e1462e7 ("libbpf: Replace btf__type_by_id() with btf_type_by_id().")
+Reported-by: Liu RuiTong <cnitlrt@gmail.com>
+Closes: https://lore.kernel.org/bpf/CAK55_s6do7C+DVwbwY_7nKfUz0YLDoiA1v6X3Y9+p0sWzipFSA@mail.gmail.com/
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20240822080124.2995724-2-eddyz87@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 95a050446f271..8c684a0e1c4bc 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7973,6 +7973,7 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
+ 	struct bpf_core_cand_list cands = {};
+ 	struct bpf_core_relo_res targ_res;
+ 	struct bpf_core_spec *specs;
++	const struct btf_type *type;
+ 	int err;
+ 
+ 	/* ~4k of temp memory necessary to convert LLVM spec like "0:1:0:5"
+@@ -7982,6 +7983,13 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
+ 	if (!specs)
+ 		return -ENOMEM;
+ 
++	type = btf_type_by_id(ctx->btf, relo->type_id);
++	if (!type) {
++		bpf_log(ctx->log, "relo #%u: bad type id %u\n",
++			relo_idx, relo->type_id);
++		return -EINVAL;
++	}
++
+ 	if (need_cands) {
+ 		struct bpf_cand_cache *cc;
+ 		int i;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-fix-bpf_strtol-and-bpf_strtoul-helpers-for-32bit.patch b/queue-6.1/bpf-fix-bpf_strtol-and-bpf_strtoul-helpers-for-32bit.patch
new file mode 100644
index 00000000000..2fc14f3abad
--- /dev/null
+++ b/queue-6.1/bpf-fix-bpf_strtol-and-bpf_strtoul-helpers-for-32bit.patch
@@ -0,0 +1,74 @@
+From 3e5bfcc254809f202a74a63ac50ed94fd08ba46d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 21:17:46 +0200
+Subject: bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit cfe69c50b05510b24e26ccb427c7cc70beafd6c1 ]
+
+The bpf_strtol() and bpf_strtoul() helpers are currently broken on 32bit:
+
+The argument type ARG_PTR_TO_LONG is BPF-side "long", not kernel-side "long"
+and therefore always considered fixed 64bit no matter if 64 or 32bit underlying
+architecture.
+
+This contract breaks in case of the two mentioned helpers since their BPF_CALL
+definition for the helpers was added with {unsigned,}long *res. Meaning, the
+transition from BPF-side "long" (BPF program) to kernel-side "long" (BPF helper)
+breaks here.
+
+Both helpers call __bpf_strtoll() with "long long" correctly, but later assigning
+the result into 32-bit "*(long *)" on 32bit architectures. From a BPF program
+point of view, this means upper bits will be seen as uninitialised.
+
+Therefore, fix both BPF_CALL signatures to {s,u}64 types to fix this situation.
+
+Now, changing also uapi/bpf.h helper documentation which generates bpf_helper_defs.h
+for BPF programs is tricky: Changing signatures there to __{s,u}64 would trigger
+compiler warnings (incompatible pointer types passing 'long *' to parameter of type
+'__s64 *' (aka 'long long *')) for existing BPF programs.
+
+Leaving the signatures as-is would be fine as from BPF program point of view it is
+still BPF-side "long" and thus equivalent to __{s,u}64 on 64 or 32bit underlying
+architectures.
+
+Note that bpf_strtol() and bpf_strtoul() are the only helpers with this issue.
+
+Fixes: d7a4cb9b6705 ("bpf: Introduce bpf_strtol and bpf_strtoul helpers")
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/481fcec8-c12c-9abb-8ecb-76c71c009959@iogearbox.net
+Link: https://lore.kernel.org/r/20240913191754.13290-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 758510b46d87b..d12e696fac74f 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -509,7 +509,7 @@ static int __bpf_strtoll(const char *buf, size_t buf_len, u64 flags,
+ }
+ 
+ BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
+-	   long *, res)
++	   s64 *, res)
+ {
+ 	long long _res;
+ 	int err;
+@@ -534,7 +534,7 @@ const struct bpf_func_proto bpf_strtol_proto = {
+ };
+ 
+ BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
+-	   unsigned long *, res)
++	   u64 *, res)
+ {
+ 	unsigned long long _res;
+ 	bool is_negative;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-improve-check_raw_mode_ok-test-for-mem_uninit-ta.patch b/queue-6.1/bpf-improve-check_raw_mode_ok-test-for-mem_uninit-ta.patch
new file mode 100644
index 00000000000..1e89c5cf25a
--- /dev/null
+++ b/queue-6.1/bpf-improve-check_raw_mode_ok-test-for-mem_uninit-ta.patch
@@ -0,0 +1,80 @@
+From fd454769172f3e494e3f5347131dbe86052b8c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 21:17:49 +0200
+Subject: bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 18752d73c1898fd001569195ba4b0b8c43255f4a ]
+
+When checking malformed helper function signatures, also take other argument
+types into account aside from just ARG_PTR_TO_UNINIT_MEM.
+
+This concerns (formerly) ARG_PTR_TO_{INT,LONG} given uninitialized memory can
+be passed there, too.
+
+The func proto sanity check goes back to commit 435faee1aae9 ("bpf, verifier:
+add ARG_PTR_TO_RAW_STACK type"), and its purpose was to detect wrong func protos
+which had more than just one MEM_UNINIT-tagged type as arguments.
+
+The reason more than one is currently not supported is as we mark stack slots with
+STACK_MISC in check_helper_call() in case of raw mode based on meta.access_size to
+allow uninitialized stack memory to be passed to helpers when they just write into
+the buffer.
+
+Probing for base type as well as MEM_UNINIT tagging ensures that other types do not
+get missed (as it used to be the case for ARG_PTR_TO_{INT,LONG}).
+
+Fixes: 57c3bb725a3d ("bpf: Introduce ARG_PTR_TO_{INT,LONG} arg types")
+Reported-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Link: https://lore.kernel.org/r/20240913191754.13290-4-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4efa50eb07d72..eb4073781a3c7 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5796,6 +5796,12 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type)
+ 	       type == ARG_CONST_SIZE_OR_ZERO;
+ }
+ 
++static bool arg_type_is_raw_mem(enum bpf_arg_type type)
++{
++	return base_type(type) == ARG_PTR_TO_MEM &&
++	       type & MEM_UNINIT;
++}
++
+ static bool arg_type_is_release(enum bpf_arg_type type)
+ {
+ 	return type & OBJ_RELEASE;
+@@ -6708,15 +6714,15 @@ static bool check_raw_mode_ok(const struct bpf_func_proto *fn)
+ {
+ 	int count = 0;
+ 
+-	if (fn->arg1_type == ARG_PTR_TO_UNINIT_MEM)
++	if (arg_type_is_raw_mem(fn->arg1_type))
+ 		count++;
+-	if (fn->arg2_type == ARG_PTR_TO_UNINIT_MEM)
++	if (arg_type_is_raw_mem(fn->arg2_type))
+ 		count++;
+-	if (fn->arg3_type == ARG_PTR_TO_UNINIT_MEM)
++	if (arg_type_is_raw_mem(fn->arg3_type))
+ 		count++;
+-	if (fn->arg4_type == ARG_PTR_TO_UNINIT_MEM)
++	if (arg_type_is_raw_mem(fn->arg4_type))
+ 		count++;
+-	if (fn->arg5_type == ARG_PTR_TO_UNINIT_MEM)
++	if (arg_type_is_raw_mem(fn->arg5_type))
+ 		count++;
+ 
+ 	/* We only support one arg being in raw mode at the moment,
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-zero-former-arg_ptr_to_-long-int-args-in-case-of.patch b/queue-6.1/bpf-zero-former-arg_ptr_to_-long-int-args-in-case-of.patch
new file mode 100644
index 00000000000..92041d2889f
--- /dev/null
+++ b/queue-6.1/bpf-zero-former-arg_ptr_to_-long-int-args-in-case-of.patch
@@ -0,0 +1,169 @@
+From 5d9b8db91180c9aa71bb8e312e3c18d913df5395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 21:17:50 +0200
+Subject: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4b3786a6c5397dc220b1483d8e2f4867743e966f ]
+
+For all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input
+arguments, zero the value for the case of an error as otherwise it could leak
+memory. For tracing, it is not needed given CAP_PERFMON can already read all
+kernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped
+in here.
+
+Also, the MTU helpers mtu_len pointer value is being written but also read.
+Technically, the MEM_UNINIT should not be there in order to always force init.
+Removing MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now
+implies two things actually: i) write into memory, ii) memory does not have
+to be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,
+ii) memory must be initialized. This means that for bpf_*_check_mtu() we're
+readding the issue we're trying to fix, that is, it would then be able to
+write back into things like .rodata BPF maps. Follow-up work will rework the
+MEM_UNINIT semantics such that the intent can be better expressed. For now
+just clear the *mtu_len on error path which can be lifted later again.
+
+Fixes: 8a67f2de9b1d ("bpf: expose bpf_strtol and bpf_strtoul to all program types")
+Fixes: d7a4cb9b6705 ("bpf: Introduce bpf_strtol and bpf_strtoul helpers")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/e5edd241-59e7-5e39-0ee5-a51e31b6840a@iogearbox.net
+Link: https://lore.kernel.org/r/20240913191754.13290-5-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c |  2 ++
+ kernel/bpf/syscall.c |  1 +
+ net/core/filter.c    | 44 +++++++++++++++++++++++---------------------
+ 3 files changed, 26 insertions(+), 21 deletions(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index d12e696fac74f..a3fc4e2e8256a 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -514,6 +514,7 @@ BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
+ 	long long _res;
+ 	int err;
+ 
++	*res = 0;
+ 	err = __bpf_strtoll(buf, buf_len, flags, &_res);
+ 	if (err < 0)
+ 		return err;
+@@ -540,6 +541,7 @@ BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
+ 	bool is_negative;
+ 	int err;
+ 
++	*res = 0;
+ 	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
+ 	if (err < 0)
+ 		return err;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index d77597daa0022..42f5b37a74c6f 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -5239,6 +5239,7 @@ static const struct bpf_func_proto bpf_sys_close_proto = {
+ 
+ BPF_CALL_4(bpf_kallsyms_lookup_name, const char *, name, int, name_sz, int, flags, u64 *, res)
+ {
++	*res = 0;
+ 	if (flags)
+ 		return -EINVAL;
+ 
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 1cd5f146cafe4..6f65c6eb0d90d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -6131,20 +6131,25 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,
+ 	int ret = BPF_MTU_CHK_RET_FRAG_NEEDED;
+ 	struct net_device *dev = skb->dev;
+ 	int skb_len, dev_len;
+-	int mtu;
++	int mtu = 0;
+ 
+-	if (unlikely(flags & ~(BPF_MTU_CHK_SEGS)))
+-		return -EINVAL;
++	if (unlikely(flags & ~(BPF_MTU_CHK_SEGS))) {
++		ret = -EINVAL;
++		goto out;
++	}
+ 
+-	if (unlikely(flags & BPF_MTU_CHK_SEGS && (len_diff || *mtu_len)))
+-		return -EINVAL;
++	if (unlikely(flags & BPF_MTU_CHK_SEGS && (len_diff || *mtu_len))) {
++		ret = -EINVAL;
++		goto out;
++	}
+ 
+ 	dev = __dev_via_ifindex(dev, ifindex);
+-	if (unlikely(!dev))
+-		return -ENODEV;
++	if (unlikely(!dev)) {
++		ret = -ENODEV;
++		goto out;
++	}
+ 
+ 	mtu = READ_ONCE(dev->mtu);
+-
+ 	dev_len = mtu + dev->hard_header_len;
+ 
+ 	/* If set use *mtu_len as input, L3 as iph->tot_len (like fib_lookup) */
+@@ -6162,15 +6167,12 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,
+ 	 */
+ 	if (skb_is_gso(skb)) {
+ 		ret = BPF_MTU_CHK_RET_SUCCESS;
+-
+ 		if (flags & BPF_MTU_CHK_SEGS &&
+ 		    !skb_gso_validate_network_len(skb, mtu))
+ 			ret = BPF_MTU_CHK_RET_SEGS_TOOBIG;
+ 	}
+ out:
+-	/* BPF verifier guarantees valid pointer */
+ 	*mtu_len = mtu;
+-
+ 	return ret;
+ }
+ 
+@@ -6180,19 +6182,21 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp,
+ 	struct net_device *dev = xdp->rxq->dev;
+ 	int xdp_len = xdp->data_end - xdp->data;
+ 	int ret = BPF_MTU_CHK_RET_SUCCESS;
+-	int mtu, dev_len;
++	int mtu = 0, dev_len;
+ 
+ 	/* XDP variant doesn't support multi-buffer segment check (yet) */
+-	if (unlikely(flags))
+-		return -EINVAL;
++	if (unlikely(flags)) {
++		ret = -EINVAL;
++		goto out;
++	}
+ 
+ 	dev = __dev_via_ifindex(dev, ifindex);
+-	if (unlikely(!dev))
+-		return -ENODEV;
++	if (unlikely(!dev)) {
++		ret = -ENODEV;
++		goto out;
++	}
+ 
+ 	mtu = READ_ONCE(dev->mtu);
+-
+-	/* Add L2-header as dev MTU is L3 size */
+ 	dev_len = mtu + dev->hard_header_len;
+ 
+ 	/* Use *mtu_len as input, L3 as iph->tot_len (like fib_lookup) */
+@@ -6202,10 +6206,8 @@ BPF_CALL_5(bpf_xdp_check_mtu, struct xdp_buff *, xdp,
+ 	xdp_len += len_diff; /* minus result pass check */
+ 	if (xdp_len > dev_len)
+ 		ret = BPF_MTU_CHK_RET_FRAG_NEEDED;
+-
+-	/* BPF verifier guarantees valid pointer */
++out:
+ 	*mtu_len = mtu;
+-
+ 	return ret;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/can-bcm-clear-bo-bcm_proc_read-after-remove_proc_ent.patch b/queue-6.1/can-bcm-clear-bo-bcm_proc_read-after-remove_proc_ent.patch
new file mode 100644
index 00000000000..b2d0cca5bae
--- /dev/null
+++ b/queue-6.1/can-bcm-clear-bo-bcm_proc_read-after-remove_proc_ent.patch
@@ -0,0 +1,99 @@
+From 33f7dba8df626622923821c87d20d23599d14be5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 18:22:37 -0700
+Subject: can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
+
+syzbot reported a warning in bcm_release(). [0]
+
+The blamed change fixed another warning that is triggered when
+connect() is issued again for a socket whose connect()ed device has
+been unregistered.
+
+However, if the socket is just close()d without the 2nd connect(), the
+remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry()
+in bcm_release().
+
+Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
+
+[0]
+name '4986'
+WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711
+Modules linked in:
+CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
+RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711
+Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07
+RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246
+RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a
+R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640
+R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000
+FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ bcm_release+0x250/0x880 net/can/bcm.c:1578
+ __sock_release net/socket.c:659 [inline]
+ sock_close+0xbc/0x240 net/socket.c:1421
+ __fput+0x24a/0x8a0 fs/file_table.c:422
+ task_work_run+0x24f/0x310 kernel/task_work.c:228
+ exit_task_work include/linux/task_work.h:40 [inline]
+ do_exit+0xa2f/0x27f0 kernel/exit.c:882
+ do_group_exit+0x207/0x2c0 kernel/exit.c:1031
+ __do_sys_exit_group kernel/exit.c:1042 [inline]
+ __se_sys_exit_group kernel/exit.c:1040 [inline]
+ __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040
+ x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7fcfb51ee969
+Code: Unable to access opcode bytes at 0x7fcfb51ee93f.
+RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969
+RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
+RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000
+R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0
+R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160
+ </TASK>
+
+Fixes: 76fe372ccb81 ("can: bcm: Remove proc entry when dev is unregistered.")
+Reported-by: syzbot+0532ac7a06fb1a03187e@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=0532ac7a06fb1a03187e
+Tested-by: syzbot+0532ac7a06fb1a03187e@syzkaller.appspotmail.com
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://patch.msgid.link/20240905012237.79683-1-kuniyu@amazon.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/bcm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 4ecb5cd8a22d0..3817692e83af6 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1429,8 +1429,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
+ 		/* remove device reference, if this is our bound device */
+ 		if (bo->bound && bo->ifindex == dev->ifindex) {
+ #if IS_ENABLED(CONFIG_PROC_FS)
+-			if (sock_net(sk)->can.bcmproc_dir && bo->bcm_proc_read)
++			if (sock_net(sk)->can.bcmproc_dir && bo->bcm_proc_read) {
+ 				remove_proc_entry(bo->procname, sock_net(sk)->can.bcmproc_dir);
++				bo->bcm_proc_read = NULL;
++			}
+ #endif
+ 			bo->bound   = 0;
+ 			bo->ifindex = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/can-j1939-use-correct-function-name-in-comment.patch b/queue-6.1/can-j1939-use-correct-function-name-in-comment.patch
new file mode 100644
index 00000000000..acb02f84e94
--- /dev/null
+++ b/queue-6.1/can-j1939-use-correct-function-name-in-comment.patch
@@ -0,0 +1,44 @@
+From 148d8fccb9674658205b42c4e4452e60651f74f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 20:48:23 +0800
+Subject: can: j1939: use correct function name in comment
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit dc2ddcd136fe9b6196a7dd01f75f824beb02d43f ]
+
+The function j1939_cancel_all_active_sessions() was renamed to
+j1939_cancel_active_session() but name in comment wasn't updated.
+
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Link: https://patch.msgid.link/1724935703-44621-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/j1939/transport.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
+index 25e7339834670..5d2097e5ca3a8 100644
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1179,10 +1179,10 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)
+ 		break;
+ 	case -ENETDOWN:
+ 		/* In this case we should get a netdev_event(), all active
+-		 * sessions will be cleared by
+-		 * j1939_cancel_all_active_sessions(). So handle this as an
+-		 * error, but let j1939_cancel_all_active_sessions() do the
+-		 * cleanup including propagation of the error to user space.
++		 * sessions will be cleared by j1939_cancel_active_session().
++		 * So handle this as an error, but let
++		 * j1939_cancel_active_session() do the cleanup including
++		 * propagation of the error to user space.
+ 		 */
+ 		break;
+ 	case -EOVERFLOW:
+-- 
+2.43.0
+
diff --git a/queue-6.1/can-m_can-enable-napi-before-enabling-interrupts.patch b/queue-6.1/can-m_can-enable-napi-before-enabling-interrupts.patch
new file mode 100644
index 00000000000..e3b1e8394a1
--- /dev/null
+++ b/queue-6.1/can-m_can-enable-napi-before-enabling-interrupts.patch
@@ -0,0 +1,102 @@
+From 51667faf4b1a36691140d247b447b41f8db15df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 23:19:51 +0000
+Subject: can: m_can: enable NAPI before enabling interrupts
+
+From: Jake Hamby <Jake.Hamby@Teledyne.com>
+
+[ Upstream commit 801ad2f87b0c6d0c34a75a4efd6bfd3a2d9f9298 ]
+
+If an interrupt (RX-complete or error flag) is set when bringing up
+the CAN device, e.g. due to CAN bus traffic before initializing the
+device, when m_can_start() is called and interrupts are enabled,
+m_can_isr() is called immediately, which disables all CAN interrupts
+and calls napi_schedule().
+
+Because napi_enable() isn't called until later in m_can_open(), the
+call to napi_schedule() never schedules the m_can_poll() callback and
+the device is left with interrupts disabled and can't receive any CAN
+packets until rebooted.
+
+This can be verified by running "cansend" from another device before
+setting the bitrate and calling "ip link set up can0" on the test
+device. Adding debug lines to m_can_isr() shows it's called with flags
+(IR_EP | IR_EW | IR_CRCE), which calls m_can_disable_all_interrupts()
+and napi_schedule(), and then m_can_poll() is never called.
+
+Move the call to napi_enable() above the call to m_can_start() to
+enable any initial interrupt flags to be handled by m_can_poll() so
+that interrupts are reenabled. Add a call to napi_disable() in the
+error handling section of m_can_open(), to handle the case where later
+functions return errors.
+
+Also, in m_can_close(), move the call to napi_disable() below the call
+to m_can_stop() to ensure all interrupts are handled when bringing
+down the device. This race condition is much less likely to occur.
+
+Tested on a Microchip SAMA7G54 MPU. The fix should be applicable to
+any SoC with a Bosch M_CAN controller.
+
+Signed-off-by: Jake Hamby <Jake.Hamby@Teledyne.com>
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Link: https://patch.msgid.link/20240910-can-m_can-fix-ifup-v3-1-6c1720ba45ce@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index ead8321ed3bfc..d8e6a081118b7 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1555,9 +1555,6 @@ static int m_can_close(struct net_device *dev)
+ 
+ 	netif_stop_queue(dev);
+ 
+-	if (!cdev->is_peripheral)
+-		napi_disable(&cdev->napi);
+-
+ 	m_can_stop(dev);
+ 	m_can_clk_stop(cdev);
+ 	free_irq(dev->irq, dev);
+@@ -1567,6 +1564,8 @@ static int m_can_close(struct net_device *dev)
+ 		destroy_workqueue(cdev->tx_wq);
+ 		cdev->tx_wq = NULL;
+ 		can_rx_offload_disable(&cdev->offload);
++	} else {
++		napi_disable(&cdev->napi);
+ 	}
+ 
+ 	close_candev(dev);
+@@ -1784,6 +1783,8 @@ static int m_can_open(struct net_device *dev)
+ 
+ 	if (cdev->is_peripheral)
+ 		can_rx_offload_enable(&cdev->offload);
++	else
++		napi_enable(&cdev->napi);
+ 
+ 	/* register interrupt handler */
+ 	if (cdev->is_peripheral) {
+@@ -1815,9 +1816,6 @@ static int m_can_open(struct net_device *dev)
+ 	if (err)
+ 		goto exit_start_fail;
+ 
+-	if (!cdev->is_peripheral)
+-		napi_enable(&cdev->napi);
+-
+ 	netif_start_queue(dev);
+ 
+ 	return 0;
+@@ -1831,6 +1829,8 @@ static int m_can_open(struct net_device *dev)
+ out_wq_fail:
+ 	if (cdev->is_peripheral)
+ 		can_rx_offload_disable(&cdev->offload);
++	else
++		napi_disable(&cdev->napi);
+ 	close_candev(dev);
+ exit_disable_clks:
+ 	m_can_clk_stop(cdev);
+-- 
+2.43.0
+
diff --git a/queue-6.1/can-m_can-m_can_close-stop-clocks-after-device-has-b.patch b/queue-6.1/can-m_can-m_can_close-stop-clocks-after-device-has-b.patch
new file mode 100644
index 00000000000..d5f395f7d29
--- /dev/null
+++ b/queue-6.1/can-m_can-m_can_close-stop-clocks-after-device-has-b.patch
@@ -0,0 +1,50 @@
+From 9cecdb526ac746b8bd100d96018115a40629cb59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 15:07:41 +0200
+Subject: can: m_can: m_can_close(): stop clocks after device has been shut
+ down
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 2c09b50efcad985cf920ca88baa9aa52b1999dcc ]
+
+After calling m_can_stop() an interrupt may be pending or NAPI might
+still be executed. This means the driver might still touch registers
+of the IP core after the clocks have been disabled. This is not good
+practice and might lead to aborts depending on the SoC integration.
+
+To avoid these potential problems, make m_can_close() symmetric to
+m_can_open(), i.e. stop the clocks at the end, right before shutting
+down the transceiver.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Link: https://patch.msgid.link/20240910-can-m_can-fix-ifup-v3-2-6c1720ba45ce@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index d8e6a081118b7..e77b4b60f4e61 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1556,7 +1556,6 @@ static int m_can_close(struct net_device *dev)
+ 	netif_stop_queue(dev);
+ 
+ 	m_can_stop(dev);
+-	m_can_clk_stop(cdev);
+ 	free_irq(dev->irq, dev);
+ 
+ 	if (cdev->is_peripheral) {
+@@ -1570,6 +1569,7 @@ static int m_can_close(struct net_device *dev)
+ 
+ 	close_candev(dev);
+ 
++	m_can_clk_stop(cdev);
+ 	phy_power_off(cdev->transceiver);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/can-m_can-remove-repeated-check-for-is_peripheral.patch b/queue-6.1/can-m_can-remove-repeated-check-for-is_peripheral.patch
new file mode 100644
index 00000000000..f449150007f
--- /dev/null
+++ b/queue-6.1/can-m_can-remove-repeated-check-for-is_peripheral.patch
@@ -0,0 +1,40 @@
+From e5693bb2ddf64f4b4b37fc147a2a2cb64a637eb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 12:05:31 +0100
+Subject: can: m_can: Remove repeated check for is_peripheral
+
+From: Markus Schneider-Pargmann <msp@baylibre.com>
+
+[ Upstream commit 73042934e4a30d9f45ff9cb0b3b029a01dbe7130 ]
+
+Merge both if-blocks to fix this.
+
+Signed-off-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/all/20230315110546.2518305-2-msp@baylibre.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Stable-dep-of: 801ad2f87b0c ("can: m_can: enable NAPI before enabling interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 561f25cdad3fb..ead8321ed3bfc 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1566,10 +1566,8 @@ static int m_can_close(struct net_device *dev)
+ 		cdev->tx_skb = NULL;
+ 		destroy_workqueue(cdev->tx_wq);
+ 		cdev->tx_wq = NULL;
+-	}
+-
+-	if (cdev->is_peripheral)
+ 		can_rx_offload_disable(&cdev->offload);
++	}
+ 
+ 	close_candev(dev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-composite-7ulp-check-the-pcc-present-bit.patch b/queue-6.1/clk-imx-composite-7ulp-check-the-pcc-present-bit.patch
new file mode 100644
index 00000000000..5828ab99086
--- /dev/null
+++ b/queue-6.1/clk-imx-composite-7ulp-check-the-pcc-present-bit.patch
@@ -0,0 +1,52 @@
+From 330314426b9b511a5d7e0213e56cb36eace69c86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:35 +0800
+Subject: clk: imx: composite-7ulp: Check the PCC present bit
+
+From: Ye Li <ye.li@nxp.com>
+
+[ Upstream commit 4717ccadb51e2630790dddd222830702de17f090 ]
+
+When some module is disabled by fuse, its PCC PR bit is default 0 and
+PCC is not operational. Any write to this PCC will cause SError.
+
+Fixes: b40ba8065347 ("clk: imx: Update the compsite driver to support imx8ulp")
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Ye Li <ye.li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-4-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-composite-7ulp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-composite-7ulp.c b/drivers/clk/imx/clk-composite-7ulp.c
+index 4eedd45dbaa83..5429b76f4f72c 100644
+--- a/drivers/clk/imx/clk-composite-7ulp.c
++++ b/drivers/clk/imx/clk-composite-7ulp.c
+@@ -14,6 +14,7 @@
+ #include "../clk-fractional-divider.h"
+ #include "clk.h"
+ 
++#define PCG_PR_MASK		BIT(31)
+ #define PCG_PCS_SHIFT	24
+ #define PCG_PCS_MASK	0x7
+ #define PCG_CGC_SHIFT	30
+@@ -80,6 +81,12 @@ static struct clk_hw *imx_ulp_clk_hw_composite(const char *name,
+ 	struct clk_hw *hw;
+ 	u32 val;
+ 
++	val = readl(reg);
++	if (!(val & PCG_PR_MASK)) {
++		pr_info("PCC PR is 0 for clk:%s, bypass\n", name);
++		return 0;
++	}
++
+ 	if (mux_present) {
+ 		mux = kzalloc(sizeof(*mux), GFP_KERNEL);
+ 		if (!mux)
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-composite-8m-enable-gate-clk-with-mcore_boot.patch b/queue-6.1/clk-imx-composite-8m-enable-gate-clk-with-mcore_boot.patch
new file mode 100644
index 00000000000..6b50331443a
--- /dev/null
+++ b/queue-6.1/clk-imx-composite-8m-enable-gate-clk-with-mcore_boot.patch
@@ -0,0 +1,113 @@
+From 4fbef863364dc294992c64ef790bf6486e49e0a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:33 +0800
+Subject: clk: imx: composite-8m: Enable gate clk with mcore_booted
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 8f32e9dd0916eb3fd4bcf550ed1d04542a65cb9e ]
+
+Bootloader might disable some CCM ROOT Slices. So if mcore_booted set with
+display CCM ROOT disabled by Bootloader, kernel display BLK CTRL driver
+imx8m_blk_ctrl_driver_init may hang the system because the BUS clk is
+disabled.
+
+Add back gate ops, but with disable doing nothing, then the CCM ROOT
+will be enabled when used.
+
+Fixes: bb7e897b002a ("clk: imx8m: check mcore_booted before register clk")
+Reviewed-by: Ye Li <ye.li@nxp.com>
+Reviewed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-2-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-composite-8m.c | 53 +++++++++++++++++++++++-------
+ 1 file changed, 42 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c
+index d36fb533da564..4f5536163d656 100644
+--- a/drivers/clk/imx/clk-composite-8m.c
++++ b/drivers/clk/imx/clk-composite-8m.c
+@@ -173,6 +173,34 @@ static const struct clk_ops imx8m_clk_composite_mux_ops = {
+ 	.determine_rate = imx8m_clk_composite_mux_determine_rate,
+ };
+ 
++static int imx8m_clk_composite_gate_enable(struct clk_hw *hw)
++{
++	struct clk_gate *gate = to_clk_gate(hw);
++	unsigned long flags;
++	u32 val;
++
++	spin_lock_irqsave(gate->lock, flags);
++
++	val = readl(gate->reg);
++	val |= BIT(gate->bit_idx);
++	writel(val, gate->reg);
++
++	spin_unlock_irqrestore(gate->lock, flags);
++
++	return 0;
++}
++
++static void imx8m_clk_composite_gate_disable(struct clk_hw *hw)
++{
++	/* composite clk requires the disable hook */
++}
++
++static const struct clk_ops imx8m_clk_composite_gate_ops = {
++	.enable = imx8m_clk_composite_gate_enable,
++	.disable = imx8m_clk_composite_gate_disable,
++	.is_enabled = clk_gate_is_enabled,
++};
++
+ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 					const char * const *parent_names,
+ 					int num_parents, void __iomem *reg,
+@@ -186,6 +214,7 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 	struct clk_mux *mux = NULL;
+ 	const struct clk_ops *divider_ops;
+ 	const struct clk_ops *mux_ops;
++	const struct clk_ops *gate_ops;
+ 
+ 	mux = kzalloc(sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+@@ -226,20 +255,22 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 	div->flags = CLK_DIVIDER_ROUND_CLOSEST;
+ 
+ 	/* skip registering the gate ops if M4 is enabled */
+-	if (!mcore_booted) {
+-		gate = kzalloc(sizeof(*gate), GFP_KERNEL);
+-		if (!gate)
+-			goto free_div;
+-
+-		gate_hw = &gate->hw;
+-		gate->reg = reg;
+-		gate->bit_idx = PCG_CGC_SHIFT;
+-		gate->lock = &imx_ccm_lock;
+-	}
++	gate = kzalloc(sizeof(*gate), GFP_KERNEL);
++	if (!gate)
++		goto free_div;
++
++	gate_hw = &gate->hw;
++	gate->reg = reg;
++	gate->bit_idx = PCG_CGC_SHIFT;
++	gate->lock = &imx_ccm_lock;
++	if (!mcore_booted)
++		gate_ops = &clk_gate_ops;
++	else
++		gate_ops = &imx8m_clk_composite_gate_ops;
+ 
+ 	hw = clk_hw_register_composite(NULL, name, parent_names, num_parents,
+ 			mux_hw, mux_ops, div_hw,
+-			divider_ops, gate_hw, &clk_gate_ops, flags);
++			divider_ops, gate_hw, gate_ops, flags);
+ 	if (IS_ERR(hw))
+ 		goto free_gate;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-composite-8m-less-function-calls-in-__imx8m_.patch b/queue-6.1/clk-imx-composite-8m-less-function-calls-in-__imx8m_.patch
new file mode 100644
index 00000000000..e19be13d5fd
--- /dev/null
+++ b/queue-6.1/clk-imx-composite-8m-less-function-calls-in-__imx8m_.patch
@@ -0,0 +1,81 @@
+From 35b85fe1f454df38f6387d1e3adbb93884dd7971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Dec 2023 16:48:24 +0100
+Subject: clk: imx: composite-8m: Less function calls in
+ __imx8m_clk_hw_composite() after error detection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit fed6bf52c86df27ad4f39a72cdad8c27da9a50ba ]
+
+The function “kfree” was called in up to three cases
+by the function “__imx8m_clk_hw_composite” during error handling
+even if the passed variables contained a null pointer.
+
+Adjust jump targets according to the Linux coding style convention.
+
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/147ca1e6-69f3-4586-b5b3-b69f9574a862@web.de
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Stable-dep-of: 8f32e9dd0916 ("clk: imx: composite-8m: Enable gate clk with mcore_booted")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-composite-8m.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c
+index 3e9a092e136c1..d36fb533da564 100644
+--- a/drivers/clk/imx/clk-composite-8m.c
++++ b/drivers/clk/imx/clk-composite-8m.c
+@@ -189,7 +189,7 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 
+ 	mux = kzalloc(sizeof(*mux), GFP_KERNEL);
+ 	if (!mux)
+-		goto fail;
++		return ERR_CAST(hw);
+ 
+ 	mux_hw = &mux->hw;
+ 	mux->reg = reg;
+@@ -199,7 +199,7 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 
+ 	div = kzalloc(sizeof(*div), GFP_KERNEL);
+ 	if (!div)
+-		goto fail;
++		goto free_mux;
+ 
+ 	div_hw = &div->hw;
+ 	div->reg = reg;
+@@ -229,7 +229,7 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 	if (!mcore_booted) {
+ 		gate = kzalloc(sizeof(*gate), GFP_KERNEL);
+ 		if (!gate)
+-			goto fail;
++			goto free_div;
+ 
+ 		gate_hw = &gate->hw;
+ 		gate->reg = reg;
+@@ -241,13 +241,15 @@ struct clk_hw *__imx8m_clk_hw_composite(const char *name,
+ 			mux_hw, mux_ops, div_hw,
+ 			divider_ops, gate_hw, &clk_gate_ops, flags);
+ 	if (IS_ERR(hw))
+-		goto fail;
++		goto free_gate;
+ 
+ 	return hw;
+ 
+-fail:
++free_gate:
+ 	kfree(gate);
++free_div:
+ 	kfree(div);
++free_mux:
+ 	kfree(mux);
+ 	return ERR_CAST(hw);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-fracn-gppll-fix-fractional-part-of-pll-getti.patch b/queue-6.1/clk-imx-fracn-gppll-fix-fractional-part-of-pll-getti.patch
new file mode 100644
index 00000000000..ced101b7f00
--- /dev/null
+++ b/queue-6.1/clk-imx-fracn-gppll-fix-fractional-part-of-pll-getti.patch
@@ -0,0 +1,43 @@
+From 505e348f58b4183abd6fb94942e6cb48c34b7bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:36 +0800
+Subject: clk: imx: fracn-gppll: fix fractional part of PLL getting lost
+
+From: Pengfei Li <pengfei.li_1@nxp.com>
+
+[ Upstream commit 7622f888fca125ae46f695edf918798ebc0506c5 ]
+
+Fractional part of PLL gets lost after re-enabling the PLL. the
+MFN can NOT be automatically loaded when doing frac PLL enable/disable,
+So when re-enable PLL, configure mfn explicitly.
+
+Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll")
+Signed-off-by: Pengfei Li <pengfei.li_1@nxp.com>
+Reviewed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-5-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index e2633ad94640f..421a78e295ee4 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -289,6 +289,10 @@ static int clk_fracn_gppll_prepare(struct clk_hw *hw)
+ 	if (val & POWERUP_MASK)
+ 		return 0;
+ 
++	if (pll->flags & CLK_FRACN_GPPLL_FRACN)
++		writel_relaxed(readl_relaxed(pll->base + PLL_NUMERATOR),
++			       pll->base + PLL_NUMERATOR);
++
+ 	val |= CLKMUX_BYPASS;
+ 	writel_relaxed(val, pll->base + PLL_CTRL);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-fracn-gppll-support-integer-pll.patch b/queue-6.1/clk-imx-fracn-gppll-support-integer-pll.patch
new file mode 100644
index 00000000000..c5fabfb3b71
--- /dev/null
+++ b/queue-6.1/clk-imx-fracn-gppll-support-integer-pll.patch
@@ -0,0 +1,184 @@
+From b1308359d0b749cd67d05d67bc1ed8f34ebbe0f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 17:52:56 +0800
+Subject: clk: imx: fracn-gppll: support integer pll
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 56b8d0bf3ea8b0db8543e04a6b97348a543405ab ]
+
+The fracn gppll could be configured in FRAC or INTEGER mode during
+hardware design. The current driver only support FRAC mode, while
+this patch introduces INTEGER support. When the PLL is INTEGER pll,
+there is no mfn, mfd, the calculation is as below:
+ Fvco_clk = (Fref / DIV[RDIV] ) * DIV[MFI]
+ Fclko_odiv = Fvco_clk / DIV[ODIV]
+
+In this patch, we reuse the FRAC pll logic with some condition check to
+simplify the driver
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20230403095300.3386988-4-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Stable-dep-of: 7622f888fca1 ("clk: imx: fracn-gppll: fix fractional part of PLL getting lost")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 68 +++++++++++++++++++++++++++----
+ drivers/clk/imx/clk.h             |  7 ++++
+ 2 files changed, 68 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index f6674110a88e0..e2633ad94640f 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -53,11 +53,22 @@
+ 		.odiv	=	(_odiv),			\
+ 	}
+ 
++#define PLL_FRACN_GP_INTEGER(_rate, _mfi, _rdiv, _odiv)		\
++	{							\
++		.rate	=	(_rate),			\
++		.mfi	=	(_mfi),				\
++		.mfn	=	0,				\
++		.mfd	=	0,				\
++		.rdiv	=	(_rdiv),			\
++		.odiv	=	(_odiv),			\
++	}
++
+ struct clk_fracn_gppll {
+ 	struct clk_hw			hw;
+ 	void __iomem			*base;
+ 	const struct imx_fracn_gppll_rate_table *rate_table;
+ 	int rate_count;
++	u32 flags;
+ };
+ 
+ /*
+@@ -83,6 +94,24 @@ struct imx_fracn_gppll_clk imx_fracn_gppll = {
+ };
+ EXPORT_SYMBOL_GPL(imx_fracn_gppll);
+ 
++/*
++ * Fvco = (Fref / rdiv) * MFI
++ * Fout = Fvco / odiv
++ * The (Fref / rdiv) should be in range 20MHz to 40MHz
++ * The Fvco should be in range 2.5Ghz to 5Ghz
++ */
++static const struct imx_fracn_gppll_rate_table int_tbl[] = {
++	PLL_FRACN_GP_INTEGER(1700000000U, 141, 1, 2),
++	PLL_FRACN_GP_INTEGER(1400000000U, 175, 1, 3),
++	PLL_FRACN_GP_INTEGER(900000000U, 150, 1, 4),
++};
++
++struct imx_fracn_gppll_clk imx_fracn_gppll_integer = {
++	.rate_table = int_tbl,
++	.rate_count = ARRAY_SIZE(int_tbl),
++};
++EXPORT_SYMBOL_GPL(imx_fracn_gppll_integer);
++
+ static inline struct clk_fracn_gppll *to_clk_fracn_gppll(struct clk_hw *hw)
+ {
+ 	return container_of(hw, struct clk_fracn_gppll, hw);
+@@ -169,9 +198,15 @@ static unsigned long clk_fracn_gppll_recalc_rate(struct clk_hw *hw, unsigned lon
+ 		break;
+ 	}
+ 
+-	/* Fvco = Fref * (MFI + MFN / MFD) */
+-	fvco = fvco * mfi * mfd + fvco * mfn;
+-	do_div(fvco, mfd * rdiv * odiv);
++	if (pll->flags & CLK_FRACN_GPPLL_INTEGER) {
++		/* Fvco = (Fref / rdiv) * MFI */
++		fvco = fvco * mfi;
++		do_div(fvco, rdiv * odiv);
++	} else {
++		/* Fvco = (Fref / rdiv) * (MFI + MFN / MFD) */
++		fvco = fvco * mfi * mfd + fvco * mfn;
++		do_div(fvco, mfd * rdiv * odiv);
++	}
+ 
+ 	return (unsigned long)fvco;
+ }
+@@ -215,8 +250,10 @@ static int clk_fracn_gppll_set_rate(struct clk_hw *hw, unsigned long drate,
+ 	pll_div = FIELD_PREP(PLL_RDIV_MASK, rate->rdiv) | rate->odiv |
+ 		FIELD_PREP(PLL_MFI_MASK, rate->mfi);
+ 	writel_relaxed(pll_div, pll->base + PLL_DIV);
+-	writel_relaxed(rate->mfd, pll->base + PLL_DENOMINATOR);
+-	writel_relaxed(FIELD_PREP(PLL_MFN_MASK, rate->mfn), pll->base + PLL_NUMERATOR);
++	if (pll->flags & CLK_FRACN_GPPLL_FRACN) {
++		writel_relaxed(rate->mfd, pll->base + PLL_DENOMINATOR);
++		writel_relaxed(FIELD_PREP(PLL_MFN_MASK, rate->mfn), pll->base + PLL_NUMERATOR);
++	}
+ 
+ 	/* Wait for 5us according to fracn mode pll doc */
+ 	udelay(5);
+@@ -300,8 +337,10 @@ static const struct clk_ops clk_fracn_gppll_ops = {
+ 	.set_rate	= clk_fracn_gppll_set_rate,
+ };
+ 
+-struct clk_hw *imx_clk_fracn_gppll(const char *name, const char *parent_name, void __iomem *base,
+-				   const struct imx_fracn_gppll_clk *pll_clk)
++static struct clk_hw *_imx_clk_fracn_gppll(const char *name, const char *parent_name,
++					   void __iomem *base,
++					   const struct imx_fracn_gppll_clk *pll_clk,
++					   u32 pll_flags)
+ {
+ 	struct clk_fracn_gppll *pll;
+ 	struct clk_hw *hw;
+@@ -322,6 +361,7 @@ struct clk_hw *imx_clk_fracn_gppll(const char *name, const char *parent_name, vo
+ 	pll->hw.init = &init;
+ 	pll->rate_table = pll_clk->rate_table;
+ 	pll->rate_count = pll_clk->rate_count;
++	pll->flags = pll_flags;
+ 
+ 	hw = &pll->hw;
+ 
+@@ -334,4 +374,18 @@ struct clk_hw *imx_clk_fracn_gppll(const char *name, const char *parent_name, vo
+ 
+ 	return hw;
+ }
++
++struct clk_hw *imx_clk_fracn_gppll(const char *name, const char *parent_name, void __iomem *base,
++				   const struct imx_fracn_gppll_clk *pll_clk)
++{
++	return _imx_clk_fracn_gppll(name, parent_name, base, pll_clk, CLK_FRACN_GPPLL_FRACN);
++}
+ EXPORT_SYMBOL_GPL(imx_clk_fracn_gppll);
++
++struct clk_hw *imx_clk_fracn_gppll_integer(const char *name, const char *parent_name,
++					   void __iomem *base,
++					   const struct imx_fracn_gppll_clk *pll_clk)
++{
++	return _imx_clk_fracn_gppll(name, parent_name, base, pll_clk, CLK_FRACN_GPPLL_INTEGER);
++}
++EXPORT_SYMBOL_GPL(imx_clk_fracn_gppll_integer);
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index fb59131395f03..ef090fa3327a2 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -74,6 +74,9 @@ extern struct imx_pll14xx_clk imx_1416x_pll;
+ extern struct imx_pll14xx_clk imx_1443x_pll;
+ extern struct imx_pll14xx_clk imx_1443x_dram_pll;
+ 
++#define CLK_FRACN_GPPLL_INTEGER	BIT(0)
++#define CLK_FRACN_GPPLL_FRACN	BIT(1)
++
+ /* NOTE: Rate table should be kept sorted in descending order. */
+ struct imx_fracn_gppll_rate_table {
+ 	unsigned int rate;
+@@ -92,8 +95,12 @@ struct imx_fracn_gppll_clk {
+ 
+ struct clk_hw *imx_clk_fracn_gppll(const char *name, const char *parent_name, void __iomem *base,
+ 				   const struct imx_fracn_gppll_clk *pll_clk);
++struct clk_hw *imx_clk_fracn_gppll_integer(const char *name, const char *parent_name,
++					   void __iomem *base,
++					   const struct imx_fracn_gppll_clk *pll_clk);
+ 
+ extern struct imx_fracn_gppll_clk imx_fracn_gppll;
++extern struct imx_fracn_gppll_clk imx_fracn_gppll_integer;
+ 
+ #define imx_clk_cpu(name, parent_name, div, mux, pll, step) \
+ 	to_clk(imx_clk_hw_cpu(name, parent_name, div, mux, pll, step))
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-imx8mp-fix-clock-tree-update-of-tf-a-managed.patch b/queue-6.1/clk-imx-imx8mp-fix-clock-tree-update-of-tf-a-managed.patch
new file mode 100644
index 00000000000..4f5077898af
--- /dev/null
+++ b/queue-6.1/clk-imx-imx8mp-fix-clock-tree-update-of-tf-a-managed.patch
@@ -0,0 +1,61 @@
+From 4a63ea252f5ae329f3fd5fcc4fbb587ce90d9d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:38 +0800
+Subject: clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
+
+From: Zhipeng Wang <zhipeng.wang_1@nxp.com>
+
+[ Upstream commit 3d29036853b9cb07ac49e8261fca82a940be5c41 ]
+
+On the i.MX8M*, the TF-A exposes a SiP (Silicon Provider) service
+for DDR frequency scaling. The imx8m-ddrc-devfreq driver calls the
+SiP and then does clk_set_parent on the DDR muxes to synchronize
+the clock tree.
+
+since commit 936c383673b9 ("clk: imx: fix composite peripheral flags"),
+these TF-A managed muxes have SET_PARENT_GATE set, which results
+in imx8m-ddrc-devfreq's clk_set_parent after SiP failing with -EBUSY:
+
+clk_set_parent(dram_apb_src, sys1_pll_40m);(busfreq-imx8mq.c)
+
+commit 926bf91248dd
+("clk: imx8m: fix clock tree update of TF-A managed clocks") adds this
+method and enables 8mm, 8mn and 8mq. i.MX8MP also needs it.
+
+This is safe to do, because updating the Linux clock tree to reflect
+reality will always be glitch-free.
+
+Another reason to this patch is that powersave image BT music
+requires dram to be 400MTS, so clk_set_parent(dram_alt_src,
+sys1_pll_800m); is required. Without this patch, it will not succeed.
+
+Fixes: 936c383673b9 ("clk: imx: fix composite peripheral flags")
+Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
+Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-7-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
+index 3d0d8f2c02dc1..2de49bbc40f30 100644
+--- a/drivers/clk/imx/clk-imx8mp.c
++++ b/drivers/clk/imx/clk-imx8mp.c
+@@ -550,8 +550,8 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
+ 
+ 	hws[IMX8MP_CLK_IPG_ROOT] = imx_clk_hw_divider2("ipg_root", "ahb_root", ccm_base + 0x9080, 0, 1);
+ 
+-	hws[IMX8MP_CLK_DRAM_ALT] = imx8m_clk_hw_composite("dram_alt", imx8mp_dram_alt_sels, ccm_base + 0xa000);
+-	hws[IMX8MP_CLK_DRAM_APB] = imx8m_clk_hw_composite_critical("dram_apb", imx8mp_dram_apb_sels, ccm_base + 0xa080);
++	hws[IMX8MP_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mp_dram_alt_sels, ccm_base + 0xa000);
++	hws[IMX8MP_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mp_dram_apb_sels, ccm_base + 0xa080);
+ 	hws[IMX8MP_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mp_vpu_g1_sels, ccm_base + 0xa100);
+ 	hws[IMX8MP_CLK_VPU_G2] = imx8m_clk_hw_composite("vpu_g2", imx8mp_vpu_g2_sels, ccm_base + 0xa180);
+ 	hws[IMX8MP_CLK_CAN1] = imx8m_clk_hw_composite("can1", imx8mp_can1_sels, ccm_base + 0xa200);
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-imx8qxp-parent-should-be-initialized-earlier.patch b/queue-6.1/clk-imx-imx8qxp-parent-should-be-initialized-earlier.patch
new file mode 100644
index 00000000000..6003e4266a4
--- /dev/null
+++ b/queue-6.1/clk-imx-imx8qxp-parent-should-be-initialized-earlier.patch
@@ -0,0 +1,57 @@
+From c2817d08bf4780ebab55d194c81f809242a25b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:46 +0800
+Subject: clk: imx: imx8qxp: Parent should be initialized earlier than the
+ clock
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 766c386c16c9899461b83573a06380d364c6e261 ]
+
+The initialization order of SCU clocks affects the sequence of SCU clock
+resume. If there are no other effects, the earlier the initialization,
+the earlier the resume. During SCU clock resume, the clock rate is
+restored. As SCFW guidelines, configure the parent clock rate before
+configuring the child rate.
+
+Fixes: babfaa9556d7 ("clk: imx: scu: add more scu clocks")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-15-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8qxp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c
+index fd89f0090779f..28265e28856c2 100644
+--- a/drivers/clk/imx/clk-imx8qxp.c
++++ b/drivers/clk/imx/clk-imx8qxp.c
+@@ -166,8 +166,8 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ 	imx_clk_scu("pwm_clk",   IMX_SC_R_LCD_0_PWM_0, IMX_SC_PM_CLK_PER);
+ 	imx_clk_scu("elcdif_pll", IMX_SC_R_ELCDIF_PLL, IMX_SC_PM_CLK_PLL);
+ 	imx_clk_scu2("lcd_clk", lcd_sels, ARRAY_SIZE(lcd_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_PER);
+-	imx_clk_scu2("lcd_pxl_clk", lcd_pxl_sels, ARRAY_SIZE(lcd_pxl_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_MISC0);
+ 	imx_clk_scu("lcd_pxl_bypass_div_clk", IMX_SC_R_LCD_0, IMX_SC_PM_CLK_BYPASS);
++	imx_clk_scu2("lcd_pxl_clk", lcd_pxl_sels, ARRAY_SIZE(lcd_pxl_sels), IMX_SC_R_LCD_0, IMX_SC_PM_CLK_MISC0);
+ 
+ 	/* Audio SS */
+ 	imx_clk_scu("audio_pll0_clk", IMX_SC_R_AUDIO_PLL_0, IMX_SC_PM_CLK_PLL);
+@@ -207,11 +207,11 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ 	imx_clk_scu2("dc0_disp1_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC1);
+ 	imx_clk_scu("dc0_bypass1_clk", IMX_SC_R_DC_0_VIDEO1, IMX_SC_PM_CLK_BYPASS);
+ 
+-	imx_clk_scu2("dc1_disp0_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC0);
+-	imx_clk_scu2("dc1_disp1_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC1);
+ 	imx_clk_scu("dc1_pll0_clk", IMX_SC_R_DC_1_PLL_0, IMX_SC_PM_CLK_PLL);
+ 	imx_clk_scu("dc1_pll1_clk", IMX_SC_R_DC_1_PLL_1, IMX_SC_PM_CLK_PLL);
+ 	imx_clk_scu("dc1_bypass0_clk", IMX_SC_R_DC_1_VIDEO0, IMX_SC_PM_CLK_BYPASS);
++	imx_clk_scu2("dc1_disp0_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC0);
++	imx_clk_scu2("dc1_disp1_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC1);
+ 	imx_clk_scu("dc1_bypass1_clk", IMX_SC_R_DC_1_VIDEO1, IMX_SC_PM_CLK_BYPASS);
+ 
+ 	/* MIPI-LVDS SS */
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-imx8qxp-register-dc0_bypass0_clk-before-disp.patch b/queue-6.1/clk-imx-imx8qxp-register-dc0_bypass0_clk-before-disp.patch
new file mode 100644
index 00000000000..54dc2f8971b
--- /dev/null
+++ b/queue-6.1/clk-imx-imx8qxp-register-dc0_bypass0_clk-before-disp.patch
@@ -0,0 +1,46 @@
+From 4362d02050cf6aa501969ca4797bd7062a3ba19f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 21:33:45 +0800
+Subject: clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit e61352d5ecdc0da2e7253121c15d9a3e040f78a1 ]
+
+The initialization order of SCU clocks affects the sequence of SCU clock
+resume. If there are no other effects, the earlier the initialization,
+the earlier the resume. During SCU clock resume, the clock rate is
+restored. As SCFW guidelines, configure the parent clock rate before
+configuring the child rate.
+
+Fixes: 91e916771de0 ("clk: imx: scu: remove legacy scu clock binding support")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240607133347.3291040-14-peng.fan@oss.nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8qxp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c
+index 1066ea16de625..fd89f0090779f 100644
+--- a/drivers/clk/imx/clk-imx8qxp.c
++++ b/drivers/clk/imx/clk-imx8qxp.c
+@@ -200,11 +200,11 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ 	imx_clk_scu("usb3_lpm_div", IMX_SC_R_USB_2, IMX_SC_PM_CLK_MISC);
+ 
+ 	/* Display controller SS */
+-	imx_clk_scu2("dc0_disp0_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC0);
+-	imx_clk_scu2("dc0_disp1_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC1);
+ 	imx_clk_scu("dc0_pll0_clk", IMX_SC_R_DC_0_PLL_0, IMX_SC_PM_CLK_PLL);
+ 	imx_clk_scu("dc0_pll1_clk", IMX_SC_R_DC_0_PLL_1, IMX_SC_PM_CLK_PLL);
+ 	imx_clk_scu("dc0_bypass0_clk", IMX_SC_R_DC_0_VIDEO0, IMX_SC_PM_CLK_BYPASS);
++	imx_clk_scu2("dc0_disp0_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC0);
++	imx_clk_scu2("dc0_disp1_clk", dc0_sels, ARRAY_SIZE(dc0_sels), IMX_SC_R_DC_0, IMX_SC_PM_CLK_MISC1);
+ 	imx_clk_scu("dc0_bypass1_clk", IMX_SC_R_DC_0_VIDEO1, IMX_SC_PM_CLK_BYPASS);
+ 
+ 	imx_clk_scu2("dc1_disp0_clk", dc1_sels, ARRAY_SIZE(dc1_sels), IMX_SC_R_DC_1, IMX_SC_PM_CLK_MISC0);
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-qcom-dispcc-sm8250-use-special-function-for-luci.patch b/queue-6.1/clk-qcom-dispcc-sm8250-use-special-function-for-luci.patch
new file mode 100644
index 00000000000..4339db45417
--- /dev/null
+++ b/queue-6.1/clk-qcom-dispcc-sm8250-use-special-function-for-luci.patch
@@ -0,0 +1,124 @@
+From 4f6b578b6befa2ce4d3852f76653266574c25ed8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Aug 2024 08:40:06 +0300
+Subject: clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 362be5cbaec2a663eb86b7105313368b4a71fc1e ]
+
+According to msm-5.10 the lucid 5lpe PLLs have require slightly
+different configuration that trion / lucid PLLs, it doesn't set
+PLL_UPDATE_BYPASS bit. Add corresponding function and use it for the
+display clock controller on Qualcomm SM8350 platform.
+
+Fixes: 205737fe3345 ("clk: qcom: add support for SM8350 DISPCC")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240804-sm8350-fixes-v1-2-1149dd8399fe@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 52 ++++++++++++++++++++++++++++++++
+ drivers/clk/qcom/clk-alpha-pll.h |  2 ++
+ drivers/clk/qcom/dispcc-sm8250.c |  9 ++++--
+ 3 files changed, 61 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index 391b8da8849bd..0b5a3e13c55cf 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -1700,6 +1700,58 @@ const struct clk_ops clk_alpha_pll_agera_ops = {
+ };
+ EXPORT_SYMBOL_GPL(clk_alpha_pll_agera_ops);
+ 
++/**
++ * clk_lucid_5lpe_pll_configure - configure the lucid 5lpe pll
++ *
++ * @pll: clk alpha pll
++ * @regmap: register map
++ * @config: configuration to apply for pll
++ */
++void clk_lucid_5lpe_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
++				  const struct alpha_pll_config *config)
++{
++	/*
++	 * If the bootloader left the PLL enabled it's likely that there are
++	 * RCGs that will lock up if we disable the PLL below.
++	 */
++	if (trion_pll_is_enabled(pll, regmap)) {
++		pr_debug("Lucid 5LPE PLL is already enabled, skipping configuration\n");
++		return;
++	}
++
++	clk_alpha_pll_write_config(regmap, PLL_L_VAL(pll), config->l);
++	regmap_write(regmap, PLL_CAL_L_VAL(pll), TRION_PLL_CAL_VAL);
++	clk_alpha_pll_write_config(regmap, PLL_ALPHA_VAL(pll), config->alpha);
++	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL(pll),
++				     config->config_ctl_val);
++	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL_U(pll),
++				     config->config_ctl_hi_val);
++	clk_alpha_pll_write_config(regmap, PLL_CONFIG_CTL_U1(pll),
++				     config->config_ctl_hi1_val);
++	clk_alpha_pll_write_config(regmap, PLL_USER_CTL(pll),
++					config->user_ctl_val);
++	clk_alpha_pll_write_config(regmap, PLL_USER_CTL_U(pll),
++					config->user_ctl_hi_val);
++	clk_alpha_pll_write_config(regmap, PLL_USER_CTL_U1(pll),
++					config->user_ctl_hi1_val);
++	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL(pll),
++					config->test_ctl_val);
++	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL_U(pll),
++					config->test_ctl_hi_val);
++	clk_alpha_pll_write_config(regmap, PLL_TEST_CTL_U1(pll),
++					config->test_ctl_hi1_val);
++
++	/* Disable PLL output */
++	regmap_update_bits(regmap, PLL_MODE(pll),  PLL_OUTCTRL, 0);
++
++	/* Set operation mode to OFF */
++	regmap_write(regmap, PLL_OPMODE(pll), PLL_STANDBY);
++
++	/* Place the PLL in STANDBY mode */
++	regmap_update_bits(regmap, PLL_MODE(pll), PLL_RESET_N, PLL_RESET_N);
++}
++EXPORT_SYMBOL_GPL(clk_lucid_5lpe_pll_configure);
++
+ static int alpha_pll_lucid_5lpe_enable(struct clk_hw *hw)
+ {
+ 	struct clk_alpha_pll *pll = to_clk_alpha_pll(hw);
+diff --git a/drivers/clk/qcom/clk-alpha-pll.h b/drivers/clk/qcom/clk-alpha-pll.h
+index f9524b3fce6b9..e0c5f2f855ad1 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.h
++++ b/drivers/clk/qcom/clk-alpha-pll.h
+@@ -178,6 +178,8 @@ void clk_agera_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+ 
+ void clk_zonda_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+ 			     const struct alpha_pll_config *config);
++void clk_lucid_5lpe_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
++				  const struct alpha_pll_config *config);
+ void clk_lucid_evo_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+ 				 const struct alpha_pll_config *config);
+ void clk_rivian_evo_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+diff --git a/drivers/clk/qcom/dispcc-sm8250.c b/drivers/clk/qcom/dispcc-sm8250.c
+index 709076f0f9d73..78fcd57aa9116 100644
+--- a/drivers/clk/qcom/dispcc-sm8250.c
++++ b/drivers/clk/qcom/dispcc-sm8250.c
+@@ -1332,8 +1332,13 @@ static int disp_cc_sm8250_probe(struct platform_device *pdev)
+ 		disp_cc_pll1.vco_table = lucid_5lpe_vco;
+ 	}
+ 
+-	clk_lucid_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+-	clk_lucid_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
++	if (of_device_is_compatible(pdev->dev.of_node, "qcom,sm8350-dispcc")) {
++		clk_lucid_5lpe_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
++		clk_lucid_5lpe_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
++	} else {
++		clk_lucid_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
++		clk_lucid_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
++	}
+ 
+ 	/* Enable clock gating for MDP clocks */
+ 	regmap_update_bits(regmap, 0x8000, 0x10, 0x10);
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-rockchip-set-parent-rate-for-dclk_vop-clock-on-r.patch b/queue-6.1/clk-rockchip-set-parent-rate-for-dclk_vop-clock-on-r.patch
new file mode 100644
index 00000000000..04b6102ebb0
--- /dev/null
+++ b/queue-6.1/clk-rockchip-set-parent-rate-for-dclk_vop-clock-on-r.patch
@@ -0,0 +1,42 @@
+From cf0eaff4439187152273a7a30f811ed8eb40acd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jun 2024 17:03:53 +0000
+Subject: clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 1d34b9757523c1ad547bd6d040381f62d74a3189 ]
+
+Similar to DCLK_LCDC on RK3328, the DCLK_VOP on RK3228 is typically
+parented by the hdmiphy clk and it is expected that the DCLK_VOP and
+hdmiphy clk rate are kept in sync.
+
+Use CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT flags, same as used
+on RK3328, to make full use of all possible supported display modes.
+
+Fixes: 0a9d4ac08ebc ("clk: rockchip: set the clock ids for RK3228 VOP")
+Fixes: 307a2e9ac524 ("clk: rockchip: add clock controller for rk3228")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Link: https://lore.kernel.org/r/20240615170417.3134517-3-jonas@kwiboo.se
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3228.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c
+index a24a35553e134..7343d2d7676bc 100644
+--- a/drivers/clk/rockchip/clk-rk3228.c
++++ b/drivers/clk/rockchip/clk-rk3228.c
+@@ -409,7 +409,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
+ 			RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),
+ 	DIV(0, "sclk_vop_pre", "sclk_vop_src", 0,
+ 			RK2928_CLKSEL_CON(27), 8, 8, DFLAGS),
+-	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, 0,
++	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, CLK_SET_RATE_PARENT | CLK_SET_RATE_NO_REPARENT,
+ 			RK2928_CLKSEL_CON(27), 1, 1, MFLAGS),
+ 
+ 	FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-ti-dra7-atl-fix-leak-of-of_nodes.patch b/queue-6.1/clk-ti-dra7-atl-fix-leak-of-of_nodes.patch
new file mode 100644
index 00000000000..48f22cc62c0
--- /dev/null
+++ b/queue-6.1/clk-ti-dra7-atl-fix-leak-of-of_nodes.patch
@@ -0,0 +1,39 @@
+From d4b83a007e26723042c6120fcc895dcd7e26da0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 10:35:29 -0500
+Subject: clk: ti: dra7-atl: Fix leak of of_nodes
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 9d6e9f10e2e031fb7bfb3030a7d1afc561a28fea ]
+
+This fix leaking the of_node references in of_dra7_atl_clk_probe().
+
+The docs for of_parse_phandle_with_args() say that the caller must call
+of_node_put() on the returned node. This adds the missing of_node_put()
+to fix the leak.
+
+Fixes: 9ac33b0ce81f ("CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20240826-clk-fix-leak-v1-1-f55418a13aa6@baylibre.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-dra7-atl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 1c576599f6dbd..32b8adfa8bbf6 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -250,6 +250,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		clk = of_clk_get_from_provider(&clkspec);
++		of_node_put(clkspec.np);
+ 		if (IS_ERR(clk)) {
+ 			pr_err("%s: failed to get atl clock %d from provider\n",
+ 			       __func__, i);
+-- 
+2.43.0
+
diff --git a/queue-6.1/clocksource-drivers-qcom-add-missing-iounmap-on-erro.patch b/queue-6.1/clocksource-drivers-qcom-add-missing-iounmap-on-erro.patch
new file mode 100644
index 00000000000..2877709f75b
--- /dev/null
+++ b/queue-6.1/clocksource-drivers-qcom-add-missing-iounmap-on-erro.patch
@@ -0,0 +1,51 @@
+From a25541cb211413995b43a26167269e8ce3215fe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jul 2024 15:27:13 +0530
+Subject: clocksource/drivers/qcom: Add missing iounmap() on errors in
+ msm_dt_timer_init()
+
+From: Ankit Agrawal <agrawal.ag.ankit@gmail.com>
+
+[ Upstream commit ca140a0dc0a18acd4653b56db211fec9b2339986 ]
+
+Add the missing iounmap() when clock frequency fails to get read by the
+of_property_read_u32() call, or if the call to msm_timer_init() fails.
+
+Fixes: 6e3321631ac2 ("ARM: msm: Add DT support to msm_timer")
+Signed-off-by: Ankit Agrawal <agrawal.ag.ankit@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240713095713.GA430091@bnew-VirtualBox
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-qcom.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-qcom.c b/drivers/clocksource/timer-qcom.c
+index b4afe3a675835..eac4c95c6127f 100644
+--- a/drivers/clocksource/timer-qcom.c
++++ b/drivers/clocksource/timer-qcom.c
+@@ -233,6 +233,7 @@ static int __init msm_dt_timer_init(struct device_node *np)
+ 	}
+ 
+ 	if (of_property_read_u32(np, "clock-frequency", &freq)) {
++		iounmap(cpu0_base);
+ 		pr_err("Unknown frequency\n");
+ 		return -EINVAL;
+ 	}
+@@ -243,7 +244,11 @@ static int __init msm_dt_timer_init(struct device_node *np)
+ 	freq /= 4;
+ 	writel_relaxed(DGT_CLK_CTL_DIV_4, source_base + DGT_CLK_CTL);
+ 
+-	return msm_timer_init(freq, 32, irq, !!percpu_offset);
++	ret = msm_timer_init(freq, 32, irq, !!percpu_offset);
++	if (ret)
++		iounmap(cpu0_base);
++
++	return ret;
+ }
+ TIMER_OF_DECLARE(kpss_timer, "qcom,kpss-timer", msm_dt_timer_init);
+ TIMER_OF_DECLARE(scss_timer, "qcom,scss-timer", msm_dt_timer_init);
+-- 
+2.43.0
+
diff --git a/queue-6.1/coresight-tmc-sg-do-not-leak-sg_table.patch b/queue-6.1/coresight-tmc-sg-do-not-leak-sg_table.patch
new file mode 100644
index 00000000000..e6cb7e4095b
--- /dev/null
+++ b/queue-6.1/coresight-tmc-sg-do-not-leak-sg_table.patch
@@ -0,0 +1,73 @@
+From 968d2a9b8d0365a2ec1ab022dfa801fc65fd3ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 14:28:46 +0100
+Subject: coresight: tmc: sg: Do not leak sg_table
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit c58dc5a1f886f2fcc1133746d0cbaa1fe7fd44ff ]
+
+Running perf with cs_etm on Juno triggers the following kmemleak warning !
+
+:~# cat /sys/kernel/debug/kmemleak
+ unreferenced object 0xffffff8806b6d720 (size 96):
+ comm "perf", pid 562, jiffies 4297810960
+ hex dump (first 32 bytes):
+ 38 d8 13 07 88 ff ff ff 00 d0 9e 85 c0 ff ff ff  8...............
+ 00 10 00 88 c0 ff ff ff 00 f0 ff f7 ff 00 00 00  ................
+ backtrace (crc 1dbf6e00):
+ [<ffffffc08107381c>] kmemleak_alloc+0xbc/0xd8
+ [<ffffffc0802f9798>] kmalloc_trace_noprof+0x220/0x2e8
+ [<ffffffc07bb71948>] tmc_alloc_sg_table+0x48/0x208 [coresight_tmc]
+ [<ffffffc07bb71cbc>] tmc_etr_alloc_sg_buf+0xac/0x240 [coresight_tmc]
+ [<ffffffc07bb72538>] tmc_alloc_etr_buf.constprop.0+0x1f0/0x260 [coresight_tmc]
+ [<ffffffc07bb7280c>] alloc_etr_buf.constprop.0.isra.0+0x74/0xa8 [coresight_tmc]
+ [<ffffffc07bb72950>] tmc_alloc_etr_buffer+0x110/0x260 [coresight_tmc]
+ [<ffffffc07bb38afc>] etm_setup_aux+0x204/0x3b0 [coresight]
+ [<ffffffc08025837c>] rb_alloc_aux+0x20c/0x318
+ [<ffffffc08024dd84>] perf_mmap+0x2e4/0x7a0
+ [<ffffffc0802cceb0>] mmap_region+0x3b0/0xa08
+ [<ffffffc0802cd8a8>] do_mmap+0x3a0/0x500
+ [<ffffffc080295328>] vm_mmap_pgoff+0x100/0x1d0
+ [<ffffffc0802cadf8>] ksys_mmap_pgoff+0xb8/0x110
+ [<ffffffc080020688>] __arm64_sys_mmap+0x38/0x58
+ [<ffffffc080028fc0>] invoke_syscall.constprop.0+0x58/0x100
+
+This due to the fact that we do not free the "sg_table" itself while
+freeing up  the SG table and data pages. Fix this by freeing the sg_table
+in tmc_free_sg_table().
+
+Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: James Clark <james.clark@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Link: https://lore.kernel.org/r/20240702132846.1677261-1-suzuki.poulose@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index c88a6afb29512..74e8b7632305a 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -255,6 +255,7 @@ void tmc_free_sg_table(struct tmc_sg_table *sg_table)
+ {
+ 	tmc_free_table_pages(sg_table);
+ 	tmc_free_data_pages(sg_table);
++	kfree(sg_table);
+ }
+ EXPORT_SYMBOL_GPL(tmc_free_sg_table);
+ 
+@@ -336,7 +337,6 @@ struct tmc_sg_table *tmc_alloc_sg_table(struct device *dev,
+ 		rc = tmc_alloc_table_pages(sg_table);
+ 	if (rc) {
+ 		tmc_free_sg_table(sg_table);
+-		kfree(sg_table);
+ 		return ERR_PTR(rc);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/cpufreq-ti-cpufreq-introduce-quirks-to-handle-syscon.patch b/queue-6.1/cpufreq-ti-cpufreq-introduce-quirks-to-handle-syscon.patch
new file mode 100644
index 00000000000..defbb5147c6
--- /dev/null
+++ b/queue-6.1/cpufreq-ti-cpufreq-introduce-quirks-to-handle-syscon.patch
@@ -0,0 +1,89 @@
+From 30c87f28f459247cbbcd5bc90bf9de7f6b6bf5fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 08:19:15 -0500
+Subject: cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails
+ appropriately
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit abc00ffda43bd4ba85896713464c7510c39f8165 ]
+
+Commit b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx
+and omap36xx") introduced special handling for OMAP3 class devices
+where syscon node may not be present. However, this also creates a bug
+where the syscon node is present, however the offset used to read
+is beyond the syscon defined range.
+
+Fix this by providing a quirk option that is populated when such
+special handling is required. This allows proper failure for all other
+platforms when the syscon node and efuse offsets are mismatched.
+
+Fixes: b4bc9f9e27ed ("cpufreq: ti-cpufreq: add support for omap34xx and omap36xx")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Tested-by: Dhruva Gole <d-gole@ti.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/ti-cpufreq.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index 15e2ef8303508..9e3c7478fc204 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -53,6 +53,9 @@ struct ti_cpufreq_soc_data {
+ 	unsigned long efuse_shift;
+ 	unsigned long rev_offset;
+ 	bool multi_regulator;
++/* Backward compatibility hack: Might have missing syscon */
++#define TI_QUIRK_SYSCON_MAY_BE_MISSING	0x1
++	u8 quirks;
+ };
+ 
+ struct ti_cpufreq_data {
+@@ -155,6 +158,7 @@ static struct ti_cpufreq_soc_data omap34xx_soc_data = {
+ 	.efuse_mask = BIT(3),
+ 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
+ 	.multi_regulator = false,
++	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
+ };
+ 
+ /*
+@@ -182,6 +186,7 @@ static struct ti_cpufreq_soc_data omap36xx_soc_data = {
+ 	.efuse_mask = BIT(9),
+ 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
+ 	.multi_regulator = true,
++	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
+ };
+ 
+ /*
+@@ -196,6 +201,7 @@ static struct ti_cpufreq_soc_data am3517_soc_data = {
+ 	.efuse_mask = 0,
+ 	.rev_offset = OMAP3_CONTROL_IDCODE - OMAP3_SYSCON_BASE,
+ 	.multi_regulator = false,
++	.quirks = TI_QUIRK_SYSCON_MAY_BE_MISSING,
+ };
+ 
+ 
+@@ -215,7 +221,7 @@ static int ti_cpufreq_get_efuse(struct ti_cpufreq_data *opp_data,
+ 
+ 	ret = regmap_read(opp_data->syscon, opp_data->soc_data->efuse_offset,
+ 			  &efuse);
+-	if (ret == -EIO) {
++	if (opp_data->soc_data->quirks & TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO) {
+ 		/* not a syscon register! */
+ 		void __iomem *regs = ioremap(OMAP3_SYSCON_BASE +
+ 				opp_data->soc_data->efuse_offset, 4);
+@@ -256,7 +262,7 @@ static int ti_cpufreq_get_rev(struct ti_cpufreq_data *opp_data,
+ 
+ 	ret = regmap_read(opp_data->syscon, opp_data->soc_data->rev_offset,
+ 			  &revision);
+-	if (ret == -EIO) {
++	if (opp_data->soc_data->quirks & TI_QUIRK_SYSCON_MAY_BE_MISSING && ret == -EIO) {
+ 		/* not a syscon register! */
+ 		void __iomem *regs = ioremap(OMAP3_SYSCON_BASE +
+ 				opp_data->soc_data->rev_offset, 4);
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-hpre-enable-sva-error-interrupt-eve.patch b/queue-6.1/crypto-hisilicon-hpre-enable-sva-error-interrupt-eve.patch
new file mode 100644
index 00000000000..bba50324a9b
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-hpre-enable-sva-error-interrupt-eve.patch
@@ -0,0 +1,47 @@
+From 33748603dce1215c49dc3d969cfbdcee18a17bcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jul 2023 19:41:38 +0800
+Subject: crypto: hisilicon/hpre - enable sva error interrupt event
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 391dde6e48ff84687395a0a4e84f7e1540301e4e ]
+
+Enable sva error interrupt event. When an error occurs on
+the sva module, the device reports an abnormal interrupt to
+the driver.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 145013f72394 ("crypto: hisilicon/hpre - mask cluster timeout error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 269df4ec148ba..19a36facabcc4 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -203,7 +203,7 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = {
+ 	{HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37},
+ 	{HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37},
+ 	{HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8},
+-	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xFFFFFE},
++	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE},
+ 	{HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE},
+ 	{HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE},
+ 	{HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1},
+@@ -283,6 +283,9 @@ static const struct hpre_hw_error hpre_hw_errors[] = {
+ 	}, {
+ 		.int_msk = BIT(23),
+ 		.msg = "sva_fsm_timeout_int_set"
++	}, {
++		.int_msk = BIT(24),
++		.msg = "sva_int_set"
+ 	}, {
+ 		/* sentinel */
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-hpre-mask-cluster-timeout-error.patch b/queue-6.1/crypto-hisilicon-hpre-mask-cluster-timeout-error.patch
new file mode 100644
index 00000000000..9a049bc4b24
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-hpre-mask-cluster-timeout-error.patch
@@ -0,0 +1,115 @@
+From fa4d1ea15ef2de40a6176b5ec8b4ea67d16b0437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2024 19:48:30 +0800
+Subject: crypto: hisilicon/hpre - mask cluster timeout error
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 145013f723947c83b1a5f76a0cf6e7237d59e973 ]
+
+The timeout threshold of the hpre cluster is 16ms. When the CPU
+and device share virtual address, page fault processing time may
+exceed the threshold.
+
+In the current test, there is a high probability that the
+cluster times out. However, the cluster is waiting for the
+completion of memory access, which is not an error, the device
+does not need to be reset. If an error occurs in the cluster,
+qm also reports the error. Therefore, the cluster timeout
+error of hpre can be masked.
+
+Fixes: d90fab0deb8e ("crypto: hisilicon/qm - get error type from hardware registers")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 22 ++++++----------------
+ 1 file changed, 6 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 19a36facabcc4..ed5bb2d7292a0 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -14,9 +14,7 @@
+ #include <linux/uacce.h>
+ #include "hpre.h"
+ 
+-#define HPRE_QM_ABNML_INT_MASK		0x100004
+ #define HPRE_CTRL_CNT_CLR_CE_BIT	BIT(0)
+-#define HPRE_COMM_CNT_CLR_CE		0x0
+ #define HPRE_CTRL_CNT_CLR_CE		0x301000
+ #define HPRE_FSM_MAX_CNT		0x301008
+ #define HPRE_VFG_AXQOS			0x30100c
+@@ -43,7 +41,6 @@
+ #define HPRE_HAC_INT_SET		0x301500
+ #define HPRE_RNG_TIMEOUT_NUM		0x301A34
+ #define HPRE_CORE_INT_ENABLE		0
+-#define HPRE_CORE_INT_DISABLE		GENMASK(21, 0)
+ #define HPRE_RDCHN_INI_ST		0x301a00
+ #define HPRE_CLSTR_BASE			0x302000
+ #define HPRE_CORE_EN_OFFSET		0x04
+@@ -67,7 +64,6 @@
+ #define HPRE_CLSTR_ADDR_INTRVL		0x1000
+ #define HPRE_CLUSTER_INQURY		0x100
+ #define HPRE_CLSTR_ADDR_INQRY_RSLT	0x104
+-#define HPRE_TIMEOUT_ABNML_BIT		6
+ #define HPRE_PASID_EN_BIT		9
+ #define HPRE_REG_RD_INTVRL_US		10
+ #define HPRE_REG_RD_TMOUT_US		1000
+@@ -203,9 +199,9 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = {
+ 	{HPRE_QM_RESET_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0xC37, 0x6C37},
+ 	{HPRE_QM_OOO_SHUTDOWN_MASK_CAP, 0x3128, 0, GENMASK(31, 0), 0x0, 0x4, 0x6C37},
+ 	{HPRE_QM_CE_MASK_CAP, 0x312C, 0, GENMASK(31, 0), 0x0, 0x8, 0x8},
+-	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFFFE},
+-	{HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFFFE},
+-	{HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFFFE},
++	{HPRE_NFE_MASK_CAP, 0x3130, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0x1FFFC3E},
++	{HPRE_RESET_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x3FFFFE, 0xBFFC3E},
++	{HPRE_OOO_SHUTDOWN_MASK_CAP, 0x3134, 0, GENMASK(31, 0), 0x0, 0x22, 0xBFFC3E},
+ 	{HPRE_CE_MASK_CAP, 0x3138, 0, GENMASK(31, 0), 0x0, 0x1, 0x1},
+ 	{HPRE_CLUSTER_NUM_CAP, 0x313c, 20, GENMASK(3, 0), 0x0,  0x4, 0x1},
+ 	{HPRE_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x0, 0x2, 0x2},
+@@ -654,11 +650,6 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+ 	writel(HPRE_QM_USR_CFG_MASK, qm->io_base + QM_AWUSER_M_CFG_ENABLE);
+ 	writel_relaxed(HPRE_QM_AXI_CFG_MASK, qm->io_base + QM_AXI_M_CFG);
+ 
+-	/* HPRE need more time, we close this interrupt */
+-	val = readl_relaxed(qm->io_base + HPRE_QM_ABNML_INT_MASK);
+-	val |= BIT(HPRE_TIMEOUT_ABNML_BIT);
+-	writel_relaxed(val, qm->io_base + HPRE_QM_ABNML_INT_MASK);
+-
+ 	if (qm->ver >= QM_HW_V3)
+ 		writel(HPRE_RSA_ENB | HPRE_ECC_ENB,
+ 			qm->io_base + HPRE_TYPES_ENB);
+@@ -667,9 +658,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+ 
+ 	writel(HPRE_QM_VFG_AX_MASK, qm->io_base + HPRE_VFG_AXCACHE);
+ 	writel(0x0, qm->io_base + HPRE_BD_ENDIAN);
+-	writel(0x0, qm->io_base + HPRE_INT_MASK);
+ 	writel(0x0, qm->io_base + HPRE_POISON_BYPASS);
+-	writel(0x0, qm->io_base + HPRE_COMM_CNT_CLR_CE);
+ 	writel(0x0, qm->io_base + HPRE_ECC_BYPASS);
+ 
+ 	writel(HPRE_BD_USR_MASK, qm->io_base + HPRE_BD_ARUSR_CFG);
+@@ -759,7 +748,7 @@ static void hpre_hw_error_disable(struct hisi_qm *qm)
+ 
+ static void hpre_hw_error_enable(struct hisi_qm *qm)
+ {
+-	u32 ce, nfe;
++	u32 ce, nfe, err_en;
+ 
+ 	ce = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CE_MASK_CAP, qm->cap_ver);
+ 	nfe = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
+@@ -776,7 +765,8 @@ static void hpre_hw_error_enable(struct hisi_qm *qm)
+ 	hpre_master_ooo_ctrl(qm, true);
+ 
+ 	/* enable hpre hw error interrupts */
+-	writel(HPRE_CORE_INT_ENABLE, qm->io_base + HPRE_INT_MASK);
++	err_en = ce | nfe | HPRE_HAC_RAS_FE_ENABLE;
++	writel(~err_en, qm->io_base + HPRE_INT_MASK);
+ }
+ 
+ static inline struct hisi_qm *hpre_file_to_qm(struct hpre_debugfs_file *file)
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-qm-fix-coding-style-issues.patch b/queue-6.1/crypto-hisilicon-qm-fix-coding-style-issues.patch
new file mode 100644
index 00000000000..f7c260a7ce1
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-qm-fix-coding-style-issues.patch
@@ -0,0 +1,142 @@
+From de5c9d1506d839181c2c034594c5010731c8d05d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 20:36:17 +0800
+Subject: crypto: hisilicon/qm - fix coding style issues
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit ced18fd1794787d57acff1a4d1b2816d5ec99fbc ]
+
+1. Remove extra blank lines.
+2. Remove extra spaces.
+3. Use spaces instead of tabs around '=' and '\',
+to ensure consistent coding styles.
+4. Macros should be capital letters, change 'QM_SQC_VFT_NUM_MASK_v2'
+to 'QM_SQC_VFT_NUM_MASK_V2'.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c  | 29 ++++++++++++-----------------
+ drivers/crypto/hisilicon/sgl.c |  1 -
+ 2 files changed, 12 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 5539be1bfb402..8b85cb5ab6f89 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -118,7 +118,7 @@
+ #define QM_SQC_VFT_BASE_SHIFT_V2	28
+ #define QM_SQC_VFT_BASE_MASK_V2		GENMASK(15, 0)
+ #define QM_SQC_VFT_NUM_SHIFT_V2		45
+-#define QM_SQC_VFT_NUM_MASK_v2		GENMASK(9, 0)
++#define QM_SQC_VFT_NUM_MASK_V2		GENMASK(9, 0)
+ 
+ #define QM_ABNORMAL_INT_SOURCE		0x100000
+ #define QM_ABNORMAL_INT_MASK		0x100004
+@@ -240,23 +240,23 @@
+ #define QM_DEV_ALG_MAX_LEN		256
+ 
+ #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \
+-	(((hop_num) << QM_CQ_HOP_NUM_SHIFT)	| \
+-	((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT)	| \
+-	((buf_sz) << QM_CQ_BUF_SIZE_SHIFT)	| \
++	(((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \
++	((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \
++	((buf_sz) << QM_CQ_BUF_SIZE_SHIFT) | \
+ 	((cqe_sz) << QM_CQ_CQE_SIZE_SHIFT))
+ 
+ #define QM_MK_CQC_DW3_V2(cqe_sz, cq_depth) \
+ 	((((u32)cq_depth) - 1) | ((cqe_sz) << QM_CQ_CQE_SIZE_SHIFT))
+ 
+ #define QM_MK_SQC_W13(priority, orders, alg_type) \
+-	(((priority) << QM_SQ_PRIORITY_SHIFT)	| \
+-	((orders) << QM_SQ_ORDERS_SHIFT)	| \
++	(((priority) << QM_SQ_PRIORITY_SHIFT) | \
++	((orders) << QM_SQ_ORDERS_SHIFT) | \
+ 	(((alg_type) & QM_SQ_TYPE_MASK) << QM_SQ_TYPE_SHIFT))
+ 
+ #define QM_MK_SQC_DW3_V1(hop_num, pg_sz, buf_sz, sqe_sz) \
+-	(((hop_num) << QM_SQ_HOP_NUM_SHIFT)	| \
+-	((pg_sz) << QM_SQ_PAGE_SIZE_SHIFT)	| \
+-	((buf_sz) << QM_SQ_BUF_SIZE_SHIFT)	| \
++	(((hop_num) << QM_SQ_HOP_NUM_SHIFT) | \
++	((pg_sz) << QM_SQ_PAGE_SIZE_SHIFT) | \
++	((buf_sz) << QM_SQ_BUF_SIZE_SHIFT) | \
+ 	((u32)ilog2(sqe_sz) << QM_SQ_SQE_SIZE_SHIFT))
+ 
+ #define QM_MK_SQC_DW3_V2(sqe_sz, sq_depth) \
+@@ -720,7 +720,7 @@ static void qm_db_v2(struct hisi_qm *qm, u16 qn, u8 cmd, u16 index, u8 priority)
+ 
+ 	doorbell = qn | ((u64)cmd << QM_DB_CMD_SHIFT_V2) |
+ 		   ((u64)randata << QM_DB_RAND_SHIFT_V2) |
+-		   ((u64)index << QM_DB_INDEX_SHIFT_V2)	 |
++		   ((u64)index << QM_DB_INDEX_SHIFT_V2) |
+ 		   ((u64)priority << QM_DB_PRIORITY_SHIFT_V2);
+ 
+ 	writeq(doorbell, io_base);
+@@ -1354,7 +1354,7 @@ static int qm_get_vft_v2(struct hisi_qm *qm, u32 *base, u32 *number)
+ 	sqc_vft = readl(qm->io_base + QM_MB_CMD_DATA_ADDR_L) |
+ 		  ((u64)readl(qm->io_base + QM_MB_CMD_DATA_ADDR_H) << 32);
+ 	*base = QM_SQC_VFT_BASE_MASK_V2 & (sqc_vft >> QM_SQC_VFT_BASE_SHIFT_V2);
+-	*number = (QM_SQC_VFT_NUM_MASK_v2 &
++	*number = (QM_SQC_VFT_NUM_MASK_V2 &
+ 		   (sqc_vft >> QM_SQC_VFT_NUM_SHIFT_V2)) + 1;
+ 
+ 	return 0;
+@@ -3123,7 +3123,6 @@ static int qm_stop_started_qp(struct hisi_qm *qm)
+ 	return 0;
+ }
+ 
+-
+ /**
+  * qm_clear_queues() - Clear all queues memory in a qm.
+  * @qm: The qm in which the queues will be cleared.
+@@ -3609,7 +3608,7 @@ static ssize_t qm_algqos_read(struct file *filp, char __user *buf,
+ 	qos_val = ir / QM_QOS_RATE;
+ 	ret = scnprintf(tbuf, QM_DBG_READ_LEN, "%u\n", qos_val);
+ 
+-	ret =  simple_read_from_buffer(buf, count, pos, tbuf, ret);
++	ret = simple_read_from_buffer(buf, count, pos, tbuf, ret);
+ 
+ err_get_status:
+ 	clear_bit(QM_RESETTING, &qm->misc_ctl);
+@@ -4116,13 +4115,10 @@ static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+ 	if (!qm->err_status.is_dev_ecc_mbit &&
+ 	    qm->err_status.is_qm_ecc_mbit &&
+ 	    qm->err_ini->close_axi_master_ooo) {
+-
+ 		qm->err_ini->close_axi_master_ooo(qm);
+-
+ 	} else if (qm->err_status.is_dev_ecc_mbit &&
+ 		   !qm->err_status.is_qm_ecc_mbit &&
+ 		   !qm->err_ini->close_axi_master_ooo) {
+-
+ 		nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE);
+ 		writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE,
+ 		       qm->io_base + QM_RAS_NFE_ENABLE);
+@@ -4566,7 +4562,6 @@ static irqreturn_t qm_abnormal_irq(int irq, void *data)
+ 	return IRQ_HANDLED;
+ }
+ 
+-
+ /**
+  * hisi_qm_dev_shutdown() - Shutdown device.
+  * @pdev: The device will be shutdown.
+diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c
+index 0974b00414050..09586a837b1e8 100644
+--- a/drivers/crypto/hisilicon/sgl.c
++++ b/drivers/crypto/hisilicon/sgl.c
+@@ -249,7 +249,6 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev,
+ 		dev_err(dev, "Get SGL error!\n");
+ 		dma_unmap_sg(dev, sgl, sg_n, DMA_BIDIRECTIONAL);
+ 		return ERR_PTR(-ENOMEM);
+-
+ 	}
+ 	curr_hw_sgl->entry_length_in_sgl = cpu_to_le16(pool->sge_nr);
+ 	curr_hw_sge = curr_hw_sgl->sge_entries;
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-qm-inject-error-before-stopping-que.patch b/queue-6.1/crypto-hisilicon-qm-inject-error-before-stopping-que.patch
new file mode 100644
index 00000000000..877ac8b504d
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-qm-inject-error-before-stopping-que.patch
@@ -0,0 +1,108 @@
+From 6edc65d47bf4179f78e83b1ffbe8e755c649d7d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2024 19:48:31 +0800
+Subject: crypto: hisilicon/qm - inject error before stopping queue
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit b04f06fc0243600665b3b50253869533b7938468 ]
+
+The master ooo cannot be completely closed when the
+accelerator core reports memory error. Therefore, the driver
+needs to inject the qm error to close the master ooo. Currently,
+the qm error is injected after stopping queue, memory may be
+released immediately after stopping queue, causing the device to
+access the released memory. Therefore, error is injected to close master
+ooo before stopping queue to ensure that the device does not access
+the released memory.
+
+Fixes: 6c6dd5802c2d ("crypto: hisilicon/qm - add controller reset interface")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 47 ++++++++++++++++++-----------------
+ 1 file changed, 24 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 83ec28f9515ea..df14727f6e714 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4017,6 +4017,28 @@ static int qm_set_vf_mse(struct hisi_qm *qm, bool set)
+ 	return -ETIMEDOUT;
+ }
+ 
++static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
++{
++	u32 nfe_enb = 0;
++
++	/* Kunpeng930 hardware automatically close master ooo when NFE occurs */
++	if (qm->ver >= QM_HW_V3)
++		return;
++
++	if (!qm->err_status.is_dev_ecc_mbit &&
++	    qm->err_status.is_qm_ecc_mbit &&
++	    qm->err_ini->close_axi_master_ooo) {
++		qm->err_ini->close_axi_master_ooo(qm);
++	} else if (qm->err_status.is_dev_ecc_mbit &&
++		   !qm->err_status.is_qm_ecc_mbit &&
++		   !qm->err_ini->close_axi_master_ooo) {
++		nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE);
++		writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE,
++		       qm->io_base + QM_RAS_NFE_ENABLE);
++		writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET);
++	}
++}
++
+ static int qm_vf_reset_prepare(struct hisi_qm *qm,
+ 			       enum qm_stop_reason stop_reason)
+ {
+@@ -4081,6 +4103,8 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm)
+ 		return ret;
+ 	}
+ 
++	qm_dev_ecc_mbit_handle(qm);
++
+ 	/* PF obtains the information of VF by querying the register. */
+ 	qm_cmd_uninit(qm);
+ 
+@@ -4121,28 +4145,6 @@ static int qm_master_ooo_check(struct hisi_qm *qm)
+ 	return ret;
+ }
+ 
+-static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+-{
+-	u32 nfe_enb = 0;
+-
+-	/* Kunpeng930 hardware automatically close master ooo when NFE occurs */
+-	if (qm->ver >= QM_HW_V3)
+-		return;
+-
+-	if (!qm->err_status.is_dev_ecc_mbit &&
+-	    qm->err_status.is_qm_ecc_mbit &&
+-	    qm->err_ini->close_axi_master_ooo) {
+-		qm->err_ini->close_axi_master_ooo(qm);
+-	} else if (qm->err_status.is_dev_ecc_mbit &&
+-		   !qm->err_status.is_qm_ecc_mbit &&
+-		   !qm->err_ini->close_axi_master_ooo) {
+-		nfe_enb = readl(qm->io_base + QM_RAS_NFE_ENABLE);
+-		writel(nfe_enb & QM_RAS_NFE_MBIT_DISABLE,
+-		       qm->io_base + QM_RAS_NFE_ENABLE);
+-		writel(QM_ECC_MBIT, qm->io_base + QM_ABNORMAL_INT_SET);
+-	}
+-}
+-
+ static int qm_soft_reset_prepare(struct hisi_qm *qm)
+ {
+ 	struct pci_dev *pdev = qm->pdev;
+@@ -4167,7 +4169,6 @@ static int qm_soft_reset_prepare(struct hisi_qm *qm)
+ 		return ret;
+ 	}
+ 
+-	qm_dev_ecc_mbit_handle(qm);
+ 	ret = qm_master_ooo_check(qm);
+ 	if (ret)
+ 		return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-hisilicon-qm-reset-device-before-enabling-it.patch b/queue-6.1/crypto-hisilicon-qm-reset-device-before-enabling-it.patch
new file mode 100644
index 00000000000..c6d566203eb
--- /dev/null
+++ b/queue-6.1/crypto-hisilicon-qm-reset-device-before-enabling-it.patch
@@ -0,0 +1,434 @@
+From 41398449790c00396b82354baee2604490fbe6de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2024 19:48:29 +0800
+Subject: crypto: hisilicon/qm - reset device before enabling it
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 5d2d1ee0874c26b8010ddf7f57e2f246e848af38 ]
+
+Before the device is enabled again, the device may still
+store the previously processed data. If an error occurs in
+the previous task, the device may fail to be enabled again.
+Therefore, before enabling device, reset the device to restore
+the initial state.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: b04f06fc0243 ("crypto: hisilicon/qm - inject error before stopping queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c |  32 +++---
+ drivers/crypto/hisilicon/qm.c             | 114 +++++++++++++++-------
+ drivers/crypto/hisilicon/sec2/sec_main.c  |  16 ++-
+ drivers/crypto/hisilicon/zip/zip_main.c   |  23 +++--
+ 4 files changed, 121 insertions(+), 64 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index ed5bb2d7292a0..e9abb66773fe9 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -354,6 +354,8 @@ static struct dfx_diff_registers hpre_diff_regs[] = {
+ 	},
+ };
+ 
++static const struct hisi_qm_err_ini hpre_err_ini;
++
+ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
+ {
+ 	u32 cap_val;
+@@ -1152,6 +1154,7 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		qm->qp_num = pf_q_num;
+ 		qm->debug.curr_qm_qp_num = pf_q_num;
+ 		qm->qm_list = &hpre_devices;
++		qm->err_ini = &hpre_err_ini;
+ 		if (pf_q_num_flag)
+ 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ 	}
+@@ -1341,8 +1344,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ 
+ 	hpre_open_sva_prefetch(qm);
+ 
+-	qm->err_ini = &hpre_err_ini;
+-	qm->err_ini->err_info_init(qm);
+ 	hisi_qm_dev_err_init(qm);
+ 	ret = hpre_show_last_regs_init(qm);
+ 	if (ret)
+@@ -1371,6 +1372,18 @@ static int hpre_probe_init(struct hpre *hpre)
+ 	return 0;
+ }
+ 
++static void hpre_probe_uninit(struct hisi_qm *qm)
++{
++	if (qm->fun_type == QM_HW_VF)
++		return;
++
++	hpre_cnt_regs_clear(qm);
++	qm->debug.curr_qm_qp_num = 0;
++	hpre_show_last_regs_uninit(qm);
++	hpre_close_sva_prefetch(qm);
++	hisi_qm_dev_err_uninit(qm);
++}
++
+ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ 	struct hisi_qm *qm;
+@@ -1396,7 +1409,7 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	ret = hisi_qm_start(qm);
+ 	if (ret)
+-		goto err_with_err_init;
++		goto err_with_probe_init;
+ 
+ 	ret = hpre_debugfs_init(qm);
+ 	if (ret)
+@@ -1433,9 +1446,8 @@ static int hpre_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	hpre_debugfs_exit(qm);
+ 	hisi_qm_stop(qm, QM_NORMAL);
+ 
+-err_with_err_init:
+-	hpre_show_last_regs_uninit(qm);
+-	hisi_qm_dev_err_uninit(qm);
++err_with_probe_init:
++	hpre_probe_uninit(qm);
+ 
+ err_with_qm_init:
+ 	hisi_qm_uninit(qm);
+@@ -1456,13 +1468,7 @@ static void hpre_remove(struct pci_dev *pdev)
+ 	hpre_debugfs_exit(qm);
+ 	hisi_qm_stop(qm, QM_NORMAL);
+ 
+-	if (qm->fun_type == QM_HW_PF) {
+-		hpre_cnt_regs_clear(qm);
+-		qm->debug.curr_qm_qp_num = 0;
+-		hpre_show_last_regs_uninit(qm);
+-		hisi_qm_dev_err_uninit(qm);
+-	}
+-
++	hpre_probe_uninit(qm);
+ 	hisi_qm_uninit(qm);
+ }
+ 
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 8b85cb5ab6f89..83ec28f9515ea 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -454,6 +454,7 @@ static struct qm_typical_qos_table shaper_cbs_s[] = {
+ };
+ 
+ static void qm_irqs_unregister(struct hisi_qm *qm);
++static int qm_reset_device(struct hisi_qm *qm);
+ 
+ static bool qm_avail_state(struct hisi_qm *qm, enum qm_state new)
+ {
+@@ -4104,6 +4105,22 @@ static int qm_controller_reset_prepare(struct hisi_qm *qm)
+ 	return 0;
+ }
+ 
++static int qm_master_ooo_check(struct hisi_qm *qm)
++{
++	u32 val;
++	int ret;
++
++	/* Check the ooo register of the device before resetting the device. */
++	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN, qm->io_base + ACC_MASTER_GLOBAL_CTRL);
++	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
++					 val, (val == ACC_MASTER_TRANS_RETURN_RW),
++					 POLL_PERIOD, POLL_TIMEOUT);
++	if (ret)
++		pci_warn(qm->pdev, "Bus lock! Please reset system.\n");
++
++	return ret;
++}
++
+ static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+ {
+ 	u32 nfe_enb = 0;
+@@ -4126,11 +4143,10 @@ static void qm_dev_ecc_mbit_handle(struct hisi_qm *qm)
+ 	}
+ }
+ 
+-static int qm_soft_reset(struct hisi_qm *qm)
++static int qm_soft_reset_prepare(struct hisi_qm *qm)
+ {
+ 	struct pci_dev *pdev = qm->pdev;
+ 	int ret;
+-	u32 val;
+ 
+ 	/* Ensure all doorbells and mailboxes received by QM */
+ 	ret = qm_check_req_recv(qm);
+@@ -4152,29 +4168,23 @@ static int qm_soft_reset(struct hisi_qm *qm)
+ 	}
+ 
+ 	qm_dev_ecc_mbit_handle(qm);
+-
+-	/* OOO register set and check */
+-	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN,
+-	       qm->io_base + ACC_MASTER_GLOBAL_CTRL);
+-
+-	/* If bus lock, reset chip */
+-	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
+-					 val,
+-					 (val == ACC_MASTER_TRANS_RETURN_RW),
+-					 POLL_PERIOD, POLL_TIMEOUT);
+-	if (ret) {
+-		pci_emerg(pdev, "Bus lock! Please reset system.\n");
++	ret = qm_master_ooo_check(qm);
++	if (ret)
+ 		return ret;
+-	}
+ 
+ 	if (qm->err_ini->close_sva_prefetch)
+ 		qm->err_ini->close_sva_prefetch(qm);
+ 
+ 	ret = qm_set_pf_mse(qm, false);
+-	if (ret) {
++	if (ret)
+ 		pci_err(pdev, "Fails to disable pf MSE bit.\n");
+-		return ret;
+-	}
++
++	return ret;
++}
++
++static int qm_reset_device(struct hisi_qm *qm)
++{
++	struct pci_dev *pdev = qm->pdev;
+ 
+ 	/* The reset related sub-control registers are not in PCI BAR */
+ 	if (ACPI_HANDLE(&pdev->dev)) {
+@@ -4193,12 +4203,23 @@ static int qm_soft_reset(struct hisi_qm *qm)
+ 			pci_err(pdev, "Reset step %llu failed!\n", value);
+ 			return -EIO;
+ 		}
+-	} else {
+-		pci_err(pdev, "No reset method!\n");
+-		return -EINVAL;
++
++		return 0;
+ 	}
+ 
+-	return 0;
++	pci_err(pdev, "No reset method!\n");
++	return -EINVAL;
++}
++
++static int qm_soft_reset(struct hisi_qm *qm)
++{
++	int ret;
++
++	ret = qm_soft_reset_prepare(qm);
++	if (ret)
++		return ret;
++
++	return qm_reset_device(qm);
+ }
+ 
+ static int qm_vf_reset_done(struct hisi_qm *qm)
+@@ -5160,6 +5181,35 @@ static int qm_get_pci_res(struct hisi_qm *qm)
+ 	return ret;
+ }
+ 
++static int qm_clear_device(struct hisi_qm *qm)
++{
++	acpi_handle handle = ACPI_HANDLE(&qm->pdev->dev);
++	int ret;
++
++	if (qm->fun_type == QM_HW_VF)
++		return 0;
++
++	/* Device does not support reset, return */
++	if (!qm->err_ini->err_info_init)
++		return 0;
++	qm->err_ini->err_info_init(qm);
++
++	if (!handle)
++		return 0;
++
++	/* No reset method, return */
++	if (!acpi_has_method(handle, qm->err_info.acpi_rst))
++		return 0;
++
++	ret = qm_master_ooo_check(qm);
++	if (ret) {
++		writel(0x0, qm->io_base + ACC_MASTER_GLOBAL_CTRL);
++		return ret;
++	}
++
++	return qm_reset_device(qm);
++}
++
+ static int hisi_qm_pci_init(struct hisi_qm *qm)
+ {
+ 	struct pci_dev *pdev = qm->pdev;
+@@ -5189,8 +5239,14 @@ static int hisi_qm_pci_init(struct hisi_qm *qm)
+ 		goto err_get_pci_res;
+ 	}
+ 
++	ret = qm_clear_device(qm);
++	if (ret)
++		goto err_free_vectors;
++
+ 	return 0;
+ 
++err_free_vectors:
++	pci_free_irq_vectors(pdev);
+ err_get_pci_res:
+ 	qm_put_pci_res(qm);
+ err_disable_pcidev:
+@@ -5457,7 +5513,6 @@ static int qm_prepare_for_suspend(struct hisi_qm *qm)
+ {
+ 	struct pci_dev *pdev = qm->pdev;
+ 	int ret;
+-	u32 val;
+ 
+ 	ret = qm->ops->set_msi(qm, false);
+ 	if (ret) {
+@@ -5465,18 +5520,9 @@ static int qm_prepare_for_suspend(struct hisi_qm *qm)
+ 		return ret;
+ 	}
+ 
+-	/* shutdown OOO register */
+-	writel(ACC_MASTER_GLOBAL_CTRL_SHUTDOWN,
+-	       qm->io_base + ACC_MASTER_GLOBAL_CTRL);
+-
+-	ret = readl_relaxed_poll_timeout(qm->io_base + ACC_MASTER_TRANS_RETURN,
+-					 val,
+-					 (val == ACC_MASTER_TRANS_RETURN_RW),
+-					 POLL_PERIOD, POLL_TIMEOUT);
+-	if (ret) {
+-		pci_emerg(pdev, "Bus lock! Please reset system.\n");
++	ret = qm_master_ooo_check(qm);
++	if (ret)
+ 		return ret;
+-	}
+ 
+ 	ret = qm_set_pf_mse(qm, false);
+ 	if (ret)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 4bab5000a13e5..d2ead648767bd 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -1063,9 +1063,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ 	struct hisi_qm *qm = &sec->qm;
+ 	int ret;
+ 
+-	qm->err_ini = &sec_err_ini;
+-	qm->err_ini->err_info_init(qm);
+-
+ 	ret = sec_set_user_domain_and_cache(qm);
+ 	if (ret)
+ 		return ret;
+@@ -1120,6 +1117,7 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		qm->qp_num = pf_q_num;
+ 		qm->debug.curr_qm_qp_num = pf_q_num;
+ 		qm->qm_list = &sec_devices;
++		qm->err_ini = &sec_err_ini;
+ 		if (pf_q_num_flag)
+ 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ 	} else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
+@@ -1184,6 +1182,12 @@ static int sec_probe_init(struct sec_dev *sec)
+ 
+ static void sec_probe_uninit(struct hisi_qm *qm)
+ {
++	if (qm->fun_type == QM_HW_VF)
++		return;
++
++	sec_debug_regs_clear(qm);
++	sec_show_last_regs_uninit(qm);
++	sec_close_sva_prefetch(qm);
+ 	hisi_qm_dev_err_uninit(qm);
+ }
+ 
+@@ -1276,7 +1280,6 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	sec_debugfs_exit(qm);
+ 	hisi_qm_stop(qm, QM_NORMAL);
+ err_probe_uninit:
+-	sec_show_last_regs_uninit(qm);
+ 	sec_probe_uninit(qm);
+ err_qm_uninit:
+ 	sec_qm_uninit(qm);
+@@ -1298,11 +1301,6 @@ static void sec_remove(struct pci_dev *pdev)
+ 	sec_debugfs_exit(qm);
+ 
+ 	(void)hisi_qm_stop(qm, QM_NORMAL);
+-
+-	if (qm->fun_type == QM_HW_PF)
+-		sec_debug_regs_clear(qm);
+-	sec_show_last_regs_uninit(qm);
+-
+ 	sec_probe_uninit(qm);
+ 
+ 	sec_qm_uninit(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 9e3f5bca27dee..a8d5d105b3542 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -1151,8 +1151,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 
+ 	hisi_zip->ctrl = ctrl;
+ 	ctrl->hisi_zip = hisi_zip;
+-	qm->err_ini = &hisi_zip_err_ini;
+-	qm->err_ini->err_info_init(qm);
+ 
+ 	ret = hisi_zip_set_user_domain_and_cache(qm);
+ 	if (ret)
+@@ -1213,6 +1211,7 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		qm->qp_num = pf_q_num;
+ 		qm->debug.curr_qm_qp_num = pf_q_num;
+ 		qm->qm_list = &zip_devices;
++		qm->err_ini = &hisi_zip_err_ini;
+ 		if (pf_q_num_flag)
+ 			set_bit(QM_MODULE_PARAM, &qm->misc_ctl);
+ 	} else if (qm->fun_type == QM_HW_VF && qm->ver == QM_HW_V1) {
+@@ -1279,6 +1278,16 @@ static int hisi_zip_probe_init(struct hisi_zip *hisi_zip)
+ 	return 0;
+ }
+ 
++static void hisi_zip_probe_uninit(struct hisi_qm *qm)
++{
++	if (qm->fun_type == QM_HW_VF)
++		return;
++
++	hisi_zip_show_last_regs_uninit(qm);
++	hisi_zip_close_sva_prefetch(qm);
++	hisi_qm_dev_err_uninit(qm);
++}
++
+ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ 	struct hisi_zip *hisi_zip;
+@@ -1305,7 +1314,7 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	ret = hisi_qm_start(qm);
+ 	if (ret)
+-		goto err_dev_err_uninit;
++		goto err_probe_uninit;
+ 
+ 	ret = hisi_zip_debugfs_init(qm);
+ 	if (ret)
+@@ -1342,9 +1351,8 @@ static int hisi_zip_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	hisi_zip_debugfs_exit(qm);
+ 	hisi_qm_stop(qm, QM_NORMAL);
+ 
+-err_dev_err_uninit:
+-	hisi_zip_show_last_regs_uninit(qm);
+-	hisi_qm_dev_err_uninit(qm);
++err_probe_uninit:
++	hisi_zip_probe_uninit(qm);
+ 
+ err_qm_uninit:
+ 	hisi_zip_qm_uninit(qm);
+@@ -1365,8 +1373,7 @@ static void hisi_zip_remove(struct pci_dev *pdev)
+ 
+ 	hisi_zip_debugfs_exit(qm);
+ 	hisi_qm_stop(qm, QM_NORMAL);
+-	hisi_zip_show_last_regs_uninit(qm);
+-	hisi_qm_dev_err_uninit(qm);
++	hisi_zip_probe_uninit(qm);
+ 	hisi_zip_qm_uninit(qm);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-xor-fix-template-benchmarking.patch b/queue-6.1/crypto-xor-fix-template-benchmarking.patch
new file mode 100644
index 00000000000..25f8e32f079
--- /dev/null
+++ b/queue-6.1/crypto-xor-fix-template-benchmarking.patch
@@ -0,0 +1,105 @@
+From 45847b3ef8ea0a25aeb9b795fc1f997d92e81f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2024 14:24:52 +0200
+Subject: crypto: xor - fix template benchmarking
+
+From: Helge Deller <deller@kernel.org>
+
+[ Upstream commit ab9a244c396aae4aaa34b2399b82fc15ec2df8c1 ]
+
+Commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking")
+switched from using jiffies to ktime-based performance benchmarking.
+
+This works nicely on machines which have a fine-grained ktime()
+clocksource as e.g. x86 machines with TSC.
+But other machines, e.g. my 4-way HP PARISC server, don't have such
+fine-grained clocksources, which is why it seems that 800 xor loops
+take zero seconds, which then shows up in the logs as:
+
+ xor: measuring software checksum speed
+    8regs           : -1018167296 MB/sec
+    8regs_prefetch  : -1018167296 MB/sec
+    32regs          : -1018167296 MB/sec
+    32regs_prefetch : -1018167296 MB/sec
+
+Fix this with some small modifications to the existing code to improve
+the algorithm to always produce correct results without introducing
+major delays for architectures with a fine-grained ktime()
+clocksource:
+a) Delay start of the timing until ktime() just advanced. On machines
+with a fast ktime() this should be just one additional ktime() call.
+b) Count the number of loops. Run at minimum 800 loops and finish
+earliest when the ktime() counter has progressed.
+
+With that the throughput can now be calculated more accurately under all
+conditions.
+
+Fixes: c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Tested-by: John David Anglin <dave.anglin@bell.net>
+
+v2:
+- clean up coding style (noticed & suggested by Herbert Xu)
+- rephrased & fixed typo in commit message
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/xor.c | 31 ++++++++++++++-----------------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/xor.c b/crypto/xor.c
+index 8e72e5d5db0de..56aa3169e8717 100644
+--- a/crypto/xor.c
++++ b/crypto/xor.c
+@@ -83,33 +83,30 @@ static void __init
+ do_xor_speed(struct xor_block_template *tmpl, void *b1, void *b2)
+ {
+ 	int speed;
+-	int i, j;
+-	ktime_t min, start, diff;
++	unsigned long reps;
++	ktime_t min, start, t0;
+ 
+ 	tmpl->next = template_list;
+ 	template_list = tmpl;
+ 
+ 	preempt_disable();
+ 
+-	min = (ktime_t)S64_MAX;
+-	for (i = 0; i < 3; i++) {
+-		start = ktime_get();
+-		for (j = 0; j < REPS; j++) {
+-			mb(); /* prevent loop optimization */
+-			tmpl->do_2(BENCH_SIZE, b1, b2);
+-			mb();
+-		}
+-		diff = ktime_sub(ktime_get(), start);
+-		if (diff < min)
+-			min = diff;
+-	}
++	reps = 0;
++	t0 = ktime_get();
++	/* delay start until time has advanced */
++	while ((start = ktime_get()) == t0)
++		cpu_relax();
++	do {
++		mb(); /* prevent loop optimization */
++		tmpl->do_2(BENCH_SIZE, b1, b2);
++		mb();
++	} while (reps++ < REPS || (t0 = ktime_get()) == start);
++	min = ktime_sub(t0, start);
+ 
+ 	preempt_enable();
+ 
+ 	// bytes/ns == GB/s, multiply by 1000 to get MB/s [not MiB/s]
+-	if (!min)
+-		min = 1;
+-	speed = (1000 * REPS * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
++	speed = (1000 * reps * BENCH_SIZE) / (unsigned int)ktime_to_ns(min);
+ 	tmpl->speed = speed;
+ 
+ 	pr_info("   %-16s: %5d MB/sec\n", tmpl->name, speed);
+-- 
+2.43.0
+
diff --git a/queue-6.1/cxl-pci-break-out-range-register-decoding-from-cxl_h.patch b/queue-6.1/cxl-pci-break-out-range-register-decoding-from-cxl_h.patch
new file mode 100644
index 00000000000..c9f9acac05a
--- /dev/null
+++ b/queue-6.1/cxl-pci-break-out-range-register-decoding-from-cxl_h.patch
@@ -0,0 +1,162 @@
+From 4567a76dcc19efc4ce8e014b22c55939160cd865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 11:41:08 -0800
+Subject: cxl/pci: Break out range register decoding from cxl_hdm_decode_init()
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 1acba6e9206c655f8eb6736c7cafbf022492f36d ]
+
+There are 2 scenarios that requires additional handling. 1. A device that
+has active ranges in DVSEC range registers (RR) but no HDM decoder register
+block. 2. A device that has both RR active and HDM, but the HDM decoders
+are not programmed. The goal is to create emulated decoder software structs
+based on the RR.
+
+Move the CXL DVSEC range register decoding code block from
+cxl_hdm_decode_init() to its own function. Refactor code in preparation for
+the HDM decoder emulation.  There is no functionality change to the code.
+Name the new function to cxl_dvsec_rr_decode().
+
+The only change is to set range->start and range->end to CXL_RESOURCE_NONE
+and skipping the reading of base registers if the range size is 0, which
+equates to range not active.
+
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/167640366839.935665.11816388524993234329.stgit@dwillia2-xfh.jf.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Stable-dep-of: 55e268694e8b ("cxl/pci: Fix to record only non-zero ranges")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/pci.c | 64 ++++++++++++++++++++++++++----------------
+ 1 file changed, 40 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
+index 5584af15300a8..194c8024216df 100644
+--- a/drivers/cxl/core/pci.c
++++ b/drivers/cxl/core/pci.c
+@@ -211,11 +211,10 @@ int cxl_await_media_ready(struct cxl_dev_state *cxlds)
+ }
+ EXPORT_SYMBOL_NS_GPL(cxl_await_media_ready, CXL);
+ 
+-static int wait_for_valid(struct cxl_dev_state *cxlds)
++static int wait_for_valid(struct pci_dev *pdev, int d)
+ {
+-	struct pci_dev *pdev = to_pci_dev(cxlds->dev);
+-	int d = cxlds->cxl_dvsec, rc;
+ 	u32 val;
++	int rc;
+ 
+ 	/*
+ 	 * Memory_Info_Valid: When set, indicates that the CXL Range 1 Size high
+@@ -404,20 +403,11 @@ static bool __cxl_hdm_decode_init(struct cxl_dev_state *cxlds,
+ 	return true;
+ }
+ 
+-/**
+- * cxl_hdm_decode_init() - Setup HDM decoding for the endpoint
+- * @cxlds: Device state
+- * @cxlhdm: Mapped HDM decoder Capability
+- *
+- * Try to enable the endpoint's HDM Decoder Capability
+- */
+-int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
++static int cxl_dvsec_rr_decode(struct device *dev, int d,
++			       struct cxl_endpoint_dvsec_info *info)
+ {
+-	struct pci_dev *pdev = to_pci_dev(cxlds->dev);
+-	struct cxl_endpoint_dvsec_info info = { 0 };
++	struct pci_dev *pdev = to_pci_dev(dev);
+ 	int hdm_count, rc, i, ranges = 0;
+-	struct device *dev = &pdev->dev;
+-	int d = cxlds->cxl_dvsec;
+ 	u16 cap, ctrl;
+ 
+ 	if (!d) {
+@@ -448,7 +438,7 @@ int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
+ 	if (!hdm_count || hdm_count > 2)
+ 		return -EINVAL;
+ 
+-	rc = wait_for_valid(cxlds);
++	rc = wait_for_valid(pdev, d);
+ 	if (rc) {
+ 		dev_dbg(dev, "Failure awaiting MEM_INFO_VALID (%d)\n", rc);
+ 		return rc;
+@@ -459,9 +449,9 @@ int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
+ 	 * disabled, and they will remain moot after the HDM Decoder
+ 	 * capability is enabled.
+ 	 */
+-	info.mem_enabled = FIELD_GET(CXL_DVSEC_MEM_ENABLE, ctrl);
+-	if (!info.mem_enabled)
+-		goto hdm_init;
++	info->mem_enabled = FIELD_GET(CXL_DVSEC_MEM_ENABLE, ctrl);
++	if (!info->mem_enabled)
++		return 0;
+ 
+ 	for (i = 0; i < hdm_count; i++) {
+ 		u64 base, size;
+@@ -480,6 +470,13 @@ int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
+ 			return rc;
+ 
+ 		size |= temp & CXL_DVSEC_MEM_SIZE_LOW_MASK;
++		if (!size) {
++			info->dvsec_range[i] = (struct range) {
++				.start = 0,
++				.end = CXL_RESOURCE_NONE,
++			};
++			continue;
++		}
+ 
+ 		rc = pci_read_config_dword(
+ 			pdev, d + CXL_DVSEC_RANGE_BASE_HIGH(i), &temp);
+@@ -495,22 +492,41 @@ int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
+ 
+ 		base |= temp & CXL_DVSEC_MEM_BASE_LOW_MASK;
+ 
+-		info.dvsec_range[i] = (struct range) {
++		info->dvsec_range[i] = (struct range) {
+ 			.start = base,
+ 			.end = base + size - 1
+ 		};
+ 
+-		if (size)
+-			ranges++;
++		ranges++;
+ 	}
+ 
+-	info.ranges = ranges;
++	info->ranges = ranges;
++
++	return 0;
++}
++
++/**
++ * cxl_hdm_decode_init() - Setup HDM decoding for the endpoint
++ * @cxlds: Device state
++ * @cxlhdm: Mapped HDM decoder Capability
++ *
++ * Try to enable the endpoint's HDM Decoder Capability
++ */
++int cxl_hdm_decode_init(struct cxl_dev_state *cxlds, struct cxl_hdm *cxlhdm)
++{
++	struct cxl_endpoint_dvsec_info info = { 0 };
++	struct device *dev = cxlds->dev;
++	int d = cxlds->cxl_dvsec;
++	int rc;
++
++	rc = cxl_dvsec_rr_decode(dev, d, &info);
++	if (rc < 0)
++		return rc;
+ 
+ 	/*
+ 	 * If DVSEC ranges are being used instead of HDM decoder registers there
+ 	 * is no use in trying to manage those.
+ 	 */
+-hdm_init:
+ 	if (!__cxl_hdm_decode_init(cxlds, cxlhdm, &info)) {
+ 		dev_err(dev,
+ 			"Legacy range registers configuration prevents HDM operation.\n");
+-- 
+2.43.0
+
diff --git a/queue-6.1/cxl-pci-fix-to-record-only-non-zero-ranges.patch b/queue-6.1/cxl-pci-fix-to-record-only-non-zero-ranges.patch
new file mode 100644
index 00000000000..be9c8372136
--- /dev/null
+++ b/queue-6.1/cxl-pci-fix-to-record-only-non-zero-ranges.patch
@@ -0,0 +1,66 @@
+From ac8fcf3edf840d22862e10a160c87a64167a216e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 16:42:28 +0800
+Subject: cxl/pci: Fix to record only non-zero ranges
+
+From: Yanfei Xu <yanfei.xu@intel.com>
+
+[ Upstream commit 55e268694e8b07026c88191f9b6949b6887d9ce3 ]
+
+The function cxl_dvsec_rr_decode() retrieves and records DVSEC ranges
+into info->dvsec_range[], regardless of whether it is non-zero range,
+and the variable info->ranges indicates the number of non-zero ranges.
+However, in cxl_hdm_decode_init(), the validation for
+info->dvsec_range[] occurs in a for loop that iterates based on
+info->ranges. It may result in zero range to be validated but non-zero
+range not be validated, in turn, the number of allowed ranges is to be
+0. Address it by only record non-zero ranges.
+
+This fix is not urgent as it requires a configuration that zeroes out
+the first dvsec range while populating the second. This has not been
+observed, but it is theoretically possible. If this gets picked up for
+-stable, no harm done, but there is no urgency to backport.
+
+Fixes: 560f78559006 ("cxl/pci: Retrieve CXL DVSEC memory info")
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Yanfei Xu <yanfei.xu@intel.com>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Link: https://patch.msgid.link/20240828084231.1378789-2-yanfei.xu@intel.com
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/pci.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
+index 194c8024216df..8d92a24fd73d9 100644
+--- a/drivers/cxl/core/pci.c
++++ b/drivers/cxl/core/pci.c
+@@ -471,10 +471,6 @@ static int cxl_dvsec_rr_decode(struct device *dev, int d,
+ 
+ 		size |= temp & CXL_DVSEC_MEM_SIZE_LOW_MASK;
+ 		if (!size) {
+-			info->dvsec_range[i] = (struct range) {
+-				.start = 0,
+-				.end = CXL_RESOURCE_NONE,
+-			};
+ 			continue;
+ 		}
+ 
+@@ -492,12 +488,10 @@ static int cxl_dvsec_rr_decode(struct device *dev, int d,
+ 
+ 		base |= temp & CXL_DVSEC_MEM_BASE_LOW_MASK;
+ 
+-		info->dvsec_range[i] = (struct range) {
++		info->dvsec_range[ranges++] = (struct range) {
+ 			.start = base,
+ 			.end = base + size - 1
+ 		};
+-
+-		ranges++;
+ 	}
+ 
+ 	info->ranges = ranges;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-drm-exynos_drm_gsc-fix-wrong-assignment-in-g.patch b/queue-6.1/drivers-drm-exynos_drm_gsc-fix-wrong-assignment-in-g.patch
new file mode 100644
index 00000000000..fb241d55d76
--- /dev/null
+++ b/queue-6.1/drivers-drm-exynos_drm_gsc-fix-wrong-assignment-in-g.patch
@@ -0,0 +1,36 @@
+From 5590218a89776fb85f82592a7b8ae624651c228a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 17:09:27 +0800
+Subject: drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
+
+From: Yuesong Li <liyuesong@vivo.com>
+
+[ Upstream commit 94ebc3d3235c5c516f67315059ce657e5090e94b ]
+
+cocci reported a double assignment problem. Upon reviewing previous
+commits, it appears this may actually be an incorrect assignment.
+
+Fixes: 8b9550344d39 ("drm/ipp: clean up debug messages")
+Signed-off-by: Yuesong Li <liyuesong@vivo.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_gsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 68ea92742b06b..f8b45fc5b15ad 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -1173,7 +1173,7 @@ static int gsc_bind(struct device *dev, struct device *master, void *data)
+ 	struct exynos_drm_ipp *ipp = &ctx->ipp;
+ 
+ 	ctx->drm_dev = drm_dev;
+-	ctx->drm_dev = drm_dev;
++	ipp->drm_dev = drm_dev;
+ 	exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
+ 
+ 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch b/queue-6.1/drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch
new file mode 100644
index 00000000000..8f7730c888f
--- /dev/null
+++ b/queue-6.1/drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch
@@ -0,0 +1,43 @@
+From 78b34ce9cf1f80bdad4337ffc1a5343a49d200ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jul 2024 01:50:23 +0800
+Subject: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write
+ error
+
+From: Junlin Li <make24@iscas.ac.cn>
+
+[ Upstream commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 ]
+
+Ensure index in rtl2830_pid_filter does not exceed 31 to prevent
+out-of-bounds access.
+
+dev->filters is a 32-bit value, so set_bit and clear_bit functions should
+only operate on indices from 0 to 31. If index is 32, it will attempt to
+access a non-existent 33rd bit, leading to out-of-bounds access.
+Change the boundary check from index > 32 to index >= 32 to resolve this
+issue.
+
+Fixes: df70ddad81b4 ("[media] rtl2830: implement PID filter")
+Signed-off-by: Junlin Li <make24@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/rtl2830.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
+index e0fbf41316ae7..73a6166c0083d 100644
+--- a/drivers/media/dvb-frontends/rtl2830.c
++++ b/drivers/media/dvb-frontends/rtl2830.c
+@@ -609,7 +609,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on
+ 		index, pid, onoff);
+ 
+ 	/* skip invalid PIDs (0x2000) */
+-	if (pid > 0x1fff || index > 32)
++	if (pid > 0x1fff || index >= 32)
+ 		return 0;
+ 
+ 	if (onoff)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch b/queue-6.1/drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch
new file mode 100644
index 00000000000..915f74a79aa
--- /dev/null
+++ b/queue-6.1/drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch
@@ -0,0 +1,44 @@
+From aca5f908a527014fe6406c2b39b5ad0a629a9144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 21:24:13 +0800
+Subject: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write
+ error
+
+From: Junlin Li <make24@iscas.ac.cn>
+
+[ Upstream commit 8ae06f360cfaca2b88b98ca89144548b3186aab1 ]
+
+Ensure index in rtl2832_pid_filter does not exceed 31 to prevent
+out-of-bounds access.
+
+dev->filters is a 32-bit value, so set_bit and clear_bit functions should
+only operate on indices from 0 to 31. If index is 32, it will attempt to
+access a non-existent 33rd bit, leading to out-of-bounds access.
+Change the boundary check from index > 32 to index >= 32 to resolve this
+issue.
+
+Signed-off-by: Junlin Li <make24@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 4b01e01a81b6 ("[media] rtl2832: implement PID filter")
+[hverkuil: added fixes tag, rtl2830_pid_filter -> rtl2832_pid_filter in logmsg]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/rtl2832.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
+index 4fa884eda5d50..c27cbddc42b7b 100644
+--- a/drivers/media/dvb-frontends/rtl2832.c
++++ b/drivers/media/dvb-frontends/rtl2832.c
+@@ -983,7 +983,7 @@ static int rtl2832_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid,
+ 		index, pid, onoff, dev->slave_ts);
+ 
+ 	/* skip invalid PIDs (0x2000) */
+-	if (pid > 0x1fff || index > 32)
++	if (pid > 0x1fff || index >= 32)
+ 		return 0;
+ 
+ 	if (onoff)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-perf-fix-ali_drw_pmu-driver-interrupt-status.patch b/queue-6.1/drivers-perf-fix-ali_drw_pmu-driver-interrupt-status.patch
new file mode 100644
index 00000000000..2ceef6d92ab
--- /dev/null
+++ b/queue-6.1/drivers-perf-fix-ali_drw_pmu-driver-interrupt-status.patch
@@ -0,0 +1,44 @@
+From fa7a12e7422ccdb32e1f53f3069ecd1bf4a26a2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 11:33:31 +0800
+Subject: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
+
+From: Jing Zhang <renyu.zj@linux.alibaba.com>
+
+[ Upstream commit a3dd920977dccc453c550260c4b7605b280b79c3 ]
+
+The alibaba_uncore_pmu driver forgot to clear all interrupt status
+in the interrupt processing function. After the PMU counter overflow
+interrupt occurred, an interrupt storm occurred, causing the system
+to hang.
+
+Therefore, clear the correct interrupt status in the interrupt handling
+function to fix it.
+
+Fixes: cf7b61073e45 ("drivers/perf: add DDR Sub-System Driveway PMU driver for Yitian 710 SoC")
+Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com>
+Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/1724297611-20686-1-git-send-email-renyu.zj@linux.alibaba.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/alibaba_uncore_drw_pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/alibaba_uncore_drw_pmu.c b/drivers/perf/alibaba_uncore_drw_pmu.c
+index a7689fecb49d9..0a57502de4284 100644
+--- a/drivers/perf/alibaba_uncore_drw_pmu.c
++++ b/drivers/perf/alibaba_uncore_drw_pmu.c
+@@ -381,7 +381,7 @@ static irqreturn_t ali_drw_pmu_isr(int irq_num, void *data)
+ 			}
+ 
+ 			/* clear common counter intr status */
+-			clr_status = FIELD_PREP(ALI_DRW_PMCOM_CNT_OV_INTR_MASK, 1);
++			clr_status = FIELD_PREP(ALI_DRW_PMCOM_CNT_OV_INTR_MASK, status);
+ 			writel(clr_status,
+ 			       drw_pmu->cfg_base + ALI_DRW_PMU_OV_INTR_CLR);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-perf-hisi_pcie-record-hardware-counts-correc.patch b/queue-6.1/drivers-perf-hisi_pcie-record-hardware-counts-correc.patch
new file mode 100644
index 00000000000..4993c626cfb
--- /dev/null
+++ b/queue-6.1/drivers-perf-hisi_pcie-record-hardware-counts-correc.patch
@@ -0,0 +1,66 @@
+From a45183aa5cd3151bd9f9bcf34fd500680ce671b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 17:03:30 +0800
+Subject: drivers/perf: hisi_pcie: Record hardware counts correctly
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit daecd3373a16a039ad241086e30a1ec46fc9d61f ]
+
+Currently we set the period and record it as the initial value of the
+counter without checking it's set to the hardware successfully or not.
+However the counter maybe unwritable if the target event is unsupported
+by the device. In such case we will pass user a wrong count:
+
+[start counts when setting the period]
+hwc->prev_count = 0x8000000000000000
+device.counter_value = 0 // the counter is not set as the period
+[when user reads the counter]
+event->count = device.counter_value - hwc->prev_count
+             = 0x8000000000000000 // wrong. should be 0.
+
+Fix this by record the hardware counter counts correctly when setting
+the period.
+
+Fixes: 8404b0fbc7fb ("drivers/perf: hisi: Add driver for HiSilicon PCIe PMU")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/20240829090332.28756-2-yangyicong@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hisi_pcie_pmu.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/perf/hisilicon/hisi_pcie_pmu.c b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+index 49f2d69c119df..8a2106f1626e1 100644
+--- a/drivers/perf/hisilicon/hisi_pcie_pmu.c
++++ b/drivers/perf/hisilicon/hisi_pcie_pmu.c
+@@ -447,10 +447,24 @@ static void hisi_pcie_pmu_set_period(struct perf_event *event)
+ 	struct hisi_pcie_pmu *pcie_pmu = to_pcie_pmu(event->pmu);
+ 	struct hw_perf_event *hwc = &event->hw;
+ 	int idx = hwc->idx;
++	u64 orig_cnt, cnt;
++
++	orig_cnt = hisi_pcie_pmu_read_counter(event);
+ 
+ 	local64_set(&hwc->prev_count, HISI_PCIE_INIT_VAL);
+ 	hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_CNT, idx, HISI_PCIE_INIT_VAL);
+ 	hisi_pcie_pmu_writeq(pcie_pmu, HISI_PCIE_EXT_CNT, idx, HISI_PCIE_INIT_VAL);
++
++	/*
++	 * The counter maybe unwritable if the target event is unsupported.
++	 * Check this by comparing the counts after setting the period. If
++	 * the counts stay unchanged after setting the period then update
++	 * the hwc->prev_count correctly. Otherwise the final counts user
++	 * get maybe totally wrong.
++	 */
++	cnt = hisi_pcie_pmu_read_counter(event);
++	if (orig_cnt == cnt)
++		local64_set(&hwc->prev_count, cnt);
+ }
+ 
+ static void hisi_pcie_pmu_enable_counter(struct hisi_pcie_pmu *pcie_pmu, struct hw_perf_event *hwc)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-amdgpu-properly-tune-the-size-of-struct.patch b/queue-6.1/drm-amd-amdgpu-properly-tune-the-size-of-struct.patch
new file mode 100644
index 00000000000..2329b2ea7ba
--- /dev/null
+++ b/queue-6.1/drm-amd-amdgpu-properly-tune-the-size-of-struct.patch
@@ -0,0 +1,55 @@
+From 8db6a3a01c1ee88d1cfcd2a71453445cdf8acf0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2024 12:10:40 +0800
+Subject: drm/amd/amdgpu: Properly tune the size of struct
+
+From: WangYuli <wangyuli@uniontech.com>
+
+[ Upstream commit 0cee47cde41e22712c034ae961076067d4ac13a0 ]
+
+The struct assertion is failed because sparse cannot parse
+`#pragma pack(push, 1)` and `#pragma pack(pop)` correctly.
+GCC's output is still 1-byte-aligned. No harm to memory layout.
+
+The error can be filtered out by sparse-diff, but sometimes
+multiple lines queezed into one, making the sparse-diff thinks
+its a new error. I'm trying to aviod this by fixing errors.
+
+Link: https://lore.kernel.org/all/20230620045919.492128-1-suhui@nfschina.com/
+Link: https://lore.kernel.org/all/93d10611-9fbb-4242-87b8-5860b2606042@suswa.mountain/
+Fixes: 1721bc1b2afa ("drm/amdgpu: Update VF2PF interface")
+Cc: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: wenlunpeng <wenlunpeng@uniontech.com>
+Reported-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: WangYuli <wangyuli@uniontech.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
+index 6c97148ca0ed3..99f459bd2748d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
+@@ -209,7 +209,7 @@ struct amd_sriov_msg_pf2vf_info {
+ 	uint32_t pcie_atomic_ops_support_flags;
+ 	/* reserved */
+ 	uint32_t reserved[256 - AMD_SRIOV_MSG_PF2VF_INFO_FILLED_SIZE];
+-};
++} __packed;
+ 
+ struct amd_sriov_msg_vf2pf_info_header {
+ 	/* the total structure size in byte */
+@@ -267,7 +267,7 @@ struct amd_sriov_msg_vf2pf_info {
+ 
+ 	/* reserved */
+ 	uint32_t reserved[256 - AMD_SRIOV_MSG_VF2PF_INFO_FILLED_SIZE];
+-};
++} __packed;
+ 
+ /* mailbox message send from guest to host  */
+ enum amd_sriov_mailbox_request_message {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-display-add-null-check-for-set_output_gamma-.patch b/queue-6.1/drm-amd-display-add-null-check-for-set_output_gamma-.patch
new file mode 100644
index 00000000000..84731e3ddd1
--- /dev/null
+++ b/queue-6.1/drm-amd-display-add-null-check-for-set_output_gamma-.patch
@@ -0,0 +1,103 @@
+From 25f82d36ace30e12afbc60dbdac73aba9ec36a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 17:18:17 +0530
+Subject: drm/amd/display: Add null check for set_output_gamma in
+ dcn30_set_output_transfer_func
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 ]
+
+This commit adds a null check for the set_output_gamma function pointer
+in the  dcn30_set_output_transfer_func function. Previously,
+set_output_gamma was being checked for nullity at line 386, but then it
+was being dereferenced without any nullity check at line 401. This
+could potentially lead to a null pointer dereference error if
+set_output_gamma is indeed null.
+
+To fix this, we now ensure that set_output_gamma is not null before
+dereferencing it. We do this by adding a nullity check for
+set_output_gamma before the call to set_output_gamma at line 401. If
+set_output_gamma is null, we log an error message and do not call the
+function.
+
+This fix prevents a potential null pointer dereference error.
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()
+error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386)
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c
+    373 bool dcn30_set_output_transfer_func(struct dc *dc,
+    374                                 struct pipe_ctx *pipe_ctx,
+    375                                 const struct dc_stream_state *stream)
+    376 {
+    377         int mpcc_id = pipe_ctx->plane_res.hubp->inst;
+    378         struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;
+    379         const struct pwl_params *params = NULL;
+    380         bool ret = false;
+    381
+    382         /* program OGAM or 3DLUT only for the top pipe*/
+    383         if (pipe_ctx->top_pipe == NULL) {
+    384                 /*program rmu shaper and 3dlut in MPC*/
+    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);
+    386                 if (ret == false && mpc->funcs->set_output_gamma) {
+                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL
+
+    387                         if (stream->out_transfer_func.type == TF_TYPE_HWPWL)
+    388                                 params = &stream->out_transfer_func.pwl;
+    389                         else if (pipe_ctx->stream->out_transfer_func.type ==
+    390                                         TF_TYPE_DISTRIBUTED_POINTS &&
+    391                                         cm3_helper_translate_curve_to_hw_format(
+    392                                         &stream->out_transfer_func,
+    393                                         &mpc->blender_params, false))
+    394                                 params = &mpc->blender_params;
+    395                          /* there are no ROM LUTs in OUTGAM */
+    396                         if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)
+    397                                 BREAK_TO_DEBUGGER();
+    398                 }
+    399         }
+    400
+--> 401         mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
+                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash
+
+    402         return ret;
+    403 }
+
+Fixes: d99f13878d6f ("drm/amd/display: Add DCN3 HWSEQ")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: Hersen Wu <hersenxs.wu@amd.com>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+index 0225b2c96041d..407f7889e8fd4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+@@ -215,7 +215,11 @@ bool dcn30_set_output_transfer_func(struct dc *dc,
+ 		}
+ 	}
+ 
+-	mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
++	if (mpc->funcs->set_output_gamma)
++		mpc->funcs->set_output_gamma(mpc, mpcc_id, params);
++	else
++		DC_LOG_ERROR("%s: set_output_gamma function pointer is NULL.\n", __func__);
++
+ 	return ret;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-properly-handle-vbios-fake-edid-sizing.patch b/queue-6.1/drm-amdgpu-properly-handle-vbios-fake-edid-sizing.patch
new file mode 100644
index 00000000000..7d49e57427a
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-properly-handle-vbios-fake-edid-sizing.patch
@@ -0,0 +1,79 @@
+From 5e1da7fd0f6f74f1092b2d1c8305d1b86cf09913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2024 13:23:56 -0400
+Subject: drm/amdgpu: properly handle vbios fake edid sizing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 8155566a26b8d6c1dd914f06a0c652e4e2f2adf1 ]
+
+The comment in the vbios structure says:
+// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
+
+This fake edid struct has not been used in a long time, so I'm
+not sure if there were actually any boards out there with a non-128 byte
+EDID, but align the code with the comment.
+
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reported-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lists.freedesktop.org/archives/amd-gfx/2024-June/109964.html
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/atombios_encoders.c    | 29 ++++++++++---------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+index 18ae9433e463d..713b9796f0f9d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
++++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+@@ -2066,26 +2066,29 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder)
+ 					fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;
+ 					if (fake_edid_record->ucFakeEDIDLength) {
+ 						struct edid *edid;
+-						int edid_size =
+-							max((int)EDID_LENGTH, (int)fake_edid_record->ucFakeEDIDLength);
+-						edid = kmalloc(edid_size, GFP_KERNEL);
++						int edid_size;
++
++						if (fake_edid_record->ucFakeEDIDLength == 128)
++							edid_size = fake_edid_record->ucFakeEDIDLength;
++						else
++							edid_size = fake_edid_record->ucFakeEDIDLength * 128;
++						edid = kmemdup(&fake_edid_record->ucFakeEDIDString[0],
++							       edid_size, GFP_KERNEL);
+ 						if (edid) {
+-							memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
+-							       fake_edid_record->ucFakeEDIDLength);
+-
+ 							if (drm_edid_is_valid(edid)) {
+ 								adev->mode_info.bios_hardcoded_edid = edid;
+ 								adev->mode_info.bios_hardcoded_edid_size = edid_size;
+-							} else
++							} else {
+ 								kfree(edid);
++							}
+ 						}
++						record += struct_size(fake_edid_record,
++								      ucFakeEDIDString,
++								      edid_size);
++					} else {
++						/* empty fake edid record must be 3 bytes long */
++						record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					}
+-					record += fake_edid_record->ucFakeEDIDLength ?
+-						  struct_size(fake_edid_record,
+-							      ucFakeEDIDString,
+-							      fake_edid_record->ucFakeEDIDLength) :
+-						  /* empty fake edid record must be 3 bytes long */
+-						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					break;
+ 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-replace-one-element-array-with-flexible-a.patch b/queue-6.1/drm-amdgpu-replace-one-element-array-with-flexible-a.patch
new file mode 100644
index 00000000000..6522114817e
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-replace-one-element-array-with-flexible-a.patch
@@ -0,0 +1,68 @@
+From 655b6a33d7c3d6efaeef9b22f0efdc1e608c1034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Oct 2022 14:30:44 +1300
+Subject: drm/amdgpu: Replace one-element array with flexible-array member
+
+From: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@gmail.com>
+
+[ Upstream commit 320e2590e281d0a7865e861f50155b5b435e9813 ]
+
+One-element arrays are deprecated, and we are replacing them with
+flexible array members instead. So, replace one-element array with
+flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and
+refactor the rest of the code accordingly.
+
+Important to mention is that doing a build before/after this patch
+results in no binary output differences.
+
+This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
+routines on memcpy() and help us make progress towards globally
+enabling -fstrict-flex-arrays=3 [1].
+
+Link: https://github.com/KSPP/linux/issues/79
+Link: https://github.com/KSPP/linux/issues/238
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1]
+
+Signed-off-by: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 8155566a26b8 ("drm/amdgpu: properly handle vbios fake edid sizing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 7 +++++--
+ drivers/gpu/drm/amd/include/atombios.h         | 2 +-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+index 6be9ac2b9c5bc..18ae9433e463d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
++++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+@@ -2081,8 +2081,11 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder)
+ 						}
+ 					}
+ 					record += fake_edid_record->ucFakeEDIDLength ?
+-						fake_edid_record->ucFakeEDIDLength + 2 :
+-						sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
++						  struct_size(fake_edid_record,
++							      ucFakeEDIDString,
++							      fake_edid_record->ucFakeEDIDLength) :
++						  /* empty fake edid record must be 3 bytes long */
++						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					break;
+ 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
+diff --git a/drivers/gpu/drm/amd/include/atombios.h b/drivers/gpu/drm/amd/include/atombios.h
+index 15943bc21bc54..b5b1d073f8e24 100644
+--- a/drivers/gpu/drm/amd/include/atombios.h
++++ b/drivers/gpu/drm/amd/include/atombios.h
+@@ -4107,7 +4107,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD
+ {
+   UCHAR ucRecordType;
+   UCHAR ucFakeEDIDLength;       // = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
+-  UCHAR ucFakeEDIDString[1];    // This actually has ucFakeEdidLength elements.
++  UCHAR ucFakeEDIDString[];     // This actually has ucFakeEdidLength elements.
+ } ATOM_FAKE_EDID_PATCH_RECORD;
+ 
+ typedef struct  _ATOM_PANEL_RESOLUTION_PATCH_RECORD
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-lontium-lt8912b-validate-mode-in-drm_brid.patch b/queue-6.1/drm-bridge-lontium-lt8912b-validate-mode-in-drm_brid.patch
new file mode 100644
index 00000000000..cf66aa8526b
--- /dev/null
+++ b/queue-6.1/drm-bridge-lontium-lt8912b-validate-mode-in-drm_brid.patch
@@ -0,0 +1,97 @@
+From fd57e14531792cf91528e1594595914a41358567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2024 17:16:37 +0800
+Subject: drm/bridge: lontium-lt8912b: Validate mode in
+ drm_bridge_funcs::mode_valid()
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit fe828fbd87786238b30f44cafd698d975d956c97 ]
+
+If the bridge is attached with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set,
+this driver won't initialize a connector and hence display mode won't be
+validated in drm_connector_helper_funcs::mode_valid().  So, move the mode
+validation from drm_connector_helper_funcs::mode_valid() to
+drm_bridge_funcs::mode_valid(), because the mode validation is always done
+for the bridge.
+
+Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge")
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240813091637.1054586-1-victor.liu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lontium-lt8912b.c | 35 ++++++++++++------------
+ 1 file changed, 18 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+index 55a7fa4670a7a..825d0973663aa 100644
+--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c
++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c
+@@ -411,22 +411,6 @@ static const struct drm_connector_funcs lt8912_connector_funcs = {
+ 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ };
+ 
+-static enum drm_mode_status
+-lt8912_connector_mode_valid(struct drm_connector *connector,
+-			    struct drm_display_mode *mode)
+-{
+-	if (mode->clock > 150000)
+-		return MODE_CLOCK_HIGH;
+-
+-	if (mode->hdisplay > 1920)
+-		return MODE_BAD_HVALUE;
+-
+-	if (mode->vdisplay > 1080)
+-		return MODE_BAD_VVALUE;
+-
+-	return MODE_OK;
+-}
+-
+ static int lt8912_connector_get_modes(struct drm_connector *connector)
+ {
+ 	struct edid *edid;
+@@ -454,7 +438,6 @@ static int lt8912_connector_get_modes(struct drm_connector *connector)
+ 
+ static const struct drm_connector_helper_funcs lt8912_connector_helper_funcs = {
+ 	.get_modes = lt8912_connector_get_modes,
+-	.mode_valid = lt8912_connector_mode_valid,
+ };
+ 
+ static void lt8912_bridge_mode_set(struct drm_bridge *bridge,
+@@ -596,6 +579,23 @@ static void lt8912_bridge_detach(struct drm_bridge *bridge)
+ 		drm_bridge_hpd_disable(lt->hdmi_port);
+ }
+ 
++static enum drm_mode_status
++lt8912_bridge_mode_valid(struct drm_bridge *bridge,
++			 const struct drm_display_info *info,
++			 const struct drm_display_mode *mode)
++{
++	if (mode->clock > 150000)
++		return MODE_CLOCK_HIGH;
++
++	if (mode->hdisplay > 1920)
++		return MODE_BAD_HVALUE;
++
++	if (mode->vdisplay > 1080)
++		return MODE_BAD_VVALUE;
++
++	return MODE_OK;
++}
++
+ static enum drm_connector_status
+ lt8912_bridge_detect(struct drm_bridge *bridge)
+ {
+@@ -626,6 +626,7 @@ static struct edid *lt8912_bridge_get_edid(struct drm_bridge *bridge,
+ static const struct drm_bridge_funcs lt8912_bridge_funcs = {
+ 	.attach = lt8912_bridge_attach,
+ 	.detach = lt8912_bridge_detach,
++	.mode_valid = lt8912_bridge_mode_valid,
+ 	.mode_set = lt8912_bridge_mode_set,
+ 	.enable = lt8912_bridge_enable,
+ 	.detect = lt8912_bridge_detect,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mediatek-fix-missing-configuration-flags-in-mtk_.patch b/queue-6.1/drm-mediatek-fix-missing-configuration-flags-in-mtk_.patch
new file mode 100644
index 00000000000..a26e6264192
--- /dev/null
+++ b/queue-6.1/drm-mediatek-fix-missing-configuration-flags-in-mtk_.patch
@@ -0,0 +1,143 @@
+From 1ae102be1d660d519834c1abfdae0674ffae7bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 22:55:19 +0800
+Subject: drm/mediatek: Fix missing configuration flags in
+ mtk_crtc_ddp_config()
+
+From: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit fe30bae552ce27b9fefe0b12db1544e73d07325f ]
+
+In mtk_crtc_ddp_config(), mtk_crtc will use some configuration flags to
+generate instructions to cmdq_handle, such as:
+  state->pending_config
+  mtk_crtc->pending_planes
+  plane_state->pending.config
+  mtk_crtc->pending_async_planes
+  plane_state->pending.async_config
+
+These configuration flags may be set to false when a GCE IRQ comes calling
+ddp_cmdq_cb(). This may result in missing prepare instructions,
+especially if mtk_crtc_update_config() with the flase need_vblank (no need
+to wait for vblank) cases.
+
+Therefore, the mtk_crtc->config_updating flag is set at the beginning of
+mtk_crtc_update_config() to ensure that these configuration flags won't be
+changed when the mtk_crtc_ddp_config() is preparing instructions.
+But somehow the ddp_cmdq_cb() didn't use the mtk_crtc->config_updating
+flag to prevent those pending config flags from being cleared.
+
+To avoid missing the configuration when generating the config instruction,
+the config_updating flag should be added into ddp_cmdq_cb() and be
+protected with spin_lock.
+
+Fixes: 7f82d9c43879 ("drm/mediatek: Clear pending flag when cmdq packet is done")
+Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240827-drm-fixup-0819-v3-1-4761005211ec@mediatek.com/
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240827-drm-fixup-0819-v3-2-4761005211ec@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 27 +++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index beaaf44004cfd..e00c8e0a21027 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -65,6 +65,8 @@ struct mtk_drm_crtc {
+ 	/* lock for display hardware access */
+ 	struct mutex			hw_lock;
+ 	bool				config_updating;
++	/* lock for config_updating to cmd buffer */
++	spinlock_t			config_lock;
+ };
+ 
+ struct mtk_crtc_state {
+@@ -102,11 +104,16 @@ static void mtk_drm_crtc_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+ 
+ static void mtk_drm_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+ {
++	unsigned long flags;
++
+ 	drm_crtc_handle_vblank(&mtk_crtc->base);
++
++	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
+ 	if (!mtk_crtc->config_updating && mtk_crtc->pending_needs_vblank) {
+ 		mtk_drm_crtc_finish_page_flip(mtk_crtc);
+ 		mtk_crtc->pending_needs_vblank = false;
+ 	}
++	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
+ }
+ 
+ #if IS_REACHABLE(CONFIG_MTK_CMDQ)
+@@ -289,12 +296,19 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
+ 	struct mtk_drm_crtc *mtk_crtc = container_of(cmdq_cl, struct mtk_drm_crtc, cmdq_client);
+ 	struct mtk_crtc_state *state;
+ 	unsigned int i;
++	unsigned long flags;
+ 
+ 	if (data->sta < 0)
+ 		return;
+ 
+ 	state = to_mtk_crtc_state(mtk_crtc->base.state);
+ 
++	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
++	if (mtk_crtc->config_updating) {
++		spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
++		goto ddp_cmdq_cb_out;
++	}
++
+ 	state->pending_config = false;
+ 
+ 	if (mtk_crtc->pending_planes) {
+@@ -321,6 +335,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)
+ 		mtk_crtc->pending_async_planes = false;
+ 	}
+ 
++	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
++
++ddp_cmdq_cb_out:
++
+ 	mtk_crtc->cmdq_vblank_cnt = 0;
+ 	wake_up(&mtk_crtc->cb_blocking_queue);
+ }
+@@ -544,9 +562,14 @@ static void mtk_drm_crtc_update_config(struct mtk_drm_crtc *mtk_crtc,
+ 	struct mtk_drm_private *priv = crtc->dev->dev_private;
+ 	unsigned int pending_planes = 0, pending_async_planes = 0;
+ 	int i;
++	unsigned long flags;
+ 
+ 	mutex_lock(&mtk_crtc->hw_lock);
++
++	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
+ 	mtk_crtc->config_updating = true;
++	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
++
+ 	if (needs_vblank)
+ 		mtk_crtc->pending_needs_vblank = true;
+ 
+@@ -600,7 +623,10 @@ static void mtk_drm_crtc_update_config(struct mtk_drm_crtc *mtk_crtc,
+ 		mbox_client_txdone(mtk_crtc->cmdq_client.chan, 0);
+ 	}
+ #endif
++	spin_lock_irqsave(&mtk_crtc->config_lock, flags);
+ 	mtk_crtc->config_updating = false;
++	spin_unlock_irqrestore(&mtk_crtc->config_lock, flags);
++
+ 	mutex_unlock(&mtk_crtc->hw_lock);
+ }
+ 
+@@ -971,6 +997,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ 	drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, has_ctm, gamma_lut_size);
+ 	priv->num_pipes++;
+ 	mutex_init(&mtk_crtc->hw_lock);
++	spin_lock_init(&mtk_crtc->config_lock);
+ 
+ #if IS_REACHABLE(CONFIG_MTK_CMDQ)
+ 	mtk_crtc->cmdq_client.client.dev = mtk_crtc->mmsys_dev;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mediatek-use-spin_lock_irqsave-for-crtc-event-lo.patch b/queue-6.1/drm-mediatek-use-spin_lock_irqsave-for-crtc-event-lo.patch
new file mode 100644
index 00000000000..82f46f27892
--- /dev/null
+++ b/queue-6.1/drm-mediatek-use-spin_lock_irqsave-for-crtc-event-lo.patch
@@ -0,0 +1,49 @@
+From 871a3c9d4b992a6df204333fe722ce2f71318fa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 18:14:47 +0800
+Subject: drm/mediatek: Use spin_lock_irqsave() for CRTC event lock
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit be03b30b7aa99aca876fbc7c1c1b73b2d0339321 ]
+
+Use the state-aware spin_lock_irqsave() and spin_unlock_irqrestore()
+to avoid unconditionally re-enabling the local interrupts.
+
+Fixes: 411f5c1eacfe ("drm/mediatek: handle events when enabling/disabling crtc")
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240828101511.3269822-1-fshao@chromium.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index e00c8e0a21027..aba26ec9a1425 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -444,6 +444,7 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ {
+ 	struct drm_device *drm = mtk_crtc->base.dev;
+ 	struct drm_crtc *crtc = &mtk_crtc->base;
++	unsigned long flags;
+ 	int i;
+ 
+ 	for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {
+@@ -470,10 +471,10 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ 	pm_runtime_put(drm->dev);
+ 
+ 	if (crtc->state->event && !crtc->state->active) {
+-		spin_lock_irq(&crtc->dev->event_lock);
++		spin_lock_irqsave(&crtc->dev->event_lock, flags);
+ 		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ 		crtc->state->event = NULL;
+-		spin_unlock_irq(&crtc->dev->event_lock);
++		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-a5xx-disable-preemption-in-submits-by-defaul.patch b/queue-6.1/drm-msm-a5xx-disable-preemption-in-submits-by-defaul.patch
new file mode 100644
index 00000000000..d13bf3a12ae
--- /dev/null
+++ b/queue-6.1/drm-msm-a5xx-disable-preemption-in-submits-by-defaul.patch
@@ -0,0 +1,52 @@
+From 7067d0689f1e3ff6012782dbd09848e58b77e3fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2024 13:54:00 +0000
+Subject: drm/msm/a5xx: disable preemption in submits by default
+
+From: Vladimir Lypak <vladimir.lypak@gmail.com>
+
+[ Upstream commit db9dec2db76146d65e1cfbb6afb2e2bd5dab67f8 ]
+
+Fine grain preemption (switching from/to points within submits)
+requires extra handling in command stream of those submits, especially
+when rendering with tiling (using GMEM). However this handling is
+missing at this point in mesa (and always was). For this reason we get
+random GPU faults and hangs if more than one priority level is used
+because local preemption is enabled prior to executing command stream
+from submit.
+With that said it was ahead of time to enable local preemption by
+default considering the fact that even on downstream kernel it is only
+enabled if requested via UAPI.
+
+Fixes: a7a4c19c36de ("drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register")
+Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612041/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 895a0e9db1f09..6e3f7d39d7e38 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -150,9 +150,13 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ 	OUT_PKT7(ring, CP_SET_PROTECTED_MODE, 1);
+ 	OUT_RING(ring, 1);
+ 
+-	/* Enable local preemption for finegrain preemption */
++	/*
++	 * Disable local preemption by default because it requires
++	 * user-space to be aware of it and provide additional handling
++	 * to restore rendering state or do various flushes on switch.
++	 */
+ 	OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1);
+-	OUT_RING(ring, 0x1);
++	OUT_RING(ring, 0x0);
+ 
+ 	/* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */
+ 	OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-a5xx-fix-races-in-preemption-evaluation-stag.patch b/queue-6.1/drm-msm-a5xx-fix-races-in-preemption-evaluation-stag.patch
new file mode 100644
index 00000000000..9d9938d24c0
--- /dev/null
+++ b/queue-6.1/drm-msm-a5xx-fix-races-in-preemption-evaluation-stag.patch
@@ -0,0 +1,124 @@
+From 01625f825c46f9add2204e0e10600a8f363bbd05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2024 13:54:02 +0000
+Subject: drm/msm/a5xx: fix races in preemption evaluation stage
+
+From: Vladimir Lypak <vladimir.lypak@gmail.com>
+
+[ Upstream commit ce050f307ad93bcc5958d0dd35fc276fd394d274 ]
+
+On A5XX GPUs when preemption is used it's invietable to enter a soft
+lock-up state in which GPU is stuck at empty ring-buffer doing nothing.
+This appears as full UI lockup and not detected as GPU hang (because
+it's not). This happens due to not triggering preemption when it was
+needed. Sometimes this state can be recovered by some new submit but
+generally it won't happen because applications are waiting for old
+submits to retire.
+
+One of the reasons why this happens is a race between a5xx_submit and
+a5xx_preempt_trigger called from IRQ during submit retire. Former thread
+updates ring->cur of previously empty and not current ring right after
+latter checks it for emptiness. Then both threads can just exit because
+for first one preempt_state wasn't NONE yet and for second one all rings
+appeared to be empty.
+
+To prevent such situations from happening we need to establish guarantee
+for preempt_trigger to make decision after each submit or retire. To
+implement this we serialize preemption initiation using spinlock. If
+switch is already in progress we need to re-trigger preemption when it
+finishes.
+
+Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets")
+Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612045/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.h     |  1 +
+ drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 24 +++++++++++++++++++++--
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+index c7187bcc5e908..b4d06ca3e499d 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+@@ -36,6 +36,7 @@ struct a5xx_gpu {
+ 	uint64_t preempt_iova[MSM_GPU_MAX_RINGS];
+ 
+ 	atomic_t preempt_state;
++	spinlock_t preempt_start_lock;
+ 	struct timer_list preempt_timer;
+ 
+ 	struct drm_gem_object *shadow_bo;
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+index 67a8ef4adf6b6..c65b34a4a8cc2 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+@@ -97,12 +97,19 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)
+ 	if (gpu->nr_rings == 1)
+ 		return;
+ 
++	/*
++	 * Serialize preemption start to ensure that we always make
++	 * decision on latest state. Otherwise we can get stuck in
++	 * lower priority or empty ring.
++	 */
++	spin_lock_irqsave(&a5xx_gpu->preempt_start_lock, flags);
++
+ 	/*
+ 	 * Try to start preemption by moving from NONE to START. If
+ 	 * unsuccessful, a preemption is already in flight
+ 	 */
+ 	if (!try_preempt_state(a5xx_gpu, PREEMPT_NONE, PREEMPT_START))
+-		return;
++		goto out;
+ 
+ 	/* Get the next ring to preempt to */
+ 	ring = get_next_ring(gpu);
+@@ -127,9 +134,11 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)
+ 		set_preempt_state(a5xx_gpu, PREEMPT_ABORT);
+ 		update_wptr(gpu, a5xx_gpu->cur_ring);
+ 		set_preempt_state(a5xx_gpu, PREEMPT_NONE);
+-		return;
++		goto out;
+ 	}
+ 
++	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
++
+ 	/* Make sure the wptr doesn't update while we're in motion */
+ 	spin_lock_irqsave(&ring->preempt_lock, flags);
+ 	a5xx_gpu->preempt[ring->id]->wptr = get_wptr(ring);
+@@ -152,6 +161,10 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)
+ 
+ 	/* And actually start the preemption */
+ 	gpu_write(gpu, REG_A5XX_CP_CONTEXT_SWITCH_CNTL, 1);
++	return;
++
++out:
++	spin_unlock_irqrestore(&a5xx_gpu->preempt_start_lock, flags);
+ }
+ 
+ void a5xx_preempt_irq(struct msm_gpu *gpu)
+@@ -188,6 +201,12 @@ void a5xx_preempt_irq(struct msm_gpu *gpu)
+ 	update_wptr(gpu, a5xx_gpu->cur_ring);
+ 
+ 	set_preempt_state(a5xx_gpu, PREEMPT_NONE);
++
++	/*
++	 * Try to trigger preemption again in case there was a submit or
++	 * retire during ring switch
++	 */
++	a5xx_preempt_trigger(gpu);
+ }
+ 
+ void a5xx_preempt_hw_init(struct msm_gpu *gpu)
+@@ -300,5 +319,6 @@ void a5xx_preempt_init(struct msm_gpu *gpu)
+ 		}
+ 	}
+ 
++	spin_lock_init(&a5xx_gpu->preempt_start_lock);
+ 	timer_setup(&a5xx_gpu->preempt_timer, a5xx_preempt_timer, 0);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-a5xx-properly-clear-preemption-records-on-re.patch b/queue-6.1/drm-msm-a5xx-properly-clear-preemption-records-on-re.patch
new file mode 100644
index 00000000000..e2955346a2f
--- /dev/null
+++ b/queue-6.1/drm-msm-a5xx-properly-clear-preemption-records-on-re.patch
@@ -0,0 +1,41 @@
+From f928e30955f9b92165049448ff5b6a97911bd442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2024 13:54:01 +0000
+Subject: drm/msm/a5xx: properly clear preemption records on resume
+
+From: Vladimir Lypak <vladimir.lypak@gmail.com>
+
+[ Upstream commit 64fd6d01a52904bdbda0ce810a45a428c995a4ca ]
+
+Two fields of preempt_record which are used by CP aren't reset on
+resume: "data" and "info". This is the reason behind faults which happen
+when we try to switch to the ring that was active last before suspend.
+In addition those faults can't be recovered from because we use suspend
+and resume to do so (keeping values of those fields again).
+
+Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets")
+Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/612043/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+index f58dd564d122b..67a8ef4adf6b6 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+@@ -204,6 +204,8 @@ void a5xx_preempt_hw_init(struct msm_gpu *gpu)
+ 		return;
+ 
+ 	for (i = 0; i < gpu->nr_rings; i++) {
++		a5xx_gpu->preempt[i]->data = 0;
++		a5xx_gpu->preempt[i]->info = 0;
+ 		a5xx_gpu->preempt[i]->wptr = 0;
+ 		a5xx_gpu->preempt[i]->rptr = 0;
+ 		a5xx_gpu->preempt[i]->rbase = gpu->rb[i]->iova;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-a5xx-workaround-early-ring-buffer-emptiness-.patch b/queue-6.1/drm-msm-a5xx-workaround-early-ring-buffer-emptiness-.patch
new file mode 100644
index 00000000000..a58fc494803
--- /dev/null
+++ b/queue-6.1/drm-msm-a5xx-workaround-early-ring-buffer-emptiness-.patch
@@ -0,0 +1,99 @@
+From cbcff33a0765da0a67ca634cbc2881d2c27bff87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2024 13:54:03 +0000
+Subject: drm/msm/a5xx: workaround early ring-buffer emptiness check
+
+From: Vladimir Lypak <vladimir.lypak@gmail.com>
+
+[ Upstream commit a30f9f65b5ac82d4390548c32ed9c7f05de7ddf5 ]
+
+There is another cause for soft lock-up of GPU in empty ring-buffer:
+race between GPU executing last commands and CPU checking ring for
+emptiness. On GPU side IRQ for retire is triggered by CACHE_FLUSH_TS
+event and RPTR shadow (which is used to check ring emptiness) is updated
+a bit later from CP_CONTEXT_SWITCH_YIELD. Thus if GPU is executing its
+last commands slow enough or we check that ring too fast we will miss a
+chance to trigger switch to lower priority ring because current ring isn't
+empty just yet. This can escalate to lock-up situation described in
+previous patch.
+To work-around this issue we keep track of last submit sequence number
+for each ring and compare it with one written to memptrs from GPU during
+execution of CACHE_FLUSH_TS event.
+
+Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets")
+Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612047/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c     | 4 ++++
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.h     | 1 +
+ drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 4 ++++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 6e3f7d39d7e38..5a10628934bc6 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -65,6 +65,8 @@ void a5xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring,
+ 
+ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ {
++	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
++	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+ 	struct msm_ringbuffer *ring = submit->ring;
+ 	struct msm_gem_object *obj;
+ 	uint32_t *ptr, dwords;
+@@ -109,6 +111,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit
+ 		}
+ 	}
+ 
++	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
+ 	a5xx_flush(gpu, ring, true);
+ 	a5xx_preempt_trigger(gpu);
+ 
+@@ -210,6 +213,7 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ 	/* Write the fence to the scratch register */
+ 	OUT_PKT4(ring, REG_A5XX_CP_SCRATCH_REG(2), 1);
+ 	OUT_RING(ring, submit->seqno);
++	a5xx_gpu->last_seqno[ring->id] = submit->seqno;
+ 
+ 	/*
+ 	 * Execute a CACHE_FLUSH_TS event. This will ensure that the
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+index b4d06ca3e499d..9c0d701fe4b85 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+@@ -34,6 +34,7 @@ struct a5xx_gpu {
+ 	struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS];
+ 	struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS];
+ 	uint64_t preempt_iova[MSM_GPU_MAX_RINGS];
++	uint32_t last_seqno[MSM_GPU_MAX_RINGS];
+ 
+ 	atomic_t preempt_state;
+ 	spinlock_t preempt_start_lock;
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+index c65b34a4a8cc2..0469fea550108 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+@@ -55,6 +55,8 @@ static inline void update_wptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+ /* Return the highest priority ringbuffer with something in it */
+ static struct msm_ringbuffer *get_next_ring(struct msm_gpu *gpu)
+ {
++	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
++	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+ 	unsigned long flags;
+ 	int i;
+ 
+@@ -64,6 +66,8 @@ static struct msm_ringbuffer *get_next_ring(struct msm_gpu *gpu)
+ 
+ 		spin_lock_irqsave(&ring->preempt_lock, flags);
+ 		empty = (get_wptr(ring) == gpu->funcs->get_rptr(gpu, ring));
++		if (!empty && ring == a5xx_gpu->cur_ring)
++			empty = ring->memptrs->fence == a5xx_gpu->last_seqno[i];
+ 		spin_unlock_irqrestore(&ring->preempt_lock, flags);
+ 
+ 		if (!empty)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-fix-incorrect-file-name-output-in-adreno_req.patch b/queue-6.1/drm-msm-fix-incorrect-file-name-output-in-adreno_req.patch
new file mode 100644
index 00000000000..feb60a86f6d
--- /dev/null
+++ b/queue-6.1/drm-msm-fix-incorrect-file-name-output-in-adreno_req.patch
@@ -0,0 +1,44 @@
+From 629650cf2bccad6eb6c6b5a3e98a16f04c7593ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2024 12:13:12 +0300
+Subject: drm/msm: Fix incorrect file name output in adreno_request_fw()
+
+From: Aleksandr Mishin <amishin@t-argos.ru>
+
+[ Upstream commit e19366911340c2313a1abbb09c54eaf9bdea4f58 ]
+
+In adreno_request_fw() when debugging information is printed to the log
+after firmware load, an incorrect filename is printed. 'newname' is used
+instead of 'fwname', so prefix "qcom/" is being added to filename.
+Looks like "copy-paste" mistake.
+
+Fix this mistake by replacing 'newname' with 'fwname'.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2c41ef1b6f7d ("drm/msm/adreno: deal with linux-firmware fw paths")
+Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/602382/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index c4ad70eb1d923..c73eb07afb0a7 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -418,7 +418,7 @@ adreno_request_fw(struct adreno_gpu *adreno_gpu, const char *fwname)
+ 		ret = request_firmware_direct(&fw, fwname, drm->dev);
+ 		if (!ret) {
+ 			DRM_DEV_INFO(drm->dev, "loaded %s from legacy location\n",
+-				newname);
++				fwname);
+ 			adreno_gpu->fwloc = FW_LOCATION_LEGACY;
+ 			goto out;
+ 		} else if (adreno_gpu->fwloc != FW_LOCATION_UNKNOWN) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-fix-s-null-argument-error.patch b/queue-6.1/drm-msm-fix-s-null-argument-error.patch
new file mode 100644
index 00000000000..980857a8a5e
--- /dev/null
+++ b/queue-6.1/drm-msm-fix-s-null-argument-error.patch
@@ -0,0 +1,48 @@
+From 350c9516faf43585cf8cf07471d8c480a1a99f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 09:53:37 -0700
+Subject: drm/msm: fix %s null argument error
+
+From: Sherry Yang <sherry.yang@oracle.com>
+
+[ Upstream commit 25b85075150fe8adddb096db8a4b950353045ee1 ]
+
+The following build error was triggered because of NULL string argument:
+
+BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c: In function 'mdp5_smp_dump':
+BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=]
+BUILDSTDERR:   352 |                         drm_printf(p, "%s:%d\t%d\t%s\n",
+BUILDSTDERR:       |                                                   ^~
+BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=]
+
+This happens from the commit a61ddb4393ad ("drm: enable (most) W=1
+warnings by default across the subsystem"). Using "(null)" instead
+to fix it.
+
+Fixes: bc5289eed481 ("drm/msm/mdp5: add debugfs to show smp block status")
+Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/611071/
+Link: https://lore.kernel.org/r/20240827165337.1075904-1-sherry.yang@oracle.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c
+index 56a3063545ec4..12d07e93a4c47 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c
+@@ -356,7 +356,7 @@ void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p)
+ 
+ 			drm_printf(p, "%s:%d\t%d\t%s\n",
+ 				pipe2name(pipe), j, inuse,
+-				plane ? plane->name : NULL);
++				plane ? plane->name : "(null)");
+ 
+ 			total += inuse;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-evergreen_cs-fix-int-overflow-errors-in-c.patch b/queue-6.1/drm-radeon-evergreen_cs-fix-int-overflow-errors-in-c.patch
new file mode 100644
index 00000000000..dfff4a0d6fd
--- /dev/null
+++ b/queue-6.1/drm-radeon-evergreen_cs-fix-int-overflow-errors-in-c.patch
@@ -0,0 +1,225 @@
+From 976cfb798fad4e66d87ed87b45cd34221cb0d304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 10:19:04 -0700
+Subject: drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 3fbaf475a5b8361ebee7da18964db809e37518b7 ]
+
+Several cs track offsets (such as 'track->db_s_read_offset')
+either are initialized with or plainly take big enough values that,
+once shifted 8 bits left, may be hit with integer overflow if the
+resulting values end up going over u32 limit.
+
+Same goes for a few instances of 'surf.layer_size * mslice'
+multiplications that are added to 'offset' variable - they may
+potentially overflow as well and need to be validated properly.
+
+While some debug prints in this code section take possible overflow
+issues into account, simply casting to (unsigned long) may be
+erroneous in its own way, as depending on CPU architecture one is
+liable to get different results.
+
+Fix said problems by:
+ - casting 'offset' to fixed u64 data type instead of
+ ambiguous unsigned long.
+ - casting one of the operands in vulnerable to integer
+ overflow cases to u64.
+ - adjust format specifiers in debug prints to properly
+ represent 'offset' values.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 285484e2d55e ("drm/radeon: add support for evergreen/ni tiling informations v11")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/evergreen_cs.c | 62 +++++++++++++--------------
+ 1 file changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
+index 0de79f3a7e3ff..820c2c3641d38 100644
+--- a/drivers/gpu/drm/radeon/evergreen_cs.c
++++ b/drivers/gpu/drm/radeon/evergreen_cs.c
+@@ -395,7 +395,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
+ 	struct evergreen_cs_track *track = p->track;
+ 	struct eg_surface surf;
+ 	unsigned pitch, slice, mslice;
+-	unsigned long offset;
++	u64 offset;
+ 	int r;
+ 
+ 	mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
+@@ -433,14 +433,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
+ 		return r;
+ 	}
+ 
+-	offset = track->cb_color_bo_offset[id] << 8;
++	offset = (u64)track->cb_color_bo_offset[id] << 8;
+ 	if (offset & (surf.base_align - 1)) {
+-		dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
++		dev_warn(p->dev, "%s:%d cb[%d] bo base %llu not aligned with %ld\n",
+ 			 __func__, __LINE__, id, offset, surf.base_align);
+ 		return -EINVAL;
+ 	}
+ 
+-	offset += surf.layer_size * mslice;
++	offset += (u64)surf.layer_size * mslice;
+ 	if (offset > radeon_bo_size(track->cb_color_bo[id])) {
+ 		/* old ddx are broken they allocate bo with w*h*bpp but
+ 		 * program slice with ALIGN(h, 8), catch this and patch
+@@ -448,14 +448,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
+ 		 */
+ 		if (!surf.mode) {
+ 			uint32_t *ib = p->ib.ptr;
+-			unsigned long tmp, nby, bsize, size, min = 0;
++			u64 tmp, nby, bsize, size, min = 0;
+ 
+ 			/* find the height the ddx wants */
+ 			if (surf.nby > 8) {
+ 				min = surf.nby - 8;
+ 			}
+ 			bsize = radeon_bo_size(track->cb_color_bo[id]);
+-			tmp = track->cb_color_bo_offset[id] << 8;
++			tmp = (u64)track->cb_color_bo_offset[id] << 8;
+ 			for (nby = surf.nby; nby > min; nby--) {
+ 				size = nby * surf.nbx * surf.bpe * surf.nsamples;
+ 				if ((tmp + size * mslice) <= bsize) {
+@@ -467,7 +467,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
+ 				slice = ((nby * surf.nbx) / 64) - 1;
+ 				if (!evergreen_surface_check(p, &surf, "cb")) {
+ 					/* check if this one works */
+-					tmp += surf.layer_size * mslice;
++					tmp += (u64)surf.layer_size * mslice;
+ 					if (tmp <= bsize) {
+ 						ib[track->cb_color_slice_idx[id]] = slice;
+ 						goto old_ddx_ok;
+@@ -476,9 +476,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
+ 			}
+ 		}
+ 		dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
+-			 "offset %d, max layer %d, bo size %ld, slice %d)\n",
++			 "offset %llu, max layer %d, bo size %ld, slice %d)\n",
+ 			 __func__, __LINE__, id, surf.layer_size,
+-			track->cb_color_bo_offset[id] << 8, mslice,
++			(u64)track->cb_color_bo_offset[id] << 8, mslice,
+ 			radeon_bo_size(track->cb_color_bo[id]), slice);
+ 		dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
+ 			 __func__, __LINE__, surf.nbx, surf.nby,
+@@ -562,7 +562,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
+ 	struct evergreen_cs_track *track = p->track;
+ 	struct eg_surface surf;
+ 	unsigned pitch, slice, mslice;
+-	unsigned long offset;
++	u64 offset;
+ 	int r;
+ 
+ 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
+@@ -608,18 +608,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
+ 		return r;
+ 	}
+ 
+-	offset = track->db_s_read_offset << 8;
++	offset = (u64)track->db_s_read_offset << 8;
+ 	if (offset & (surf.base_align - 1)) {
+-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
++		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
+ 			 __func__, __LINE__, offset, surf.base_align);
+ 		return -EINVAL;
+ 	}
+-	offset += surf.layer_size * mslice;
++	offset += (u64)surf.layer_size * mslice;
+ 	if (offset > radeon_bo_size(track->db_s_read_bo)) {
+ 		dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
+-			 "offset %ld, max layer %d, bo size %ld)\n",
++			 "offset %llu, max layer %d, bo size %ld)\n",
+ 			 __func__, __LINE__, surf.layer_size,
+-			(unsigned long)track->db_s_read_offset << 8, mslice,
++			(u64)track->db_s_read_offset << 8, mslice,
+ 			radeon_bo_size(track->db_s_read_bo));
+ 		dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
+ 			 __func__, __LINE__, track->db_depth_size,
+@@ -627,18 +627,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
+ 		return -EINVAL;
+ 	}
+ 
+-	offset = track->db_s_write_offset << 8;
++	offset = (u64)track->db_s_write_offset << 8;
+ 	if (offset & (surf.base_align - 1)) {
+-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
++		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
+ 			 __func__, __LINE__, offset, surf.base_align);
+ 		return -EINVAL;
+ 	}
+-	offset += surf.layer_size * mslice;
++	offset += (u64)surf.layer_size * mslice;
+ 	if (offset > radeon_bo_size(track->db_s_write_bo)) {
+ 		dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
+-			 "offset %ld, max layer %d, bo size %ld)\n",
++			 "offset %llu, max layer %d, bo size %ld)\n",
+ 			 __func__, __LINE__, surf.layer_size,
+-			(unsigned long)track->db_s_write_offset << 8, mslice,
++			(u64)track->db_s_write_offset << 8, mslice,
+ 			radeon_bo_size(track->db_s_write_bo));
+ 		return -EINVAL;
+ 	}
+@@ -659,7 +659,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
+ 	struct evergreen_cs_track *track = p->track;
+ 	struct eg_surface surf;
+ 	unsigned pitch, slice, mslice;
+-	unsigned long offset;
++	u64 offset;
+ 	int r;
+ 
+ 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
+@@ -706,34 +706,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
+ 		return r;
+ 	}
+ 
+-	offset = track->db_z_read_offset << 8;
++	offset = (u64)track->db_z_read_offset << 8;
+ 	if (offset & (surf.base_align - 1)) {
+-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
++		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
+ 			 __func__, __LINE__, offset, surf.base_align);
+ 		return -EINVAL;
+ 	}
+-	offset += surf.layer_size * mslice;
++	offset += (u64)surf.layer_size * mslice;
+ 	if (offset > radeon_bo_size(track->db_z_read_bo)) {
+ 		dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
+-			 "offset %ld, max layer %d, bo size %ld)\n",
++			 "offset %llu, max layer %d, bo size %ld)\n",
+ 			 __func__, __LINE__, surf.layer_size,
+-			(unsigned long)track->db_z_read_offset << 8, mslice,
++			(u64)track->db_z_read_offset << 8, mslice,
+ 			radeon_bo_size(track->db_z_read_bo));
+ 		return -EINVAL;
+ 	}
+ 
+-	offset = track->db_z_write_offset << 8;
++	offset = (u64)track->db_z_write_offset << 8;
+ 	if (offset & (surf.base_align - 1)) {
+-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
++		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
+ 			 __func__, __LINE__, offset, surf.base_align);
+ 		return -EINVAL;
+ 	}
+-	offset += surf.layer_size * mslice;
++	offset += (u64)surf.layer_size * mslice;
+ 	if (offset > radeon_bo_size(track->db_z_write_bo)) {
+ 		dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
+-			 "offset %ld, max layer %d, bo size %ld)\n",
++			 "offset %llu, max layer %d, bo size %ld)\n",
+ 			 __func__, __LINE__, surf.layer_size,
+-			(unsigned long)track->db_z_write_offset << 8, mslice,
++			(u64)track->db_z_write_offset << 8, mslice,
+ 			radeon_bo_size(track->db_z_write_bo));
+ 		return -EINVAL;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-properly-handle-vbios-fake-edid-sizing.patch b/queue-6.1/drm-radeon-properly-handle-vbios-fake-edid-sizing.patch
new file mode 100644
index 00000000000..ab4f0065030
--- /dev/null
+++ b/queue-6.1/drm-radeon-properly-handle-vbios-fake-edid-sizing.patch
@@ -0,0 +1,79 @@
+From cfa8d28056a2699c0fb4a2ff001b2f9663e70977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2024 13:31:58 -0400
+Subject: drm/radeon: properly handle vbios fake edid sizing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 17c6baff3d5f65c8da164137a58742541a060b2f ]
+
+The comment in the vbios structure says:
+// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
+
+This fake edid struct has not been used in a long time, so I'm
+not sure if there were actually any boards out there with a non-128 byte
+EDID, but align the code with the comment.
+
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reported-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lists.freedesktop.org/archives/amd-gfx/2024-June/109964.html
+Fixes: c324acd5032f ("drm/radeon/kms: parse the extended LCD info block")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 29 +++++++++++++-----------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 4ad5a328d9202..42ed71b6db8e9 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1712,26 +1712,29 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
+ 					fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;
+ 					if (fake_edid_record->ucFakeEDIDLength) {
+ 						struct edid *edid;
+-						int edid_size =
+-							max((int)EDID_LENGTH, (int)fake_edid_record->ucFakeEDIDLength);
+-						edid = kmalloc(edid_size, GFP_KERNEL);
++						int edid_size;
++
++						if (fake_edid_record->ucFakeEDIDLength == 128)
++							edid_size = fake_edid_record->ucFakeEDIDLength;
++						else
++							edid_size = fake_edid_record->ucFakeEDIDLength * 128;
++						edid = kmemdup(&fake_edid_record->ucFakeEDIDString[0],
++							       edid_size, GFP_KERNEL);
+ 						if (edid) {
+-							memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
+-							       fake_edid_record->ucFakeEDIDLength);
+-
+ 							if (drm_edid_is_valid(edid)) {
+ 								rdev->mode_info.bios_hardcoded_edid = edid;
+ 								rdev->mode_info.bios_hardcoded_edid_size = edid_size;
+-							} else
++							} else {
+ 								kfree(edid);
++							}
+ 						}
++						record += struct_size(fake_edid_record,
++								      ucFakeEDIDString,
++								      edid_size);
++					} else {
++						/* empty fake edid record must be 3 bytes long */
++						record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					}
+-					record += fake_edid_record->ucFakeEDIDLength ?
+-						  struct_size(fake_edid_record,
+-							      ucFakeEDIDString,
+-							      fake_edid_record->ucFakeEDIDLength) :
+-						  /* empty fake edid record must be 3 bytes long */
+-						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					break;
+ 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-radeon-replace-one-element-array-with-flexible-a.patch b/queue-6.1/drm-radeon-replace-one-element-array-with-flexible-a.patch
new file mode 100644
index 00000000000..4589840ab42
--- /dev/null
+++ b/queue-6.1/drm-radeon-replace-one-element-array-with-flexible-a.patch
@@ -0,0 +1,69 @@
+From 3f8484c92380fba3355e26474dcc3cbbc61b4215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Oct 2022 16:32:05 +1300
+Subject: drm/radeon: Replace one-element array with flexible-array member
+
+From: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@gmail.com>
+
+[ Upstream commit c81c5bd5cf2f428867e0bcfcccd4e4d2f8c68f51 ]
+
+One-element arrays are deprecated, and we are replacing them with
+flexible array members instead. So, replace one-element array with
+flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and
+refactor the rest of the code accordingly.
+
+It's worth mentioning that doing a build before/after this patch results
+in no binary output differences.
+
+This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
+routines on memcpy() and help us make progress towards globally
+enabling -fstrict-flex-arrays=3 [1].
+
+Link: https://github.com/KSPP/linux/issues/79
+Link: https://github.com/KSPP/linux/issues/239
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1]
+
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 17c6baff3d5f ("drm/radeon: properly handle vbios fake edid sizing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/atombios.h        | 2 +-
+ drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
+index da35a970fcc0d..235e59b547a1e 100644
+--- a/drivers/gpu/drm/radeon/atombios.h
++++ b/drivers/gpu/drm/radeon/atombios.h
+@@ -3615,7 +3615,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD
+ {
+   UCHAR ucRecordType;
+   UCHAR ucFakeEDIDLength;
+-  UCHAR ucFakeEDIDString[1];    // This actually has ucFakeEdidLength elements.
++  UCHAR ucFakeEDIDString[];    // This actually has ucFakeEdidLength elements.
+ } ATOM_FAKE_EDID_PATCH_RECORD;
+ 
+ typedef struct  _ATOM_PANEL_RESOLUTION_PATCH_RECORD
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 204127bad89ca..4ad5a328d9202 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1727,8 +1727,11 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
+ 						}
+ 					}
+ 					record += fake_edid_record->ucFakeEDIDLength ?
+-						fake_edid_record->ucFakeEDIDLength + 2 :
+-						sizeof(ATOM_FAKE_EDID_PATCH_RECORD);
++						  struct_size(fake_edid_record,
++							      ucFakeEDIDString,
++							      fake_edid_record->ucFakeEDIDLength) :
++						  /* empty fake edid record must be 3 bytes long */
++						  sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
+ 					break;
+ 				case LCD_PANEL_RESOLUTION_RECORD_TYPE:
+ 					panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-rockchip-dw_hdmi-fix-reading-edid-when-using-a-f.patch b/queue-6.1/drm-rockchip-dw_hdmi-fix-reading-edid-when-using-a-f.patch
new file mode 100644
index 00000000000..22224adade5
--- /dev/null
+++ b/queue-6.1/drm-rockchip-dw_hdmi-fix-reading-edid-when-using-a-f.patch
@@ -0,0 +1,45 @@
+From 2bee5f9744da2aedabb1b7c45d1e1db7f2e827c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jun 2024 17:03:55 +0000
+Subject: drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit a5d024541ec466f428e6c514577d511a40779c7b ]
+
+EDID cannot be read on RK3328 until after read_hpd has been called and
+correct io voltage has been configured based on connection status.
+
+When a forced mode is used, e.g. video=1920x1080@60e, the connector
+detect ops, that in turn normally calls the read_hpd, never gets called.
+
+This result in reading EDID to fail in connector get_modes ops.
+
+Call dw_hdmi_rk3328_read_hpd at end of dw_hdmi_rk3328_setup_hpd to
+correct io voltage and allow reading EDID after setup_hpd.
+
+Fixes: 1c53ba8f22a1 ("drm/rockchip: dw_hdmi: add dw-hdmi support for the rk3328")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240615170417.3134517-5-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+index ae857bf8bd624..566f2942f24ae 100644
+--- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
++++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c
+@@ -410,6 +410,8 @@ static void dw_hdmi_rk3328_setup_hpd(struct dw_hdmi *dw_hdmi, void *data)
+ 		HIWORD_UPDATE(RK3328_HDMI_SDAIN_MSK | RK3328_HDMI_SCLIN_MSK,
+ 			      RK3328_HDMI_SDAIN_MSK | RK3328_HDMI_SCLIN_MSK |
+ 			      RK3328_HDMI_HPD_IOE));
++
++	dw_hdmi_rk3328_read_hpd(dw_hdmi, data);
+ }
+ 
+ static const struct dw_hdmi_phy_ops rk3228_hdmi_phy_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-rockchip-vop-allow-4096px-width-scaling.patch b/queue-6.1/drm-rockchip-vop-allow-4096px-width-scaling.patch
new file mode 100644
index 00000000000..6dd6ec2b2eb
--- /dev/null
+++ b/queue-6.1/drm-rockchip-vop-allow-4096px-width-scaling.patch
@@ -0,0 +1,43 @@
+From fe32d0d61ea76cc372975a7e7afa83dc2e8eb91e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jun 2024 17:03:54 +0000
+Subject: drm/rockchip: vop: Allow 4096px width scaling
+
+From: Alex Bee <knaerzche@gmail.com>
+
+[ Upstream commit 0ef968d91a20b5da581839f093f98f7a03a804f7 ]
+
+There is no reason to limit VOP scaling to 3840px width, the limit of
+RK3288, when there are newer VOP versions that support 4096px width.
+
+Change to enforce a maximum of 4096px width plane scaling, the maximum
+supported output width of the VOP versions supported by this driver.
+
+Fixes: 4c156c21c794 ("drm/rockchip: vop: support plane scale")
+Signed-off-by: Alex Bee <knaerzche@gmail.com>
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240615170417.3134517-4-jonas@kwiboo.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 632ab8941eb44..59fde46f6dff8 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -385,8 +385,8 @@ static void scl_vop_cal_scl_fac(struct vop *vop, const struct vop_win_data *win,
+ 	if (info->is_yuv)
+ 		is_yuv = true;
+ 
+-	if (dst_w > 3840) {
+-		DRM_DEV_ERROR(vop->dev, "Maximum dst width (3840) exceeded\n");
++	if (dst_w > 4096) {
++		DRM_DEV_ERROR(vop->dev, "Maximum dst width (4096) exceeded\n");
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-stm-fix-an-error-handling-path-in-stm_drm_platfo.patch b/queue-6.1/drm-stm-fix-an-error-handling-path-in-stm_drm_platfo.patch
new file mode 100644
index 00000000000..8bcea3e7891
--- /dev/null
+++ b/queue-6.1/drm-stm-fix-an-error-handling-path-in-stm_drm_platfo.patch
@@ -0,0 +1,45 @@
+From 8488fa958145d213a6acbe989b7c811f789ef842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jan 2024 17:54:32 +0100
+Subject: drm/stm: Fix an error handling path in stm_drm_platform_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ce7c90bfda2656418c69ba0dd8f8a7536b8928d4 ]
+
+If drm_dev_register() fails, a call to drv_load() must be undone, as
+already done in the remove function.
+
+Fixes: b759012c5fa7 ("drm/stm: Add STM32 LTDC driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20fff7f853f20a48a96db8ff186124470ec4d976.1704560028.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/stm/drv.c b/drivers/gpu/drm/stm/drv.c
+index 0a09a85ac9d69..77b1b10456f52 100644
+--- a/drivers/gpu/drm/stm/drv.c
++++ b/drivers/gpu/drm/stm/drv.c
+@@ -201,12 +201,14 @@ static int stm_drm_platform_probe(struct platform_device *pdev)
+ 
+ 	ret = drm_dev_register(ddev, 0);
+ 	if (ret)
+-		goto err_put;
++		goto err_unload;
+ 
+ 	drm_fbdev_generic_setup(ddev, 16);
+ 
+ 	return 0;
+ 
++err_unload:
++	drv_unload(ddev);
+ err_put:
+ 	drm_dev_put(ddev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-stm-ltdc-check-memory-returned-by-devm_kzalloc.patch b/queue-6.1/drm-stm-ltdc-check-memory-returned-by-devm_kzalloc.patch
new file mode 100644
index 00000000000..41adb4d73db
--- /dev/null
+++ b/queue-6.1/drm-stm-ltdc-check-memory-returned-by-devm_kzalloc.patch
@@ -0,0 +1,38 @@
+From 853c3b674d9fac6ce03e12679edabe7c9d43d6bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 May 2023 10:28:54 +0300
+Subject: drm/stm: ltdc: check memory returned by devm_kzalloc()
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit fd39730c58890cd7f0a594231e19bb357f28877c ]
+
+devm_kzalloc() can fail and return NULL pointer. Check its return status.
+Identified with Coccinelle (kmerr.cocci script).
+
+Fixes: 484e72d3146b ("drm/stm: ltdc: add support of ycbcr pixel formats")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230531072854.142629-1-claudiu.beznea@microchip.com
+Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index b8be4c1db4235..b8c1636168cfa 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -1581,6 +1581,8 @@ static struct drm_plane *ltdc_plane_create(struct drm_device *ddev,
+ 			       ARRAY_SIZE(ltdc_drm_fmt_ycbcr_sp) +
+ 			       ARRAY_SIZE(ltdc_drm_fmt_ycbcr_fp)) *
+ 			       sizeof(*formats), GFP_KERNEL);
++	if (!formats)
++		return NULL;
+ 
+ 	for (i = 0; i < ldev->caps.pix_fmt_nb; i++) {
+ 		drm_fmt = ldev->caps.pix_fmt_drm[i];
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-vc4-hdmi-handle-error-case-of-pm_runtime_resume_.patch b/queue-6.1/drm-vc4-hdmi-handle-error-case-of-pm_runtime_resume_.patch
new file mode 100644
index 00000000000..1e1b429648a
--- /dev/null
+++ b/queue-6.1/drm-vc4-hdmi-handle-error-case-of-pm_runtime_resume_.patch
@@ -0,0 +1,61 @@
+From 23461451574cbc794aab9e29b642c923262b21c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 23:40:45 +0200
+Subject: drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f1a54e860b1bc8d824925b5a77f510913880e8d6 ]
+
+The commit 0f5251339eda ("drm/vc4: hdmi: Make sure the controller is
+powered in detect") introduced the necessary power management handling
+to avoid register access while controller is powered down.
+Unfortunately it just print a warning if pm_runtime_resume_and_get()
+fails and proceed anyway.
+
+This could happen during suspend to idle. So we must assume it is unsafe
+to access the HDMI register. So bail out properly.
+
+Fixes: 0f5251339eda ("drm/vc4: hdmi: Make sure the controller is powered in detect")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240821214052.6800-3-wahrenst@gmx.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 072e2487b4655..971801acbde60 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -448,6 +448,7 @@ static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector,
+ {
+ 	struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
+ 	enum drm_connector_status status = connector_status_disconnected;
++	int ret;
+ 
+ 	/*
+ 	 * NOTE: This function should really take vc4_hdmi->mutex, but
+@@ -460,7 +461,12 @@ static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector,
+ 	 * the lock for now.
+ 	 */
+ 
+-	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
++	ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
++	if (ret) {
++		drm_err_once(connector->dev, "Failed to retain HDMI power domain: %d\n",
++			     ret);
++		return connector_status_unknown;
++	}
+ 
+ 	if (vc4_hdmi->hpd_gpio) {
+ 		if (gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio))
+-- 
+2.43.0
+
diff --git a/queue-6.1/dt-bindings-iio-asahi-kasei-ak8975-drop-incorrect-ak.patch b/queue-6.1/dt-bindings-iio-asahi-kasei-ak8975-drop-incorrect-ak.patch
new file mode 100644
index 00000000000..fd433d3919c
--- /dev/null
+++ b/queue-6.1/dt-bindings-iio-asahi-kasei-ak8975-drop-incorrect-ak.patch
@@ -0,0 +1,41 @@
+From 2b554252587f51c3ee62c8e357cddf66125624ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 07:30:16 +0200
+Subject: dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116
+ compatible
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c7668ac67bc21aebdd8e2d7f839bfffba31b7713 ]
+
+All compatibles in this binding without prefixes were deprecated, so
+adding a new deprecated one after some time is not allowed, because it
+defies the core logic of deprecating things.
+
+Drop the AK09916 vendorless compatible.
+
+Fixes: 76e28aa97fa0 ("iio: magnetometer: ak8975: add AK09116 support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20240806053016.6401-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml b/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml
+index 9790f75fc669e..fe5145d3b73cf 100644
+--- a/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml
++++ b/Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml
+@@ -23,7 +23,6 @@ properties:
+           - ak8963
+           - ak09911
+           - ak09912
+-          - ak09916
+         deprecated: true
+ 
+   reg:
+-- 
+2.43.0
+
diff --git a/queue-6.1/edac-synopsys-fix-ecc-status-and-irq-control-race-co.patch b/queue-6.1/edac-synopsys-fix-ecc-status-and-irq-control-race-co.patch
new file mode 100644
index 00000000000..faae63516b8
--- /dev/null
+++ b/queue-6.1/edac-synopsys-fix-ecc-status-and-irq-control-race-co.patch
@@ -0,0 +1,174 @@
+From fa6984808a158469cd48f2e415ce779679b763ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 21:12:46 +0300
+Subject: EDAC/synopsys: Fix ECC status and IRQ control race condition
+
+From: Serge Semin <fancer.lancer@gmail.com>
+
+[ Upstream commit 591c946675d88dcc0ae9ff54be9d5caaee8ce1e3 ]
+
+The race condition around the ECCCLR register access happens in the IRQ
+disable method called in the device remove() procedure and in the ECC IRQ
+handler:
+
+  1. Enable IRQ:
+     a. ECCCLR = EN_CE | EN_UE
+  2. Disable IRQ:
+     a. ECCCLR = 0
+  3. IRQ handler:
+     a. ECCCLR = CLR_CE | CLR_CE_CNT | CLR_CE | CLR_CE_CNT
+     b. ECCCLR = 0
+     c. ECCCLR = EN_CE | EN_UE
+
+So if the IRQ disabling procedure is called concurrently with the IRQ
+handler method the IRQ might be actually left enabled due to the
+statement 3c.
+
+The root cause of the problem is that ECCCLR register (which since
+v3.10a has been called as ECCCTL) has intermixed ECC status data clear
+flags and the IRQ enable/disable flags. Thus the IRQ disabling (clear EN
+flags) and handling (write 1 to clear ECC status data) procedures must
+be serialised around the ECCCTL register modification to prevent the
+race.
+
+So fix the problem described above by adding the spin-lock around the
+ECCCLR modifications and preventing the IRQ-handler from modifying the
+IRQs enable flags (there is no point in disabling the IRQ and then
+re-enabling it again within a single IRQ handler call, see the
+statements 3a/3b and 3c above).
+
+Fixes: f7824ded4149 ("EDAC/synopsys: Add support for version 3 of the Synopsys EDAC DDR")
+Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20240222181324.28242-2-fancer.lancer@gmail.com
+Stable-dep-of: 35e6dbfe1846 ("EDAC/synopsys: Fix error injection on Zynq UltraScale+")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/synopsys_edac.c | 50 ++++++++++++++++++++++++++----------
+ 1 file changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
+index f7d37c2828199..014a2176c2c18 100644
+--- a/drivers/edac/synopsys_edac.c
++++ b/drivers/edac/synopsys_edac.c
+@@ -9,6 +9,7 @@
+ #include <linux/edac.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
++#include <linux/spinlock.h>
+ #include <linux/interrupt.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -300,6 +301,7 @@ struct synps_ecc_status {
+ /**
+  * struct synps_edac_priv - DDR memory controller private instance data.
+  * @baseaddr:		Base address of the DDR controller.
++ * @reglock:		Concurrent CSRs access lock.
+  * @message:		Buffer for framing the event specific info.
+  * @stat:		ECC status information.
+  * @p_data:		Platform data.
+@@ -314,6 +316,7 @@ struct synps_ecc_status {
+  */
+ struct synps_edac_priv {
+ 	void __iomem *baseaddr;
++	spinlock_t reglock;
+ 	char message[SYNPS_EDAC_MSG_SIZE];
+ 	struct synps_ecc_status stat;
+ 	const struct synps_platform_data *p_data;
+@@ -409,7 +412,8 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)
+ static int zynqmp_get_error_info(struct synps_edac_priv *priv)
+ {
+ 	struct synps_ecc_status *p;
+-	u32 regval, clearval = 0;
++	u32 regval, clearval;
++	unsigned long flags;
+ 	void __iomem *base;
+ 
+ 	base = priv->baseaddr;
+@@ -453,10 +457,14 @@ static int zynqmp_get_error_info(struct synps_edac_priv *priv)
+ 	p->ueinfo.blknr = (regval & ECC_CEADDR1_BLKNR_MASK);
+ 	p->ueinfo.data = readl(base + ECC_UESYND0_OFST);
+ out:
+-	clearval = ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT;
+-	clearval |= ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT;
++	spin_lock_irqsave(&priv->reglock, flags);
++
++	clearval = readl(base + ECC_CLR_OFST) |
++		   ECC_CTRL_CLR_CE_ERR | ECC_CTRL_CLR_CE_ERRCNT |
++		   ECC_CTRL_CLR_UE_ERR | ECC_CTRL_CLR_UE_ERRCNT;
+ 	writel(clearval, base + ECC_CLR_OFST);
+-	writel(0x0, base + ECC_CLR_OFST);
++
++	spin_unlock_irqrestore(&priv->reglock, flags);
+ 
+ 	return 0;
+ }
+@@ -516,24 +524,41 @@ static void handle_error(struct mem_ctl_info *mci, struct synps_ecc_status *p)
+ 
+ static void enable_intr(struct synps_edac_priv *priv)
+ {
++	unsigned long flags;
++
+ 	/* Enable UE/CE Interrupts */
+-	if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)
+-		writel(DDR_UE_MASK | DDR_CE_MASK,
+-		       priv->baseaddr + ECC_CLR_OFST);
+-	else
++	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)) {
+ 		writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK,
+ 		       priv->baseaddr + DDR_QOS_IRQ_EN_OFST);
+ 
++		return;
++	}
++
++	spin_lock_irqsave(&priv->reglock, flags);
++
++	writel(DDR_UE_MASK | DDR_CE_MASK,
++	       priv->baseaddr + ECC_CLR_OFST);
++
++	spin_unlock_irqrestore(&priv->reglock, flags);
+ }
+ 
+ static void disable_intr(struct synps_edac_priv *priv)
+ {
++	unsigned long flags;
++
+ 	/* Disable UE/CE Interrupts */
+-	if (priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)
+-		writel(0x0, priv->baseaddr + ECC_CLR_OFST);
+-	else
++	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR)) {
+ 		writel(DDR_QOSUE_MASK | DDR_QOSCE_MASK,
+ 		       priv->baseaddr + DDR_QOS_IRQ_DB_OFST);
++
++		return;
++	}
++
++	spin_lock_irqsave(&priv->reglock, flags);
++
++	writel(0, priv->baseaddr + ECC_CLR_OFST);
++
++	spin_unlock_irqrestore(&priv->reglock, flags);
+ }
+ 
+ /**
+@@ -577,8 +602,6 @@ static irqreturn_t intr_handler(int irq, void *dev_id)
+ 	/* v3.0 of the controller does not have this register */
+ 	if (!(priv->p_data->quirks & DDR_ECC_INTR_SELF_CLEAR))
+ 		writel(regval, priv->baseaddr + DDR_QOS_IRQ_STAT_OFST);
+-	else
+-		enable_intr(priv);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -1360,6 +1383,7 @@ static int mc_probe(struct platform_device *pdev)
+ 	priv = mci->pvt_info;
+ 	priv->baseaddr = baseaddr;
+ 	priv->p_data = p_data;
++	spin_lock_init(&priv->reglock);
+ 
+ 	mc_init(mci, pdev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/edac-synopsys-fix-error-injection-on-zynq-ultrascale.patch b/queue-6.1/edac-synopsys-fix-error-injection-on-zynq-ultrascale.patch
new file mode 100644
index 00000000000..82e8bbdc269
--- /dev/null
+++ b/queue-6.1/edac-synopsys-fix-error-injection-on-zynq-ultrascale.patch
@@ -0,0 +1,113 @@
+From c24bf6a1361ad8ed46d1d13ef58a3a39596fa4a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 15:36:56 +0530
+Subject: EDAC/synopsys: Fix error injection on Zynq UltraScale+
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+
+[ Upstream commit 35e6dbfe1846caeafabb49b7575adb36b0aa2269 ]
+
+The Zynq UltraScale+ MPSoC DDR has a disjoint memory from 2GB to 32GB.
+The DDR host interface has a contiguous memory so while injecting
+errors, the driver should remove the hole else the injection fails as
+the address translation is incorrect.
+
+Introduce a get_mem_info() function pointer and set it for Zynq
+UltraScale+ platform to return host address.
+
+Fixes: 1a81361f75d8 ("EDAC, synopsys: Add Error Injection support for ZynqMP DDR controller")
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20240711100656.31376-1-shubhrajyoti.datta@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/synopsys_edac.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
+index 014a2176c2c18..e7c18bb61f81d 100644
+--- a/drivers/edac/synopsys_edac.c
++++ b/drivers/edac/synopsys_edac.c
+@@ -10,6 +10,7 @@
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/spinlock.h>
++#include <linux/sizes.h>
+ #include <linux/interrupt.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -338,6 +339,7 @@ struct synps_edac_priv {
+  * @get_mtype:		Get mtype.
+  * @get_dtype:		Get dtype.
+  * @get_ecc_state:	Get ECC state.
++ * @get_mem_info:	Get EDAC memory info
+  * @quirks:		To differentiate IPs.
+  */
+ struct synps_platform_data {
+@@ -345,6 +347,9 @@ struct synps_platform_data {
+ 	enum mem_type (*get_mtype)(const void __iomem *base);
+ 	enum dev_type (*get_dtype)(const void __iomem *base);
+ 	bool (*get_ecc_state)(void __iomem *base);
++#ifdef CONFIG_EDAC_DEBUG
++	u64 (*get_mem_info)(struct synps_edac_priv *priv);
++#endif
+ 	int quirks;
+ };
+ 
+@@ -403,6 +408,25 @@ static int zynq_get_error_info(struct synps_edac_priv *priv)
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_EDAC_DEBUG
++/**
++ * zynqmp_get_mem_info - Get the current memory info.
++ * @priv:	DDR memory controller private instance data.
++ *
++ * Return: host interface address.
++ */
++static u64 zynqmp_get_mem_info(struct synps_edac_priv *priv)
++{
++	u64 hif_addr = 0, linear_addr;
++
++	linear_addr = priv->poison_addr;
++	if (linear_addr >= SZ_32G)
++		linear_addr = linear_addr - SZ_32G + SZ_2G;
++	hif_addr = linear_addr >> 3;
++	return hif_addr;
++}
++#endif
++
+ /**
+  * zynqmp_get_error_info - Get the current ECC error info.
+  * @priv:	DDR memory controller private instance data.
+@@ -923,6 +947,9 @@ static const struct synps_platform_data zynqmp_edac_def = {
+ 	.get_mtype	= zynqmp_get_mtype,
+ 	.get_dtype	= zynqmp_get_dtype,
+ 	.get_ecc_state	= zynqmp_get_ecc_state,
++#ifdef CONFIG_EDAC_DEBUG
++	.get_mem_info	= zynqmp_get_mem_info,
++#endif
+ 	.quirks         = (DDR_ECC_INTR_SUPPORT
+ #ifdef CONFIG_EDAC_DEBUG
+ 			  | DDR_ECC_DATA_POISON_SUPPORT
+@@ -976,10 +1003,16 @@ MODULE_DEVICE_TABLE(of, synps_edac_match);
+ static void ddr_poison_setup(struct synps_edac_priv *priv)
+ {
+ 	int col = 0, row = 0, bank = 0, bankgrp = 0, rank = 0, regval;
++	const struct synps_platform_data *p_data;
+ 	int index;
+ 	ulong hif_addr = 0;
+ 
+-	hif_addr = priv->poison_addr >> 3;
++	p_data = priv->p_data;
++
++	if (p_data->get_mem_info)
++		hif_addr = p_data->get_mem_info(priv);
++	else
++		hif_addr = priv->poison_addr >> 3;
+ 
+ 	for (index = 0; index < DDR_MAX_ROW_SHIFT; index++) {
+ 		if (priv->row_shift[index])
+-- 
+2.43.0
+
diff --git a/queue-6.1/ep93xx-clock-fix-off-by-one-in-ep93xx_div_recalc_rat.patch b/queue-6.1/ep93xx-clock-fix-off-by-one-in-ep93xx_div_recalc_rat.patch
new file mode 100644
index 00000000000..c2e0ae7bb8b
--- /dev/null
+++ b/queue-6.1/ep93xx-clock-fix-off-by-one-in-ep93xx_div_recalc_rat.patch
@@ -0,0 +1,42 @@
+From 63130ad07a3aeea4429a4f70dfcb118009e9c48d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 10:39:15 +0300
+Subject: ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
+
+From: Dan Carpenter <alexander.sverdlin@gmail.com>
+
+[ Upstream commit c7f06284a6427475e3df742215535ec3f6cd9662 ]
+
+The psc->div[] array has psc->num_div elements.  These values come from
+when we call clk_hw_register_div().  It's adc_divisors and
+ARRAY_SIZE(adc_divisors)) and so on.  So this condition needs to be >=
+instead of > to prevent an out of bounds read.
+
+Fixes: 9645ccc7bd7a ("ep93xx: clock: convert in-place to COMMON_CLK")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Reviewed-by: Nikita Shubin <nikita.shubin@maquefel.me>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Link: https://lore.kernel.org/r/1caf01ad4c0a8069535813c26c7f0b8ea011155e.camel@linaro.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ep93xx/clock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ep93xx/clock.c b/arch/arm/mach-ep93xx/clock.c
+index 85a496ddc6197..e9f72a529b508 100644
+--- a/arch/arm/mach-ep93xx/clock.c
++++ b/arch/arm/mach-ep93xx/clock.c
+@@ -359,7 +359,7 @@ static unsigned long ep93xx_div_recalc_rate(struct clk_hw *hw,
+ 	u32 val = __raw_readl(psc->reg);
+ 	u8 index = (val & psc->mask) >> psc->shift;
+ 
+-	if (index > psc->num_div)
++	if (index >= psc->num_div)
+ 		return 0;
+ 
+ 	return DIV_ROUND_UP_ULL(parent_rate, psc->div[index]);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-avoid-buffer_head-leak-in-ext4_mark_inode_used.patch b/queue-6.1/ext4-avoid-buffer_head-leak-in-ext4_mark_inode_used.patch
new file mode 100644
index 00000000000..e6b3394c72d
--- /dev/null
+++ b/queue-6.1/ext4-avoid-buffer_head-leak-in-ext4_mark_inode_used.patch
@@ -0,0 +1,51 @@
+From 50c256ffec11380ed4a7db0bb23851798374be21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 21:22:28 +0800
+Subject: ext4: avoid buffer_head leak in ext4_mark_inode_used()
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 5e5b2a56c57def1b41efd49596621504d7bcc61c ]
+
+Release inode_bitmap_bh from ext4_read_inode_bitmap() in
+ext4_mark_inode_used() to avoid buffer_head leak.
+By the way, remove unneeded goto for invalid ino when inode_bitmap_bh
+is NULL.
+
+Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Link: https://patch.msgid.link/20240820132234.2759926-2-shikemeng@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ialloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index e09c74927a430..14831c3df0cda 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -755,10 +755,10 @@ int ext4_mark_inode_used(struct super_block *sb, int ino)
+ 	struct ext4_group_desc *gdp;
+ 	ext4_group_t group;
+ 	int bit;
+-	int err = -EFSCORRUPTED;
++	int err;
+ 
+ 	if (ino < EXT4_FIRST_INO(sb) || ino > max_ino)
+-		goto out;
++		return -EFSCORRUPTED;
+ 
+ 	group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
+ 	bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
+@@ -861,6 +861,7 @@ int ext4_mark_inode_used(struct super_block *sb, int ino)
+ 	err = ext4_handle_dirty_metadata(NULL, NULL, group_desc_bh);
+ 	sync_dirty_buffer(group_desc_bh);
+ out:
++	brelse(inode_bitmap_bh);
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-avoid-negative-min_clusters-in-find_group_orlov.patch b/queue-6.1/ext4-avoid-negative-min_clusters-in-find_group_orlov.patch
new file mode 100644
index 00000000000..52bc58a9208
--- /dev/null
+++ b/queue-6.1/ext4-avoid-negative-min_clusters-in-find_group_orlov.patch
@@ -0,0 +1,41 @@
+From 4ac2313d98954997eb467a6f946c02289aca3ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 21:22:30 +0800
+Subject: ext4: avoid negative min_clusters in find_group_orlov()
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit bb0a12c3439b10d88412fd3102df5b9a6e3cd6dc ]
+
+min_clusters is signed integer and will be converted to unsigned
+integer when compared with unsigned number stats.free_clusters.
+If min_clusters is negative, it will be converted to a huge unsigned
+value in which case all groups may not meet the actual desired free
+clusters.
+Set negative min_clusters to 0 to avoid unexpected behavior.
+
+Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3")
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Link: https://patch.msgid.link/20240820132234.2759926-4-shikemeng@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ialloc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 99e8852c4e1dd..8a8d802275608 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -514,6 +514,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
+ 	if (min_inodes < 1)
+ 		min_inodes = 1;
+ 	min_clusters = avefreec - EXT4_CLUSTERS_PER_GROUP(sb)*flex_size / 4;
++	if (min_clusters < 0)
++		min_clusters = 0;
+ 
+ 	/*
+ 	 * Start looking in the flex group where we last allocated an
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-avoid-oob-when-system.data-xattr-changes-undern.patch b/queue-6.1/ext4-avoid-oob-when-system.data-xattr-changes-undern.patch
new file mode 100644
index 00000000000..6d5da953666
--- /dev/null
+++ b/queue-6.1/ext4-avoid-oob-when-system.data-xattr-changes-undern.patch
@@ -0,0 +1,146 @@
+From d091c92f4077f5e01178112dd631345da3a779c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 12:23:24 -0300
+Subject: ext4: avoid OOB when system.data xattr changes underneath the
+ filesystem
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit c6b72f5d82b1017bad80f9ebf502832fc321d796 ]
+
+When looking up for an entry in an inlined directory, if e_value_offs is
+changed underneath the filesystem by some change in the block device, it
+will lead to an out-of-bounds access that KASAN detects as an UAF.
+
+EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
+loop0: detected capacity change from 2048 to 2047
+==================================================================
+BUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500
+Read of size 1 at addr ffff88803e91130f by task syz-executor269/5103
+
+CPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:93 [inline]
+ dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
+ print_address_description mm/kasan/report.c:377 [inline]
+ print_report+0x169/0x550 mm/kasan/report.c:488
+ kasan_report+0x143/0x180 mm/kasan/report.c:601
+ ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500
+ ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697
+ __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573
+ ext4_lookup_entry fs/ext4/namei.c:1727 [inline]
+ ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795
+ lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633
+ filename_create+0x297/0x540 fs/namei.c:3980
+ do_symlinkat+0xf9/0x3a0 fs/namei.c:4587
+ __do_sys_symlinkat fs/namei.c:4610 [inline]
+ __se_sys_symlinkat fs/namei.c:4607 [inline]
+ __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7f3e73ced469
+Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
+RAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f3e73ced469
+RDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0
+RBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290
+R10: 0023706f6f6c2f76 R11: 0000000000000246 R12: 00007fff4d40c27c
+R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0
+ </TASK>
+
+Calling ext4_xattr_ibody_find right after reading the inode with
+ext4_get_inode_loc will lead to a check of the validity of the xattrs,
+avoiding this problem.
+
+Reported-by: syzbot+0c2508114d912a54ee79@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=0c2508114d912a54ee79
+Fixes: e8e948e7802a ("ext4: let ext4_find_entry handle inline data")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Link: https://patch.msgid.link/20240821152324.3621860-5-cascardo@igalia.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index e6c2650335a9f..7c9efc9330fe1 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1693,25 +1693,36 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
+ 					struct ext4_dir_entry_2 **res_dir,
+ 					int *has_inline_data)
+ {
++	struct ext4_xattr_ibody_find is = {
++		.s = { .not_found = -ENODATA, },
++	};
++	struct ext4_xattr_info i = {
++		.name_index = EXT4_XATTR_INDEX_SYSTEM,
++		.name = EXT4_XATTR_SYSTEM_DATA,
++	};
+ 	int ret;
+-	struct ext4_iloc iloc;
+ 	void *inline_start;
+ 	int inline_size;
+ 
+-	ret = ext4_get_inode_loc(dir, &iloc);
++	ret = ext4_get_inode_loc(dir, &is.iloc);
+ 	if (ret)
+ 		return ERR_PTR(ret);
+ 
+ 	down_read(&EXT4_I(dir)->xattr_sem);
++
++	ret = ext4_xattr_ibody_find(dir, &i, &is);
++	if (ret)
++		goto out;
++
+ 	if (!ext4_has_inline_data(dir)) {
+ 		*has_inline_data = 0;
+ 		goto out;
+ 	}
+ 
+-	inline_start = (void *)ext4_raw_inode(&iloc)->i_block +
++	inline_start = (void *)ext4_raw_inode(&is.iloc)->i_block +
+ 						EXT4_INLINE_DOTDOT_SIZE;
+ 	inline_size = EXT4_MIN_INLINE_DATA_SIZE - EXT4_INLINE_DOTDOT_SIZE;
+-	ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
++	ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
+ 			      dir, fname, 0, res_dir);
+ 	if (ret == 1)
+ 		goto out_find;
+@@ -1721,23 +1732,23 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
+ 	if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE)
+ 		goto out;
+ 
+-	inline_start = ext4_get_inline_xattr_pos(dir, &iloc);
++	inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
+ 	inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
+ 
+-	ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
++	ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
+ 			      dir, fname, 0, res_dir);
+ 	if (ret == 1)
+ 		goto out_find;
+ 
+ out:
+-	brelse(iloc.bh);
++	brelse(is.iloc.bh);
+ 	if (ret < 0)
+-		iloc.bh = ERR_PTR(ret);
++		is.iloc.bh = ERR_PTR(ret);
+ 	else
+-		iloc.bh = NULL;
++		is.iloc.bh = NULL;
+ out_find:
+ 	up_read(&EXT4_I(dir)->xattr_sem);
+-	return iloc.bh;
++	return is.iloc.bh;
+ }
+ 
+ int ext4_delete_inline_entry(handle_t *handle,
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-avoid-potential-buffer_head-leak-in-__ext4_new_.patch b/queue-6.1/ext4-avoid-potential-buffer_head-leak-in-__ext4_new_.patch
new file mode 100644
index 00000000000..2fb7e5cc9f5
--- /dev/null
+++ b/queue-6.1/ext4-avoid-potential-buffer_head-leak-in-__ext4_new_.patch
@@ -0,0 +1,49 @@
+From ee33af428ca7808b4856ab42fb2d3a7ad0f5502b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 21:22:29 +0800
+Subject: ext4: avoid potential buffer_head leak in __ext4_new_inode()
+
+From: Kemeng Shi <shikemeng@huaweicloud.com>
+
+[ Upstream commit 227d31b9214d1b9513383cf6c7180628d4b3b61f ]
+
+If a group is marked EXT4_GROUP_INFO_IBITMAP_CORRUPT after it's inode
+bitmap buffer_head was successfully verified, then __ext4_new_inode()
+will get a valid inode_bitmap_bh of a corrupted group from
+ext4_read_inode_bitmap() in which case inode_bitmap_bh misses a release.
+Hnadle "IS_ERR(inode_bitmap_bh)" and group corruption separately like
+how ext4_free_inode() does to avoid buffer_head leak.
+
+Fixes: 9008a58e5dce ("ext4: make the bitmap read routines return real error codes")
+Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
+Link: https://patch.msgid.link/20240820132234.2759926-3-shikemeng@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ialloc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 14831c3df0cda..99e8852c4e1dd 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1055,12 +1055,13 @@ struct inode *__ext4_new_inode(struct user_namespace *mnt_userns,
+ 		brelse(inode_bitmap_bh);
+ 		inode_bitmap_bh = ext4_read_inode_bitmap(sb, group);
+ 		/* Skip groups with suspicious inode tables */
+-		if (((!(sbi->s_mount_state & EXT4_FC_REPLAY))
+-		     && EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) ||
+-		    IS_ERR(inode_bitmap_bh)) {
++		if (IS_ERR(inode_bitmap_bh)) {
+ 			inode_bitmap_bh = NULL;
+ 			goto next_group;
+ 		}
++		if (!(sbi->s_mount_state & EXT4_FC_REPLAY) &&
++		    EXT4_MB_GRP_IBITMAP_CORRUPT(grp))
++			goto next_group;
+ 
+ repeat_in_this_group:
+ 		ret2 = find_inode_bit(sb, group, inode_bitmap_bh, &ino);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch b/queue-6.1/ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch
new file mode 100644
index 00000000000..fb8f3a96b1d
--- /dev/null
+++ b/queue-6.1/ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch
@@ -0,0 +1,69 @@
+From 887715b4111af3d0e7360f4b588d82163a6e487f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2024 16:55:10 +0800
+Subject: ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
+
+From: yangerkun <yangerkun@huawei.com>
+
+[ Upstream commit 20cee68f5b44fdc2942d20f3172a262ec247b117 ]
+
+Commit 3d56b8d2c74c ("ext4: Speed up FITRIM by recording flags in
+ext4_group_info") speed up fstrim by skipping trim trimmed group. We
+also has the chance to clear trimmed once there exists some block free
+for this group(mount without discard), and the next trim for this group
+will work well too.
+
+For mount with discard, we will issue dicard when we free blocks, so
+leave trimmed flag keep alive to skip useless trim trigger from
+userspace seems reasonable. But for some case like ext4 build on
+dm-thinpool(ext4 blocksize 4K, pool blocksize 128K), discard from ext4
+maybe unaligned for dm thinpool, and thinpool will just finish this
+discard(see process_discard_bio when begein equals to end) without
+actually process discard. For this case, trim from userspace can really
+help us to free some thinpool block.
+
+So convert to clear trimmed flag for all case no matter mounted with
+discard or not.
+
+Fixes: 3d56b8d2c74c ("ext4: Speed up FITRIM by recording flags in ext4_group_info")
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20240817085510.2084444-1-yangerkun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index c723ee3e49959..03b61af25ac10 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3686,11 +3686,8 @@ static void ext4_free_data_in_buddy(struct super_block *sb,
+ 	/*
+ 	 * Clear the trimmed flag for the group so that the next
+ 	 * ext4_trim_fs can trim it.
+-	 * If the volume is mounted with -o discard, online discard
+-	 * is supported and the free blocks will be trimmed online.
+ 	 */
+-	if (!test_opt(sb, DISCARD))
+-		EXT4_MB_GRP_CLEAR_TRIMMED(db);
++	EXT4_MB_GRP_CLEAR_TRIMMED(db);
+ 
+ 	if (!db->bb_free_root.rb_node) {
+ 		/* No more items in the per group rb tree
+@@ -6114,8 +6111,9 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode,
+ 					 " group:%u block:%d count:%lu failed"
+ 					 " with %d", block_group, bit, count,
+ 					 err);
+-		} else
+-			EXT4_MB_GRP_CLEAR_TRIMMED(e4b.bd_info);
++		}
++
++		EXT4_MB_GRP_CLEAR_TRIMMED(e4b.bd_info);
+ 
+ 		ext4_lock_group(sb, block_group);
+ 		mb_clear_bits(bitmap_bh->b_data, bit, count_clusters);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-return-error-on-ext4_find_inline_entry.patch b/queue-6.1/ext4-return-error-on-ext4_find_inline_entry.patch
new file mode 100644
index 00000000000..0b38dd91cf7
--- /dev/null
+++ b/queue-6.1/ext4-return-error-on-ext4_find_inline_entry.patch
@@ -0,0 +1,54 @@
+From 5da444bbbd753040ff1b6176f07f6fe2c17b444b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 12:23:22 -0300
+Subject: ext4: return error on ext4_find_inline_entry
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 4d231b91a944f3cab355fce65af5871fb5d7735b ]
+
+In case of errors when reading an inode from disk or traversing inline
+directory entries, return an error-encoded ERR_PTR instead of returning
+NULL. ext4_find_inline_entry only caller, __ext4_find_entry already returns
+such encoded errors.
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Link: https://patch.msgid.link/20240821152324.3621860-3-cascardo@igalia.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: c6b72f5d82b1 ("ext4: avoid OOB when system.data xattr changes underneath the filesystem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index ee9d2faa5218f..e6c2650335a9f 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1698,8 +1698,9 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
+ 	void *inline_start;
+ 	int inline_size;
+ 
+-	if (ext4_get_inode_loc(dir, &iloc))
+-		return NULL;
++	ret = ext4_get_inode_loc(dir, &iloc);
++	if (ret)
++		return ERR_PTR(ret);
+ 
+ 	down_read(&EXT4_I(dir)->xattr_sem);
+ 	if (!ext4_has_inline_data(dir)) {
+@@ -1730,7 +1731,10 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
+ 
+ out:
+ 	brelse(iloc.bh);
+-	iloc.bh = NULL;
++	if (ret < 0)
++		iloc.bh = ERR_PTR(ret);
++	else
++		iloc.bh = NULL;
+ out_find:
+ 	up_read(&EXT4_I(dir)->xattr_sem);
+ 	return iloc.bh;
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-atomic-fix-to-truncate-pagecache-before-on-disk.patch b/queue-6.1/f2fs-atomic-fix-to-truncate-pagecache-before-on-disk.patch
new file mode 100644
index 00000000000..b0561aa311a
--- /dev/null
+++ b/queue-6.1/f2fs-atomic-fix-to-truncate-pagecache-before-on-disk.patch
@@ -0,0 +1,38 @@
+From fade29ef7c7e7be6c6921facf38c42bfac833096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 18:24:35 +0800
+Subject: f2fs: atomic: fix to truncate pagecache before on-disk metadata
+ truncation
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit ebd3309aec6271c4616573b0cb83ea25e623070a ]
+
+We should always truncate pagecache while truncating on-disk data.
+
+Fixes: a46bebd502fe ("f2fs: synchronize atomic write aborts")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index c9f0bb8f8b210..8a1a38a510893 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2171,6 +2171,10 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ 		clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+ 	} else {
+ 		/* Reuse the already created COW inode */
++		f2fs_bug_on(sbi, get_dirty_pages(fi->cow_inode));
++
++		invalidate_mapping_pages(fi->cow_inode->i_mapping, 0, -1);
++
+ 		ret = f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
+ 		if (ret) {
+ 			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-clean-up-w-dotdot_name.patch b/queue-6.1/f2fs-clean-up-w-dotdot_name.patch
new file mode 100644
index 00000000000..8f2a9fa1919
--- /dev/null
+++ b/queue-6.1/f2fs-clean-up-w-dotdot_name.patch
@@ -0,0 +1,50 @@
+From 056ef7f5410cfde786911c660295729ea7a8bad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:25:54 +0800
+Subject: f2fs: clean up w/ dotdot_name
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit ff6584ac2c4b4ee8e1fca20bffaaa387d8fe2974 ]
+
+Just cleanup, no logic changes.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 884ee6dc85b9 ("f2fs: get rid of online repaire on corrupted directory")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 6dcc73ca32172..cd66584bed0fd 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -449,7 +449,6 @@ static int __recover_dot_dentries(struct inode *dir, nid_t pino)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
+ 	struct qstr dot = QSTR_INIT(".", 1);
+-	struct qstr dotdot = QSTR_INIT("..", 2);
+ 	struct f2fs_dir_entry *de;
+ 	struct page *page;
+ 	int err = 0;
+@@ -487,13 +486,13 @@ static int __recover_dot_dentries(struct inode *dir, nid_t pino)
+ 			goto out;
+ 	}
+ 
+-	de = f2fs_find_entry(dir, &dotdot, &page);
++	de = f2fs_find_entry(dir, &dotdot_name, &page);
+ 	if (de)
+ 		f2fs_put_page(page, 0);
+ 	else if (IS_ERR(page))
+ 		err = PTR_ERR(page);
+ 	else
+-		err = f2fs_do_add_link(dir, &dotdot, NULL, pino, S_IFDIR);
++		err = f2fs_do_add_link(dir, &dotdot_name, NULL, pino, S_IFDIR);
+ out:
+ 	if (!err)
+ 		clear_inode_flag(dir, FI_INLINE_DOTS);
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-factor-the-read-write-tracing-logic-into-a-help.patch b/queue-6.1/f2fs-factor-the-read-write-tracing-logic-into-a-help.patch
new file mode 100644
index 00000000000..6576b663899
--- /dev/null
+++ b/queue-6.1/f2fs-factor-the-read-write-tracing-logic-into-a-help.patch
@@ -0,0 +1,110 @@
+From 2993c385ba0b2dcbc1a38f7437400c8741c01cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 07:36:21 +0100
+Subject: f2fs: factor the read/write tracing logic into a helper
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit a28bca0f47feb5cdfc22be0e563bd4da2aed74f7 ]
+
+Factor the logic to log a path for reads and writs into a helper
+shared between the read_iter and write_iter methods.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: 0cac51185e65 ("f2fs: fix to avoid racing in between read and OPU dio write")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 61 +++++++++++++++++++++-----------------------------
+ 1 file changed, 26 insertions(+), 35 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 6ce8997fc61e0..81394c08ef850 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -4457,6 +4457,27 @@ static ssize_t f2fs_dio_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ 	return ret;
+ }
+ 
++static void f2fs_trace_rw_file_path(struct kiocb *iocb, size_t count, int rw)
++{
++	struct inode *inode = file_inode(iocb->ki_filp);
++	char *buf, *path;
++
++	buf = f2fs_kmalloc(F2FS_I_SB(inode), PATH_MAX, GFP_KERNEL);
++	if (!buf)
++		return;
++	path = dentry_path_raw(file_dentry(iocb->ki_filp), buf, PATH_MAX);
++	if (IS_ERR(path))
++		goto free_buf;
++	if (rw == WRITE)
++		trace_f2fs_datawrite_start(inode, iocb->ki_pos, count,
++				current->pid, path, current->comm);
++	else
++		trace_f2fs_dataread_start(inode, iocb->ki_pos, count,
++				current->pid, path, current->comm);
++free_buf:
++	kfree(buf);
++}
++
+ static ssize_t f2fs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ {
+ 	struct inode *inode = file_inode(iocb->ki_filp);
+@@ -4466,24 +4487,9 @@ static ssize_t f2fs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ 	if (!f2fs_is_compress_backend_ready(inode))
+ 		return -EOPNOTSUPP;
+ 
+-	if (trace_f2fs_dataread_start_enabled()) {
+-		char *p = f2fs_kmalloc(F2FS_I_SB(inode), PATH_MAX, GFP_KERNEL);
+-		char *path;
+-
+-		if (!p)
+-			goto skip_read_trace;
++	if (trace_f2fs_dataread_start_enabled())
++		f2fs_trace_rw_file_path(iocb, iov_iter_count(to), READ);
+ 
+-		path = dentry_path_raw(file_dentry(iocb->ki_filp), p, PATH_MAX);
+-		if (IS_ERR(path)) {
+-			kfree(p);
+-			goto skip_read_trace;
+-		}
+-
+-		trace_f2fs_dataread_start(inode, pos, iov_iter_count(to),
+-					current->pid, path, current->comm);
+-		kfree(p);
+-	}
+-skip_read_trace:
+ 	if (f2fs_should_use_dio(inode, iocb, to)) {
+ 		ret = f2fs_dio_read_iter(iocb, to);
+ 	} else {
+@@ -4789,24 +4795,9 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 	if (preallocated < 0) {
+ 		ret = preallocated;
+ 	} else {
+-		if (trace_f2fs_datawrite_start_enabled()) {
+-			char *p = f2fs_kmalloc(F2FS_I_SB(inode),
+-						PATH_MAX, GFP_KERNEL);
+-			char *path;
+-
+-			if (!p)
+-				goto skip_write_trace;
+-			path = dentry_path_raw(file_dentry(iocb->ki_filp),
+-								p, PATH_MAX);
+-			if (IS_ERR(path)) {
+-				kfree(p);
+-				goto skip_write_trace;
+-			}
+-			trace_f2fs_datawrite_start(inode, orig_pos, orig_count,
+-					current->pid, path, current->comm);
+-			kfree(p);
+-		}
+-skip_write_trace:
++		if (trace_f2fs_datawrite_start_enabled())
++			f2fs_trace_rw_file_path(iocb, orig_count, WRITE);
++
+ 		/* Do the actual write. */
+ 		ret = dio ?
+ 			f2fs_dio_write_iter(iocb, from, &may_need_sync) :
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-avoid-racing-in-between-read-and-opu-dio.patch b/queue-6.1/f2fs-fix-to-avoid-racing-in-between-read-and-opu-dio.patch
new file mode 100644
index 00000000000..dd0013175a6
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-avoid-racing-in-between-read-and-opu-dio.patch
@@ -0,0 +1,66 @@
+From e3f6306afcb1826509607f3ffba94673f5ad8622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 15:15:21 +0800
+Subject: f2fs: fix to avoid racing in between read and OPU dio write
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0cac51185e65dc2a20686184e02f3cafc99eb202 ]
+
+If lfs mode is on, buffered read may race w/ OPU dio write as below,
+it may cause buffered read hits unwritten data unexpectly, and for
+dio read, the race condition exists as well.
+
+Thread A			Thread B
+- f2fs_file_write_iter
+ - f2fs_dio_write_iter
+  - __iomap_dio_rw
+   - f2fs_iomap_begin
+    - f2fs_map_blocks
+     - __allocate_data_block
+      - allocated blkaddr #x
+       - iomap_dio_submit_bio
+				- f2fs_file_read_iter
+				 - filemap_read
+				  - f2fs_read_data_folio
+				   - f2fs_mpage_readpages
+				    - f2fs_map_blocks
+				     : get blkaddr #x
+				    - f2fs_submit_read_bio
+				IRQ
+				- f2fs_read_end_io
+				 : read IO on blkaddr #x complete
+IRQ
+- iomap_dio_bio_end_io
+ : direct write IO on blkaddr #x complete
+
+In LFS mode, if there is inflight dio, let's wait for its completion,
+this policy won't cover all race cases, however it is a tradeoff which
+avoids abusing lock around IO paths.
+
+Fixes: f847c699cff3 ("f2fs: allow out-place-update for direct IO in LFS mode")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 81394c08ef850..f03320c47c823 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -4490,6 +4490,10 @@ static ssize_t f2fs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ 	if (trace_f2fs_dataread_start_enabled())
+ 		f2fs_trace_rw_file_path(iocb, iov_iter_count(to), READ);
+ 
++	/* In LFS mode, if there is inflight dio, wait for its completion */
++	if (f2fs_lfs_mode(F2FS_I_SB(inode)))
++		inode_dio_wait(inode);
++
+ 	if (f2fs_should_use_dio(inode, iocb, to)) {
+ 		ret = f2fs_dio_read_iter(iocb, to);
+ 	} else {
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-update-i_ctime-in-__f2fs_setxattr.patch b/queue-6.1/f2fs-fix-to-update-i_ctime-in-__f2fs_setxattr.patch
new file mode 100644
index 00000000000..09dbb0e91c5
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-update-i_ctime-in-__f2fs_setxattr.patch
@@ -0,0 +1,57 @@
+From 19e0fd4660738fbb566d042d9e93ab7d62499c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 21:50:45 +0800
+Subject: f2fs: fix to update i_ctime in __f2fs_setxattr()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8874ad7dae8d91d24cc87c545c0073b3b2da5688 ]
+
+generic/728       - output mismatch (see /media/fstests/results//generic/728.out.bad)
+    --- tests/generic/728.out	2023-07-19 07:10:48.362711407 +0000
+    +++ /media/fstests/results//generic/728.out.bad	2023-07-19 08:39:57.000000000 +0000
+     QA output created by 728
+    +Expected ctime to change after setxattr.
+    +Expected ctime to change after removexattr.
+     Silence is golden
+    ...
+    (Run 'diff -u /media/fstests/tests/generic/728.out /media/fstests/results//generic/728.out.bad'  to see the entire diff)
+generic/729        1s
+
+It needs to update i_ctime after {set,remove}xattr, fix it.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/xattr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 0631b383e21f4..0862dfbe6a5d6 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -772,17 +772,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	if (index == F2FS_XATTR_INDEX_ENCRYPTION &&
+ 			!strcmp(name, F2FS_XATTR_NAME_ENCRYPTION_CONTEXT))
+ 		f2fs_set_encrypted_inode(inode);
+-	f2fs_mark_inode_dirty_sync(inode, true);
+ 	if (!error && S_ISDIR(inode->i_mode))
+ 		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP);
+ 
+ same:
+ 	if (is_inode_flag_set(inode, FI_ACL_MODE)) {
+ 		inode->i_mode = F2FS_I(inode)->i_acl_mode;
+-		inode->i_ctime = current_time(inode);
+ 		clear_inode_flag(inode, FI_ACL_MODE);
+ 	}
+ 
++	inode->i_ctime = current_time(inode);
++	f2fs_mark_inode_dirty_sync(inode, true);
+ exit:
+ 	kfree(base_addr);
+ 	return error;
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-wait-page-writeback-before-setting-gcing.patch b/queue-6.1/f2fs-fix-to-wait-page-writeback-before-setting-gcing.patch
new file mode 100644
index 00000000000..f22643c7d75
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-wait-page-writeback-before-setting-gcing.patch
@@ -0,0 +1,57 @@
+From 294c1767687ed0a14e55066197303ee8a5f8ea17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 22:12:42 +0800
+Subject: f2fs: fix to wait page writeback before setting gcing flag
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit a4d7f2b3238fd5f76b9e6434a0bd5d2e29049cff ]
+
+Soft IRQ				Thread
+- f2fs_write_end_io
+					- f2fs_defragment_range
+					 - set_page_private_gcing
+ - type = WB_DATA_TYPE(page, false);
+ : assign type w/ F2FS_WB_CP_DATA
+ due to page_private_gcing() is true
+  - dec_page_count() w/ wrong type
+  - end_page_writeback()
+
+Value of F2FS_WB_CP_DATA reference count may become negative under above
+race condition, the root cause is we missed to wait page writeback before
+setting gcing page private flag, let's fix it.
+
+Fixes: 2d1fe8a86bf5 ("f2fs: fix to tag gcing flag on page during file defragment")
+Fixes: 4961acdd65c9 ("f2fs: fix to tag gcing flag on page during block migration")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index f03320c47c823..c9f0bb8f8b210 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2749,6 +2749,8 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi,
+ 				goto clear_out;
+ 			}
+ 
++			f2fs_wait_on_page_writeback(page, DATA, true, true);
++
+ 			set_page_dirty(page);
+ 			set_page_private_gcing(page);
+ 			f2fs_put_page(page, 1);
+@@ -4108,6 +4110,8 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
+ 		/* It will never fail, when page has pinned above */
+ 		f2fs_bug_on(F2FS_I_SB(inode), !page);
+ 
++		f2fs_wait_on_page_writeback(page, DATA, true, true);
++
+ 		set_page_dirty(page);
+ 		set_page_private_gcing(page);
+ 		f2fs_put_page(page, 1);
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-get-rid-of-online-repaire-on-corrupted-director.patch b/queue-6.1/f2fs-get-rid-of-online-repaire-on-corrupted-director.patch
new file mode 100644
index 00000000000..77445c25758
--- /dev/null
+++ b/queue-6.1/f2fs-get-rid-of-online-repaire-on-corrupted-director.patch
@@ -0,0 +1,214 @@
+From 3ef00c5393b270ca5e5a901b85b3b8d4d292f6fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 14:27:24 +0800
+Subject: f2fs: get rid of online repaire on corrupted directory
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 884ee6dc85b959bc152f15bca80c30f06069e6c4 ]
+
+syzbot reports a f2fs bug as below:
+
+kernel BUG at fs/f2fs/inode.c:896!
+RIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896
+Call Trace:
+ evict+0x532/0x950 fs/inode.c:704
+ dispose_list fs/inode.c:747 [inline]
+ evict_inodes+0x5f9/0x690 fs/inode.c:797
+ generic_shutdown_super+0x9d/0x2d0 fs/super.c:627
+ kill_block_super+0x44/0x90 fs/super.c:1696
+ kill_f2fs_super+0x344/0x690 fs/f2fs/super.c:4898
+ deactivate_locked_super+0xc4/0x130 fs/super.c:473
+ cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
+ task_work_run+0x24f/0x310 kernel/task_work.c:228
+ ptrace_notify+0x2d2/0x380 kernel/signal.c:2402
+ ptrace_report_syscall include/linux/ptrace.h:415 [inline]
+ ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]
+ syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173
+ syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]
+ syscall_exit_to_user_mode+0x279/0x370 kernel/entry/common.c:218
+ do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896
+
+Online repaire on corrupted directory in f2fs_lookup() can generate
+dirty data/meta while racing w/ readonly remount, it may leave dirty
+inode after filesystem becomes readonly, however, checkpoint() will
+skips flushing dirty inode in a state of readonly mode, result in
+above panic.
+
+Let's get rid of online repaire in f2fs_lookup(), and leave the work
+to fsck.f2fs.
+
+Fixes: 510022a85839 ("f2fs: add F2FS_INLINE_DOTS to recover missing dot dentries")
+Reported-by: syzbot+ebea2790904673d7c618@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000a7b20f061ff2d56a@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h          | 11 -------
+ fs/f2fs/namei.c         | 68 -----------------------------------------
+ include/linux/f2fs_fs.h |  2 +-
+ 3 files changed, 1 insertion(+), 80 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index dc637dfb1ead2..4ec6621c5fd92 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -771,7 +771,6 @@ enum {
+ 	FI_NEED_IPU,		/* used for ipu per file */
+ 	FI_ATOMIC_FILE,		/* indicate atomic file */
+ 	FI_DATA_EXIST,		/* indicate data exists */
+-	FI_INLINE_DOTS,		/* indicate inline dot dentries */
+ 	FI_SKIP_WRITES,		/* should skip data page writeback */
+ 	FI_OPU_WRITE,		/* used for opu per file */
+ 	FI_DIRTY_FILE,		/* indicate regular/symlink has dirty pages */
+@@ -3000,7 +2999,6 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,
+ 			return;
+ 		fallthrough;
+ 	case FI_DATA_EXIST:
+-	case FI_INLINE_DOTS:
+ 	case FI_PIN_FILE:
+ 	case FI_COMPRESS_RELEASED:
+ 	case FI_ATOMIC_COMMITTED:
+@@ -3125,8 +3123,6 @@ static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)
+ 		set_bit(FI_INLINE_DENTRY, fi->flags);
+ 	if (ri->i_inline & F2FS_DATA_EXIST)
+ 		set_bit(FI_DATA_EXIST, fi->flags);
+-	if (ri->i_inline & F2FS_INLINE_DOTS)
+-		set_bit(FI_INLINE_DOTS, fi->flags);
+ 	if (ri->i_inline & F2FS_EXTRA_ATTR)
+ 		set_bit(FI_EXTRA_ATTR, fi->flags);
+ 	if (ri->i_inline & F2FS_PIN_FILE)
+@@ -3147,8 +3143,6 @@ static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri)
+ 		ri->i_inline |= F2FS_INLINE_DENTRY;
+ 	if (is_inode_flag_set(inode, FI_DATA_EXIST))
+ 		ri->i_inline |= F2FS_DATA_EXIST;
+-	if (is_inode_flag_set(inode, FI_INLINE_DOTS))
+-		ri->i_inline |= F2FS_INLINE_DOTS;
+ 	if (is_inode_flag_set(inode, FI_EXTRA_ATTR))
+ 		ri->i_inline |= F2FS_EXTRA_ATTR;
+ 	if (is_inode_flag_set(inode, FI_PIN_FILE))
+@@ -3235,11 +3229,6 @@ static inline int f2fs_exist_data(struct inode *inode)
+ 	return is_inode_flag_set(inode, FI_DATA_EXIST);
+ }
+ 
+-static inline int f2fs_has_inline_dots(struct inode *inode)
+-{
+-	return is_inode_flag_set(inode, FI_INLINE_DOTS);
+-}
+-
+ static inline int f2fs_is_mmap_file(struct inode *inode)
+ {
+ 	return is_inode_flag_set(inode, FI_MMAP_FILE);
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index cd66584bed0fd..9da104c0743c4 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -445,62 +445,6 @@ struct dentry *f2fs_get_parent(struct dentry *child)
+ 	return d_obtain_alias(f2fs_iget(child->d_sb, ino));
+ }
+ 
+-static int __recover_dot_dentries(struct inode *dir, nid_t pino)
+-{
+-	struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
+-	struct qstr dot = QSTR_INIT(".", 1);
+-	struct f2fs_dir_entry *de;
+-	struct page *page;
+-	int err = 0;
+-
+-	if (f2fs_readonly(sbi->sb)) {
+-		f2fs_info(sbi, "skip recovering inline_dots inode (ino:%lu, pino:%u) in readonly mountpoint",
+-			  dir->i_ino, pino);
+-		return 0;
+-	}
+-
+-	if (!S_ISDIR(dir->i_mode)) {
+-		f2fs_err(sbi, "inconsistent inode status, skip recovering inline_dots inode (ino:%lu, i_mode:%u, pino:%u)",
+-			  dir->i_ino, dir->i_mode, pino);
+-		set_sbi_flag(sbi, SBI_NEED_FSCK);
+-		return -ENOTDIR;
+-	}
+-
+-	err = f2fs_dquot_initialize(dir);
+-	if (err)
+-		return err;
+-
+-	f2fs_balance_fs(sbi, true);
+-
+-	f2fs_lock_op(sbi);
+-
+-	de = f2fs_find_entry(dir, &dot, &page);
+-	if (de) {
+-		f2fs_put_page(page, 0);
+-	} else if (IS_ERR(page)) {
+-		err = PTR_ERR(page);
+-		goto out;
+-	} else {
+-		err = f2fs_do_add_link(dir, &dot, NULL, dir->i_ino, S_IFDIR);
+-		if (err)
+-			goto out;
+-	}
+-
+-	de = f2fs_find_entry(dir, &dotdot_name, &page);
+-	if (de)
+-		f2fs_put_page(page, 0);
+-	else if (IS_ERR(page))
+-		err = PTR_ERR(page);
+-	else
+-		err = f2fs_do_add_link(dir, &dotdot_name, NULL, pino, S_IFDIR);
+-out:
+-	if (!err)
+-		clear_inode_flag(dir, FI_INLINE_DOTS);
+-
+-	f2fs_unlock_op(sbi);
+-	return err;
+-}
+-
+ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
+ 		unsigned int flags)
+ {
+@@ -510,7 +454,6 @@ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
+ 	struct dentry *new;
+ 	nid_t ino = -1;
+ 	int err = 0;
+-	unsigned int root_ino = F2FS_ROOT_INO(F2FS_I_SB(dir));
+ 	struct f2fs_filename fname;
+ 
+ 	trace_f2fs_lookup_start(dir, dentry, flags);
+@@ -547,17 +490,6 @@ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
+ 		goto out;
+ 	}
+ 
+-	if ((dir->i_ino == root_ino) && f2fs_has_inline_dots(dir)) {
+-		err = __recover_dot_dentries(dir, root_ino);
+-		if (err)
+-			goto out_iput;
+-	}
+-
+-	if (f2fs_has_inline_dots(inode)) {
+-		err = __recover_dot_dentries(inode, dir->i_ino);
+-		if (err)
+-			goto out_iput;
+-	}
+ 	if (IS_ENCRYPTED(dir) &&
+ 	    (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
+ 	    !fscrypt_has_permitted_context(dir, inode)) {
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index 1e0df607e40c4..c61d8fc1deb3e 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -264,7 +264,7 @@ struct f2fs_extent {
+ #define F2FS_INLINE_DATA	0x02	/* file inline data flag */
+ #define F2FS_INLINE_DENTRY	0x04	/* file inline dentry flag */
+ #define F2FS_DATA_EXIST		0x08	/* file inline data exist flag */
+-#define F2FS_INLINE_DOTS	0x10	/* file having implicit dot dentries */
++#define F2FS_INLINE_DOTS	0x10	/* file having implicit dot dentries (obsolete) */
+ #define F2FS_EXTRA_ATTR		0x20	/* file having extra attribute */
+ #define F2FS_PIN_FILE		0x40	/* file should not be gced */
+ #define F2FS_COMPRESS_RELEASED	0x80	/* file released compressed blocks */
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-reduce-expensive-checkpoint-trigger-frequency.patch b/queue-6.1/f2fs-reduce-expensive-checkpoint-trigger-frequency.patch
new file mode 100644
index 00000000000..ae30a8277f8
--- /dev/null
+++ b/queue-6.1/f2fs-reduce-expensive-checkpoint-trigger-frequency.patch
@@ -0,0 +1,131 @@
+From 704993499fc2af8d0af5dfd635d19990ed2f851b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2024 09:47:27 +0800
+Subject: f2fs: reduce expensive checkpoint trigger frequency
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit aaf8c0b9ae042494cb4585883b15c1332de77840 ]
+
+We may trigger high frequent checkpoint for below case:
+1. mkdir /mnt/dir1; set dir1 encrypted
+2. touch /mnt/file1; fsync /mnt/file1
+3. mkdir /mnt/dir2; set dir2 encrypted
+4. touch /mnt/file2; fsync /mnt/file2
+...
+
+Although, newly created dir and file are not related, due to
+commit bbf156f7afa7 ("f2fs: fix lost xattrs of directories"), we will
+trigger checkpoint whenever fsync() comes after a new encrypted dir
+created.
+
+In order to avoid such performance regression issue, let's record an
+entry including directory's ino in global cache whenever we update
+directory's xattr data, and then triggerring checkpoint() only if
+xattr metadata of target file's parent was updated.
+
+This patch updates to cover below no encryption case as well:
+1) parent is checkpointed
+2) set_xattr(dir) w/ new xnid
+3) create(file)
+4) fsync(file)
+
+Fixes: bbf156f7afa7 ("f2fs: fix lost xattrs of directories")
+Reported-by: wangzijie <wangzijie1@honor.com>
+Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Tested-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reported-by: Yunlei He <heyunlei@hihonor.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h              |  2 ++
+ fs/f2fs/file.c              |  3 +++
+ fs/f2fs/xattr.c             | 14 ++++++++++++--
+ include/trace/events/f2fs.h |  3 ++-
+ 4 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 2b540d87859e0..dc637dfb1ead2 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -284,6 +284,7 @@ enum {
+ 	APPEND_INO,		/* for append ino list */
+ 	UPDATE_INO,		/* for update ino list */
+ 	TRANS_DIR_INO,		/* for transactions dir ino list */
++	XATTR_DIR_INO,		/* for xattr updated dir ino list */
+ 	FLUSH_INO,		/* for multiple device flushing */
+ 	MAX_INO_ENTRY,		/* max. list */
+ };
+@@ -1137,6 +1138,7 @@ enum cp_reason_type {
+ 	CP_FASTBOOT_MODE,
+ 	CP_SPEC_LOG_NUM,
+ 	CP_RECOVER_DIR,
++	CP_XATTR_DIR,
+ };
+ 
+ enum iostat_type {
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 62f2521cd955e..6ce8997fc61e0 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -217,6 +217,9 @@ static inline enum cp_reason_type need_do_checkpoint(struct inode *inode)
+ 		f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino,
+ 							TRANS_DIR_INO))
+ 		cp_reason = CP_RECOVER_DIR;
++	else if (f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino,
++							XATTR_DIR_INO))
++		cp_reason = CP_XATTR_DIR;
+ 
+ 	return cp_reason;
+ }
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 6ee71a2faa75f..65437c18e01d3 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -629,6 +629,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 			const char *name, const void *value, size_t size,
+ 			struct page *ipage, int flags)
+ {
++	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ 	struct f2fs_xattr_entry *here, *last;
+ 	void *base_addr, *last_base_addr;
+ 	int found, newsize;
+@@ -772,9 +773,18 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	if (index == F2FS_XATTR_INDEX_ENCRYPTION &&
+ 			!strcmp(name, F2FS_XATTR_NAME_ENCRYPTION_CONTEXT))
+ 		f2fs_set_encrypted_inode(inode);
+-	if (S_ISDIR(inode->i_mode))
+-		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP);
+ 
++	if (!S_ISDIR(inode->i_mode))
++		goto same;
++	/*
++	 * In restrict mode, fsync() always try to trigger checkpoint for all
++	 * metadata consistency, in other mode, it triggers checkpoint when
++	 * parent's xattr metadata was updated.
++	 */
++	if (F2FS_OPTION(sbi).fsync_mode == FSYNC_MODE_STRICT)
++		set_sbi_flag(sbi, SBI_NEED_CP);
++	else
++		f2fs_add_ino_entry(sbi, inode->i_ino, XATTR_DIR_INO);
+ same:
+ 	if (is_inode_flag_set(inode, FI_ACL_MODE)) {
+ 		inode->i_mode = F2FS_I(inode)->i_acl_mode;
+diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
+index 5f58684f6107a..9f0883e9ab3eb 100644
+--- a/include/trace/events/f2fs.h
++++ b/include/trace/events/f2fs.h
+@@ -138,7 +138,8 @@ TRACE_DEFINE_ENUM(EX_READ);
+ 		{ CP_NODE_NEED_CP,	"node needs cp" },		\
+ 		{ CP_FASTBOOT_MODE,	"fastboot mode" },		\
+ 		{ CP_SPEC_LOG_NUM,	"log type is 2" },		\
+-		{ CP_RECOVER_DIR,	"dir needs recovery" })
++		{ CP_RECOVER_DIR,	"dir needs recovery" },		\
++		{ CP_XATTR_DIR,		"dir's xattr updated" })
+ 
+ #define show_shutdown_mode(type)					\
+ 	__print_symbolic(type,						\
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-remove-unneeded-check-condition-in-__f2fs_setxa.patch b/queue-6.1/f2fs-remove-unneeded-check-condition-in-__f2fs_setxa.patch
new file mode 100644
index 00000000000..c589adc3745
--- /dev/null
+++ b/queue-6.1/f2fs-remove-unneeded-check-condition-in-__f2fs_setxa.patch
@@ -0,0 +1,36 @@
+From eea31ce0e6b446228e2567f6b2cee76e4b458ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 21:50:46 +0800
+Subject: f2fs: remove unneeded check condition in __f2fs_setxattr()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit bc3994ffa4cf23f55171943c713366132c3ff45d ]
+
+It has checked return value of write_all_xattrs(), remove unneeded
+following check condition.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 0862dfbe6a5d6..6ee71a2faa75f 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -772,7 +772,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	if (index == F2FS_XATTR_INDEX_ENCRYPTION &&
+ 			!strcmp(name, F2FS_XATTR_NAME_ENCRYPTION_CONTEXT))
+ 		f2fs_set_encrypted_inode(inode);
+-	if (!error && S_ISDIR(inode->i_mode))
++	if (S_ISDIR(inode->i_mode))
+ 		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP);
+ 
+ same:
+-- 
+2.43.0
+
diff --git a/queue-6.1/fbdev-hpfb-fix-an-error-handling-path-in-hpfb_dio_pr.patch b/queue-6.1/fbdev-hpfb-fix-an-error-handling-path-in-hpfb_dio_pr.patch
new file mode 100644
index 00000000000..ebeceaf610d
--- /dev/null
+++ b/queue-6.1/fbdev-hpfb-fix-an-error-handling-path-in-hpfb_dio_pr.patch
@@ -0,0 +1,36 @@
+From 369f871cebdf48af02d3cdd0ed3ccc9c6fb779ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2024 22:34:39 +0200
+Subject: fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit aa578e897520f32ae12bec487f2474357d01ca9c ]
+
+If an error occurs after request_mem_region(), a corresponding
+release_mem_region() should be called, as already done in the remove
+function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/hpfb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/hpfb.c b/drivers/video/fbdev/hpfb.c
+index cdd44e5deafe4..27f33121ee2ef 100644
+--- a/drivers/video/fbdev/hpfb.c
++++ b/drivers/video/fbdev/hpfb.c
+@@ -344,6 +344,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent)
+ 	if (hpfb_init_one(paddr, vaddr)) {
+ 		if (d->scode >= DIOII_SCBASE)
+ 			iounmap((void *)vaddr);
++		release_mem_region(d->resource.start, resource_size(&d->resource));
+ 		return -ENOMEM;
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/firmware-arm_scmi-fix-double-free-in-optee-transport.patch b/queue-6.1/firmware-arm_scmi-fix-double-free-in-optee-transport.patch
new file mode 100644
index 00000000000..8d5701d5826
--- /dev/null
+++ b/queue-6.1/firmware-arm_scmi-fix-double-free-in-optee-transport.patch
@@ -0,0 +1,45 @@
+From 03e186a20f55d52ffed9a76d87cbd0ca001b4ce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 18:33:32 +0100
+Subject: firmware: arm_scmi: Fix double free in OPTEE transport
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit e98dba934b2fc587eafb83f47ad64d9053b18ae0 ]
+
+Channels can be shared between protocols, avoid freeing the same channel
+descriptors twice when unloading the stack.
+
+Fixes: 5f90f189a052 ("firmware: arm_scmi: Add optee transport")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Tested-by: Peng Fan <peng.fan@nxp.com>  #i.MX95 19x19 EVK
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Message-Id: <20240812173340.3912830-2-cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/optee.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/optee.c b/drivers/firmware/arm_scmi/optee.c
+index 2a7aeab40e543..f5f6ec83d3e1f 100644
+--- a/drivers/firmware/arm_scmi/optee.c
++++ b/drivers/firmware/arm_scmi/optee.c
+@@ -467,6 +467,13 @@ static int scmi_optee_chan_free(int id, void *p, void *data)
+ 	struct scmi_chan_info *cinfo = p;
+ 	struct scmi_optee_channel *channel = cinfo->transport_info;
+ 
++	/*
++	 * Different protocols might share the same chan info, so a previous
++	 * call might have already freed the structure.
++	 */
++	if (!channel)
++		return 0;
++
+ 	mutex_lock(&scmi_optee_private->mu);
+ 	list_del(&channel->link);
+ 	mutex_unlock(&scmi_optee_private->mu);
+-- 
+2.43.0
+
diff --git a/queue-6.1/fs-namespace-fnic-switch-to-use-pttd.patch b/queue-6.1/fs-namespace-fnic-switch-to-use-pttd.patch
new file mode 100644
index 00000000000..d2cae6d2a16
--- /dev/null
+++ b/queue-6.1/fs-namespace-fnic-switch-to-use-pttd.patch
@@ -0,0 +1,46 @@
+From d229213b8bd500956eb9b225521a78db6ea7400e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 17:09:06 +0200
+Subject: fs/namespace: fnic: Switch to use %ptTd
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 74e60b8b2f0fe3702710e648a31725ee8224dbdf ]
+
+Use %ptTd instead of open-coded variant to print contents
+of time64_t type in human readable form.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
+Stable-dep-of: 4bcda1eaf184 ("mount: handle OOM on mnt_warn_timestamp_expiry")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 1533550f73567..2b934ade9e70d 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2615,15 +2615,12 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
+ 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
+ 		char *buf = (char *)__get_free_page(GFP_KERNEL);
+ 		char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
+-		struct tm tm;
+ 
+-		time64_to_tm(sb->s_time_max, 0, &tm);
+-
+-		pr_warn("%s filesystem being %s at %s supports timestamps until %04ld (0x%llx)\n",
++		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
+ 			sb->s_type->name,
+ 			is_mounted(mnt) ? "remounted" : "mounted",
+-			mntpath,
+-			tm.tm_year+1900, (unsigned long long)sb->s_time_max);
++			mntpath, &sb->s_time_max,
++			(unsigned long long)sb->s_time_max);
+ 
+ 		free_page((unsigned long)buf);
+ 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
+-- 
+2.43.0
+
diff --git a/queue-6.1/hid-wacom-do-not-warn-about-dropped-packets-for-firs.patch b/queue-6.1/hid-wacom-do-not-warn-about-dropped-packets-for-firs.patch
new file mode 100644
index 00000000000..0b65adc8686
--- /dev/null
+++ b/queue-6.1/hid-wacom-do-not-warn-about-dropped-packets-for-firs.patch
@@ -0,0 +1,66 @@
+From 13226465b163f45a03ddc9bb599029db2449c994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 13:32:08 -0700
+Subject: HID: wacom: Do not warn about dropped packets for first packet
+
+From: Jason Gerecke <jason.gerecke@wacom.com>
+
+[ Upstream commit 84aecf2d251a3359bc78b7c8e58f54b9fc966e89 ]
+
+The driver currently assumes that the first sequence number it will see
+is going to be 0. This is not a realiable assumption and can break if,
+for example, the tablet has already been running for some time prior to
+the kernel driver connecting to the device. This commit initializes the
+expected sequence number to -1 and will only print the "Dropped" warning
+the it has been updated to a non-negative value.
+
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Tested-by: Joshua Dickens <joshua.dickens@wacom.com>
+Fixes: 6d09085b38e5 ("HID: wacom: Adding Support for new usages")
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/wacom_wac.c | 6 +++++-
+ drivers/hid/wacom_wac.h | 2 +-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index ae5bd49d89082..245a6e9631a04 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2365,6 +2365,9 @@ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
+ 		wacom_map_usage(input, usage, field, EV_KEY, BTN_STYLUS3, 0);
+ 		features->quirks &= ~WACOM_QUIRK_PEN_BUTTON3;
+ 		break;
++	case WACOM_HID_WD_SEQUENCENUMBER:
++		wacom_wac->hid_data.sequence_number = -1;
++		break;
+ 	}
+ }
+ 
+@@ -2489,7 +2492,8 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ 		wacom_wac->hid_data.barrelswitch3 = value;
+ 		return;
+ 	case WACOM_HID_WD_SEQUENCENUMBER:
+-		if (wacom_wac->hid_data.sequence_number != value) {
++		if (wacom_wac->hid_data.sequence_number != value &&
++		    wacom_wac->hid_data.sequence_number >= 0) {
+ 			int sequence_size = field->logical_maximum - field->logical_minimum + 1;
+ 			int drop_count = (value - wacom_wac->hid_data.sequence_number) % sequence_size;
+ 			hid_warn(hdev, "Dropped %d packets", drop_count);
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 2e7cc5e7a0cb7..4fd42c1de53a7 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -324,7 +324,7 @@ struct hid_data {
+ 	int bat_connected;
+ 	int ps_connected;
+ 	bool pad_input_event_flag;
+-	unsigned short sequence_number;
++	int sequence_number;
+ 	ktime_t time_delayed;
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/hid-wacom-support-sequence-numbers-smaller-than-16-b.patch b/queue-6.1/hid-wacom-support-sequence-numbers-smaller-than-16-b.patch
new file mode 100644
index 00000000000..73f5f1171da
--- /dev/null
+++ b/queue-6.1/hid-wacom-support-sequence-numbers-smaller-than-16-b.patch
@@ -0,0 +1,50 @@
+From 20fb9cd4fb6f28de22b04675cc6ab6b6040403e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 13:32:07 -0700
+Subject: HID: wacom: Support sequence numbers smaller than 16-bit
+
+From: Jason Gerecke <jason.gerecke@wacom.com>
+
+[ Upstream commit 359673ea3a203611b4f6d0f28922a4b9d2cfbcc8 ]
+
+The current dropped packet reporting assumes that all sequence numbers
+are 16 bits in length. This results in misleading "Dropped" messages if
+the hardware uses fewer bits. For example, if a tablet uses only 8 bits
+to store its sequence number, once it rolls over from 255 -> 0, the
+driver will still be expecting a packet "256". This patch adjusts the
+logic to reset the next expected packet to logical_minimum whenever
+it overflows beyond logical_maximum.
+
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Tested-by: Joshua Dickens <joshua.dickens@wacom.com>
+Fixes: 6d09085b38e5 ("HID: wacom: Adding Support for new usages")
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/wacom_wac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 82f171f6d0c53..ae5bd49d89082 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2489,9 +2489,14 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ 		wacom_wac->hid_data.barrelswitch3 = value;
+ 		return;
+ 	case WACOM_HID_WD_SEQUENCENUMBER:
+-		if (wacom_wac->hid_data.sequence_number != value)
+-			hid_warn(hdev, "Dropped %hu packets", (unsigned short)(value - wacom_wac->hid_data.sequence_number));
++		if (wacom_wac->hid_data.sequence_number != value) {
++			int sequence_size = field->logical_maximum - field->logical_minimum + 1;
++			int drop_count = (value - wacom_wac->hid_data.sequence_number) % sequence_size;
++			hid_warn(hdev, "Dropped %d packets", drop_count);
++		}
+ 		wacom_wac->hid_data.sequence_number = value + 1;
++		if (wacom_wac->hid_data.sequence_number > field->logical_maximum)
++			wacom_wac->hid_data.sequence_number = field->logical_minimum;
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-max16065-fix-alarm-attributes.patch b/queue-6.1/hwmon-max16065-fix-alarm-attributes.patch
new file mode 100644
index 00000000000..18a40f4b054
--- /dev/null
+++ b/queue-6.1/hwmon-max16065-fix-alarm-attributes.patch
@@ -0,0 +1,70 @@
+From 47e8bc7d3fcd4cc292846e0b6a4b94f89f1fa9d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jul 2024 06:41:17 -0700
+Subject: hwmon: (max16065) Fix alarm attributes
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 119abf7d1815f098f7f91ae7abc84324a19943d7 ]
+
+Chips reporting overcurrent alarms report it in the second alarm register.
+That means the second alarm register has to be read, even if the chip only
+supports 8 or fewer ADC channels.
+
+MAX16067 and MAX16068 report undervoltage and overvoltage alarms in
+separate registers. Fold register contents together to report both with
+the existing alarm attribute. This requires actually storing the chip type
+in struct max16065_data. Rename the variable 'chip' to match the variable
+name used in the probe function.
+
+Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/max16065.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
+index ab3c75bda5a03..24612f6c3d9c9 100644
+--- a/drivers/hwmon/max16065.c
++++ b/drivers/hwmon/max16065.c
+@@ -79,7 +79,7 @@ static const bool max16065_have_current[] = {
+ };
+ 
+ struct max16065_data {
+-	enum chips type;
++	enum chips chip;
+ 	struct i2c_client *client;
+ 	const struct attribute_group *groups[4];
+ 	struct mutex update_lock;
+@@ -162,10 +162,17 @@ static struct max16065_data *max16065_update_device(struct device *dev)
+ 						     MAX16065_CURR_SENSE);
+ 		}
+ 
+-		for (i = 0; i < DIV_ROUND_UP(data->num_adc, 8); i++)
++		for (i = 0; i < 2; i++)
+ 			data->fault[i]
+ 			  = i2c_smbus_read_byte_data(client, MAX16065_FAULT(i));
+ 
++		/*
++		 * MAX16067 and MAX16068 have separate undervoltage and
++		 * overvoltage alarm bits. Squash them together.
++		 */
++		if (data->chip == max16067 || data->chip == max16068)
++			data->fault[0] |= data->fault[1];
++
+ 		data->last_updated = jiffies;
+ 		data->valid = true;
+ 	}
+@@ -514,6 +521,7 @@ static int max16065_probe(struct i2c_client *client)
+ 	if (unlikely(!data))
+ 		return -ENOMEM;
+ 
++	data->chip = chip;
+ 	data->client = client;
+ 	mutex_init(&data->update_lock);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-max16065-fix-overflows-seen-when-writing-limit.patch b/queue-6.1/hwmon-max16065-fix-overflows-seen-when-writing-limit.patch
new file mode 100644
index 00000000000..e9d28b81bff
--- /dev/null
+++ b/queue-6.1/hwmon-max16065-fix-overflows-seen-when-writing-limit.patch
@@ -0,0 +1,46 @@
+From 6361e1af4b47834a920aa28593a81f530debb59b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 09:52:01 -0700
+Subject: hwmon: (max16065) Fix overflows seen when writing limits
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 744ec4477b11c42e2c8de9eb8364675ae7a0bd81 ]
+
+Writing large limits resulted in overflows as reported by module tests.
+
+in0_lcrit: Suspected overflow: [max=5538, read 0, written 2147483647]
+in0_crit: Suspected overflow: [max=5538, read 0, written 2147483647]
+in0_min: Suspected overflow: [max=5538, read 0, written 2147483647]
+
+Fix the problem by clamping prior to multiplications and the use of
+DIV_ROUND_CLOSEST, and by using consistent variable types.
+
+Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/max16065.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
+index daa5d8af1e69d..0d938161595dd 100644
+--- a/drivers/hwmon/max16065.c
++++ b/drivers/hwmon/max16065.c
+@@ -114,9 +114,10 @@ static inline int LIMIT_TO_MV(int limit, int range)
+ 	return limit * range / 256;
+ }
+ 
+-static inline int MV_TO_LIMIT(int mv, int range)
++static inline int MV_TO_LIMIT(unsigned long mv, int range)
+ {
+-	return clamp_val(DIV_ROUND_CLOSEST(mv * 256, range), 0, 255);
++	mv = clamp_val(mv, 0, ULONG_MAX / 256);
++	return DIV_ROUND_CLOSEST(clamp_val(mv * 256, 0, range * 255), range);
+ }
+ 
+ static inline int ADC_TO_CURR(int adc, int gain)
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-max16065-remove-use-of-i2c_match_id.patch b/queue-6.1/hwmon-max16065-remove-use-of-i2c_match_id.patch
new file mode 100644
index 00000000000..277a9087ed7
--- /dev/null
+++ b/queue-6.1/hwmon-max16065-remove-use-of-i2c_match_id.patch
@@ -0,0 +1,70 @@
+From 807b31164152a2b31f86b88bb2305a3b4fdafa0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 15:36:21 -0500
+Subject: hwmon: (max16065) Remove use of i2c_match_id()
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 5a71654b398e3471f0169c266a3587cf09e1200c ]
+
+The function i2c_match_id() is used to fetch the matching ID from
+the i2c_device_id table. This is often used to then retrieve the
+matching driver_data. This can be done in one step with the helper
+i2c_get_match_data().
+
+This helper has a couple other benefits:
+ * It doesn't need the i2c_device_id passed in so we do not need
+   to have that forward declared, allowing us to remove those or
+   move the i2c_device_id table down to its more natural spot
+   with the other module info.
+ * It also checks for device match data, which allows for OF and
+   ACPI based probing. That means we do not have to manually check
+   those first and can remove those checks.
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20240403203633.914389-20-afd@ti.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/max16065.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
+index 0d938161595dd..ab3c75bda5a03 100644
+--- a/drivers/hwmon/max16065.c
++++ b/drivers/hwmon/max16065.c
+@@ -494,8 +494,6 @@ static const struct attribute_group max16065_max_group = {
+ 	.is_visible = max16065_secondary_is_visible,
+ };
+ 
+-static const struct i2c_device_id max16065_id[];
+-
+ static int max16065_probe(struct i2c_client *client)
+ {
+ 	struct i2c_adapter *adapter = client->adapter;
+@@ -506,7 +504,7 @@ static int max16065_probe(struct i2c_client *client)
+ 	bool have_secondary;		/* true if chip has secondary limits */
+ 	bool secondary_is_max = false;	/* secondary limits reflect max */
+ 	int groups = 0;
+-	const struct i2c_device_id *id = i2c_match_id(max16065_id, client);
++	enum chips chip = (uintptr_t)i2c_get_match_data(client);
+ 
+ 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA
+ 				     | I2C_FUNC_SMBUS_READ_WORD_DATA))
+@@ -519,9 +517,9 @@ static int max16065_probe(struct i2c_client *client)
+ 	data->client = client;
+ 	mutex_init(&data->update_lock);
+ 
+-	data->num_adc = max16065_num_adc[id->driver_data];
+-	data->have_current = max16065_have_current[id->driver_data];
+-	have_secondary = max16065_have_secondary[id->driver_data];
++	data->num_adc = max16065_num_adc[chip];
++	data->have_current = max16065_have_current[chip];
++	have_secondary = max16065_have_secondary[chip];
+ 
+ 	if (have_secondary) {
+ 		val = i2c_smbus_read_byte_data(client, MAX16065_SW_ENABLE);
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-ntc_thermistor-fix-module-autoloading.patch b/queue-6.1/hwmon-ntc_thermistor-fix-module-autoloading.patch
new file mode 100644
index 00000000000..c12642f4582
--- /dev/null
+++ b/queue-6.1/hwmon-ntc_thermistor-fix-module-autoloading.patch
@@ -0,0 +1,36 @@
+From 6bf610e30ef827204f44be4f6ad5c7c365940b26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2024 08:30:21 +0000
+Subject: hwmon: (ntc_thermistor) fix module autoloading
+
+From: Yuntao Liu <liuyuntao12@huawei.com>
+
+[ Upstream commit b6964d66a07a9003868e428a956949e17ab44d7e ]
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
+based on the alias from of_device_id table.
+
+Fixes: 9e8269de100d ("hwmon: (ntc_thermistor) Add DT with IIO support to NTC thermistor driver")
+Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
+Message-ID: <20240815083021.756134-1-liuyuntao12@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ntc_thermistor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
+index 9c9e9f4ccb9e9..4efbacce5d0ca 100644
+--- a/drivers/hwmon/ntc_thermistor.c
++++ b/drivers/hwmon/ntc_thermistor.c
+@@ -62,6 +62,7 @@ static const struct platform_device_id ntc_thermistor_id[] = {
+ 	[NTC_SSG1404001221]   = { "ssg1404_001221",  TYPE_NCPXXWB473 },
+ 	[NTC_LAST]            = { },
+ };
++MODULE_DEVICE_TABLE(platform, ntc_thermistor_id);
+ 
+ /*
+  * A compensation table should be sorted by the values of .ohm
+-- 
+2.43.0
+
diff --git a/queue-6.1/i2c-add-i2c_get_match_data.patch b/queue-6.1/i2c-add-i2c_get_match_data.patch
new file mode 100644
index 00000000000..d182d3080ab
--- /dev/null
+++ b/queue-6.1/i2c-add-i2c_get_match_data.patch
@@ -0,0 +1,69 @@
+From 495ed925a9d8166724bc93d097b60a2c79c6380f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 17:57:38 +0100
+Subject: i2c: Add i2c_get_match_data()
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 564d73c4d9201526bd976b9379d2aaf1a7133e84 ]
+
+Add i2c_get_match_data() to get match data for I2C, ACPI and
+DT-based matching, so that we can optimize the driver code.
+
+Suggested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+[wsa: simplified var initialization]
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 119abf7d1815 ("hwmon: (max16065) Fix alarm attributes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 19 +++++++++++++++++++
+ include/linux/i2c.h         |  2 ++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index d6a879f1542c5..643c7f1e5bfd4 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -113,6 +113,25 @@ const struct i2c_device_id *i2c_match_id(const struct i2c_device_id *id,
+ }
+ EXPORT_SYMBOL_GPL(i2c_match_id);
+ 
++const void *i2c_get_match_data(const struct i2c_client *client)
++{
++	struct i2c_driver *driver = to_i2c_driver(client->dev.driver);
++	const struct i2c_device_id *match;
++	const void *data;
++
++	data = device_get_match_data(&client->dev);
++	if (!data) {
++		match = i2c_match_id(driver->id_table, client);
++		if (!match)
++			return NULL;
++
++		data = (const void *)match->driver_data;
++	}
++
++	return data;
++}
++EXPORT_SYMBOL(i2c_get_match_data);
++
+ static int i2c_device_match(struct device *dev, struct device_driver *drv)
+ {
+ 	struct i2c_client	*client = i2c_verify_client(dev);
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 35e296d9e1c55..4f5285b87a7f0 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -362,6 +362,8 @@ struct i2c_adapter *i2c_verify_adapter(struct device *dev);
+ const struct i2c_device_id *i2c_match_id(const struct i2c_device_id *id,
+ 					 const struct i2c_client *client);
+ 
++const void *i2c_get_match_data(const struct i2c_client *client);
++
+ static inline struct i2c_client *kobj_to_i2c_client(struct kobject *kobj)
+ {
+ 	struct device * const dev = kobj_to_dev(kobj);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ib-core-fix-ib_cache_setup_one-error-flow-cleanup.patch b/queue-6.1/ib-core-fix-ib_cache_setup_one-error-flow-cleanup.patch
new file mode 100644
index 00000000000..af9eac1deae
--- /dev/null
+++ b/queue-6.1/ib-core-fix-ib_cache_setup_one-error-flow-cleanup.patch
@@ -0,0 +1,102 @@
+From 0c199938ebeacecc7c42f1e0322b89f668378dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 13:36:33 +0300
+Subject: IB/core: Fix ib_cache_setup_one error flow cleanup
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 1403c8b14765eab805377dd3b75e96ace8747aed ]
+
+When ib_cache_update return an error, we exit ib_cache_setup_one
+instantly with no proper cleanup, even though before this we had
+already successfully done gid_table_setup_one, that results in
+the kernel WARN below.
+
+Do proper cleanup using gid_table_cleanup_one before returning
+the err in order to fix the issue.
+
+WARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0
+Modules linked in:
+CPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+RIP: 0010:gid_table_release_one+0x181/0x1a0
+Code: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8    3 c4 10 5b 5d 41 5c 41 5d 41
+RSP: 0018:ffffc90002b835b0 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527
+RDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001
+RBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631
+R10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001
+R13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001
+FS:  00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ ? show_regs+0x94/0xa0
+ ? __warn+0x9e/0x1c0
+ ? gid_table_release_one+0x181/0x1a0
+ ? report_bug+0x1f9/0x340
+ ? gid_table_release_one+0x181/0x1a0
+ ? handle_bug+0xa2/0x110
+ ? exc_invalid_op+0x31/0xa0
+ ? asm_exc_invalid_op+0x16/0x20
+ ? __warn_printk+0xc7/0x180
+ ? __warn_printk+0xd4/0x180
+ ? gid_table_release_one+0x181/0x1a0
+ ib_device_release+0x71/0xe0
+ ? __pfx_ib_device_release+0x10/0x10
+ device_release+0x44/0xd0
+ kobject_put+0x135/0x3d0
+ put_device+0x20/0x30
+ rxe_net_add+0x7d/0xa0
+ rxe_newlink+0xd7/0x190
+ nldev_newlink+0x1b0/0x2a0
+ ? __pfx_nldev_newlink+0x10/0x10
+ rdma_nl_rcv_msg+0x1ad/0x2e0
+ rdma_nl_rcv_skb.constprop.0+0x176/0x210
+ netlink_unicast+0x2de/0x400
+ netlink_sendmsg+0x306/0x660
+ __sock_sendmsg+0x110/0x120
+ ____sys_sendmsg+0x30e/0x390
+ ___sys_sendmsg+0x9b/0xf0
+ ? kstrtouint+0x6e/0xa0
+ ? kstrtouint_from_user+0x7c/0xb0
+ ? get_pid_task+0xb0/0xd0
+ ? proc_fail_nth_write+0x5b/0x140
+ ? __fget_light+0x9a/0x200
+ ? preempt_count_add+0x47/0xa0
+ __sys_sendmsg+0x61/0xd0
+ do_syscall_64+0x50/0x110
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: 1901b91f9982 ("IB/core: Fix potential NULL pointer dereference in pkey cache")
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
+Link: https://patch.msgid.link/79137687d829899b0b1c9835fcb4b258004c439a.1725273354.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cache.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index c319664ca74b3..873988e5c5280 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -1629,8 +1629,10 @@ int ib_cache_setup_one(struct ib_device *device)
+ 
+ 	rdma_for_each_port (device, p) {
+ 		err = ib_cache_update(device, p, true, true, true);
+-		if (err)
++		if (err) {
++			gid_table_cleanup_one(device);
+ 			return err;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/iio-adc-ad7606-fix-oversampling-gpio-array.patch b/queue-6.1/iio-adc-ad7606-fix-oversampling-gpio-array.patch
new file mode 100644
index 00000000000..1331fcefe89
--- /dev/null
+++ b/queue-6.1/iio-adc-ad7606-fix-oversampling-gpio-array.patch
@@ -0,0 +1,72 @@
+From 806763ac1e323cd548a21d47eb129a81064a2f31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 17:34:10 +0000
+Subject: iio: adc: ad7606: fix oversampling gpio array
+
+From: Guillaume Stols <gstols@baylibre.com>
+
+[ Upstream commit 8dc4594b54dbaaba40dc8884ad3d42083de39434 ]
+
+gpiod_set_array_value was misused here: the implementation relied on the
+assumption that an unsigned long was required for each gpio, while the
+function expects a bit array stored in "as much unsigned long as needed
+for storing one bit per GPIO", i.e it is using a bit field.
+
+This leaded to incorrect parameter passed to gpiod_set_array_value, that
+would set 1 value instead of 3.
+It also prevents to select the software mode correctly for the AD7606B.
+
+Fixes: d2a415c86c6b ("iio: adc: ad7606: Add support for AD7606B ADC")
+Fixes: 41f71e5e7daf ("staging: iio: adc: ad7606: Use find_closest() macro")
+Signed-off-by: Guillaume Stols <gstols@baylibre.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7606.c     | 4 ++--
+ drivers/iio/adc/ad7606_spi.c | 5 +++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
+index 00df4fc5a51f0..5e41df6531581 100644
+--- a/drivers/iio/adc/ad7606.c
++++ b/drivers/iio/adc/ad7606.c
+@@ -215,9 +215,9 @@ static int ad7606_write_os_hw(struct iio_dev *indio_dev, int val)
+ 	struct ad7606_state *st = iio_priv(indio_dev);
+ 	DECLARE_BITMAP(values, 3);
+ 
+-	values[0] = val;
++	values[0] = val & GENMASK(2, 0);
+ 
+-	gpiod_set_array_value(ARRAY_SIZE(values), st->gpio_os->desc,
++	gpiod_set_array_value(st->gpio_os->ndescs, st->gpio_os->desc,
+ 			      st->gpio_os->info, values);
+ 
+ 	/* AD7616 requires a reset to update value */
+diff --git a/drivers/iio/adc/ad7606_spi.c b/drivers/iio/adc/ad7606_spi.c
+index 263a778bcf253..287a0591533b6 100644
+--- a/drivers/iio/adc/ad7606_spi.c
++++ b/drivers/iio/adc/ad7606_spi.c
+@@ -249,8 +249,9 @@ static int ad7616_sw_mode_config(struct iio_dev *indio_dev)
+ static int ad7606B_sw_mode_config(struct iio_dev *indio_dev)
+ {
+ 	struct ad7606_state *st = iio_priv(indio_dev);
+-	unsigned long os[3] = {1};
++	DECLARE_BITMAP(os, 3);
+ 
++	bitmap_fill(os, 3);
+ 	/*
+ 	 * Software mode is enabled when all three oversampling
+ 	 * pins are set to high. If oversampling gpios are defined
+@@ -258,7 +259,7 @@ static int ad7606B_sw_mode_config(struct iio_dev *indio_dev)
+ 	 * otherwise, they must be hardwired to VDD
+ 	 */
+ 	if (st->gpio_os) {
+-		gpiod_set_array_value(ARRAY_SIZE(os),
++		gpiod_set_array_value(st->gpio_os->ndescs,
+ 				      st->gpio_os->desc, st->gpio_os->info, os);
+ 	}
+ 	/* OS of 128 and 256 are available only in software mode */
+-- 
+2.43.0
+
diff --git a/queue-6.1/iio-adc-ad7606-fix-standby-gpio-state-to-match-the-d.patch b/queue-6.1/iio-adc-ad7606-fix-standby-gpio-state-to-match-the-d.patch
new file mode 100644
index 00000000000..4bccf244f0a
--- /dev/null
+++ b/queue-6.1/iio-adc-ad7606-fix-standby-gpio-state-to-match-the-d.patch
@@ -0,0 +1,48 @@
+From 3f2e70decb3a211c2e89487a4410725eb6c8100f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 17:34:11 +0000
+Subject: iio: adc: ad7606: fix standby gpio state to match the documentation
+
+From: Guillaume Stols <gstols@baylibre.com>
+
+[ Upstream commit 059fe4f8bbdf5cad212e1aeeb3e8968c80b9ff3b ]
+
+The binding's documentation specifies that "As the line is active low, it
+should be marked GPIO_ACTIVE_LOW". However, in the driver, it was handled
+the opposite way. This commit sets the driver's behaviour in sync with the
+documentation
+
+Fixes: 722407a4e8c0 ("staging:iio:ad7606: Use GPIO descriptor API")
+Signed-off-by: Guillaume Stols <gstols@baylibre.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7606.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
+index 5e41df6531581..b1b0ac47e3bc8 100644
+--- a/drivers/iio/adc/ad7606.c
++++ b/drivers/iio/adc/ad7606.c
+@@ -422,7 +422,7 @@ static int ad7606_request_gpios(struct ad7606_state *st)
+ 		return PTR_ERR(st->gpio_range);
+ 
+ 	st->gpio_standby = devm_gpiod_get_optional(dev, "standby",
+-						   GPIOD_OUT_HIGH);
++						   GPIOD_OUT_LOW);
+ 	if (IS_ERR(st->gpio_standby))
+ 		return PTR_ERR(st->gpio_standby);
+ 
+@@ -681,7 +681,7 @@ static int ad7606_suspend(struct device *dev)
+ 
+ 	if (st->gpio_standby) {
+ 		gpiod_set_value(st->gpio_range, 1);
+-		gpiod_set_value(st->gpio_standby, 0);
++		gpiod_set_value(st->gpio_standby, 1);
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/iio-chemical-bme680-fix-read-write-ops-to-device-by-.patch b/queue-6.1/iio-chemical-bme680-fix-read-write-ops-to-device-by-.patch
new file mode 100644
index 00000000000..e487d4b57ed
--- /dev/null
+++ b/queue-6.1/iio-chemical-bme680-fix-read-write-ops-to-device-by-.patch
@@ -0,0 +1,77 @@
+From 0bbcb112b16df573b4b98b5863f8f66b20537475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jun 2024 01:38:12 +0200
+Subject: iio: chemical: bme680: Fix read/write ops to device by adding mutexes
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+[ Upstream commit 77641e5a477d428335cd094b88ac54e09ccb70f4 ]
+
+Add mutexes in the {read/write}_raw() functions of the device to guard the
+read/write of data from/to the device. This is necessary because for any
+operation other than temperature, multiple reads need to take place from
+the device. Even though regmap has a locking by itself, it won't protect us
+from multiple applications trying to read at the same time temperature and
+pressure since the pressure reading includes an internal temperature
+reading and there is nothing to ensure that this temperature+pressure
+reading will happen sequentially without any other operation interfering
+in the meantime.
+
+Fixes: 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor")
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://patch.msgid.link/20240609233826.330516-2-vassilisamir@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/chemical/bme680_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c
+index 500f56834b01f..a6bf689833dad 100644
+--- a/drivers/iio/chemical/bme680_core.c
++++ b/drivers/iio/chemical/bme680_core.c
+@@ -10,6 +10,7 @@
+  */
+ #include <linux/acpi.h>
+ #include <linux/bitfield.h>
++#include <linux/cleanup.h>
+ #include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/module.h>
+@@ -52,6 +53,7 @@ struct bme680_calib {
+ struct bme680_data {
+ 	struct regmap *regmap;
+ 	struct bme680_calib bme680;
++	struct mutex lock; /* Protect multiple serial R/W ops to device. */
+ 	u8 oversampling_temp;
+ 	u8 oversampling_press;
+ 	u8 oversampling_humid;
+@@ -827,6 +829,8 @@ static int bme680_read_raw(struct iio_dev *indio_dev,
+ {
+ 	struct bme680_data *data = iio_priv(indio_dev);
+ 
++	guard(mutex)(&data->lock);
++
+ 	switch (mask) {
+ 	case IIO_CHAN_INFO_PROCESSED:
+ 		switch (chan->type) {
+@@ -871,6 +875,8 @@ static int bme680_write_raw(struct iio_dev *indio_dev,
+ {
+ 	struct bme680_data *data = iio_priv(indio_dev);
+ 
++	guard(mutex)(&data->lock);
++
+ 	if (val2 != 0)
+ 		return -EINVAL;
+ 
+@@ -967,6 +973,7 @@ int bme680_core_probe(struct device *dev, struct regmap *regmap,
+ 		name = bme680_match_acpi_device(dev);
+ 
+ 	data = iio_priv(indio_dev);
++	mutex_init(&data->lock);
+ 	dev_set_drvdata(dev, indio_dev);
+ 	data->regmap = regmap;
+ 	indio_dev->name = name;
+-- 
+2.43.0
+
diff --git a/queue-6.1/iio-magnetometer-ak8975-convert-enum-pointer-for-dat.patch b/queue-6.1/iio-magnetometer-ak8975-convert-enum-pointer-for-dat.patch
new file mode 100644
index 00000000000..86a73fe39a3
--- /dev/null
+++ b/queue-6.1/iio-magnetometer-ak8975-convert-enum-pointer-for-dat.patch
@@ -0,0 +1,143 @@
+From df793ca35655dce6406a9ede8c05da808b3e200e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Aug 2023 08:55:56 +0100
+Subject: iio: magnetometer: ak8975: Convert enum->pointer for data in the
+ match tables
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 4f9ea93afde190a0f906ee624fc9a45cf784551b ]
+
+Convert enum->pointer for data in the match tables to simplify the probe()
+by replacing device_get_match_data() and i2c_client_get_device_id by
+i2c_get_match_data() as we have similar I2C, ACPI and DT matching table.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230818075600.24277-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: da6e3160df23 ("iio: magnetometer: ak8975: drop incorrect AK09116 compatible")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 75 +++++++++++++------------------
+ 1 file changed, 30 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index caf03a2a98a5d..8762e0f085b80 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -813,13 +813,13 @@ static const struct iio_info ak8975_info = {
+ };
+ 
+ static const struct acpi_device_id ak_acpi_match[] = {
+-	{"AK8975", AK8975},
+-	{"AK8963", AK8963},
+-	{"INVN6500", AK8963},
+-	{"AK009911", AK09911},
+-	{"AK09911", AK09911},
+-	{"AKM9911", AK09911},
+-	{"AK09912", AK09912},
++	{"AK8975", (kernel_ulong_t)&ak_def_array[AK8975] },
++	{"AK8963", (kernel_ulong_t)&ak_def_array[AK8963] },
++	{"INVN6500", (kernel_ulong_t)&ak_def_array[AK8963] },
++	{"AK009911", (kernel_ulong_t)&ak_def_array[AK09911] },
++	{"AK09911", (kernel_ulong_t)&ak_def_array[AK09911] },
++	{"AKM9911", (kernel_ulong_t)&ak_def_array[AK09911] },
++	{"AK09912", (kernel_ulong_t)&ak_def_array[AK09912] },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(acpi, ak_acpi_match);
+@@ -883,10 +883,7 @@ static int ak8975_probe(struct i2c_client *client,
+ 	struct iio_dev *indio_dev;
+ 	struct gpio_desc *eoc_gpiod;
+ 	struct gpio_desc *reset_gpiod;
+-	const void *match;
+-	unsigned int i;
+ 	int err;
+-	enum asahi_compass_chipset chipset;
+ 	const char *name = NULL;
+ 
+ 	/*
+@@ -928,27 +925,15 @@ static int ak8975_probe(struct i2c_client *client,
+ 		return err;
+ 
+ 	/* id will be NULL when enumerated via ACPI */
+-	match = device_get_match_data(&client->dev);
+-	if (match) {
+-		chipset = (uintptr_t)match;
+-		name = dev_name(&client->dev);
+-	} else if (id) {
+-		chipset = (enum asahi_compass_chipset)(id->driver_data);
+-		name = id->name;
+-	} else
+-		return -ENOSYS;
+-
+-	for (i = 0; i < ARRAY_SIZE(ak_def_array); i++)
+-		if (ak_def_array[i].type == chipset)
+-			break;
+-
+-	if (i == ARRAY_SIZE(ak_def_array)) {
+-		dev_err(&client->dev, "AKM device type unsupported: %d\n",
+-			chipset);
++	data->def = i2c_get_match_data(client);
++	if (!data->def)
+ 		return -ENODEV;
+-	}
+ 
+-	data->def = &ak_def_array[i];
++	/* If enumerated via firmware node, fix the ABI */
++	if (dev_fwnode(&client->dev))
++		name = dev_name(&client->dev);
++	else
++		name = id->name;
+ 
+ 	/* Fetch the regulators */
+ 	data->vdd = devm_regulator_get(&client->dev, "vdd");
+@@ -1077,28 +1062,28 @@ static DEFINE_RUNTIME_DEV_PM_OPS(ak8975_dev_pm_ops, ak8975_runtime_suspend,
+ 				 ak8975_runtime_resume, NULL);
+ 
+ static const struct i2c_device_id ak8975_id[] = {
+-	{"ak8975", AK8975},
+-	{"ak8963", AK8963},
+-	{"AK8963", AK8963},
+-	{"ak09911", AK09911},
+-	{"ak09912", AK09912},
+-	{"ak09916", AK09916},
++	{"ak8975", (kernel_ulong_t)&ak_def_array[AK8975] },
++	{"ak8963", (kernel_ulong_t)&ak_def_array[AK8963] },
++	{"AK8963", (kernel_ulong_t)&ak_def_array[AK8963] },
++	{"ak09911", (kernel_ulong_t)&ak_def_array[AK09911] },
++	{"ak09912", (kernel_ulong_t)&ak_def_array[AK09912] },
++	{"ak09916", (kernel_ulong_t)&ak_def_array[AK09916] },
+ 	{}
+ };
+ 
+ MODULE_DEVICE_TABLE(i2c, ak8975_id);
+ 
+ static const struct of_device_id ak8975_of_match[] = {
+-	{ .compatible = "asahi-kasei,ak8975", },
+-	{ .compatible = "ak8975", },
+-	{ .compatible = "asahi-kasei,ak8963", },
+-	{ .compatible = "ak8963", },
+-	{ .compatible = "asahi-kasei,ak09911", },
+-	{ .compatible = "ak09911", },
+-	{ .compatible = "asahi-kasei,ak09912", },
+-	{ .compatible = "ak09912", },
+-	{ .compatible = "asahi-kasei,ak09916", },
+-	{ .compatible = "ak09916", },
++	{ .compatible = "asahi-kasei,ak8975", .data = &ak_def_array[AK8975] },
++	{ .compatible = "ak8975", .data = &ak_def_array[AK8975] },
++	{ .compatible = "asahi-kasei,ak8963", .data = &ak_def_array[AK8963] },
++	{ .compatible = "ak8963", .data = &ak_def_array[AK8963] },
++	{ .compatible = "asahi-kasei,ak09911", .data = &ak_def_array[AK09911] },
++	{ .compatible = "ak09911", .data = &ak_def_array[AK09911] },
++	{ .compatible = "asahi-kasei,ak09912", .data = &ak_def_array[AK09912] },
++	{ .compatible = "ak09912", .data = &ak_def_array[AK09912] },
++	{ .compatible = "asahi-kasei,ak09916", .data = &ak_def_array[AK09916] },
++	{ .compatible = "ak09916", .data = &ak_def_array[AK09916] },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, ak8975_of_match);
+-- 
+2.43.0
+
diff --git a/queue-6.1/iio-magnetometer-ak8975-drop-incorrect-ak09116-compa.patch b/queue-6.1/iio-magnetometer-ak8975-drop-incorrect-ak09116-compa.patch
new file mode 100644
index 00000000000..55f96e8a31b
--- /dev/null
+++ b/queue-6.1/iio-magnetometer-ak8975-drop-incorrect-ak09116-compa.patch
@@ -0,0 +1,39 @@
+From a1017d9ddf6a152da583b177b96ac0304b614946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 07:30:15 +0200
+Subject: iio: magnetometer: ak8975: drop incorrect AK09116 compatible
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit da6e3160df230692bbd48a6d52318035f19595e2 ]
+
+All compatibles in this binding without prefixes were deprecated, so
+adding a new deprecated one after some time is not allowed, because it
+defies the core logic of deprecating things.
+
+Drop the AK09916 vendorless compatible.
+
+Fixes: 76e28aa97fa0 ("iio: magnetometer: ak8975: add AK09116 support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20240806053016.6401-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 8762e0f085b80..d2b606bf13ead 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -1083,7 +1083,6 @@ static const struct of_device_id ak8975_of_match[] = {
+ 	{ .compatible = "asahi-kasei,ak09912", .data = &ak_def_array[AK09912] },
+ 	{ .compatible = "ak09912", .data = &ak_def_array[AK09912] },
+ 	{ .compatible = "asahi-kasei,ak09916", .data = &ak_def_array[AK09916] },
+-	{ .compatible = "ak09916", .data = &ak_def_array[AK09916] },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, ak8975_of_match);
+-- 
+2.43.0
+
diff --git a/queue-6.1/input-ilitek_ts_i2c-add-report-id-message-validation.patch b/queue-6.1/input-ilitek_ts_i2c-add-report-id-message-validation.patch
new file mode 100644
index 00000000000..052ffc3aec5
--- /dev/null
+++ b/queue-6.1/input-ilitek_ts_i2c-add-report-id-message-validation.patch
@@ -0,0 +1,50 @@
+From 31a3083003889f18534326521e70a0f895059451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 10:55:11 +0200
+Subject: Input: ilitek_ts_i2c - add report id message validation
+
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+
+[ Upstream commit 208989744a6f01bed86968473312d4e650e600b3 ]
+
+Ensure that the touchscreen response has correct "report id" byte
+before processing the touch data and discard other messages.
+
+Fixes: 42370681bd46 ("Input: Add support for ILITEK Lego Series")
+Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://lore.kernel.org/r/20240805085511.43955-3-francesco@dolcini.it
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ilitek_ts_i2c.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/touchscreen/ilitek_ts_i2c.c b/drivers/input/touchscreen/ilitek_ts_i2c.c
+index 43c3e068a8c35..41c928dc9d050 100644
+--- a/drivers/input/touchscreen/ilitek_ts_i2c.c
++++ b/drivers/input/touchscreen/ilitek_ts_i2c.c
+@@ -37,6 +37,8 @@
+ #define ILITEK_TP_CMD_GET_MCU_VER			0x61
+ #define ILITEK_TP_CMD_GET_IC_MODE			0xC0
+ 
++#define ILITEK_TP_I2C_REPORT_ID				0x48
++
+ #define REPORT_COUNT_ADDRESS				61
+ #define ILITEK_SUPPORT_MAX_POINT			40
+ 
+@@ -163,6 +165,11 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)
+ 		return error;
+ 	}
+ 
++	if (buf[0] != ILITEK_TP_I2C_REPORT_ID) {
++		dev_err(dev, "get touch info failed. Wrong id: 0x%02X\n", buf[0]);
++		return -EINVAL;
++	}
++
+ 	report_max_point = buf[REPORT_COUNT_ADDRESS];
+ 	if (report_max_point > ts->max_tp) {
+ 		dev_err(dev, "FW report max point:%d > panel info. max:%d\n",
+-- 
+2.43.0
+
diff --git a/queue-6.1/input-ilitek_ts_i2c-avoid-wrong-input-subsystem-sync.patch b/queue-6.1/input-ilitek_ts_i2c-avoid-wrong-input-subsystem-sync.patch
new file mode 100644
index 00000000000..12a35cfdc69
--- /dev/null
+++ b/queue-6.1/input-ilitek_ts_i2c-avoid-wrong-input-subsystem-sync.patch
@@ -0,0 +1,71 @@
+From b014aaece2ef5fdc249f4cd6f9253e05f6774816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 10:55:10 +0200
+Subject: Input: ilitek_ts_i2c - avoid wrong input subsystem sync
+
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+
+[ Upstream commit 7d0b18cd5dc7429917812963611d961fd93cb44d ]
+
+For different reasons i2c transaction may fail or report id in the
+message may be wrong. Avoid closing the frame in this case as it will
+result in all contacts being dropped, indicating that nothing is
+touching the screen anymore, while usually it is not the case.
+
+Fixes: 42370681bd46 ("Input: Add support for ILITEK Lego Series")
+Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://lore.kernel.org/r/20240805085511.43955-2-francesco@dolcini.it
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ilitek_ts_i2c.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/touchscreen/ilitek_ts_i2c.c b/drivers/input/touchscreen/ilitek_ts_i2c.c
+index c5d259c76adc1..43c3e068a8c35 100644
+--- a/drivers/input/touchscreen/ilitek_ts_i2c.c
++++ b/drivers/input/touchscreen/ilitek_ts_i2c.c
+@@ -160,15 +160,14 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)
+ 	error = ilitek_i2c_write_and_read(ts, NULL, 0, 0, buf, 64);
+ 	if (error) {
+ 		dev_err(dev, "get touch info failed, err:%d\n", error);
+-		goto err_sync_frame;
++		return error;
+ 	}
+ 
+ 	report_max_point = buf[REPORT_COUNT_ADDRESS];
+ 	if (report_max_point > ts->max_tp) {
+ 		dev_err(dev, "FW report max point:%d > panel info. max:%d\n",
+ 			report_max_point, ts->max_tp);
+-		error = -EINVAL;
+-		goto err_sync_frame;
++		return -EINVAL;
+ 	}
+ 
+ 	count = DIV_ROUND_UP(report_max_point, packet_max_point);
+@@ -178,7 +177,7 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)
+ 		if (error) {
+ 			dev_err(dev, "get touch info. failed, cnt:%d, err:%d\n",
+ 				count, error);
+-			goto err_sync_frame;
++			return error;
+ 		}
+ 	}
+ 
+@@ -203,10 +202,10 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)
+ 		ilitek_touch_down(ts, id, x, y);
+ 	}
+ 
+-err_sync_frame:
+ 	input_mt_sync_frame(input);
+ 	input_sync(input);
+-	return error;
++
++	return 0;
+ }
+ 
+ /* APIs of cmds for ILITEK Touch IC */
+-- 
+2.43.0
+
diff --git a/queue-6.1/input-ps2-gpio-use-irqf_no_autoen-flag-in-request_ir.patch b/queue-6.1/input-ps2-gpio-use-irqf_no_autoen-flag-in-request_ir.patch
new file mode 100644
index 00000000000..2ab0705d572
--- /dev/null
+++ b/queue-6.1/input-ps2-gpio-use-irqf_no_autoen-flag-in-request_ir.patch
@@ -0,0 +1,49 @@
+From 69727b0dd78b9f1a1e78b14bdac07db7cf55d134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 11:30:13 +0800
+Subject: Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit dcd18a3fb1228409dfc24373c5c6868a655810b0 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 9ee0a0558819 ("Input: PS/2 gpio bit banging driver for serio bus")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Acked-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://lore.kernel.org/r/20240912033013.2610949-1-ruanjinjie@huawei.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/ps2-gpio.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/serio/ps2-gpio.c b/drivers/input/serio/ps2-gpio.c
+index bc1dc484389b4..ea67968fb112c 100644
+--- a/drivers/input/serio/ps2-gpio.c
++++ b/drivers/input/serio/ps2-gpio.c
+@@ -429,16 +429,14 @@ static int ps2_gpio_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	error = devm_request_irq(dev, drvdata->irq, ps2_gpio_irq,
+-				 IRQF_NO_THREAD, DRIVER_NAME, drvdata);
++				 IRQF_NO_THREAD | IRQF_NO_AUTOEN, DRIVER_NAME,
++				 drvdata);
+ 	if (error) {
+ 		dev_err(dev, "failed to request irq %d: %d\n",
+ 			drvdata->irq, error);
+ 		goto err_free_serio;
+ 	}
+ 
+-	/* Keep irq disabled until serio->open is called. */
+-	disable_irq(drvdata->irq);
+-
+ 	serio->id.type = SERIO_8042;
+ 	serio->open = ps2_gpio_open;
+ 	serio->close = ps2_gpio_close;
+-- 
+2.43.0
+
diff --git a/queue-6.1/iommu-amd-do-not-set-the-d-bit-on-amd-v2-table-entri.patch b/queue-6.1/iommu-amd-do-not-set-the-d-bit-on-amd-v2-table-entri.patch
new file mode 100644
index 00000000000..b608133f5f2
--- /dev/null
+++ b/queue-6.1/iommu-amd-do-not-set-the-d-bit-on-amd-v2-table-entri.patch
@@ -0,0 +1,38 @@
+From ce535d0b3f720256fe5bb2e71708062f0b63249d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 21:06:23 -0300
+Subject: iommu/amd: Do not set the D bit on AMD v2 table entries
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 2910a7fa1be090fc7637cef0b2e70bcd15bf5469 ]
+
+The manual says that bit 6 is IGN for all Page-Table Base Address
+pointers, don't set it.
+
+Fixes: aaac38f61487 ("iommu/amd: Initial support for AMD IOMMU v2 page table")
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/14-v2-831cdc4d00f3+1a315-amd_iopgtbl_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/io_pgtable_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd/io_pgtable_v2.c b/drivers/iommu/amd/io_pgtable_v2.c
+index 8638ddf6fb3b2..232d17bd941fd 100644
+--- a/drivers/iommu/amd/io_pgtable_v2.c
++++ b/drivers/iommu/amd/io_pgtable_v2.c
+@@ -56,7 +56,7 @@ static inline u64 set_pgtable_attr(u64 *page)
+ 	u64 prot;
+ 
+ 	prot = IOMMU_PAGE_PRESENT | IOMMU_PAGE_RW | IOMMU_PAGE_USER;
+-	prot |= IOMMU_PAGE_ACCESS | IOMMU_PAGE_DIRTY;
++	prot |= IOMMU_PAGE_ACCESS;
+ 
+ 	return (iommu_virt_to_phys(page) | prot);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/ipmi-docs-don-t-advertise-deprecated-sysfs-entries.patch b/queue-6.1/ipmi-docs-don-t-advertise-deprecated-sysfs-entries.patch
new file mode 100644
index 00000000000..cff2b265a9f
--- /dev/null
+++ b/queue-6.1/ipmi-docs-don-t-advertise-deprecated-sysfs-entries.patch
@@ -0,0 +1,39 @@
+From 2a535678a97a3597d55d2ae3c057862314f3fc49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2024 11:02:11 +0200
+Subject: ipmi: docs: don't advertise deprecated sysfs entries
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 64dce81f8c373c681e62d5ffe0397c45a35d48a2 ]
+
+"i2c-adapter" class entries are deprecated since 2009. Switch to the
+proper location.
+
+Reported-by: Heiner Kallweit <hkallweit1@gmail.com>
+Closes: https://lore.kernel.org/r/80c4a898-5867-4162-ac85-bdf7c7c68746@gmail.com
+Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF)")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Message-Id: <20240901090211.3797-2-wsa+renesas@sang-engineering.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/driver-api/ipmi.rst | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/driver-api/ipmi.rst b/Documentation/driver-api/ipmi.rst
+index e224e47b6b094..dfa021eacd63c 100644
+--- a/Documentation/driver-api/ipmi.rst
++++ b/Documentation/driver-api/ipmi.rst
+@@ -540,7 +540,7 @@ at module load time (for a module) with::
+ 	alerts_broken
+ 
+ The addresses are normal I2C addresses.  The adapter is the string
+-name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name.
++name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name.
+ It is *NOT* i2c-<n> itself.  Also, the comparison is done ignoring
+ spaces, so if the name is "This is an I2C chip" you can say
+ adapter_name=ThisisanI2cchip.  This is because it's hard to pass in
+-- 
+2.43.0
+
diff --git a/queue-6.1/ipv6-avoid-possible-null-deref-in-rt6_uncached_list_.patch b/queue-6.1/ipv6-avoid-possible-null-deref-in-rt6_uncached_list_.patch
new file mode 100644
index 00000000000..b5f598a38d8
--- /dev/null
+++ b/queue-6.1/ipv6-avoid-possible-null-deref-in-rt6_uncached_list_.patch
@@ -0,0 +1,110 @@
+From 1e50b6bf089e403375f25f59bb7185ab053b0e8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 08:31:47 +0000
+Subject: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 04ccecfa959d3b9ae7348780d8e379c6486176ac ]
+
+Blamed commit accidentally removed a check for rt->rt6i_idev being NULL,
+as spotted by syzbot:
+
+Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
+KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
+ RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]
+ RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914
+Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06
+RSP: 0018:ffffc900047374e0 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000
+RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0
+RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c
+R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18
+R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930
+FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+  addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856
+ addrconf_notify+0x3cb/0x1020
+  notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93
+  call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]
+  call_netdevice_notifiers net/core/dev.c:2046 [inline]
+  unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352
+  unregister_netdevice_many net/core/dev.c:11414 [inline]
+  unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289
+  unregister_netdevice include/linux/netdevice.h:3129 [inline]
+  __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685
+  tun_detach drivers/net/tun.c:701 [inline]
+  tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510
+  __fput+0x24a/0x8a0 fs/file_table.c:422
+  task_work_run+0x24f/0x310 kernel/task_work.c:228
+  exit_task_work include/linux/task_work.h:40 [inline]
+  do_exit+0xa2f/0x27f0 kernel/exit.c:882
+  do_group_exit+0x207/0x2c0 kernel/exit.c:1031
+  __do_sys_exit_group kernel/exit.c:1042 [inline]
+  __se_sys_exit_group kernel/exit.c:1040 [inline]
+  __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040
+  x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7f1acc77def9
+Code: Unable to access opcode bytes at 0x7f1acc77decf.
+RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
+RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
+R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0
+ </TASK>
+Modules linked in:
+---[ end trace 0000000000000000 ]---
+ RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]
+ RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914
+Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06
+RSP: 0018:ffffc900047374e0 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000
+RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0
+RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c
+R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18
+R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930
+FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Fixes: e332bc67cf5e ("ipv6: Don't call with rt6_uncached_list_flush_dev")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20240913083147.3095442-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 8c1d9e6124363..6a227edf8a8aa 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -175,7 +175,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev)
+ 			struct net_device *rt_dev = rt->dst.dev;
+ 			bool handled = false;
+ 
+-			if (rt_idev->dev == dev) {
++			if (rt_idev && rt_idev->dev == dev) {
+ 				rt->rt6i_idev = in6_dev_get(blackhole_netdev);
+ 				in6_dev_put(rt_idev);
+ 				handled = true;
+-- 
+2.43.0
+
diff --git a/queue-6.1/jfs-fix-out-of-bounds-in-dbnextag-and-dialloc.patch b/queue-6.1/jfs-fix-out-of-bounds-in-dbnextag-and-dialloc.patch
new file mode 100644
index 00000000000..2b24279a1ce
--- /dev/null
+++ b/queue-6.1/jfs-fix-out-of-bounds-in-dbnextag-and-dialloc.patch
@@ -0,0 +1,68 @@
+From f3ae50294cc0a3be28e6a625350538c183e5b9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 13:05:46 +0900
+Subject: jfs: fix out-of-bounds in dbNextAG() and diAlloc()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]
+
+In dbNextAG() , there is no check for the case where bmp->db_numag is
+greater or same than MAXAG due to a polluted image, which causes an
+out-of-bounds. Therefore, a bounds check should be added in dbMount().
+
+And in dbNextAG(), a check for the case where agpref is greater than
+bmp->db_numag should be added, so an out-of-bounds exception should be
+prevented.
+
+Additionally, a check for the case where agno is greater or same than
+MAXAG should be added in diAlloc() to prevent out-of-bounds.
+
+Reported-by: Jeongjun Park <aha310510@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 4 ++--
+ fs/jfs/jfs_imap.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index d2df00676292d..bc645014b2849 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
+ 	}
+ 
+ 	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
+-	if (!bmp->db_numag) {
++	if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
+ 		err = -EINVAL;
+ 		goto err_release_metapage;
+ 	}
+@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
+ 	 * average free space.
+ 	 */
+ 	for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
+-		if (agpref == bmp->db_numag)
++		if (agpref >= bmp->db_numag)
+ 			agpref = 0;
+ 
+ 		if (atomic_read(&bmp->db_active[agpref]))
+diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
+index ba6f28521360b..c72e97f065798 100644
+--- a/fs/jfs/jfs_imap.c
++++ b/fs/jfs/jfs_imap.c
+@@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
+ 	/* get the ag number of this iag */
+ 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+ 	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
+-	if (agno < 0 || agno > dn_numag)
++	if (agno < 0 || agno > dn_numag || agno >= MAXAG)
+ 		return -EIO;
+ 
+ 	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-arm64-actually-test-sme-vector-length-chan.patch b/queue-6.1/kselftest-arm64-actually-test-sme-vector-length-chan.patch
new file mode 100644
index 00000000000..ec521505013
--- /dev/null
+++ b/queue-6.1/kselftest-arm64-actually-test-sme-vector-length-chan.patch
@@ -0,0 +1,72 @@
+From f70ac8a65fe5ccd7fb9f9db684651735436a0b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 18:20:09 +0100
+Subject: kselftest/arm64: Actually test SME vector length changes via
+ sigreturn
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 6f0315330af7a57c1c00587fdfb69c7778bf1c50 ]
+
+The test case for SME vector length changes via sigreturn use a bit too
+much cut'n'paste and only actually changed the SVE vector length in the
+test itself. Andre's recent factoring out of the initialisation code caused
+this to be exposed and the test to start failing. Fix the test to actually
+cover the thing it's supposed to test.
+
+Fixes: 4963aeb35a9e ("kselftest/arm64: signal: Add SME signal handling tests")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Tested-by: Andre Przywara <andre.przywara@arm.com>
+Link: https://lore.kernel.org/r/20240829-arm64-sme-signal-vl-change-test-v1-1-42d7534cb818@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testcases/fake_sigreturn_sme_change_vl.c       | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
+index cb8c051b5c8f2..dfd6a2badf9fb 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
++++ b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
+@@ -35,30 +35,30 @@ static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
+ {
+ 	size_t resv_sz, offset;
+ 	struct _aarch64_ctx *head = GET_SF_RESV_HEAD(sf);
+-	struct sve_context *sve;
++	struct za_context *za;
+ 
+ 	/* Get a signal context with a SME ZA frame in it */
+ 	if (!get_current_context(td, &sf.uc, sizeof(sf.uc)))
+ 		return 1;
+ 
+ 	resv_sz = GET_SF_RESV_SIZE(sf);
+-	head = get_header(head, SVE_MAGIC, resv_sz, &offset);
++	head = get_header(head, ZA_MAGIC, resv_sz, &offset);
+ 	if (!head) {
+-		fprintf(stderr, "No SVE context\n");
++		fprintf(stderr, "No ZA context\n");
+ 		return 1;
+ 	}
+ 
+-	if (head->size != sizeof(struct sve_context)) {
++	if (head->size != sizeof(struct za_context)) {
+ 		fprintf(stderr, "Register data present, aborting\n");
+ 		return 1;
+ 	}
+ 
+-	sve = (struct sve_context *)head;
++	za = (struct za_context *)head;
+ 
+ 	/* No changes are supported; init left us at minimum VL so go to max */
+ 	fprintf(stderr, "Attempting to change VL from %d to %d\n",
+-		sve->vl, vls[0]);
+-	sve->vl = vls[0];
++		za->vl, vls[0]);
++	za->vl = vls[0];
+ 
+ 	fake_sigreturn(&sf, sizeof(sf), 0);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-arm64-don-t-pass-headers-to-the-compiler-a.patch b/queue-6.1/kselftest-arm64-don-t-pass-headers-to-the-compiler-a.patch
new file mode 100644
index 00000000000..51001e75876
--- /dev/null
+++ b/queue-6.1/kselftest-arm64-don-t-pass-headers-to-the-compiler-a.patch
@@ -0,0 +1,56 @@
+From 3674998b7b9890516fff02e22e9b73a4ae53a643 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 19:51:49 +0000
+Subject: kselftest/arm64: Don't pass headers to the compiler as source
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit a884f7970e57aef78c6011561e29d238e46b3a9f ]
+
+The signal Makefile rules pass all the dependencies for each executable,
+including headers, to the compiler which GCC is happy enough with but
+clang rejects:
+
+   clang --target=aarch64-none-linux-gnu -fintegrated-as -Wall -O2 -g -I/home/broonie/git/linux/tools/testing/selftests/ -isystem /home/broonie/git/linux/usr/include -D_GNU_SOURCE -std=gnu99 -I.  test_signals.c test_signals_utils.c testcases/testcases.c signals.S testcases/fake_sigreturn_bad_magic.c test_signals.h test_signals_utils.h testcases/testcases.h -o testcases/fake_sigreturn_bad_magic
+  clang: error: cannot specify -o when generating multiple output files
+
+This happens because clang gets confused about what to do with the
+header files, failing to identify them as source.  This is not amazing
+behaviour on clang's part and should ideally be fixed but even if that
+happens we'd still need a new clang release so let's instead rework the
+Makefile so we use variables for the lists of header and source files,
+allowing us to only pass the source files to the compiler and keep clang
+happy.
+
+As a bonus the resulting Makefile is a bit easier to read.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20230111-arm64-kselftest-clang-v1-3-89c69d377727@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/Makefile | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/signal/Makefile b/tools/testing/selftests/arm64/signal/Makefile
+index be7520a863b03..8f5febaf1a9a2 100644
+--- a/tools/testing/selftests/arm64/signal/Makefile
++++ b/tools/testing/selftests/arm64/signal/Makefile
+@@ -22,6 +22,10 @@ $(TEST_GEN_PROGS): $(PROGS)
+ 
+ # Common test-unit targets to build common-layout test-cases executables
+ # Needs secondary expansion to properly include the testcase c-file in pre-reqs
++COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \
++	signals.S
++COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h
++
+ .SECONDEXPANSION:
+-$(PROGS): test_signals.c test_signals_utils.c testcases/testcases.c signals.S $$@.c test_signals.h test_signals_utils.h testcases/testcases.h
+-	$(CC) $(CFLAGS) $^ -o $@
++$(PROGS): $$@.c ${COMMON_SOURCES} ${COMMON_HEADERS}
++	$(CC) $(CFLAGS) ${@}.c ${COMMON_SOURCES} -o $@
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-arm64-fix-enumeration-of-systems-without-1.patch b/queue-6.1/kselftest-arm64-fix-enumeration-of-systems-without-1.patch
new file mode 100644
index 00000000000..04453fdb8cf
--- /dev/null
+++ b/queue-6.1/kselftest-arm64-fix-enumeration-of-systems-without-1.patch
@@ -0,0 +1,44 @@
+From 9afe98e4f52f525502c87e3f5690589b1073c93a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 22:56:35 +0000
+Subject: kselftest/arm64: Fix enumeration of systems without 128 bit SME for
+ SSVE+ZA
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit a7db82f18cd3d85ea8ef70fca5946b441187ed6d ]
+
+The current signal handling tests for SME do not account for the fact that
+unlike SVE all SME vector lengths are optional so we can't guarantee that
+we will encounter the minimum possible VL, they will hang enumerating VLs
+on such systems. Abort enumeration when we find the lowest VL in the newly
+added ssve_za_regs test.
+
+Fixes: bc69da5ff087 ("kselftest/arm64: Verify simultaneous SSVE and ZA context generation")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20230131-arm64-kselftest-sig-sme-no-128-v1-2-d47c13dc8e1e@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+index 954a21f6121a2..1f62621794d50 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td)
+ 
+ 		vl &= PR_SME_VL_LEN_MASK;
+ 
++		/* Did we find the lowest supported VL? */
++		if (vq < sve_vq_from_vl(vl))
++			break;
++
+ 		/* Skip missing VLs */
+ 		vq = sve_vq_from_vl(vl);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-arm64-signal-fix-refactor-sve-vector-lengt.patch b/queue-6.1/kselftest-arm64-signal-fix-refactor-sve-vector-lengt.patch
new file mode 100644
index 00000000000..14b82bd1c20
--- /dev/null
+++ b/queue-6.1/kselftest-arm64-signal-fix-refactor-sve-vector-lengt.patch
@@ -0,0 +1,570 @@
+From 4027ce125ec2cdb8a5341d6df4bc50bfbc1ade8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 17:44:01 +0100
+Subject: kselftest/arm64: signal: fix/refactor SVE vector length enumeration
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 5225b6562b9a7dc808d5a1e465aaf5e2ebb220cd ]
+
+Currently a number of SVE/SME related tests have almost identical
+functions to enumerate all supported vector lengths. However over time
+the copy&pasted code has diverged, allowing some bugs to creep in:
+- fake_sigreturn_sme_change_vl reports a failure, not a SKIP if only
+  one vector length is supported (but the SVE version is fine)
+- fake_sigreturn_sme_change_vl tries to set the SVE vector length, not
+  the SME one (but the other SME tests are fine)
+- za_no_regs keeps iterating forever if only one vector length is
+  supported (but za_regs is correct)
+
+Since those bugs seem to be mostly copy&paste ones, let's consolidate
+the enumeration loop into one shared function, and just call that from
+each test. That should fix the above bugs, and prevent similar issues
+from happening again.
+
+Fixes: 4963aeb35a9e ("kselftest/arm64: signal: Add SME signal handling tests")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240821164401.3598545-1-andre.przywara@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/Makefile |  2 +-
+ .../selftests/arm64/signal/sve_helpers.c      | 56 +++++++++++++++++++
+ .../selftests/arm64/signal/sve_helpers.h      | 21 +++++++
+ .../testcases/fake_sigreturn_sme_change_vl.c  | 32 +++--------
+ .../testcases/fake_sigreturn_sve_change_vl.c  | 30 ++--------
+ .../arm64/signal/testcases/ssve_regs.c        | 36 +++---------
+ .../arm64/signal/testcases/ssve_za_regs.c     | 36 +++---------
+ .../arm64/signal/testcases/sve_regs.c         | 32 +++--------
+ .../arm64/signal/testcases/za_no_regs.c       | 32 +++--------
+ .../arm64/signal/testcases/za_regs.c          | 36 +++---------
+ 10 files changed, 132 insertions(+), 181 deletions(-)
+ create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.c
+ create mode 100644 tools/testing/selftests/arm64/signal/sve_helpers.h
+
+diff --git a/tools/testing/selftests/arm64/signal/Makefile b/tools/testing/selftests/arm64/signal/Makefile
+index 8f5febaf1a9a2..edb3613513b8a 100644
+--- a/tools/testing/selftests/arm64/signal/Makefile
++++ b/tools/testing/selftests/arm64/signal/Makefile
+@@ -23,7 +23,7 @@ $(TEST_GEN_PROGS): $(PROGS)
+ # Common test-unit targets to build common-layout test-cases executables
+ # Needs secondary expansion to properly include the testcase c-file in pre-reqs
+ COMMON_SOURCES := test_signals.c test_signals_utils.c testcases/testcases.c \
+-	signals.S
++	signals.S sve_helpers.c
+ COMMON_HEADERS := test_signals.h test_signals_utils.h testcases/testcases.h
+ 
+ .SECONDEXPANSION:
+diff --git a/tools/testing/selftests/arm64/signal/sve_helpers.c b/tools/testing/selftests/arm64/signal/sve_helpers.c
+new file mode 100644
+index 0000000000000..0acc121af3062
+--- /dev/null
++++ b/tools/testing/selftests/arm64/signal/sve_helpers.c
+@@ -0,0 +1,56 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2024 ARM Limited
++ *
++ * Common helper functions for SVE and SME functionality.
++ */
++
++#include <stdbool.h>
++#include <kselftest.h>
++#include <asm/sigcontext.h>
++#include <sys/prctl.h>
++
++unsigned int vls[SVE_VQ_MAX];
++unsigned int nvls;
++
++int sve_fill_vls(bool use_sme, int min_vls)
++{
++	int vq, vl;
++	int pr_set_vl = use_sme ? PR_SME_SET_VL : PR_SVE_SET_VL;
++	int len_mask = use_sme ? PR_SME_VL_LEN_MASK : PR_SVE_VL_LEN_MASK;
++
++	/*
++	 * Enumerate up to SVE_VQ_MAX vector lengths
++	 */
++	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
++		vl = prctl(pr_set_vl, vq * 16);
++		if (vl == -1)
++			return KSFT_FAIL;
++
++		vl &= len_mask;
++
++		/*
++		 * Unlike SVE, SME does not require the minimum vector length
++		 * to be implemented, or the VLs to be consecutive, so any call
++		 * to the prctl might return the single implemented VL, which
++		 * might be larger than 16. So to avoid this loop never
++		 * terminating,  bail out here when we find a higher VL than
++		 * we asked for.
++		 * See the ARM ARM, DDI 0487K.a, B1.4.2: I_QQRNR and I_NWYBP.
++		 */
++		if (vq < sve_vq_from_vl(vl))
++			break;
++
++		/* Skip missing VLs */
++		vq = sve_vq_from_vl(vl);
++
++		vls[nvls++] = vl;
++	}
++
++	if (nvls < min_vls) {
++		fprintf(stderr, "Only %d VL supported\n", nvls);
++		return KSFT_SKIP;
++	}
++
++	return KSFT_PASS;
++}
+diff --git a/tools/testing/selftests/arm64/signal/sve_helpers.h b/tools/testing/selftests/arm64/signal/sve_helpers.h
+new file mode 100644
+index 0000000000000..50948ce471cc6
+--- /dev/null
++++ b/tools/testing/selftests/arm64/signal/sve_helpers.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (C) 2024 ARM Limited
++ *
++ * Common helper functions for SVE and SME functionality.
++ */
++
++#ifndef __SVE_HELPERS_H__
++#define __SVE_HELPERS_H__
++
++#include <stdbool.h>
++
++#define VLS_USE_SVE	false
++#define VLS_USE_SME	true
++
++extern unsigned int vls[];
++extern unsigned int nvls;
++
++int sve_fill_vls(bool use_sme, int min_vls);
++
++#endif
+diff --git a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
+index ebd5815b54bba..cb8c051b5c8f2 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
++++ b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sme_change_vl.c
+@@ -6,44 +6,28 @@
+  * handler, this is not supported and is expected to segfault.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ struct fake_sigframe sf;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sme_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SME, 2);
+ 
+-	/*
+-	 * Enumerate up to SVE_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SVE_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
++	if (!res)
++		return true;
+ 
+-		vl &= PR_SME_VL_LEN_MASK;
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
+-
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least two VLs */
+-	if (nvls < 2) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
+-
+-	return true;
++	return false;
+ }
+ 
+ static int fake_sigreturn_ssve_change_vl(struct tdescr *td,
+diff --git a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c
+index e2a452190511f..e1ccf8f85a70c 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c
++++ b/tools/testing/selftests/arm64/signal/testcases/fake_sigreturn_sve_change_vl.c
+@@ -12,40 +12,22 @@
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ struct fake_sigframe sf;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sve_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SVE, 2);
+ 
+-	/*
+-	 * Enumerate up to SVE_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SVE_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
++	if (!res)
++		return true;
+ 
+-		vl &= PR_SVE_VL_LEN_MASK;
+-
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
+-
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least two VLs */
+-	if (nvls < 2) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
++	if (res == KSFT_SKIP)
+ 		td->result = KSFT_SKIP;
+-		return false;
+-	}
+ 
+-	return true;
++	return false;
+ }
+ 
+ static int fake_sigreturn_sve_change_vl(struct tdescr *td,
+diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
+index c6b17c47cac4c..05dfbfc7c5b51 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c
+@@ -6,51 +6,31 @@
+  * set up as expected.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ static union {
+ 	ucontext_t uc;
+ 	char buf[1024 * 64];
+ } context;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sme_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SME, 1);
+ 
+-	/*
+-	 * Enumerate up to SVE_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SME_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
+-
+-		vl &= PR_SME_VL_LEN_MASK;
+-
+-		/* Did we find the lowest supported VL? */
+-		if (vq < sve_vq_from_vl(vl))
+-			break;
++	if (!res)
++		return true;
+ 
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
+-
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least one VL */
+-	if (nvls < 1) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-	return true;
++	return false;
+ }
+ 
+ static void setup_ssve_regs(void)
+diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+index 1f62621794d50..ffefb24d16e9e 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+@@ -6,51 +6,31 @@
+  * signal frames is set up as expected when enabled simultaneously.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ static union {
+ 	ucontext_t uc;
+ 	char buf[1024 * 128];
+ } context;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sme_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SME, 1);
+ 
+-	/*
+-	 * Enumerate up to SVE_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SME_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
+-
+-		vl &= PR_SME_VL_LEN_MASK;
+-
+-		/* Did we find the lowest supported VL? */
+-		if (vq < sve_vq_from_vl(vl))
+-			break;
++	if (!res)
++		return true;
+ 
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
+-
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least one VL */
+-	if (nvls < 1) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-	return true;
++	return false;
+ }
+ 
+ static void setup_regs(void)
+diff --git a/tools/testing/selftests/arm64/signal/testcases/sve_regs.c b/tools/testing/selftests/arm64/signal/testcases/sve_regs.c
+index 8b16eabbb7697..8143eb1c58c18 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/sve_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/sve_regs.c
+@@ -6,47 +6,31 @@
+  * expected.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ static union {
+ 	ucontext_t uc;
+ 	char buf[1024 * 64];
+ } context;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sve_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SVE, 1);
+ 
+-	/*
+-	 * Enumerate up to SVE_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SVE_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
+-
+-		vl &= PR_SVE_VL_LEN_MASK;
+-
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
++	if (!res)
++		return true;
+ 
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least one VL */
+-	if (nvls < 1) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-	return true;
++	return false;
+ }
+ 
+ static void setup_sve_regs(void)
+diff --git a/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c b/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c
+index 4d6f94b6178f3..ce26e9c2fa5e3 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/za_no_regs.c
+@@ -6,47 +6,31 @@
+  * expected.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ static union {
+ 	ucontext_t uc;
+ 	char buf[1024 * 128];
+ } context;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sme_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SME, 1);
+ 
+-	/*
+-	 * Enumerate up to SME_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SME_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
+-
+-		vl &= PR_SME_VL_LEN_MASK;
+-
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
++	if (!res)
++		return true;
+ 
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least one VL */
+-	if (nvls < 1) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-	return true;
++	return false;
+ }
+ 
+ static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
+diff --git a/tools/testing/selftests/arm64/signal/testcases/za_regs.c b/tools/testing/selftests/arm64/signal/testcases/za_regs.c
+index 174ad66566964..b9e13f27f1f9a 100644
+--- a/tools/testing/selftests/arm64/signal/testcases/za_regs.c
++++ b/tools/testing/selftests/arm64/signal/testcases/za_regs.c
+@@ -6,51 +6,31 @@
+  * expected.
+  */
+ 
++#include <kselftest.h>
+ #include <signal.h>
+ #include <ucontext.h>
+ #include <sys/prctl.h>
+ 
+ #include "test_signals_utils.h"
++#include "sve_helpers.h"
+ #include "testcases.h"
+ 
+ static union {
+ 	ucontext_t uc;
+ 	char buf[1024 * 128];
+ } context;
+-static unsigned int vls[SVE_VQ_MAX];
+-unsigned int nvls = 0;
+ 
+ static bool sme_get_vls(struct tdescr *td)
+ {
+-	int vq, vl;
++	int res = sve_fill_vls(VLS_USE_SME, 1);
+ 
+-	/*
+-	 * Enumerate up to SME_VQ_MAX vector lengths
+-	 */
+-	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
+-		vl = prctl(PR_SME_SET_VL, vq * 16);
+-		if (vl == -1)
+-			return false;
+-
+-		vl &= PR_SME_VL_LEN_MASK;
+-
+-		/* Did we find the lowest supported VL? */
+-		if (vq < sve_vq_from_vl(vl))
+-			break;
++	if (!res)
++		return true;
+ 
+-		/* Skip missing VLs */
+-		vq = sve_vq_from_vl(vl);
+-
+-		vls[nvls++] = vl;
+-	}
+-
+-	/* We need at least one VL */
+-	if (nvls < 1) {
+-		fprintf(stderr, "Only %d VL supported\n", nvls);
+-		return false;
+-	}
++	if (res == KSFT_SKIP)
++		td->result = KSFT_SKIP;
+ 
+-	return true;
++	return false;
+ }
+ 
+ static void setup_za_regs(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/kselftest-arm64-verify-simultaneous-ssve-and-za-cont.patch b/queue-6.1/kselftest-arm64-verify-simultaneous-ssve-and-za-cont.patch
new file mode 100644
index 00000000000..fbe822ae4a6
--- /dev/null
+++ b/queue-6.1/kselftest-arm64-verify-simultaneous-ssve-and-za-cont.patch
@@ -0,0 +1,193 @@
+From c7218d105c4dfbb743de1b9a1fa6b9c6195e0187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 12:04:09 +0000
+Subject: kselftest/arm64: Verify simultaneous SSVE and ZA context generation
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit bc69da5ff087c40d1fc4f30596f1ee1b71924577 ]
+
+Add a test that generates SSVE and ZA context in a single signal frame to
+ensure that nothing is going wrong in that case for any reason.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20230117-arm64-test-ssve-za-v1-2-203c00150154@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Stable-dep-of: 5225b6562b9a ("kselftest/arm64: signal: fix/refactor SVE vector length enumeration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/signal/testcases/ssve_za_regs.c     | 162 ++++++++++++++++++
+ 1 file changed, 162 insertions(+)
+ create mode 100644 tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+
+diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+new file mode 100644
+index 0000000000000..954a21f6121a2
+--- /dev/null
++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_za_regs.c
+@@ -0,0 +1,162 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) 2021 ARM Limited
++ *
++ * Verify that both the streaming SVE and ZA register context in
++ * signal frames is set up as expected when enabled simultaneously.
++ */
++
++#include <signal.h>
++#include <ucontext.h>
++#include <sys/prctl.h>
++
++#include "test_signals_utils.h"
++#include "testcases.h"
++
++static union {
++	ucontext_t uc;
++	char buf[1024 * 128];
++} context;
++static unsigned int vls[SVE_VQ_MAX];
++unsigned int nvls = 0;
++
++static bool sme_get_vls(struct tdescr *td)
++{
++	int vq, vl;
++
++	/*
++	 * Enumerate up to SVE_VQ_MAX vector lengths
++	 */
++	for (vq = SVE_VQ_MAX; vq > 0; --vq) {
++		vl = prctl(PR_SME_SET_VL, vq * 16);
++		if (vl == -1)
++			return false;
++
++		vl &= PR_SME_VL_LEN_MASK;
++
++		/* Skip missing VLs */
++		vq = sve_vq_from_vl(vl);
++
++		vls[nvls++] = vl;
++	}
++
++	/* We need at least one VL */
++	if (nvls < 1) {
++		fprintf(stderr, "Only %d VL supported\n", nvls);
++		return false;
++	}
++
++	return true;
++}
++
++static void setup_regs(void)
++{
++	/* smstart sm; real data is TODO */
++	asm volatile(".inst 0xd503437f" : : : );
++
++	/* smstart za; real data is TODO */
++	asm volatile(".inst 0xd503457f" : : : );
++}
++
++static char zeros[ZA_SIG_REGS_SIZE(SVE_VQ_MAX)];
++
++static int do_one_sme_vl(struct tdescr *td, siginfo_t *si, ucontext_t *uc,
++			 unsigned int vl)
++{
++	size_t offset;
++	struct _aarch64_ctx *head = GET_BUF_RESV_HEAD(context);
++	struct _aarch64_ctx *regs;
++	struct sve_context *ssve;
++	struct za_context *za;
++	int ret;
++
++	fprintf(stderr, "Testing VL %d\n", vl);
++
++	ret = prctl(PR_SME_SET_VL, vl);
++	if (ret != vl) {
++		fprintf(stderr, "Failed to set VL, got %d\n", ret);
++		return 1;
++	}
++
++	/*
++	 * Get a signal context which should have the SVE and ZA
++	 * frames in it.
++	 */
++	setup_regs();
++	if (!get_current_context(td, &context.uc, sizeof(context)))
++		return 1;
++
++	regs = get_header(head, SVE_MAGIC, GET_BUF_RESV_SIZE(context),
++			  &offset);
++	if (!regs) {
++		fprintf(stderr, "No SVE context\n");
++		return 1;
++	}
++
++	ssve = (struct sve_context *)regs;
++	if (ssve->vl != vl) {
++		fprintf(stderr, "Got SSVE VL %d, expected %d\n", ssve->vl, vl);
++		return 1;
++	}
++
++	if (!(ssve->flags & SVE_SIG_FLAG_SM)) {
++		fprintf(stderr, "SVE_SIG_FLAG_SM not set in SVE record\n");
++		return 1;
++	}
++
++	fprintf(stderr, "Got expected SSVE size %u and VL %d\n",
++		regs->size, ssve->vl);
++
++	regs = get_header(head, ZA_MAGIC, GET_BUF_RESV_SIZE(context),
++			  &offset);
++	if (!regs) {
++		fprintf(stderr, "No ZA context\n");
++		return 1;
++	}
++
++	za = (struct za_context *)regs;
++	if (za->vl != vl) {
++		fprintf(stderr, "Got ZA VL %d, expected %d\n", za->vl, vl);
++		return 1;
++	}
++
++	fprintf(stderr, "Got expected ZA size %u and VL %d\n",
++		regs->size, za->vl);
++
++	/* We didn't load any data into ZA so it should be all zeros */
++	if (memcmp(zeros, (char *)za + ZA_SIG_REGS_OFFSET,
++		   ZA_SIG_REGS_SIZE(sve_vq_from_vl(za->vl))) != 0) {
++		fprintf(stderr, "ZA data invalid\n");
++		return 1;
++	}
++
++	return 0;
++}
++
++static int sme_regs(struct tdescr *td, siginfo_t *si, ucontext_t *uc)
++{
++	int i;
++
++	for (i = 0; i < nvls; i++) {
++		if (do_one_sme_vl(td, si, uc, vls[i]))
++			return 1;
++	}
++
++	td->pass = 1;
++
++	return 0;
++}
++
++struct tdescr tde = {
++	.name = "Streaming SVE registers",
++	.descr = "Check that we get the right Streaming SVE registers reported",
++	/*
++	 * We shouldn't require FA64 but things like memset() used in the
++	 * helpers might use unsupported instructions so for now disable
++	 * the test unless we've got the full instruction set.
++	 */
++	.feats_required = FEAT_SME | FEAT_SME_FA64,
++	.timeout = 3,
++	.init = sme_get_vls,
++	.run = sme_regs,
++};
+-- 
+2.43.0
+
diff --git a/queue-6.1/kthread-fix-task-state-in-kthread-worker-if-being-fr.patch b/queue-6.1/kthread-fix-task-state-in-kthread-worker-if-being-fr.patch
new file mode 100644
index 00000000000..88193609aca
--- /dev/null
+++ b/queue-6.1/kthread-fix-task-state-in-kthread-worker-if-being-fr.patch
@@ -0,0 +1,91 @@
+From 0889d433cb7bedefff7065521977d12291564b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 19:23:08 +0800
+Subject: kthread: fix task state in kthread worker if being frozen
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit e16c7b07784f3fb03025939c4590b9a7c64970a7 ]
+
+When analyzing a kernel waring message, Peter pointed out that there is a
+race condition when the kworker is being frozen and falls into
+try_to_freeze() with TASK_INTERRUPTIBLE, which could trigger a
+might_sleep() warning in try_to_freeze().  Although the root cause is not
+related to freeze()[1], it is still worthy to fix this issue ahead.
+
+One possible race scenario:
+
+        CPU 0                                           CPU 1
+        -----                                           -----
+
+        // kthread_worker_fn
+        set_current_state(TASK_INTERRUPTIBLE);
+                                                       suspend_freeze_processes()
+                                                         freeze_processes
+                                                           static_branch_inc(&freezer_active);
+                                                         freeze_kernel_threads
+                                                           pm_nosig_freezing = true;
+        if (work) { //false
+          __set_current_state(TASK_RUNNING);
+
+        } else if (!freezing(current)) //false, been frozen
+
+                      freezing():
+                      if (static_branch_unlikely(&freezer_active))
+                        if (pm_nosig_freezing)
+                          return true;
+          schedule()
+	}
+
+        // state is still TASK_INTERRUPTIBLE
+        try_to_freeze()
+          might_sleep() <--- warning
+
+Fix this by explicitly set the TASK_RUNNING before entering
+try_to_freeze().
+
+Link: https://lore.kernel.org/lkml/Zs2ZoAcUsZMX2B%2FI@chenyu5-mobl2/ [1]
+Link: https://lkml.kernel.org/r/20240827112308.181081-1-yu.c.chen@intel.com
+Fixes: b56c0d8937e6 ("kthread: implement kthread_worker")
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andreas Gruenbacher <agruenba@redhat.com>
+Cc: David Gow <davidgow@google.com>
+Cc: Mateusz Guzik <mjguzik@gmail.com>
+Cc: Mickaël Salaün <mic@digikod.net>
+Cc: Tejun Heo <tj@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kthread.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index f97fd01a29325..bf6eff073cd43 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -826,8 +826,16 @@ int kthread_worker_fn(void *worker_ptr)
+ 		 * event only cares about the address.
+ 		 */
+ 		trace_sched_kthread_work_execute_end(work, func);
+-	} else if (!freezing(current))
++	} else if (!freezing(current)) {
+ 		schedule();
++	} else {
++		/*
++		 * Handle the case where the current remains
++		 * TASK_INTERRUPTIBLE. try_to_freeze() expects
++		 * the current to be TASK_RUNNING.
++		 */
++		__set_current_state(TASK_RUNNING);
++	}
+ 
+ 	try_to_freeze();
+ 	cond_resched();
+-- 
+2.43.0
+
diff --git a/queue-6.1/lib-sbitmap-define-swap_lock-as-raw_spinlock_t.patch b/queue-6.1/lib-sbitmap-define-swap_lock-as-raw_spinlock_t.patch
new file mode 100644
index 00000000000..5660a31fd16
--- /dev/null
+++ b/queue-6.1/lib-sbitmap-define-swap_lock-as-raw_spinlock_t.patch
@@ -0,0 +1,65 @@
+From b376dd4dd75dae9775212813767108b8c52e3c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 10:17:09 +0800
+Subject: lib/sbitmap: define swap_lock as raw_spinlock_t
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 65f666c6203600053478ce8e34a1db269a8701c9 ]
+
+When called from sbitmap_queue_get(), sbitmap_deferred_clear() may be run
+with preempt disabled. In RT kernel, spin_lock() can sleep, then warning
+of "BUG: sleeping function called from invalid context" can be triggered.
+
+Fix it by replacing it with raw_spin_lock.
+
+Cc: Yang Yang <yang.yang@vivo.com>
+Fixes: 72d04bdcf3f7 ("sbitmap: fix io hung due to race on sbitmap_word::cleared")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Yang Yang <yang.yang@vivo.com>
+Link: https://lore.kernel.org/r/20240919021709.511329-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sbitmap.h | 2 +-
+ lib/sbitmap.c           | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h
+index c09cdcc99471e..189140bf11fc4 100644
+--- a/include/linux/sbitmap.h
++++ b/include/linux/sbitmap.h
+@@ -40,7 +40,7 @@ struct sbitmap_word {
+ 	/**
+ 	 * @swap_lock: serializes simultaneous updates of ->word and ->cleared
+ 	 */
+-	spinlock_t swap_lock;
++	raw_spinlock_t swap_lock;
+ } ____cacheline_aligned_in_smp;
+ 
+ /**
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index 61075535a8073..1c813212453f5 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -65,7 +65,7 @@ static inline bool sbitmap_deferred_clear(struct sbitmap_word *map,
+ {
+ 	unsigned long mask, word_mask;
+ 
+-	guard(spinlock_irqsave)(&map->swap_lock);
++	guard(raw_spinlock_irqsave)(&map->swap_lock);
+ 
+ 	if (!map->cleared) {
+ 		if (depth == 0)
+@@ -136,7 +136,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift,
+ 	}
+ 
+ 	for (i = 0; i < sb->map_nr; i++)
+-		spin_lock_init(&sb->map[i].swap_lock);
++		raw_spin_lock_init(&sb->map[i].swap_lock);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-convert-st_ops-data-to-shadow-type.patch b/queue-6.1/libbpf-convert-st_ops-data-to-shadow-type.patch
new file mode 100644
index 00000000000..37781f38fc9
--- /dev/null
+++ b/queue-6.1/libbpf-convert-st_ops-data-to-shadow-type.patch
@@ -0,0 +1,117 @@
+From 8ac11a7b2fe3c1dd3cebb0269e03b7cf34533a15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 22:45:20 -0800
+Subject: libbpf: Convert st_ops->data to shadow type.
+
+From: Kui-Feng Lee <thinker.li@gmail.com>
+
+[ Upstream commit 69e4a9d2b3f5adf5af4feeab0a9f505da971265a ]
+
+Convert st_ops->data to the shadow type of the struct_ops map. The shadow
+type of a struct_ops type is a variant of the original struct type
+providing a way to access/change the values in the maps of the struct_ops
+type.
+
+bpf_map__initial_value() will return st_ops->data for struct_ops types. The
+skeleton is going to use it as the pointer to the shadow type of the
+original struct type.
+
+One of the main differences between the original struct type and the shadow
+type is that all function pointers of the shadow type are converted to
+pointers of struct bpf_program. Users can replace these bpf_program
+pointers with other BPF programs. The st_ops->progs[] will be updated
+before updating the value of a map to reflect the changes made by users.
+
+Signed-off-by: Kui-Feng Lee <thinker.li@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240229064523.2091270-3-thinker.li@gmail.com
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 40 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 38 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index bd5b32c9c5406..76835fa67c6d1 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1011,6 +1011,19 @@ static bool bpf_map__is_struct_ops(const struct bpf_map *map)
+ 	return map->def.type == BPF_MAP_TYPE_STRUCT_OPS;
+ }
+ 
++static bool is_valid_st_ops_program(struct bpf_object *obj,
++				    const struct bpf_program *prog)
++{
++	int i;
++
++	for (i = 0; i < obj->nr_programs; i++) {
++		if (&obj->programs[i] == prog)
++			return prog->type == BPF_PROG_TYPE_STRUCT_OPS;
++	}
++
++	return false;
++}
++
+ /* Init the map's fields that depend on kern_btf */
+ static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
+ {
+@@ -1099,9 +1112,16 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
+ 		if (btf_is_ptr(mtype)) {
+ 			struct bpf_program *prog;
+ 
+-			prog = st_ops->progs[i];
++			/* Update the value from the shadow type */
++			prog = *(void **)mdata;
++			st_ops->progs[i] = prog;
+ 			if (!prog)
+ 				continue;
++			if (!is_valid_st_ops_program(obj, prog)) {
++				pr_warn("struct_ops init_kern %s: member %s is not a struct_ops program\n",
++					map->name, mname);
++				return -ENOTSUP;
++			}
+ 
+ 			kern_mtype = skip_mods_and_typedefs(kern_btf,
+ 							    kern_mtype->type,
+@@ -8902,7 +8922,9 @@ static struct bpf_map *find_struct_ops_map_by_offset(struct bpf_object *obj,
+ 	return NULL;
+ }
+ 
+-/* Collect the reloc from ELF and populate the st_ops->progs[] */
++/* Collect the reloc from ELF, populate the st_ops->progs[], and update
++ * st_ops->data for shadow type.
++ */
+ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
+ 					    Elf64_Shdr *shdr, Elf_Data *data)
+ {
+@@ -9015,6 +9037,14 @@ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
+ 		}
+ 
+ 		st_ops->progs[member_idx] = prog;
++
++		/* st_ops->data will be exposed to users, being returned by
++		 * bpf_map__initial_value() as a pointer to the shadow
++		 * type. All function pointers in the original struct type
++		 * should be converted to a pointer to struct bpf_program
++		 * in the shadow type.
++		 */
++		*((struct bpf_program **)(st_ops->data + moff)) = prog;
+ 	}
+ 
+ 	return 0;
+@@ -9373,6 +9403,12 @@ int bpf_map__set_initial_value(struct bpf_map *map,
+ 
+ const void *bpf_map__initial_value(struct bpf_map *map, size_t *psize)
+ {
++	if (bpf_map__is_struct_ops(map)) {
++		if (psize)
++			*psize = map->def.value_size;
++		return map->st_ops->data;
++	}
++
+ 	if (!map->mmaped)
+ 		return NULL;
+ 	*psize = map->def.value_size;
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-create-a-bpf_link-in-bpf_map__attach_struct_o.patch b/queue-6.1/libbpf-create-a-bpf_link-in-bpf_map__attach_struct_o.patch
new file mode 100644
index 00000000000..69f07e82085
--- /dev/null
+++ b/queue-6.1/libbpf-create-a-bpf_link-in-bpf_map__attach_struct_o.patch
@@ -0,0 +1,180 @@
+From 06cc14343dc0e027e13fa9264640da1a9f1f72ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 20:24:01 -0700
+Subject: libbpf: Create a bpf_link in bpf_map__attach_struct_ops().
+
+From: Kui-Feng Lee <kuifeng@meta.com>
+
+[ Upstream commit 8d1608d70927747da9c1a8770edf7b6ee68f8ebc ]
+
+bpf_map__attach_struct_ops() was creating a dummy bpf_link as a
+placeholder, but now it is constructing an authentic one by calling
+bpf_link_create() if the map has the BPF_F_LINK flag.
+
+You can flag a struct_ops map with BPF_F_LINK by calling
+bpf_map__set_map_flags().
+
+Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20230323032405.3735486-5-kuifeng@meta.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 95 +++++++++++++++++++++++++++++++-----------
+ 1 file changed, 71 insertions(+), 24 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 878f05a424218..25e01addcdb57 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -117,6 +117,7 @@ static const char * const attach_type_name[] = {
+ 	[BPF_SK_REUSEPORT_SELECT_OR_MIGRATE]	= "sk_reuseport_select_or_migrate",
+ 	[BPF_PERF_EVENT]		= "perf_event",
+ 	[BPF_TRACE_KPROBE_MULTI]	= "trace_kprobe_multi",
++	[BPF_STRUCT_OPS]		= "struct_ops",
+ };
+ 
+ static const char * const link_type_name[] = {
+@@ -7670,6 +7671,37 @@ static int bpf_object__resolve_externs(struct bpf_object *obj,
+ 	return 0;
+ }
+ 
++static void bpf_map_prepare_vdata(const struct bpf_map *map)
++{
++	struct bpf_struct_ops *st_ops;
++	__u32 i;
++
++	st_ops = map->st_ops;
++	for (i = 0; i < btf_vlen(st_ops->type); i++) {
++		struct bpf_program *prog = st_ops->progs[i];
++		void *kern_data;
++		int prog_fd;
++
++		if (!prog)
++			continue;
++
++		prog_fd = bpf_program__fd(prog);
++		kern_data = st_ops->kern_vdata + st_ops->kern_func_off[i];
++		*(unsigned long *)kern_data = prog_fd;
++	}
++}
++
++static int bpf_object_prepare_struct_ops(struct bpf_object *obj)
++{
++	int i;
++
++	for (i = 0; i < obj->nr_maps; i++)
++		if (bpf_map__is_struct_ops(&obj->maps[i]))
++			bpf_map_prepare_vdata(&obj->maps[i]);
++
++	return 0;
++}
++
+ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const char *target_btf_path)
+ {
+ 	int err, i;
+@@ -7695,6 +7727,7 @@ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const ch
+ 	err = err ? : bpf_object__relocate(obj, obj->btf_custom_path ? : target_btf_path);
+ 	err = err ? : bpf_object__load_progs(obj, extra_log_level);
+ 	err = err ? : bpf_object_init_prog_arrays(obj);
++	err = err ? : bpf_object_prepare_struct_ops(obj);
+ 
+ 	if (obj->gen_loader) {
+ 		/* reset FDs */
+@@ -11420,22 +11453,30 @@ struct bpf_link *bpf_program__attach(const struct bpf_program *prog)
+ 	return link;
+ }
+ 
++struct bpf_link_struct_ops {
++	struct bpf_link link;
++	int map_fd;
++};
++
+ static int bpf_link__detach_struct_ops(struct bpf_link *link)
+ {
++	struct bpf_link_struct_ops *st_link;
+ 	__u32 zero = 0;
+ 
+-	if (bpf_map_delete_elem(link->fd, &zero))
+-		return -errno;
++	st_link = container_of(link, struct bpf_link_struct_ops, link);
+ 
+-	return 0;
++	if (st_link->map_fd < 0)
++		/* w/o a real link */
++		return bpf_map_delete_elem(link->fd, &zero);
++
++	return close(link->fd);
+ }
+ 
+ struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map)
+ {
+-	struct bpf_struct_ops *st_ops;
+-	struct bpf_link *link;
+-	__u32 i, zero = 0;
+-	int err;
++	struct bpf_link_struct_ops *link;
++	__u32 zero = 0;
++	int err, fd;
+ 
+ 	if (!bpf_map__is_struct_ops(map) || map->fd == -1)
+ 		return libbpf_err_ptr(-EINVAL);
+@@ -11444,31 +11485,37 @@ struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map)
+ 	if (!link)
+ 		return libbpf_err_ptr(-EINVAL);
+ 
+-	st_ops = map->st_ops;
+-	for (i = 0; i < btf_vlen(st_ops->type); i++) {
+-		struct bpf_program *prog = st_ops->progs[i];
+-		void *kern_data;
+-		int prog_fd;
++	/* kern_vdata should be prepared during the loading phase. */
++	err = bpf_map_update_elem(map->fd, &zero, map->st_ops->kern_vdata, 0);
++	/* It can be EBUSY if the map has been used to create or
++	 * update a link before.  We don't allow updating the value of
++	 * a struct_ops once it is set.  That ensures that the value
++	 * never changed.  So, it is safe to skip EBUSY.
++	 */
++	if (err && (!(map->def.map_flags & BPF_F_LINK) || err != -EBUSY)) {
++		free(link);
++		return libbpf_err_ptr(err);
++	}
+ 
+-		if (!prog)
+-			continue;
++	link->link.detach = bpf_link__detach_struct_ops;
+ 
+-		prog_fd = bpf_program__fd(prog);
+-		kern_data = st_ops->kern_vdata + st_ops->kern_func_off[i];
+-		*(unsigned long *)kern_data = prog_fd;
++	if (!(map->def.map_flags & BPF_F_LINK)) {
++		/* w/o a real link */
++		link->link.fd = map->fd;
++		link->map_fd = -1;
++		return &link->link;
+ 	}
+ 
+-	err = bpf_map_update_elem(map->fd, &zero, st_ops->kern_vdata, 0);
+-	if (err) {
+-		err = -errno;
++	fd = bpf_link_create(map->fd, 0, BPF_STRUCT_OPS, NULL);
++	if (fd < 0) {
+ 		free(link);
+-		return libbpf_err_ptr(err);
++		return libbpf_err_ptr(fd);
+ 	}
+ 
+-	link->detach = bpf_link__detach_struct_ops;
+-	link->fd = map->fd;
++	link->link.fd = fd;
++	link->map_fd = map->fd;
+ 
+-	return link;
++	return &link->link;
+ }
+ 
+ typedef enum bpf_perf_event_ret (*bpf_perf_event_print_t)(struct perf_event_header *hdr,
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-don-t-take-direct-pointers-into-btf-data-from.patch b/queue-6.1/libbpf-don-t-take-direct-pointers-into-btf-data-from.patch
new file mode 100644
index 00000000000..9b904af7b17
--- /dev/null
+++ b/queue-6.1/libbpf-don-t-take-direct-pointers-into-btf-data-from.patch
@@ -0,0 +1,125 @@
+From 0a7be403c467ac132a333e3084c3988b9b77d4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2024 12:14:58 -0500
+Subject: libbpf: Don't take direct pointers into BTF data from st_ops
+
+From: David Vernet <void@manifault.com>
+
+[ Upstream commit 04a94133f1b3cccb19e056c26f056c50b4e5b3b1 ]
+
+In struct bpf_struct_ops, we have take a pointer to a BTF type name, and
+a struct btf_type. This was presumably done for convenience, but can
+actually result in subtle and confusing bugs given that BTF data can be
+invalidated before a program is loaded. For example, in sched_ext, we
+may sometimes resize a data section after a skeleton has been opened,
+but before the struct_ops scheduler map has been loaded. This may cause
+the BTF data to be realloc'd, which can then cause a UAF when loading
+the program because the struct_ops map has pointers directly into the
+BTF data.
+
+We're already storing the BTF type_id in struct bpf_struct_ops. Because
+type_id is stable, we can therefore just update the places where we were
+looking at those pointers to instead do the lookups we need from the
+type_id.
+
+Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
+Signed-off-by: David Vernet <void@manifault.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240724171459.281234-1-void@manifault.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 7934919b153cb..5c82a223c6f61 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -441,8 +441,6 @@ struct bpf_program {
+ };
+ 
+ struct bpf_struct_ops {
+-	const char *tname;
+-	const struct btf_type *type;
+ 	struct bpf_program **progs;
+ 	__u32 *kern_func_off;
+ 	/* e.g. struct tcp_congestion_ops in bpf_prog's btf format */
+@@ -1044,11 +1042,14 @@ static int bpf_object_adjust_struct_ops_autoload(struct bpf_object *obj)
+ 			continue;
+ 
+ 		for (j = 0; j < obj->nr_maps; ++j) {
++			const struct btf_type *type;
++
+ 			map = &obj->maps[j];
+ 			if (!bpf_map__is_struct_ops(map))
+ 				continue;
+ 
+-			vlen = btf_vlen(map->st_ops->type);
++			type = btf__type_by_id(obj->btf, map->st_ops->type_id);
++			vlen = btf_vlen(type);
+ 			for (k = 0; k < vlen; ++k) {
+ 				slot_prog = map->st_ops->progs[k];
+ 				if (prog != slot_prog)
+@@ -1082,8 +1083,8 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
+ 	int err;
+ 
+ 	st_ops = map->st_ops;
+-	type = st_ops->type;
+-	tname = st_ops->tname;
++	type = btf__type_by_id(btf, st_ops->type_id);
++	tname = btf__name_by_offset(btf, type->name_off);
+ 	err = find_struct_ops_kern_types(obj, tname, &mod_btf,
+ 					 &kern_type, &kern_type_id,
+ 					 &kern_vtype, &kern_vtype_id,
+@@ -1313,8 +1314,6 @@ static int bpf_object__init_struct_ops_maps(struct bpf_object *obj)
+ 		memcpy(st_ops->data,
+ 		       obj->efile.st_ops_data->d_buf + vsi->offset,
+ 		       type->size);
+-		st_ops->tname = tname;
+-		st_ops->type = type;
+ 		st_ops->type_id = type_id;
+ 
+ 		pr_debug("struct_ops init: struct %s(type_id=%u) %s found at offset %u\n",
+@@ -7780,11 +7779,13 @@ static int bpf_object__resolve_externs(struct bpf_object *obj,
+ 
+ static void bpf_map_prepare_vdata(const struct bpf_map *map)
+ {
++	const struct btf_type *type;
+ 	struct bpf_struct_ops *st_ops;
+ 	__u32 i;
+ 
+ 	st_ops = map->st_ops;
+-	for (i = 0; i < btf_vlen(st_ops->type); i++) {
++	type = btf__type_by_id(map->obj->btf, st_ops->type_id);
++	for (i = 0; i < btf_vlen(type); i++) {
+ 		struct bpf_program *prog = st_ops->progs[i];
+ 		void *kern_data;
+ 		int prog_fd;
+@@ -8971,6 +8972,7 @@ static struct bpf_map *find_struct_ops_map_by_offset(struct bpf_object *obj,
+ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
+ 					    Elf64_Shdr *shdr, Elf_Data *data)
+ {
++	const struct btf_type *type;
+ 	const struct btf_member *member;
+ 	struct bpf_struct_ops *st_ops;
+ 	struct bpf_program *prog;
+@@ -9030,13 +9032,14 @@ static int bpf_object__collect_st_ops_relos(struct bpf_object *obj,
+ 		}
+ 		insn_idx = sym->st_value / BPF_INSN_SZ;
+ 
+-		member = find_member_by_offset(st_ops->type, moff * 8);
++		type = btf__type_by_id(btf, st_ops->type_id);
++		member = find_member_by_offset(type, moff * 8);
+ 		if (!member) {
+ 			pr_warn("struct_ops reloc %s: cannot find member at moff %u\n",
+ 				map->name, moff);
+ 			return -EINVAL;
+ 		}
+-		member_idx = member - btf_members(st_ops->type);
++		member_idx = member - btf_members(type);
+ 		name = btf__name_by_offset(btf, member->name_off);
+ 
+ 		if (!resolve_func_ptr(btf, member->type, NULL)) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-ensure-fd-3-during-bpf_map__reuse_fd.patch b/queue-6.1/libbpf-ensure-fd-3-during-bpf_map__reuse_fd.patch
new file mode 100644
index 00000000000..8116a71dd43
--- /dev/null
+++ b/queue-6.1/libbpf-ensure-fd-3-during-bpf_map__reuse_fd.patch
@@ -0,0 +1,56 @@
+From 637be1d85b6354976dec1a81af51919bfcc4ece6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 15:13:11 -0700
+Subject: libbpf: Ensure FD >= 3 during bpf_map__reuse_fd()
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 4aadd2920b81b3d7e5c8ac63c7d5d673f3c8aaeb ]
+
+Improve bpf_map__reuse_fd() logic and ensure that dup'ed map FD is
+"good" (>= 3) and has O_CLOEXEC flags. Use fcntl(F_DUPFD_CLOEXEC) for
+that, similarly to ensure_good_fd() helper we already use in low-level
+APIs that work with bpf() syscall.
+
+Suggested-by: Lennart Poettering <lennart@poettering.net>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230525221311.2136408-2-andrii@kernel.org
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 25e01addcdb57..b18dab0c80787 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4342,18 +4342,17 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ 	if (!new_name)
+ 		return libbpf_err(-errno);
+ 
+-	new_fd = open("/", O_RDONLY | O_CLOEXEC);
++	/*
++	 * Like dup(), but make sure new FD is >= 3 and has O_CLOEXEC set.
++	 * This is similar to what we do in ensure_good_fd(), but without
++	 * closing original FD.
++	 */
++	new_fd = fcntl(fd, F_DUPFD_CLOEXEC, 3);
+ 	if (new_fd < 0) {
+ 		err = -errno;
+ 		goto err_free_new_name;
+ 	}
+ 
+-	new_fd = dup3(fd, new_fd, O_CLOEXEC);
+-	if (new_fd < 0) {
+-		err = -errno;
+-		goto err_close_new_fd;
+-	}
+-
+ 	err = zclose(map->fd);
+ 	if (err) {
+ 		err = -errno;
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-find-correct-module-btfs-for-struct_ops-maps-.patch b/queue-6.1/libbpf-find-correct-module-btfs-for-struct_ops-maps-.patch
new file mode 100644
index 00000000000..5d5a85e5db9
--- /dev/null
+++ b/queue-6.1/libbpf-find-correct-module-btfs-for-struct_ops-maps-.patch
@@ -0,0 +1,216 @@
+From e54112b9721da7a24f43e15b2837c0db046090ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 14:50:03 -0800
+Subject: libbpf: Find correct module BTFs for struct_ops maps and progs.
+
+From: Kui-Feng Lee <thinker.li@gmail.com>
+
+[ Upstream commit 9e926acda0c2e21bca431a1818665ddcd6939755 ]
+
+Locate the module BTFs for struct_ops maps and progs and pass them to the
+kernel. This ensures that the kernel correctly resolves type IDs from the
+appropriate module BTFs.
+
+For the map of a struct_ops object, the FD of the module BTF is set to
+bpf_map to keep a reference to the module BTF. The FD is passed to the
+kernel as value_type_btf_obj_fd when the struct_ops object is loaded.
+
+For a bpf_struct_ops prog, attach_btf_obj_fd of bpf_prog is the FD of a
+module BTF in the kernel.
+
+Signed-off-by: Kui-Feng Lee <thinker.li@gmail.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240119225005.668602-13-thinker.li@gmail.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf.c           |  4 +++-
+ tools/lib/bpf/bpf.h           |  4 +++-
+ tools/lib/bpf/libbpf.c        | 41 ++++++++++++++++++++++++++---------
+ tools/lib/bpf/libbpf_probes.c |  1 +
+ 4 files changed, 38 insertions(+), 12 deletions(-)
+
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index 1d49a03528365..7d5419e8cb6ae 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -169,7 +169,8 @@ int bpf_map_create(enum bpf_map_type map_type,
+ 		   __u32 max_entries,
+ 		   const struct bpf_map_create_opts *opts)
+ {
+-	const size_t attr_sz = offsetofend(union bpf_attr, map_extra);
++	const size_t attr_sz = offsetofend(union bpf_attr,
++					   value_type_btf_obj_fd);
+ 	union bpf_attr attr;
+ 	int fd;
+ 
+@@ -191,6 +192,7 @@ int bpf_map_create(enum bpf_map_type map_type,
+ 	attr.btf_key_type_id = OPTS_GET(opts, btf_key_type_id, 0);
+ 	attr.btf_value_type_id = OPTS_GET(opts, btf_value_type_id, 0);
+ 	attr.btf_vmlinux_value_type_id = OPTS_GET(opts, btf_vmlinux_value_type_id, 0);
++	attr.value_type_btf_obj_fd = OPTS_GET(opts, value_type_btf_obj_fd, -1);
+ 
+ 	attr.inner_map_fd = OPTS_GET(opts, inner_map_fd, 0);
+ 	attr.map_flags = OPTS_GET(opts, map_flags, 0);
+diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
+index 874fe362375de..41134fec3c06d 100644
+--- a/tools/lib/bpf/bpf.h
++++ b/tools/lib/bpf/bpf.h
+@@ -51,8 +51,10 @@ struct bpf_map_create_opts {
+ 
+ 	__u32 numa_node;
+ 	__u32 map_ifindex;
++	__s32 value_type_btf_obj_fd;
++	size_t:0;
+ };
+-#define bpf_map_create_opts__last_field map_ifindex
++#define bpf_map_create_opts__last_field value_type_btf_obj_fd
+ 
+ LIBBPF_API int bpf_map_create(enum bpf_map_type map_type,
+ 			      const char *map_name,
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 58136673fd312..bd5b32c9c5406 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -501,6 +501,7 @@ struct bpf_map {
+ 	struct bpf_map_def def;
+ 	__u32 numa_node;
+ 	__u32 btf_var_idx;
++	int mod_btf_fd;
+ 	__u32 btf_key_type_id;
+ 	__u32 btf_value_type_id;
+ 	__u32 btf_vmlinux_value_type_id;
+@@ -935,22 +936,29 @@ find_member_by_name(const struct btf *btf, const struct btf_type *t,
+ 	return NULL;
+ }
+ 
++static int find_ksym_btf_id(struct bpf_object *obj, const char *ksym_name,
++			    __u16 kind, struct btf **res_btf,
++			    struct module_btf **res_mod_btf);
++
+ #define STRUCT_OPS_VALUE_PREFIX "bpf_struct_ops_"
+ static int find_btf_by_prefix_kind(const struct btf *btf, const char *prefix,
+ 				   const char *name, __u32 kind);
+ 
+ static int
+-find_struct_ops_kern_types(const struct btf *btf, const char *tname,
++find_struct_ops_kern_types(struct bpf_object *obj, const char *tname,
++			   struct module_btf **mod_btf,
+ 			   const struct btf_type **type, __u32 *type_id,
+ 			   const struct btf_type **vtype, __u32 *vtype_id,
+ 			   const struct btf_member **data_member)
+ {
+ 	const struct btf_type *kern_type, *kern_vtype;
+ 	const struct btf_member *kern_data_member;
++	struct btf *btf;
+ 	__s32 kern_vtype_id, kern_type_id;
+ 	__u32 i;
+ 
+-	kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
++	kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
++					&btf, mod_btf);
+ 	if (kern_type_id < 0) {
+ 		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
+ 			tname);
+@@ -1004,14 +1012,16 @@ static bool bpf_map__is_struct_ops(const struct bpf_map *map)
+ }
+ 
+ /* Init the map's fields that depend on kern_btf */
+-static int bpf_map__init_kern_struct_ops(struct bpf_map *map,
+-					 const struct btf *btf,
+-					 const struct btf *kern_btf)
++static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
+ {
+ 	const struct btf_member *member, *kern_member, *kern_data_member;
+ 	const struct btf_type *type, *kern_type, *kern_vtype;
+ 	__u32 i, kern_type_id, kern_vtype_id, kern_data_off;
++	struct bpf_object *obj = map->obj;
++	const struct btf *btf = obj->btf;
+ 	struct bpf_struct_ops *st_ops;
++	const struct btf *kern_btf;
++	struct module_btf *mod_btf;
+ 	void *data, *kern_data;
+ 	const char *tname;
+ 	int err;
+@@ -1019,16 +1029,19 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map,
+ 	st_ops = map->st_ops;
+ 	type = st_ops->type;
+ 	tname = st_ops->tname;
+-	err = find_struct_ops_kern_types(kern_btf, tname,
++	err = find_struct_ops_kern_types(obj, tname, &mod_btf,
+ 					 &kern_type, &kern_type_id,
+ 					 &kern_vtype, &kern_vtype_id,
+ 					 &kern_data_member);
+ 	if (err)
+ 		return err;
+ 
++	kern_btf = mod_btf ? mod_btf->btf : obj->btf_vmlinux;
++
+ 	pr_debug("struct_ops init_kern %s: type_id:%u kern_type_id:%u kern_vtype_id:%u\n",
+ 		 map->name, st_ops->type_id, kern_type_id, kern_vtype_id);
+ 
++	map->mod_btf_fd = mod_btf ? mod_btf->fd : -1;
+ 	map->def.value_size = kern_vtype->size;
+ 	map->btf_vmlinux_value_type_id = kern_vtype_id;
+ 
+@@ -1104,6 +1117,8 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map,
+ 				return -ENOTSUP;
+ 			}
+ 
++			if (mod_btf)
++				prog->attach_btf_obj_fd = mod_btf->fd;
+ 			prog->attach_btf_id = kern_type_id;
+ 			prog->expected_attach_type = kern_member_idx;
+ 
+@@ -1146,8 +1161,7 @@ static int bpf_object__init_kern_struct_ops_maps(struct bpf_object *obj)
+ 		if (!bpf_map__is_struct_ops(map))
+ 			continue;
+ 
+-		err = bpf_map__init_kern_struct_ops(map, obj->btf,
+-						    obj->btf_vmlinux);
++		err = bpf_map__init_kern_struct_ops(map);
+ 		if (err)
+ 			return err;
+ 	}
+@@ -5004,8 +5018,13 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 	create_attr.numa_node = map->numa_node;
+ 	create_attr.map_extra = map->map_extra;
+ 
+-	if (bpf_map__is_struct_ops(map))
++	if (bpf_map__is_struct_ops(map)) {
+ 		create_attr.btf_vmlinux_value_type_id = map->btf_vmlinux_value_type_id;
++		if (map->mod_btf_fd >= 0) {
++			create_attr.value_type_btf_obj_fd = map->mod_btf_fd;
++			create_attr.map_flags |= BPF_F_VTYPE_BTF_OBJ_FD;
++		}
++	}
+ 
+ 	if (obj->btf && btf__fd(obj->btf) >= 0) {
+ 		create_attr.btf_fd = btf__fd(obj->btf);
+@@ -9180,7 +9199,9 @@ static int libbpf_find_attach_btf_id(struct bpf_program *prog, const char *attac
+ 		*btf_obj_fd = 0;
+ 		*btf_type_id = 1;
+ 	} else {
+-		err = find_kernel_btf_id(prog->obj, attach_name, attach_type, btf_obj_fd, btf_type_id);
++		err = find_kernel_btf_id(prog->obj, attach_name,
++					 attach_type, btf_obj_fd,
++					 btf_type_id);
+ 	}
+ 	if (err) {
+ 		pr_warn("prog '%s': failed to find kernel BTF type ID of '%s': %d\n",
+diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
+index d504d96adc839..9b6da1daf2999 100644
+--- a/tools/lib/bpf/libbpf_probes.c
++++ b/tools/lib/bpf/libbpf_probes.c
+@@ -239,6 +239,7 @@ static int probe_map_create(enum bpf_map_type map_type)
+ 	case BPF_MAP_TYPE_STRUCT_OPS:
+ 		/* we'll get -ENOTSUPP for invalid BTF type ID for struct_ops */
+ 		opts.btf_vmlinux_value_type_id = 1;
++		opts.value_type_btf_obj_fd = -1;
+ 		exp_err = -524; /* -ENOTSUPP */
+ 		break;
+ 	case BPF_MAP_TYPE_BLOOM_FILTER:
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-sync-progs-autoload-with-maps-autocreate-for-.patch b/queue-6.1/libbpf-sync-progs-autoload-with-maps-autocreate-for-.patch
new file mode 100644
index 00000000000..6ef78b4593e
--- /dev/null
+++ b/queue-6.1/libbpf-sync-progs-autoload-with-maps-autocreate-for-.patch
@@ -0,0 +1,117 @@
+From 97bd14ba8c58a2a2d4a1ca930e357725254da724 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 12:45:22 +0200
+Subject: libbpf: Sync progs autoload with maps autocreate for struct_ops maps
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+[ Upstream commit fe9d049c3da06373a1a35914b7f695509e4cb1fe ]
+
+Automatically select which struct_ops programs to load depending on
+which struct_ops maps are selected for automatic creation.
+E.g. for the BPF code below:
+
+    SEC("struct_ops/test_1") int BPF_PROG(foo) { ... }
+    SEC("struct_ops/test_2") int BPF_PROG(bar) { ... }
+
+    SEC(".struct_ops.link")
+    struct test_ops___v1 A = {
+        .foo = (void *)foo
+    };
+
+    SEC(".struct_ops.link")
+    struct test_ops___v2 B = {
+        .foo = (void *)foo,
+        .bar = (void *)bar,
+    };
+
+And the following libbpf API calls:
+
+    bpf_map__set_autocreate(skel->maps.A, true);
+    bpf_map__set_autocreate(skel->maps.B, false);
+
+The autoload would be enabled for program 'foo' and disabled for
+program 'bar'.
+
+During load, for each struct_ops program P, referenced from some
+struct_ops map M:
+- set P.autoload = true if M.autocreate is true for some M;
+- set P.autoload = false if M.autocreate is false for all M;
+- don't change P.autoload, if P is not referenced from any map.
+
+Do this after bpf_object__init_kern_struct_ops_maps()
+to make sure that shadow vars assignment is done.
+
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240306104529.6453-9-eddyz87@gmail.com
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 43 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 76835fa67c6d1..7934919b153cb 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1024,6 +1024,48 @@ static bool is_valid_st_ops_program(struct bpf_object *obj,
+ 	return false;
+ }
+ 
++/* For each struct_ops program P, referenced from some struct_ops map M,
++ * enable P.autoload if there are Ms for which M.autocreate is true,
++ * disable P.autoload if for all Ms M.autocreate is false.
++ * Don't change P.autoload for programs that are not referenced from any maps.
++ */
++static int bpf_object_adjust_struct_ops_autoload(struct bpf_object *obj)
++{
++	struct bpf_program *prog, *slot_prog;
++	struct bpf_map *map;
++	int i, j, k, vlen;
++
++	for (i = 0; i < obj->nr_programs; ++i) {
++		int should_load = false;
++		int use_cnt = 0;
++
++		prog = &obj->programs[i];
++		if (prog->type != BPF_PROG_TYPE_STRUCT_OPS)
++			continue;
++
++		for (j = 0; j < obj->nr_maps; ++j) {
++			map = &obj->maps[j];
++			if (!bpf_map__is_struct_ops(map))
++				continue;
++
++			vlen = btf_vlen(map->st_ops->type);
++			for (k = 0; k < vlen; ++k) {
++				slot_prog = map->st_ops->progs[k];
++				if (prog != slot_prog)
++					continue;
++
++				use_cnt++;
++				if (map->autocreate)
++					should_load = true;
++			}
++		}
++		if (use_cnt)
++			prog->autoload = should_load;
++	}
++
++	return 0;
++}
++
+ /* Init the map's fields that depend on kern_btf */
+ static int bpf_map__init_kern_struct_ops(struct bpf_map *map)
+ {
+@@ -7788,6 +7830,7 @@ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const ch
+ 	err = err ? : bpf_object__sanitize_and_load_btf(obj);
+ 	err = err ? : bpf_object__sanitize_maps(obj);
+ 	err = err ? : bpf_object__init_kern_struct_ops_maps(obj);
++	err = err ? : bpf_object_adjust_struct_ops_autoload(obj);
+ 	err = err ? : bpf_object__relocate(obj, obj->btf_custom_path ? : target_btf_path);
+ 	err = err ? : bpf_object__create_maps(obj);
+ 	err = err ? : bpf_object__load_progs(obj, extra_log_level);
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-use-stable-map-placeholder-fds.patch b/queue-6.1/libbpf-use-stable-map-placeholder-fds.patch
new file mode 100644
index 00000000000..2610ead1127
--- /dev/null
+++ b/queue-6.1/libbpf-use-stable-map-placeholder-fds.patch
@@ -0,0 +1,285 @@
+From d97f968c80c35205982d2bbc24bc39e34e8e73ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 17:38:42 -0800
+Subject: libbpf: use stable map placeholder FDs
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit dac645b950ea4fc0896fe46a645365cb8d9ab92b ]
+
+Move map creation to later during BPF object loading by pre-creating
+stable placeholder FDs (utilizing memfd_create()). Use dup2()
+syscall to then atomically make those placeholder FDs point to real
+kernel BPF map objects.
+
+This change allows to delay BPF map creation to after all the BPF
+program relocations. That, in turn, allows to delay BTF finalization and
+loading into kernel to after all the relocations as well. We'll take
+advantage of the latter in subsequent patches to allow libbpf to adjust
+BTF in a way that helps with BPF global function usage.
+
+Clean up a few places where we close map->fd, which now shouldn't
+happen, because map->fd should be a valid FD regardless of whether map
+was created or not. Surprisingly and nicely it simplifies a bunch of
+error handling code. If this change doesn't backfire, I'm tempted to
+pre-create such stable FDs for other entities (progs, maybe even BTF).
+We previously did some manipulations to make gen_loader work with fake
+map FDs, with stable map FDs this hack is not necessary for maps (we
+still have it for BTF, but I left it as is for now).
+
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240104013847.3875810-5-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 04a94133f1b3 ("libbpf: Don't take direct pointers into BTF data from st_ops")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c          | 101 ++++++++++++++++++++------------
+ tools/lib/bpf/libbpf_internal.h |  14 +++++
+ 2 files changed, 77 insertions(+), 38 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index b18dab0c80787..58136673fd312 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1496,6 +1496,16 @@ static int find_elf_var_offset(const struct bpf_object *obj, const char *name, _
+ 	return -ENOENT;
+ }
+ 
++static int create_placeholder_fd(void)
++{
++	int fd;
++
++	fd = ensure_good_fd(memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC));
++	if (fd < 0)
++		return -errno;
++	return fd;
++}
++
+ static struct bpf_map *bpf_object__add_map(struct bpf_object *obj)
+ {
+ 	struct bpf_map *map;
+@@ -1508,7 +1518,21 @@ static struct bpf_map *bpf_object__add_map(struct bpf_object *obj)
+ 
+ 	map = &obj->maps[obj->nr_maps++];
+ 	map->obj = obj;
+-	map->fd = -1;
++	/* Preallocate map FD without actually creating BPF map just yet.
++	 * These map FD "placeholders" will be reused later without changing
++	 * FD value when map is actually created in the kernel.
++	 *
++	 * This is useful to be able to perform BPF program relocations
++	 * without having to create BPF maps before that step. This allows us
++	 * to finalize and load BTF very late in BPF object's loading phase,
++	 * right before BPF maps have to be created and BPF programs have to
++	 * be loaded. By having these map FD placeholders we can perform all
++	 * the sanitizations, relocations, and any other adjustments before we
++	 * start creating actual BPF kernel objects (BTF, maps, progs).
++	 */
++	map->fd = create_placeholder_fd();
++	if (map->fd < 0)
++		return ERR_PTR(map->fd);
+ 	map->inner_map_fd = -1;
+ 	map->autocreate = true;
+ 
+@@ -2537,7 +2561,9 @@ static int bpf_object__init_user_btf_map(struct bpf_object *obj,
+ 		map->inner_map = calloc(1, sizeof(*map->inner_map));
+ 		if (!map->inner_map)
+ 			return -ENOMEM;
+-		map->inner_map->fd = -1;
++		map->inner_map->fd = create_placeholder_fd();
++		if (map->inner_map->fd < 0)
++			return map->inner_map->fd;
+ 		map->inner_map->sec_idx = sec_idx;
+ 		map->inner_map->name = malloc(strlen(map_name) + sizeof(".inner") + 1);
+ 		if (!map->inner_map->name)
+@@ -4353,14 +4379,12 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ 		goto err_free_new_name;
+ 	}
+ 
+-	err = zclose(map->fd);
+-	if (err) {
+-		err = -errno;
+-		goto err_close_new_fd;
+-	}
++	err = reuse_fd(map->fd, new_fd);
++	if (err)
++		goto err_free_new_name;
++
+ 	free(map->name);
+ 
+-	map->fd = new_fd;
+ 	map->name = new_name;
+ 	map->def.type = info.type;
+ 	map->def.key_size = info.key_size;
+@@ -4374,8 +4398,6 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ 
+ 	return 0;
+ 
+-err_close_new_fd:
+-	close(new_fd);
+ err_free_new_name:
+ 	free(new_name);
+ 	return libbpf_err(err);
+@@ -4973,7 +4995,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 	LIBBPF_OPTS(bpf_map_create_opts, create_attr);
+ 	struct bpf_map_def *def = &map->def;
+ 	const char *map_name = NULL;
+-	int err = 0;
++	int err = 0, map_fd;
+ 
+ 	if (kernel_supports(obj, FEAT_PROG_NAME))
+ 		map_name = map->name;
+@@ -5035,17 +5057,19 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 		bpf_gen__map_create(obj->gen_loader, def->type, map_name,
+ 				    def->key_size, def->value_size, def->max_entries,
+ 				    &create_attr, is_inner ? -1 : map - obj->maps);
+-		/* Pretend to have valid FD to pass various fd >= 0 checks.
+-		 * This fd == 0 will not be used with any syscall and will be reset to -1 eventually.
++		/* We keep pretenting we have valid FD to pass various fd >= 0
++		 * checks by just keeping original placeholder FDs in place.
++		 * See bpf_object__add_map() comment.
++		 * This placeholder fd will not be used with any syscall and
++		 * will be reset to -1 eventually.
+ 		 */
+-		map->fd = 0;
++		map_fd = map->fd;
+ 	} else {
+-		map->fd = bpf_map_create(def->type, map_name,
+-					 def->key_size, def->value_size,
+-					 def->max_entries, &create_attr);
++		map_fd = bpf_map_create(def->type, map_name,
++					def->key_size, def->value_size,
++					def->max_entries, &create_attr);
+ 	}
+-	if (map->fd < 0 && (create_attr.btf_key_type_id ||
+-			    create_attr.btf_value_type_id)) {
++	if (map_fd < 0 && (create_attr.btf_key_type_id || create_attr.btf_value_type_id)) {
+ 		char *cp, errmsg[STRERR_BUFSIZE];
+ 
+ 		err = -errno;
+@@ -5057,13 +5081,11 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 		create_attr.btf_value_type_id = 0;
+ 		map->btf_key_type_id = 0;
+ 		map->btf_value_type_id = 0;
+-		map->fd = bpf_map_create(def->type, map_name,
+-					 def->key_size, def->value_size,
+-					 def->max_entries, &create_attr);
++		map_fd = bpf_map_create(def->type, map_name,
++					def->key_size, def->value_size,
++					def->max_entries, &create_attr);
+ 	}
+ 
+-	err = map->fd < 0 ? -errno : 0;
+-
+ 	if (bpf_map_type__is_map_in_map(def->type) && map->inner_map) {
+ 		if (obj->gen_loader)
+ 			map->inner_map->fd = -1;
+@@ -5071,7 +5093,19 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 		zfree(&map->inner_map);
+ 	}
+ 
+-	return err;
++	if (map_fd < 0)
++		return map_fd;
++
++	/* obj->gen_loader case, prevent reuse_fd() from closing map_fd */
++	if (map->fd == map_fd)
++		return 0;
++
++	/* Keep placeholder FD value but now point it to the BPF map object.
++	 * This way everything that relied on this map's FD (e.g., relocated
++	 * ldimm64 instructions) will stay valid and won't need adjustments.
++	 * map->fd stays valid but now point to what map_fd points to.
++	 */
++	return reuse_fd(map->fd, map_fd);
+ }
+ 
+ static int init_map_in_map_slots(struct bpf_object *obj, struct bpf_map *map)
+@@ -5155,10 +5189,8 @@ static int bpf_object_init_prog_arrays(struct bpf_object *obj)
+ 			continue;
+ 
+ 		err = init_prog_array_slots(obj, map);
+-		if (err < 0) {
+-			zclose(map->fd);
++		if (err < 0)
+ 			return err;
+-		}
+ 	}
+ 	return 0;
+ }
+@@ -5249,25 +5281,20 @@ bpf_object__create_maps(struct bpf_object *obj)
+ 
+ 			if (bpf_map__is_internal(map)) {
+ 				err = bpf_object__populate_internal_map(obj, map);
+-				if (err < 0) {
+-					zclose(map->fd);
++				if (err < 0)
+ 					goto err_out;
+-				}
+ 			}
+ 
+ 			if (map->init_slots_sz && map->def.type != BPF_MAP_TYPE_PROG_ARRAY) {
+ 				err = init_map_in_map_slots(obj, map);
+-				if (err < 0) {
+-					zclose(map->fd);
++				if (err < 0)
+ 					goto err_out;
+-				}
+ 			}
+ 		}
+ 
+ 		if (map->pin_path && !map->pinned) {
+ 			err = bpf_map__pin(map, NULL);
+ 			if (err) {
+-				zclose(map->fd);
+ 				if (!retried && err == -EEXIST) {
+ 					retried = true;
+ 					goto retry;
+@@ -7722,8 +7749,8 @@ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const ch
+ 	err = err ? : bpf_object__sanitize_and_load_btf(obj);
+ 	err = err ? : bpf_object__sanitize_maps(obj);
+ 	err = err ? : bpf_object__init_kern_struct_ops_maps(obj);
+-	err = err ? : bpf_object__create_maps(obj);
+ 	err = err ? : bpf_object__relocate(obj, obj->btf_custom_path ? : target_btf_path);
++	err = err ? : bpf_object__create_maps(obj);
+ 	err = err ? : bpf_object__load_progs(obj, extra_log_level);
+ 	err = err ? : bpf_object_init_prog_arrays(obj);
+ 	err = err ? : bpf_object_prepare_struct_ops(obj);
+@@ -7732,8 +7759,6 @@ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const ch
+ 		/* reset FDs */
+ 		if (obj->btf)
+ 			btf__set_fd(obj->btf, -1);
+-		for (i = 0; i < obj->nr_maps; i++)
+-			obj->maps[i].fd = -1;
+ 		if (!err)
+ 			err = bpf_gen__finish(obj->gen_loader, obj->nr_programs, obj->nr_maps);
+ 	}
+diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
+index 8669f6e0f6e2f..4f081203d02f9 100644
+--- a/tools/lib/bpf/libbpf_internal.h
++++ b/tools/lib/bpf/libbpf_internal.h
+@@ -565,6 +565,20 @@ static inline int ensure_good_fd(int fd)
+ 	return fd;
+ }
+ 
++/* Point *fixed_fd* to the same file that *tmp_fd* points to.
++ * Regardless of success, *tmp_fd* is closed.
++ * Whatever *fixed_fd* pointed to is closed silently.
++ */
++static inline int reuse_fd(int fixed_fd, int tmp_fd)
++{
++	int err;
++
++	err = dup2(tmp_fd, fixed_fd);
++	err = err < 0 ? -errno : 0;
++	close(tmp_fd); /* clean up temporary FD */
++	return err;
++}
++
+ /* The following two functions are exposed to bpftool */
+ int bpf_core_add_cands(struct bpf_core_cand *local_cand,
+ 		       size_t local_essent_len,
+-- 
+2.43.0
+
diff --git a/queue-6.1/m68k-fix-kernel_clone_args.flags-in-m68k_clone.patch b/queue-6.1/m68k-fix-kernel_clone_args.flags-in-m68k_clone.patch
new file mode 100644
index 00000000000..3022a55a8e3
--- /dev/null
+++ b/queue-6.1/m68k-fix-kernel_clone_args.flags-in-m68k_clone.patch
@@ -0,0 +1,54 @@
+From 36f88f7dfbbffea878841fdcd016c1e6f325eeb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 10:12:29 +1000
+Subject: m68k: Fix kernel_clone_args.flags in m68k_clone()
+
+From: Finn Thain <fthain@linux-m68k.org>
+
+[ Upstream commit 09b3d870faa7bc3e96c0978ab3cf4e96e4b15571 ]
+
+Stan Johnson recently reported a failure from the 'dump' command:
+
+  DUMP: Date of this level 0 dump: Fri Aug  9 23:37:15 2024
+  DUMP: Dumping /dev/sda (an unlisted file system) to /dev/null
+  DUMP: Label: none
+  DUMP: Writing 10 Kilobyte records
+  DUMP: mapping (Pass I) [regular files]
+  DUMP: mapping (Pass II) [directories]
+  DUMP: estimated 3595695 blocks.
+  DUMP: Context save fork fails in parent 671
+
+The dump program uses the clone syscall with the CLONE_IO flag, that is,
+flags == 0x80000000. When that value is promoted from long int to u64 by
+m68k_clone(), it undergoes sign-extension. The new value includes
+CLONE_INTO_CGROUP so the validation in cgroup_css_set_fork() fails and
+the syscall returns -EBADF. Avoid sign-extension by casting to u32.
+
+Reported-by: Stan Johnson <userm57@yahoo.com>
+Closes: https://lists.debian.org/debian-68k/2024/08/msg00000.html
+Fixes: 6aabc1facdb2 ("m68k: Implement copy_thread_tls()")
+Signed-off-by: Finn Thain <fthain@linux-m68k.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/3463f1e5d4e95468dc9f3368f2b78ffa7b72199b.1723335149.git.fthain@linux-m68k.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/process.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
+index 2cb4a61bcfacb..81347e7704c5b 100644
+--- a/arch/m68k/kernel/process.c
++++ b/arch/m68k/kernel/process.c
+@@ -115,7 +115,7 @@ asmlinkage int m68k_clone(struct pt_regs *regs)
+ {
+ 	/* regs will be equal to current_pt_regs() */
+ 	struct kernel_clone_args args = {
+-		.flags		= regs->d1 & ~CSIGNAL,
++		.flags		= (u32)(regs->d1) & ~CSIGNAL,
+ 		.pidfd		= (int __user *)regs->d3,
+ 		.child_tid	= (int __user *)regs->d4,
+ 		.parent_tid	= (int __user *)regs->d3,
+-- 
+2.43.0
+
diff --git a/queue-6.1/minmax-avoid-overly-complex-min-max-macro-arguments-.patch b/queue-6.1/minmax-avoid-overly-complex-min-max-macro-arguments-.patch
new file mode 100644
index 00000000000..67ac95ce84d
--- /dev/null
+++ b/queue-6.1/minmax-avoid-overly-complex-min-max-macro-arguments-.patch
@@ -0,0 +1,77 @@
+From c135851d72faadad85ace268fc01c300d9f1b13e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2024 15:09:07 -0700
+Subject: minmax: avoid overly complex min()/max() macro arguments in xen
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit e8432ac802a028eaee6b1e86383d7cd8e9fb8431 ]
+
+We have some very fancy min/max macros that have tons of sanity checking
+to warn about mixed signedness etc.
+
+This is all things that a sane compiler should warn about, but there are
+no sane compiler interfaces for this, and '-Wsign-compare' is broken [1]
+and not useful.
+
+So then we compensate (some would say over-compensate) by doing the
+checks manually with some truly horrid macro games.
+
+And no, we can't just use __builtin_types_compatible_p(), because the
+whole question of "does it make sense to compare these two values" is a
+lot more complicated than that.
+
+For example, it makes a ton of sense to compare unsigned values with
+simple constants like "5", even if that is indeed a signed type.  So we
+have these very strange macros to try to make sensible type checking
+decisions on the arguments to 'min()' and 'max()'.
+
+But that can cause enormous code expansion if the min()/max() macros are
+used with complicated expressions, and particularly if you nest these
+things so that you get the first big expansion then expanded again.
+
+The xen setup.c file ended up ballooning to over 50MB of preprocessed
+noise that takes 15s to compile (obviously depending on the build host),
+largely due to one single line.
+
+So let's split that one single line to just be simpler.  I think it ends
+up being more legible to humans too at the same time.  Now that single
+file compiles in under a second.
+
+Reported-and-reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Link: https://lore.kernel.org/all/c83c17bb-be75-4c67-979d-54eee38774c6@lucifer.local/
+Link: https://staticthinking.wordpress.com/2023/07/25/wsign-compare-is-garbage/ [1]
+Cc: David Laight <David.Laight@aculab.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/setup.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 46a2cb782ab7d..f0bb5e350990d 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -731,6 +731,7 @@ char * __init xen_memory_setup(void)
+ 	struct xen_memory_map memmap;
+ 	unsigned long max_pages;
+ 	unsigned long extra_pages = 0;
++	unsigned long maxmem_pages;
+ 	int i;
+ 	int op;
+ 
+@@ -793,8 +794,8 @@ char * __init xen_memory_setup(void)
+ 	 * Make sure we have no memory above max_pages, as this area
+ 	 * isn't handled by the p2m management.
+ 	 */
+-	extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)),
+-			   extra_pages, max_pages - max_pfn);
++	maxmem_pages = EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM));
++	extra_pages = min3(maxmem_pages, extra_pages, max_pages - max_pfn);
+ 	i = 0;
+ 	addr = xen_e820_table.entries[0].addr;
+ 	size = xen_e820_table.entries[0].size;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mount-handle-oom-on-mnt_warn_timestamp_expiry.patch b/queue-6.1/mount-handle-oom-on-mnt_warn_timestamp_expiry.patch
new file mode 100644
index 00000000000..e78e7c8b403
--- /dev/null
+++ b/queue-6.1/mount-handle-oom-on-mnt_warn_timestamp_expiry.patch
@@ -0,0 +1,61 @@
+From 87b73cdfb4f98422312894f47784157d503180af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2024 10:58:13 +0200
+Subject: mount: handle OOM on mnt_warn_timestamp_expiry
+
+From: Olaf Hering <olaf@aepfle.de>
+
+[ Upstream commit 4bcda1eaf184e308f07f9c61d3a535f9ce477ce8 ]
+
+If no page could be allocated, an error pointer was used as format
+string in pr_warn.
+
+Rearrange the code to return early in case of OOM. Also add a check
+for the return value of d_path.
+
+Fixes: f8b92ba67c5d ("mount: Add mount warning for impending timestamp expiry")
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+Link: https://lore.kernel.org/r/20240730085856.32385-1-olaf@aepfle.de
+[brauner: rewrite commit and commit message]
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 2b934ade9e70d..59a9f877738b2 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2613,8 +2613,15 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
+ 	if (!__mnt_is_readonly(mnt) &&
+ 	   (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
+ 	   (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
+-		char *buf = (char *)__get_free_page(GFP_KERNEL);
+-		char *mntpath = buf ? d_path(mountpoint, buf, PAGE_SIZE) : ERR_PTR(-ENOMEM);
++		char *buf, *mntpath;
++
++		buf = (char *)__get_free_page(GFP_KERNEL);
++		if (buf)
++			mntpath = d_path(mountpoint, buf, PAGE_SIZE);
++		else
++			mntpath = ERR_PTR(-ENOMEM);
++		if (IS_ERR(mntpath))
++			mntpath = "(unknown)";
+ 
+ 		pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
+ 			sb->s_type->name,
+@@ -2622,8 +2629,9 @@ static void mnt_warn_timestamp_expiry(struct path *mountpoint, struct vfsmount *
+ 			mntpath, &sb->s_time_max,
+ 			(unsigned long long)sb->s_time_max);
+ 
+-		free_page((unsigned long)buf);
+ 		sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
++		if (buf)
++			free_page((unsigned long)buf);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-powernv-add-check-devm_kasprintf-returned-value.patch b/queue-6.1/mtd-powernv-add-check-devm_kasprintf-returned-value.patch
new file mode 100644
index 00000000000..1cfb15d8100
--- /dev/null
+++ b/queue-6.1/mtd-powernv-add-check-devm_kasprintf-returned-value.patch
@@ -0,0 +1,38 @@
+From 80bce08da56c5fd138e5ba28bdc4656ff1bfebd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 17:24:27 +0800
+Subject: mtd: powernv: Add check devm_kasprintf() returned value
+
+From: Charles Han <hanchunchao@inspur.com>
+
+[ Upstream commit 395999829880a106bb95f0ce34e6e4c2b43c6a5d ]
+
+devm_kasprintf() can return a NULL pointer on failure but this
+returned value is not checked.
+
+Fixes: acfe63ec1c59 ("mtd: Convert to using %pOFn instead of device_node.name")
+Signed-off-by: Charles Han <hanchunchao@inspur.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240828092427.128177-1-hanchunchao@inspur.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/devices/powernv_flash.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mtd/devices/powernv_flash.c b/drivers/mtd/devices/powernv_flash.c
+index 36e060386e59d..59e1b3a4406ed 100644
+--- a/drivers/mtd/devices/powernv_flash.c
++++ b/drivers/mtd/devices/powernv_flash.c
+@@ -207,6 +207,9 @@ static int powernv_flash_set_driver_info(struct device *dev,
+ 	 * get them
+ 	 */
+ 	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFP", dev->of_node);
++	if (!mtd->name)
++		return -ENOMEM;
++
+ 	mtd->type = MTD_NORFLASH;
+ 	mtd->flags = MTD_WRITEABLE;
+ 	mtd->size = size;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-rawnand-mtk-factorize-out-the-logic-cleaning-mtk.patch b/queue-6.1/mtd-rawnand-mtk-factorize-out-the-logic-cleaning-mtk.patch
new file mode 100644
index 00000000000..dd7aa752eb4
--- /dev/null
+++ b/queue-6.1/mtd-rawnand-mtk-factorize-out-the-logic-cleaning-mtk.patch
@@ -0,0 +1,79 @@
+From aa959cd0d2fe8db331800fbf643da3f0d151d278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 17:30:18 +0200
+Subject: mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 81cb3be3261e766a1f8efab9e3154a4f4fd9d03d ]
+
+There are some un-freed resources in one of the error path which would
+benefit from a helper going through all the registered mtk chips one by
+one and perform all the necessary cleanup. This is precisely what the
+remove path does, so let's extract the logic in a helper.
+
+There is no functional change.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20240826153019.67106-1-miquel.raynal@bootlin.com
+Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/mtk_nand.c | 31 ++++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index 537ac81e661fc..3a2b801937398 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -1456,6 +1456,23 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
+ 	return 0;
+ }
+ 
++static void mtk_nfc_nand_chips_cleanup(struct mtk_nfc *nfc)
++{
++	struct mtk_nfc_nand_chip *mtk_chip;
++	struct nand_chip *chip;
++	int ret;
++
++	while (!list_empty(&nfc->chips)) {
++		mtk_chip = list_first_entry(&nfc->chips,
++					    struct mtk_nfc_nand_chip, node);
++		chip = &mtk_chip->nand;
++		ret = mtd_device_unregister(nand_to_mtd(chip));
++		WARN_ON(ret);
++		nand_cleanup(chip);
++		list_del(&mtk_chip->node);
++	}
++}
++
+ static int mtk_nfc_nand_chips_init(struct device *dev, struct mtk_nfc *nfc)
+ {
+ 	struct device_node *np = dev->of_node;
+@@ -1601,20 +1618,8 @@ static int mtk_nfc_probe(struct platform_device *pdev)
+ static int mtk_nfc_remove(struct platform_device *pdev)
+ {
+ 	struct mtk_nfc *nfc = platform_get_drvdata(pdev);
+-	struct mtk_nfc_nand_chip *mtk_chip;
+-	struct nand_chip *chip;
+-	int ret;
+-
+-	while (!list_empty(&nfc->chips)) {
+-		mtk_chip = list_first_entry(&nfc->chips,
+-					    struct mtk_nfc_nand_chip, node);
+-		chip = &mtk_chip->nand;
+-		ret = mtd_device_unregister(nand_to_mtd(chip));
+-		WARN_ON(ret);
+-		nand_cleanup(chip);
+-		list_del(&mtk_chip->node);
+-	}
+ 
++	mtk_nfc_nand_chips_cleanup(nfc);
+ 	mtk_ecc_release(nfc->ecc);
+ 	mtk_nfc_disable_clk(&nfc->clk);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-rawnand-mtk-fix-init-error-path.patch b/queue-6.1/mtd-rawnand-mtk-fix-init-error-path.patch
new file mode 100644
index 00000000000..cd1f74b4c6e
--- /dev/null
+++ b/queue-6.1/mtd-rawnand-mtk-fix-init-error-path.patch
@@ -0,0 +1,44 @@
+From 5d1fff4494185a96e30c19acb3df2c620aacc5e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 17:30:19 +0200
+Subject: mtd: rawnand: mtk: Fix init error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 2073ae37d550ea32e8545edaa94ef10b4fef7235 ]
+
+Reviewing a series converting the for_each_chil_of_node() loops into
+their _scoped variants made me realize there was no cleanup of the
+already registered NAND devices upon error which may leak memory on
+systems with more than a chip when this error occurs. We should call the
+_nand_chips_cleanup() function when this happens.
+
+Fixes: 1d6b1e464950 ("mtd: mediatek: driver for MTK Smart Device")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20240826153019.67106-2-miquel.raynal@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/mtk_nand.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index 3a2b801937398..53fc19e1dc5b6 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -1480,8 +1480,10 @@ static int mtk_nfc_nand_chips_init(struct device *dev, struct mtk_nfc *nfc)
+ 
+ 	for_each_child_of_node_scoped(np, nand_np) {
+ 		ret = mtk_nfc_nand_chip_init(dev, nfc, nand_np);
+-		if (ret)
++		if (ret) {
++			mtk_nfc_nand_chips_cleanup(nfc);
+ 			return ret;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-rawnand-mtk-use-for_each_child_of_node_scoped.patch b/queue-6.1/mtd-rawnand-mtk-use-for_each_child_of_node_scoped.patch
new file mode 100644
index 00000000000..da36158eeed
--- /dev/null
+++ b/queue-6.1/mtd-rawnand-mtk-use-for_each_child_of_node_scoped.patch
@@ -0,0 +1,46 @@
+From 3a36f806b0f43af0ce2afb97b55144d7c23f3078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 17:43:25 +0800
+Subject: mtd: rawnand: mtk: Use for_each_child_of_node_scoped()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 8795952679494b111b7b2ba08bb54ac408daca3b ]
+
+Avoids the need for manual cleanup of_node_put() in early exits
+from the loop.
+
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240826094328.2991664-8-ruanjinjie@huawei.com
+Stable-dep-of: 2073ae37d550 ("mtd: rawnand: mtk: Fix init error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/mtk_nand.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index d540454cbbdfa..537ac81e661fc 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -1459,15 +1459,12 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
+ static int mtk_nfc_nand_chips_init(struct device *dev, struct mtk_nfc *nfc)
+ {
+ 	struct device_node *np = dev->of_node;
+-	struct device_node *nand_np;
+ 	int ret;
+ 
+-	for_each_child_of_node(np, nand_np) {
++	for_each_child_of_node_scoped(np, nand_np) {
+ 		ret = mtk_nfc_nand_chip_init(dev, nfc, nand_np);
+-		if (ret) {
+-			of_node_put(nand_np);
++		if (ret)
+ 			return ret;
+-		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/mtd-slram-insert-break-after-errors-in-parsing-the-m.patch b/queue-6.1/mtd-slram-insert-break-after-errors-in-parsing-the-m.patch
new file mode 100644
index 00000000000..de6ad72350b
--- /dev/null
+++ b/queue-6.1/mtd-slram-insert-break-after-errors-in-parsing-the-m.patch
@@ -0,0 +1,72 @@
+From f1bf8449cac056fdd0a7a291aadb1b9325622878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2024 01:43:20 +0200
+Subject: mtd: slram: insert break after errors in parsing the map
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mtodorovac69@gmail.com>
+
+[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]
+
+GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution
+path in which, due to lazy evaluation, devlength isn't initialised with the
+parsed string:
+
+   289		while (map) {
+   290			devname = devstart = devlength = NULL;
+   291
+   292			if (!(devname = strsep(&map, ","))) {
+   293				E("slram: No devicename specified.\n");
+   294				break;
+   295			}
+   296			T("slram: devname = %s\n", devname);
+   297			if ((!map) || (!(devstart = strsep(&map, ",")))) {
+   298				E("slram: No devicestart specified.\n");
+   299			}
+   300			T("slram: devstart = %s\n", devstart);
+ → 301			if ((!map) || (!(devlength = strsep(&map, ",")))) {
+   302				E("slram: No devicelength / -end specified.\n");
+   303			}
+ → 304			T("slram: devlength = %s\n", devlength);
+   305			if (parse_cmdline(devname, devstart, devlength) != 0) {
+   306				return(-EINVAL);
+   307			}
+
+Parsing should be finished after map == NULL, so a break is best inserted after
+each E("slram: ... \n") error message.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Vignesh Raghavendra <vigneshr@ti.com>
+Cc: linux-mtd@lists.infradead.org
+Signed-off-by: Mirsad Todorovac <mtodorovac69@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240711234319.637824-1-mtodorovac69@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/devices/slram.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
+index 28131a127d065..8297b366a0669 100644
+--- a/drivers/mtd/devices/slram.c
++++ b/drivers/mtd/devices/slram.c
+@@ -296,10 +296,12 @@ static int __init init_slram(void)
+ 		T("slram: devname = %s\n", devname);
+ 		if ((!map) || (!(devstart = strsep(&map, ",")))) {
+ 			E("slram: No devicestart specified.\n");
++			break;
+ 		}
+ 		T("slram: devstart = %s\n", devstart);
+ 		if ((!map) || (!(devlength = strsep(&map, ",")))) {
+ 			E("slram: No devicelength / -end specified.\n");
++			break;
+ 		}
+ 		T("slram: devlength = %s\n", devlength);
+ 		if (parse_cmdline(devname, devstart, devlength) != 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/nbd-fix-race-between-timeout-and-normal-completion.patch b/queue-6.1/nbd-fix-race-between-timeout-and-normal-completion.patch
new file mode 100644
index 00000000000..100341667fc
--- /dev/null
+++ b/queue-6.1/nbd-fix-race-between-timeout-and-normal-completion.patch
@@ -0,0 +1,64 @@
+From 56dbc1d59a88190aa29dc72c248c2b5576e6d477 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 11:41:45 +0800
+Subject: nbd: fix race between timeout and normal completion
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit c9ea57c91f03bcad415e1a20113bdb2077bcf990 ]
+
+If request timetout is handled by nbd_requeue_cmd(), normal completion
+has to be stopped for avoiding to complete this requeued request, other
+use-after-free can be triggered.
+
+Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime
+make sure that cmd->lock is grabbed for clearing the flag and the
+requeue.
+
+Cc: Josef Bacik <josef@toxicpanda.com>
+Cc: Yu Kuai <yukuai3@huawei.com>
+Fixes: 2895f1831e91 ("nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240830034145.1827742-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 5c4be8dda253c..1f3cd5de41172 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -181,6 +181,17 @@ static void nbd_requeue_cmd(struct nbd_cmd *cmd)
+ {
+ 	struct request *req = blk_mq_rq_from_pdu(cmd);
+ 
++	lockdep_assert_held(&cmd->lock);
++
++	/*
++	 * Clear INFLIGHT flag so that this cmd won't be completed in
++	 * normal completion path
++	 *
++	 * INFLIGHT flag will be set when the cmd is queued to nbd next
++	 * time.
++	 */
++	__clear_bit(NBD_CMD_INFLIGHT, &cmd->flags);
++
+ 	if (!test_and_set_bit(NBD_CMD_REQUEUED, &cmd->flags))
+ 		blk_mq_requeue_request(req, true);
+ }
+@@ -445,8 +456,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req)
+ 					nbd_mark_nsock_dead(nbd, nsock, 1);
+ 				mutex_unlock(&nsock->tx_lock);
+ 			}
+-			mutex_unlock(&cmd->lock);
+ 			nbd_requeue_cmd(cmd);
++			mutex_unlock(&cmd->lock);
+ 			nbd_config_put(nbd);
+ 			return BLK_EH_DONE;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-enetc-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.1/net-enetc-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644
index 00000000000..5c9a5de394a
--- /dev/null
+++ b/queue-6.1/net-enetc-use-irqf_no_autoen-flag-in-request_irq.patch
@@ -0,0 +1,43 @@
+From 830918fb3f16beea901b101816fcd661eeda3bff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 17:44:44 +0800
+Subject: net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 799a9225997799f7b1b579bc50a93b78b4fb2a01 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: bbb96dc7fa1a ("enetc: Factor out the traffic start/stop procedures")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20240911094445.1922476-3-ruanjinjie@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
+index 25c303406e6b4..e811ea33e2727 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -2181,12 +2181,11 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)
+ 
+ 		snprintf(v->name, sizeof(v->name), "%s-rxtx%d",
+ 			 priv->ndev->name, i);
+-		err = request_irq(irq, enetc_msix, 0, v->name, v);
++		err = request_irq(irq, enetc_msix, IRQF_NO_AUTOEN, v->name, v);
+ 		if (err) {
+ 			dev_err(priv->dev, "request_irq() failed!\n");
+ 			goto irq_err;
+ 		}
+-		disable_irq(irq);
+ 
+ 		v->tbier_base = hw->reg + ENETC_BDR(TX, 0, ENETC_TBIER);
+ 		v->rbier = hw->reg + ENETC_BDR(RX, i, ENETC_RBIER);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-ipv6-rpl_iptunnel-fix-memory-leak-in-rpl_input.patch b/queue-6.1/net-ipv6-rpl_iptunnel-fix-memory-leak-in-rpl_input.patch
new file mode 100644
index 00000000000..e6924290084
--- /dev/null
+++ b/queue-6.1/net-ipv6-rpl_iptunnel-fix-memory-leak-in-rpl_input.patch
@@ -0,0 +1,57 @@
+From 5334de0decd5da7655e721404e5913f41804377e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 19:45:57 +0200
+Subject: net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
+
+From: Justin Iurman <justin.iurman@uliege.be>
+
+[ Upstream commit 2c84b0aa28b9e73e8c4b4ce038269469434ae372 ]
+
+Free the skb before returning from rpl_input when skb_cow_head() fails.
+Use a "drop" label and goto instructions.
+
+Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel")
+Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20240911174557.11536-1-justin.iurman@uliege.be
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/rpl_iptunnel.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
+index 26adbe7f8a2f0..c1d0f947a7c87 100644
+--- a/net/ipv6/rpl_iptunnel.c
++++ b/net/ipv6/rpl_iptunnel.c
+@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb)
+ 	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);
+ 
+ 	err = rpl_do_srh(skb, rlwt);
+-	if (unlikely(err)) {
+-		kfree_skb(skb);
+-		return err;
+-	}
++	if (unlikely(err))
++		goto drop;
+ 
+ 	local_bh_disable();
+ 	dst = dst_cache_get(&rlwt->cache);
+@@ -287,9 +285,13 @@ static int rpl_input(struct sk_buff *skb)
+ 
+ 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
+ 	if (unlikely(err))
+-		return err;
++		goto drop;
+ 
+ 	return dst_input(skb);
++
++drop:
++	kfree_skb(skb);
++	return err;
+ }
+ 
+ static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-ipv6-select-dst_cache-from-ipv6_rpl_lwtunnel.patch b/queue-6.1/net-ipv6-select-dst_cache-from-ipv6_rpl_lwtunnel.patch
new file mode 100644
index 00000000000..1716bfe04c4
--- /dev/null
+++ b/queue-6.1/net-ipv6-select-dst_cache-from-ipv6_rpl_lwtunnel.patch
@@ -0,0 +1,44 @@
+From e8a598527909efddb865edc850740cc1e41169ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 20:57:13 +0200
+Subject: net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 93c21077bb9ba08807c459982d440dbbee4c7af3 ]
+
+The rpl sr tunnel code contains calls to dst_cache_*() which are
+only present when the dst cache is built.
+Select DST_CACHE to build the dst cache, similar to other kconfig
+options in the same file.
+Compiling the rpl sr tunnel without DST_CACHE will lead to linker
+errors.
+
+Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
+index 658bfed1df8b1..71cefa4b866fe 100644
+--- a/net/ipv6/Kconfig
++++ b/net/ipv6/Kconfig
+@@ -323,6 +323,7 @@ config IPV6_RPL_LWTUNNEL
+ 	bool "IPv6: RPL Source Routing Header support"
+ 	depends on IPV6
+ 	select LWTUNNEL
++	select DST_CACHE
+ 	help
+ 	  Support for RFC6554 RPL Source Routing Header using the lightweight
+ 	  tunnels mechanism.
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-qrtr-update-packets-cloning-when-broadcasting.patch b/queue-6.1/net-qrtr-update-packets-cloning-when-broadcasting.patch
new file mode 100644
index 00000000000..39cca868dd6
--- /dev/null
+++ b/queue-6.1/net-qrtr-update-packets-cloning-when-broadcasting.patch
@@ -0,0 +1,49 @@
+From 9c12020716c083d447e561d5b05d99f7137e8ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 19:08:58 +0200
+Subject: net: qrtr: Update packets cloning when broadcasting
+
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+
+[ Upstream commit f011b313e8ebd5b7abd8521b5119aecef403de45 ]
+
+When broadcasting data to multiple nodes via MHI, using skb_clone()
+causes all nodes to receive the same header data. This can result in
+packets being discarded by endpoints, leading to lost data.
+
+This issue occurs when a socket is closed, and a QRTR_TYPE_DEL_CLIENT
+packet is broadcasted. All nodes receive the same destination node ID,
+causing the node connected to the client to discard the packet and
+remain unaware of the client's deletion.
+
+Replace skb_clone() with pskb_copy(), to create a separate copy of
+the header for each sk_buff.
+
+Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
+Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
+Reviewed-by: Jeffery Hugo <quic_jhugo@quicinc.com>
+Reviewed-by: Carl Vanderlip <quic_carlv@quicinc.com>
+Reviewed-by: Chris Lew <quic_clew@quicinc.com>
+Link: https://patch.msgid.link/20240916170858.2382247-1-quic_yabdulra@quicinc.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/qrtr/af_qrtr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
+index 76f0434d3d06a..a59e1b2fea1c5 100644
+--- a/net/qrtr/af_qrtr.c
++++ b/net/qrtr/af_qrtr.c
+@@ -879,7 +879,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ 
+ 	mutex_lock(&qrtr_node_lock);
+ 	list_for_each_entry(node, &qrtr_all_nodes, item) {
+-		skbn = skb_clone(skb, GFP_KERNEL);
++		skbn = pskb_copy(skb, GFP_KERNEL);
+ 		if (!skbn)
+ 			break;
+ 		skb_set_owner_w(skbn, skb->sk);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-seeq-fix-use-after-free-vulnerability-in-ether3-.patch b/queue-6.1/net-seeq-fix-use-after-free-vulnerability-in-ether3-.patch
new file mode 100644
index 00000000000..5917b3e5d72
--- /dev/null
+++ b/queue-6.1/net-seeq-fix-use-after-free-vulnerability-in-ether3-.patch
@@ -0,0 +1,57 @@
+From 149c2c8fcabda66d18e805fc1dd08408148d6d26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2024 22:40:46 +0800
+Subject: net: seeq: Fix use after free vulnerability in ether3 Driver Due to
+ Race Condition
+
+From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
+
+[ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ]
+
+In the ether3_probe function, a timer is initialized with a callback
+function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is
+started, there is a risk of a race condition if the module or device
+is removed, triggering the ether3_remove function to perform cleanup.
+The sequence of operations that may lead to a UAF bug is as follows:
+
+CPU0                                    CPU1
+
+                      |  ether3_ledoff
+ether3_remove         |
+  free_netdev(dev);   |
+  put_devic           |
+  kfree(dev);         |
+ |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
+                      | // use dev
+
+Fix it by ensuring that the timer is canceled before proceeding with
+the cleanup in ether3_remove.
+
+Fixes: 6fd9c53f7186 ("net: seeq: Convert timers to use timer_setup()")
+Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn>
+Link: https://patch.msgid.link/20240915144045.451-1-kxwang23@m.fudan.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/seeq/ether3.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/seeq/ether3.c b/drivers/net/ethernet/seeq/ether3.c
+index c672f92d65e97..9319a2675e7b6 100644
+--- a/drivers/net/ethernet/seeq/ether3.c
++++ b/drivers/net/ethernet/seeq/ether3.c
+@@ -847,9 +847,11 @@ static void ether3_remove(struct expansion_card *ec)
+ {
+ 	struct net_device *dev = ecard_get_drvdata(ec);
+ 
++	ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
+ 	ecard_set_drvdata(ec, NULL);
+ 
+ 	unregister_netdev(dev);
++	del_timer_sync(&priv(dev)->timer);
+ 	free_netdev(dev);
+ 	ecard_release_resources(ec);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-stmmac-dwmac-loongson-init-ref-and-ptp-clocks-ra.patch b/queue-6.1/net-stmmac-dwmac-loongson-init-ref-and-ptp-clocks-ra.patch
new file mode 100644
index 00000000000..e0c20fcafe6
--- /dev/null
+++ b/queue-6.1/net-stmmac-dwmac-loongson-init-ref-and-ptp-clocks-ra.patch
@@ -0,0 +1,44 @@
+From 48d7561d79b20cf18bbeb465df81419544fc0c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 21:48:02 +0800
+Subject: net: stmmac: dwmac-loongson: Init ref and PTP clocks rate
+
+From: Yanteng Si <siyanteng@loongson.cn>
+
+[ Upstream commit c70f3163681381c15686bdd2fe56bf4af9b8aaaa ]
+
+Reference and PTP clocks rate of the Loongson GMAC devices is 125MHz.
+(So is in the GNET devices which support is about to be added.) Set
+the respective plat_stmmacenet_data field up in accordance with that
+so to have the coalesce command and timestamping work correctly.
+
+Fixes: 30bba69d7db4 ("stmmac: pci: Add dwmac support for Loongson")
+Signed-off-by: Feiyang Chen <chenfeiyang@loongson.cn>
+Signed-off-by: Yinggang Gu <guyinggang@loongson.cn>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Acked-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
+Tested-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
+index e129ee1020f0a..472ea1bb454cc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
+@@ -35,6 +35,9 @@ static int loongson_default_data(struct plat_stmmacenet_data *plat)
+ 	/* Disable RX queues routing by default */
+ 	plat->rx_queues_cfg[0].pkt_route = 0x0;
+ 
++	plat->clk_ref_rate = 125000000;
++	plat->clk_ptp_rate = 125000000;
++
+ 	/* Default to phy auto-detection */
+ 	plat->phy_addr = -1;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-stmmac-set-pp_flag_dma_sync_dev-only-if-xdp-is-e.patch b/queue-6.1/net-stmmac-set-pp_flag_dma_sync_dev-only-if-xdp-is-e.patch
new file mode 100644
index 00000000000..e1661186814
--- /dev/null
+++ b/queue-6.1/net-stmmac-set-pp_flag_dma_sync_dev-only-if-xdp-is-e.patch
@@ -0,0 +1,48 @@
+From 5d2bdfa0db621567f55b228ab126dfa15a6ee780 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 20:10:28 +0800
+Subject: net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
+
+From: Furong Xu <0x1207@gmail.com>
+
+[ Upstream commit b514c47ebf41a6536551ed28a05758036e6eca7c ]
+
+Commit 5fabb01207a2 ("net: stmmac: Add initial XDP support") sets
+PP_FLAG_DMA_SYNC_DEV flag for page_pool unconditionally,
+page_pool_recycle_direct() will call page_pool_dma_sync_for_device()
+on every page even the page is not going to be reused by XDP program.
+
+When XDP is not enabled, the page which holds the received buffer
+will be recycled once the buffer is copied into new SKB by
+skb_copy_to_linear_data(), then the MAC core will never reuse this
+page any longer. Always setting PP_FLAG_DMA_SYNC_DEV wastes CPU cycles
+on unnecessary calling of page_pool_dma_sync_for_device().
+
+After this patch, up to 9% noticeable performance improvement was observed
+on certain platforms.
+
+Fixes: 5fabb01207a2 ("net: stmmac: Add initial XDP support")
+Signed-off-by: Furong Xu <0x1207@gmail.com>
+Link: https://patch.msgid.link/20240919121028.1348023-1-0x1207@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 93630840309e7..b5b7ff5b32616 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2015,7 +2015,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
+ 	rx_q->queue_index = queue;
+ 	rx_q->priv_data = priv;
+ 
+-	pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
++	pp_params.flags = PP_FLAG_DMA_MAP | (xdp_prog ? PP_FLAG_DMA_SYNC_DEV : 0);
+ 	pp_params.pool_size = dma_conf->dma_rx_size;
+ 	num_pages = DIV_ROUND_UP(dma_conf->dma_buf_sz, PAGE_SIZE);
+ 	pp_params.order = ilog2(num_pages);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-tipc-avoid-possible-garbage-value.patch b/queue-6.1/net-tipc-avoid-possible-garbage-value.patch
new file mode 100644
index 00000000000..05048a7e329
--- /dev/null
+++ b/queue-6.1/net-tipc-avoid-possible-garbage-value.patch
@@ -0,0 +1,47 @@
+From b2cbc8b9fd5e9a1e1d47a858de331ef0aed44328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 19:01:20 +0800
+Subject: net: tipc: avoid possible garbage value
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 99655a304e450baaae6b396cb942b9e47659d644 ]
+
+Clang static checker (scan-build) warning:
+net/tipc/bcast.c:305:4:
+The expression is an uninitialized value. The computed value will also
+be garbage [core.uninitialized.Assign]
+  305 |                         (*cong_link_cnt)++;
+      |                         ^~~~~~~~~~~~~~~~~~
+
+tipc_rcast_xmit() will increase cong_link_cnt's value, but cong_link_cnt
+is uninitialized. Although it won't really cause a problem, it's better
+to fix it.
+
+Fixes: dca4a17d24ee ("tipc: fix potential hanging after b/rcast changing")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Link: https://patch.msgid.link/20240912110119.2025503-1-suhui@nfschina.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/bcast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
+index 593846d252143..114fef65f92ea 100644
+--- a/net/tipc/bcast.c
++++ b/net/tipc/bcast.c
+@@ -320,8 +320,8 @@ static int tipc_mcast_send_sync(struct net *net, struct sk_buff *skb,
+ {
+ 	struct tipc_msg *hdr, *_hdr;
+ 	struct sk_buff_head tmpq;
++	u16 cong_link_cnt = 0;
+ 	struct sk_buff *_skb;
+-	u16 cong_link_cnt;
+ 	int rc = 0;
+ 
+ 	/* Is a cluster supporting with new capabilities ? */
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-xilinx-axienet-fix-packet-counting.patch b/queue-6.1/net-xilinx-axienet-fix-packet-counting.patch
new file mode 100644
index 00000000000..96a26f7902f
--- /dev/null
+++ b/queue-6.1/net-xilinx-axienet-fix-packet-counting.patch
@@ -0,0 +1,98 @@
+From ab56c684b913666225a32cab894b3f20a9231f2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 10:51:56 -0400
+Subject: net: xilinx: axienet: Fix packet counting
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit 5a6caa2cfabb559309b5ce29ee7c8e9ce1a9a9df ]
+
+axienet_free_tx_chain returns the number of DMA descriptors it's
+handled. However, axienet_tx_poll treats the return as the number of
+packets. When scatter-gather SKBs are enabled, a single packet may use
+multiple DMA descriptors, which causes incorrect packet counts. Fix this
+by explicitly keepting track of the number of packets processed as
+separate from the DMA descriptors.
+
+Budget does not affect the number of Tx completions we can process for
+NAPI, so we use the ring size as the limit instead of budget. As we no
+longer return the number of descriptors processed to axienet_tx_poll, we
+now update tx_bd_ci in axienet_free_tx_chain.
+
+Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Link: https://patch.msgid.link/20240913145156.2283067-1-sean.anderson@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/xilinx/xilinx_axienet_main.c | 23 +++++++++++--------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index f7d6a5f4ee367..0b6f0908f3e1c 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -651,15 +651,15 @@ static int axienet_device_reset(struct net_device *ndev)
+  *
+  * Would either be called after a successful transmit operation, or after
+  * there was an error when setting up the chain.
+- * Returns the number of descriptors handled.
++ * Returns the number of packets handled.
+  */
+ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd,
+ 				 int nr_bds, bool force, u32 *sizep, int budget)
+ {
+ 	struct axidma_bd *cur_p;
+ 	unsigned int status;
++	int i, packets = 0;
+ 	dma_addr_t phys;
+-	int i;
+ 
+ 	for (i = 0; i < nr_bds; i++) {
+ 		cur_p = &lp->tx_bd_v[(first_bd + i) % lp->tx_bd_num];
+@@ -678,8 +678,10 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd,
+ 				 (cur_p->cntrl & XAXIDMA_BD_CTRL_LENGTH_MASK),
+ 				 DMA_TO_DEVICE);
+ 
+-		if (cur_p->skb && (status & XAXIDMA_BD_STS_COMPLETE_MASK))
++		if (cur_p->skb && (status & XAXIDMA_BD_STS_COMPLETE_MASK)) {
+ 			napi_consume_skb(cur_p->skb, budget);
++			packets++;
++		}
+ 
+ 		cur_p->app0 = 0;
+ 		cur_p->app1 = 0;
+@@ -695,7 +697,13 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd,
+ 			*sizep += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
+ 	}
+ 
+-	return i;
++	if (!force) {
++		lp->tx_bd_ci += i;
++		if (lp->tx_bd_ci >= lp->tx_bd_num)
++			lp->tx_bd_ci %= lp->tx_bd_num;
++	}
++
++	return packets;
+ }
+ 
+ /**
+@@ -746,13 +754,10 @@ static int axienet_tx_poll(struct napi_struct *napi, int budget)
+ 	u32 size = 0;
+ 	int packets;
+ 
+-	packets = axienet_free_tx_chain(lp, lp->tx_bd_ci, budget, false, &size, budget);
++	packets = axienet_free_tx_chain(lp, lp->tx_bd_ci, lp->tx_bd_num, false,
++					&size, budget);
+ 
+ 	if (packets) {
+-		lp->tx_bd_ci += packets;
+-		if (lp->tx_bd_ci >= lp->tx_bd_num)
+-			lp->tx_bd_ci %= lp->tx_bd_num;
+-
+ 		u64_stats_update_begin(&lp->tx_stat_sync);
+ 		u64_stats_add(&lp->tx_packets, packets);
+ 		u64_stats_add(&lp->tx_bytes, size);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-xilinx-axienet-schedule-napi-in-two-steps.patch b/queue-6.1/net-xilinx-axienet-schedule-napi-in-two-steps.patch
new file mode 100644
index 00000000000..19b8d800a75
--- /dev/null
+++ b/queue-6.1/net-xilinx-axienet-schedule-napi-in-two-steps.patch
@@ -0,0 +1,60 @@
+From d065c906cb40046c75544bcb65b8f51ec767aec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 10:57:11 -0400
+Subject: net: xilinx: axienet: Schedule NAPI in two steps
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit ba0da2dc934ec5ac32bbeecbd0670da16ba03565 ]
+
+As advised by Documentation/networking/napi.rst, masking IRQs after
+calling napi_schedule can be racy. Avoid this by only masking/scheduling
+if napi_schedule_prep returns true.
+
+Fixes: 9e2bc267e780 ("net: axienet: Use NAPI for TX completion path")
+Fixes: cc37610caaf8 ("net: axienet: implement NAPI and GRO receive")
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Reviewed-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20240913145711.2284295-1-sean.anderson@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index b631d80de3370..f7d6a5f4ee367 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1041,9 +1041,10 @@ static irqreturn_t axienet_tx_irq(int irq, void *_ndev)
+ 		u32 cr = lp->tx_dma_cr;
+ 
+ 		cr &= ~(XAXIDMA_IRQ_IOC_MASK | XAXIDMA_IRQ_DELAY_MASK);
+-		axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr);
+-
+-		napi_schedule(&lp->napi_tx);
++		if (napi_schedule_prep(&lp->napi_tx)) {
++			axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr);
++			__napi_schedule(&lp->napi_tx);
++		}
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -1085,9 +1086,10 @@ static irqreturn_t axienet_rx_irq(int irq, void *_ndev)
+ 		u32 cr = lp->rx_dma_cr;
+ 
+ 		cr &= ~(XAXIDMA_IRQ_IOC_MASK | XAXIDMA_IRQ_DELAY_MASK);
+-		axienet_dma_out32(lp, XAXIDMA_RX_CR_OFFSET, cr);
+-
+-		napi_schedule(&lp->napi_rx);
++		if (napi_schedule_prep(&lp->napi_rx)) {
++			axienet_dma_out32(lp, XAXIDMA_RX_CR_OFFSET, cr);
++			__napi_schedule(&lp->napi_rx);
++		}
+ 	}
+ 
+ 	return IRQ_HANDLED;
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-ctnetlink-compile-ctnetlink_label_size-wit.patch b/queue-6.1/netfilter-ctnetlink-compile-ctnetlink_label_size-wit.patch
new file mode 100644
index 00000000000..065f0a93e9d
--- /dev/null
+++ b/queue-6.1/netfilter-ctnetlink-compile-ctnetlink_label_size-wit.patch
@@ -0,0 +1,86 @@
+From 293f5e1476ee7790d871055becce97080081de1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 16:14:41 +0100
+Subject: netfilter: ctnetlink: compile ctnetlink_label_size with
+ CONFIG_NF_CONNTRACK_EVENTS
+
+From: Simon Horman <horms@kernel.org>
+
+[ Upstream commit e1f1ee0e9ad8cbe660f5c104e791c5f1a7cf4c31 ]
+
+Only provide ctnetlink_label_size when it is used,
+which is when CONFIG_NF_CONNTRACK_EVENTS is configured.
+
+Flagged by clang-18 W=1 builds as:
+
+.../nf_conntrack_netlink.c:385:19: warning: unused function 'ctnetlink_label_size' [-Wunused-function]
+  385 | static inline int ctnetlink_label_size(const struct nf_conn *ct)
+      |                   ^~~~~~~~~~~~~~~~~~~~
+
+The condition on CONFIG_NF_CONNTRACK_LABELS being removed by
+this patch guards compilation of non-trivial implementations
+of ctnetlink_dump_labels() and ctnetlink_label_size().
+
+However, this is not necessary as each of these functions
+will always return 0 if CONFIG_NF_CONNTRACK_LABELS is not defined
+as each function starts with the equivalent of:
+
+	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
+
+	if (!labels)
+		return 0;
+
+And nf_ct_labels_find always returns NULL if CONFIG_NF_CONNTRACK_LABELS
+is not enabled.  So I believe that the compiler optimises the code away
+in such cases anyway.
+
+Found by inspection.
+Compile tested only.
+
+Originally splitted in two patches, Pablo Neira Ayuso collapsed them and
+added Fixes: tag.
+
+Fixes: 0ceabd83875b ("netfilter: ctnetlink: deliver labels to userspace")
+Link: https://lore.kernel.org/netfilter-devel/20240909151712.GZ2097826@kernel.org/
+Signed-off-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 9672b0e00d6bf..2cf58a8b8e4dc 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -381,7 +381,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
+ #define ctnetlink_dump_secctx(a, b) (0)
+ #endif
+ 
+-#ifdef CONFIG_NF_CONNTRACK_LABELS
++#ifdef CONFIG_NF_CONNTRACK_EVENTS
+ static inline int ctnetlink_label_size(const struct nf_conn *ct)
+ {
+ 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
+@@ -390,6 +390,7 @@ static inline int ctnetlink_label_size(const struct nf_conn *ct)
+ 		return 0;
+ 	return nla_total_size(sizeof(labels->bits));
+ }
++#endif
+ 
+ static int
+ ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
+@@ -410,10 +411,6 @@ ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
+ 
+ 	return 0;
+ }
+-#else
+-#define ctnetlink_dump_labels(a, b) (0)
+-#define ctnetlink_label_size(a)	(0)
+-#endif
+ 
+ #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_reject_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch b/queue-6.1/netfilter-nf_reject_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch
new file mode 100644
index 00000000000..c26ed1fdbe3
--- /dev/null
+++ b/queue-6.1/netfilter-nf_reject_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch
@@ -0,0 +1,191 @@
+From 518446f308ee1660b3a100ac2bdda49687df310e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 17:06:15 +0000
+Subject: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9c778fe48d20ef362047e3376dee56d77f8500d4 ]
+
+syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending
+garbage on the four reserved tcp bits (th->res1)
+
+Use skb_put_zero() to clear the whole TCP header,
+as done in nf_reject_ip_tcphdr_put()
+
+BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255
+  nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255
+  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
+  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
+  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
+  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288
+  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
+  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
+  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
+  nf_hook include/linux/netfilter.h:269 [inline]
+  NF_HOOK include/linux/netfilter.h:312 [inline]
+  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310
+  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
+  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
+  process_backlog+0x4ad/0xa50 net/core/dev.c:6108
+  __napi_poll+0xe7/0x980 net/core/dev.c:6772
+  napi_poll net/core/dev.c:6841 [inline]
+  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963
+  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554
+  __do_softirq+0x14/0x1a kernel/softirq.c:588
+  do_softirq+0x9a/0x100 kernel/softirq.c:455
+  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382
+  local_bh_enable include/linux/bottom_half.h:33 [inline]
+  rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline]
+  __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450
+  dev_queue_xmit include/linux/netdevice.h:3105 [inline]
+  neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565
+  neigh_output include/net/neighbour.h:542 [inline]
+  ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141
+  __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
+  ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226
+  NF_HOOK_COND include/linux/netfilter.h:303 [inline]
+  ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247
+  dst_output include/net/dst.h:450 [inline]
+  NF_HOOK include/linux/netfilter.h:314 [inline]
+  ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366
+  inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135
+  __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466
+  tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]
+  tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143
+  tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333
+  __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679
+  inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750
+  __sys_connect_file net/socket.c:2061 [inline]
+  __sys_connect+0x606/0x690 net/socket.c:2078
+  __do_sys_connect net/socket.c:2088 [inline]
+  __se_sys_connect net/socket.c:2085 [inline]
+  __x64_sys_connect+0x91/0xe0 net/socket.c:2085
+  x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Uninit was stored to memory at:
+  nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249
+  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
+  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
+  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
+  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288
+  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
+  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
+  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
+  nf_hook include/linux/netfilter.h:269 [inline]
+  NF_HOOK include/linux/netfilter.h:312 [inline]
+  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310
+  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
+  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
+  process_backlog+0x4ad/0xa50 net/core/dev.c:6108
+  __napi_poll+0xe7/0x980 net/core/dev.c:6772
+  napi_poll net/core/dev.c:6841 [inline]
+  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963
+  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554
+  __do_softirq+0x14/0x1a kernel/softirq.c:588
+
+Uninit was stored to memory at:
+  nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231
+  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
+  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
+  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
+  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288
+  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
+  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
+  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
+  nf_hook include/linux/netfilter.h:269 [inline]
+  NF_HOOK include/linux/netfilter.h:312 [inline]
+  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310
+  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
+  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
+  process_backlog+0x4ad/0xa50 net/core/dev.c:6108
+  __napi_poll+0xe7/0x980 net/core/dev.c:6772
+  napi_poll net/core/dev.c:6841 [inline]
+  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963
+  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554
+  __do_softirq+0x14/0x1a kernel/softirq.c:588
+
+Uninit was created at:
+  slab_post_alloc_hook mm/slub.c:3998 [inline]
+  slab_alloc_node mm/slub.c:4041 [inline]
+  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4084
+  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
+  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
+  alloc_skb include/linux/skbuff.h:1320 [inline]
+  nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327
+  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
+  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
+  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288
+  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
+  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
+  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
+  nf_hook include/linux/netfilter.h:269 [inline]
+  NF_HOOK include/linux/netfilter.h:312 [inline]
+  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310
+  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
+  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
+  process_backlog+0x4ad/0xa50 net/core/dev.c:6108
+  __napi_poll+0xe7/0x980 net/core/dev.c:6772
+  napi_poll net/core/dev.c:6841 [inline]
+  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963
+  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554
+  __do_softirq+0x14/0x1a kernel/softirq.c:588
+
+Fixes: c8d7b98bec43 ("netfilter: move nf_send_resetX() code to nf_reject_ipvX modules")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Link: https://patch.msgid.link/20240913170615.3670897-1-edumazet@google.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/netfilter/nf_reject_ipv6.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index 71d692728230e..690d1c0476913 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -223,33 +223,23 @@ void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb,
+ 			      const struct tcphdr *oth, unsigned int otcplen)
+ {
+ 	struct tcphdr *tcph;
+-	int needs_ack;
+ 
+ 	skb_reset_transport_header(nskb);
+-	tcph = skb_put(nskb, sizeof(struct tcphdr));
++	tcph = skb_put_zero(nskb, sizeof(struct tcphdr));
+ 	/* Truncate to length (no data) */
+ 	tcph->doff = sizeof(struct tcphdr)/4;
+ 	tcph->source = oth->dest;
+ 	tcph->dest = oth->source;
+ 
+ 	if (oth->ack) {
+-		needs_ack = 0;
+ 		tcph->seq = oth->ack_seq;
+-		tcph->ack_seq = 0;
+ 	} else {
+-		needs_ack = 1;
+ 		tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
+ 				      otcplen - (oth->doff<<2));
+-		tcph->seq = 0;
++		tcph->ack = 1;
+ 	}
+ 
+-	/* Reset flags */
+-	((u_int8_t *)tcph)[13] = 0;
+ 	tcph->rst = 1;
+-	tcph->ack = needs_ack;
+-	tcph->window = 0;
+-	tcph->urg_ptr = 0;
+-	tcph->check = 0;
+ 
+ 	/* Adjust TCP checksum */
+ 	tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-elements-with-timeout-below-conf.patch b/queue-6.1/netfilter-nf_tables-elements-with-timeout-below-conf.patch
new file mode 100644
index 00000000000..dfb8502bc8c
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-elements-with-timeout-below-conf.patch
@@ -0,0 +1,37 @@
+From ec9fd091b6097ef114d14ee015a2398678660352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 01:06:41 +0200
+Subject: netfilter: nf_tables: elements with timeout below CONFIG_HZ never
+ expire
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
+
+Element timeout that is below CONFIG_HZ never expires because the
+timeout extension is not allocated given that nf_msecs_to_jiffies64()
+returns 0. Set timeout to the minimum value to honor timeout.
+
+Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 25a9bce8cd3a4..4ebd3382f15b0 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4223,7 +4223,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+ 		return -ERANGE;
+ 
+ 	ms *= NSEC_PER_MSEC;
+-	*result = nsecs_to_jiffies64(ms);
++	*result = nsecs_to_jiffies64(ms) ? : !!ms;
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-keep-deleted-flowtable-hooks-unt.patch b/queue-6.1/netfilter-nf_tables-keep-deleted-flowtable-hooks-unt.patch
new file mode 100644
index 00000000000..1ff02a520ba
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-keep-deleted-flowtable-hooks-unt.patch
@@ -0,0 +1,38 @@
+From f883889b5bd50fea3a78d74cded44f6864f0c256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 14:21:33 +0200
+Subject: netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 642c89c475419b4d0c0d90e29d9c1a0e4351f379 ]
+
+Documentation of list_del_rcu() warns callers to not immediately free
+the deleted list item. While it seems not necessary to use the
+RCU-variant of list_del() here in the first place, doing so seems to
+require calling kfree_rcu() on the deleted item as well.
+
+Fixes: 3f0465a9ef02 ("netfilter: nf_tables: dynamically allocate hooks per net_device in flowtables")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index a68b2193393c8..ed09b1fdda16e 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8619,7 +8619,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
+ 		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
+ 					    FLOW_BLOCK_UNBIND);
+ 		list_del_rcu(&hook->list);
+-		kfree(hook);
++		kfree_rcu(hook, rcu);
+ 	}
+ 	kfree(flowtable->name);
+ 	module_put(flowtable->data.type->owner);
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-reject-element-expiration-with-n.patch b/queue-6.1/netfilter-nf_tables-reject-element-expiration-with-n.patch
new file mode 100644
index 00000000000..ec1e9d2c9b4
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-reject-element-expiration-with-n.patch
@@ -0,0 +1,40 @@
+From fc7b4bcc79f369920b61c14db6c95cab825b0cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 01:06:49 +0200
+Subject: netfilter: nf_tables: reject element expiration with no timeout
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit d2dc429ecb4e79ad164028d965c00f689e6f6d06 ]
+
+If element timeout is unset and set provides no default timeout, the
+element expiration is silently ignored, reject this instead to let user
+know this is unsupported.
+
+Also prepare for supporting timeout that never expire, where zero
+timeout and expiration must be also rejected.
+
+Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 4ebd3382f15b0..77306f48b3994 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6411,6 +6411,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 	if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
+ 		if (!(set->flags & NFT_SET_TIMEOUT))
+ 			return -EINVAL;
++		if (timeout == 0)
++			return -EOPNOTSUPP;
++
+ 		err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
+ 					    &expiration);
+ 		if (err)
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-reject-expiration-higher-than-ti.patch b/queue-6.1/netfilter-nf_tables-reject-expiration-higher-than-ti.patch
new file mode 100644
index 00000000000..7ae03510fac
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-reject-expiration-higher-than-ti.patch
@@ -0,0 +1,36 @@
+From f88319e693f268286d04f9ddd4392fecf2e01fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 01:06:58 +0200
+Subject: netfilter: nf_tables: reject expiration higher than timeout
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit c0f38a8c60174368aed1d0f9965d733195f15033 ]
+
+Report ERANGE to userspace if user specifies an expiration larger than
+the timeout.
+
+Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 77306f48b3994..f57418150717c 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6418,6 +6418,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 					    &expiration);
+ 		if (err)
+ 			return err;
++
++		if (expiration > timeout)
++			return -ERANGE;
+ 	}
+ 
+ 	if (nla[NFTA_SET_ELEM_EXPR]) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/netfilter-nf_tables-remove-annotation-to-access-set-.patch b/queue-6.1/netfilter-nf_tables-remove-annotation-to-access-set-.patch
new file mode 100644
index 00000000000..df0b9aa7462
--- /dev/null
+++ b/queue-6.1/netfilter-nf_tables-remove-annotation-to-access-set-.patch
@@ -0,0 +1,44 @@
+From 63bf47c3667a869a2d27967e6ba184d309a5161c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 01:07:06 +0200
+Subject: netfilter: nf_tables: remove annotation to access set timeout while
+ holding lock
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 15d8605c0cf4fc9cf4386cae658c68a0fd4bdb92 ]
+
+Mutex is held when adding an element, no need for READ_ONCE, remove it.
+
+Fixes: 123b99619cca ("netfilter: nf_tables: honor set timeout and garbage collection updates")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index f57418150717c..a68b2193393c8 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6404,7 +6404,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 			return err;
+ 	} else if (set->flags & NFT_SET_TIMEOUT &&
+ 		   !(flags & NFT_SET_ELEM_INTERVAL_END)) {
+-		timeout = READ_ONCE(set->timeout);
++		timeout = set->timeout;
+ 	}
+ 
+ 	expiration = 0;
+@@ -6511,7 +6511,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 		if (err < 0)
+ 			goto err_parse_key_end;
+ 
+-		if (timeout != READ_ONCE(set->timeout)) {
++		if (timeout != set->timeout) {
+ 			err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
+ 			if (err < 0)
+ 				goto err_parse_key_end;
+-- 
+2.43.0
+
diff --git a/queue-6.1/nfsd-call-cache_put-if-xdr_reserve_space-returns-nul.patch b/queue-6.1/nfsd-call-cache_put-if-xdr_reserve_space-returns-nul.patch
new file mode 100644
index 00000000000..55d5bba7ed8
--- /dev/null
+++ b/queue-6.1/nfsd-call-cache_put-if-xdr_reserve_space-returns-nul.patch
@@ -0,0 +1,58 @@
+From 23baaed080b99b99ae080b456ded6334000a998f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 22:03:18 +0800
+Subject: nfsd: call cache_put if xdr_reserve_space returns NULL
+
+From: Guoqing Jiang <guoqing.jiang@linux.dev>
+
+[ Upstream commit d078cbf5c38de83bc31f83c47dcd2184c04a50c7 ]
+
+If not enough buffer space available, but idmap_lookup has triggered
+lookup_fn which calls cache_get and returns successfully. Then we
+missed to call cache_put here which pairs with cache_get.
+
+Fixes: ddd1ea563672 ("nfsd4: use xdr_reserve_space in attribute encoding")
+Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
+Reviwed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4idmap.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
+index 5e9809aff37eb..717e400b16b86 100644
+--- a/fs/nfsd/nfs4idmap.c
++++ b/fs/nfsd/nfs4idmap.c
+@@ -581,6 +581,7 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr,
+ 		.id = id,
+ 		.type = type,
+ 	};
++	__be32 status = nfs_ok;
+ 	__be32 *p;
+ 	int ret;
+ 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
+@@ -593,12 +594,16 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr,
+ 		return nfserrno(ret);
+ 	ret = strlen(item->name);
+ 	WARN_ON_ONCE(ret > IDMAP_NAMESZ);
++
+ 	p = xdr_reserve_space(xdr, ret + 4);
+-	if (!p)
+-		return nfserr_resource;
+-	p = xdr_encode_opaque(p, item->name, ret);
++	if (unlikely(!p)) {
++		status = nfserr_resource;
++		goto out_put;
++	}
++	xdr_encode_opaque(p, item->name, ret);
++out_put:
+ 	cache_put(&item->h, nn->idtoname_cache);
+-	return 0;
++	return status;
+ }
+ 
+ static bool
+-- 
+2.43.0
+
diff --git a/queue-6.1/nfsd-fix-refcount-leak-when-file-is-unhashed-after-b.patch b/queue-6.1/nfsd-fix-refcount-leak-when-file-is-unhashed-after-b.patch
new file mode 100644
index 00000000000..17dcea2dce3
--- /dev/null
+++ b/queue-6.1/nfsd-fix-refcount-leak-when-file-is-unhashed-after-b.patch
@@ -0,0 +1,37 @@
+From cd9dca1c8497f2d2b0c3b63bd6a54aff0810dc8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2024 09:05:32 -0400
+Subject: nfsd: fix refcount leak when file is unhashed after being found
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 8a7926176378460e0d91e02b03f0ff20a8709a60 ]
+
+If we wait_for_construction and find that the file is no longer hashed,
+and we're going to retry the open, the old nfsd_file reference is
+currently leaked. Put the reference before retrying.
+
+Fixes: c6593366c0bf ("nfsd: don't kill nfsd_files because of lease break error")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Tested-by: Youzhong Yang <youzhong@gmail.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/filecache.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index 9101ad9175396..9e81f3a9097e0 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -1055,6 +1055,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ 			status = nfserr_jukebox;
+ 			goto construction_err;
+ 		}
++		nfsd_file_put(nf);
+ 		open_retry = false;
+ 		goto retry;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/nfsd-remove-unneeded-eexist-error-check-in-nfsd_do_f.patch b/queue-6.1/nfsd-remove-unneeded-eexist-error-check-in-nfsd_do_f.patch
new file mode 100644
index 00000000000..d49ec186581
--- /dev/null
+++ b/queue-6.1/nfsd-remove-unneeded-eexist-error-check-in-nfsd_do_f.patch
@@ -0,0 +1,37 @@
+From f6a4ca9fab33c355fd254e9d3c00dcfdf629ca13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 15:11:13 -0400
+Subject: nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 81a95c2b1d605743220f28db04b8da13a65c4059 ]
+
+Given that we do the search and insertion while holding the i_lock, I
+don't think it's possible for us to get EEXIST here. Remove this case.
+
+Fixes: c6593366c0bf ("nfsd: don't kill nfsd_files because of lease break error")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Tested-by: Youzhong Yang <youzhong@gmail.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/filecache.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index ee9c923192e08..9101ad9175396 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -1041,8 +1041,6 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ 	if (likely(ret == 0))
+ 		goto open_file;
+ 
+-	if (ret == -EEXIST)
+-		goto retry;
+ 	trace_nfsd_file_insert_err(rqstp, inode, may_flags, ret);
+ 	status = nfserr_jukebox;
+ 	goto construction_err;
+-- 
+2.43.0
+
diff --git a/queue-6.1/nfsd-return-einval-when-namelen-is-0.patch b/queue-6.1/nfsd-return-einval-when-namelen-is-0.patch
new file mode 100644
index 00000000000..cfeedfdef66
--- /dev/null
+++ b/queue-6.1/nfsd-return-einval-when-namelen-is-0.patch
@@ -0,0 +1,95 @@
+From 4f600150682aa13b59f9a537ff8d1e21fc4aa541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 19:14:46 +0800
+Subject: nfsd: return -EINVAL when namelen is 0
+
+From: Li Lingfeng <lilingfeng3@huawei.com>
+
+[ Upstream commit 22451a16b7ab7debefce660672566be887db1637 ]
+
+When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may
+result in namelen being 0, which will cause memdup_user() to return
+ZERO_SIZE_PTR.
+When we access the name.data that has been assigned the value of
+ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is
+triggered.
+
+[ T1205] ==================================================================
+[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260
+[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205
+[ T1205]
+[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406
+[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+[ T1205] Call Trace:
+[ T1205]  dump_stack+0x9a/0xd0
+[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
+[ T1205]  __kasan_report.cold+0x34/0x84
+[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260
+[ T1205]  kasan_report+0x3a/0x50
+[ T1205]  nfs4_client_to_reclaim+0xe9/0x260
+[ T1205]  ? nfsd4_release_lockowner+0x410/0x410
+[ T1205]  cld_pipe_downcall+0x5ca/0x760
+[ T1205]  ? nfsd4_cld_tracking_exit+0x1d0/0x1d0
+[ T1205]  ? down_write_killable_nested+0x170/0x170
+[ T1205]  ? avc_policy_seqno+0x28/0x40
+[ T1205]  ? selinux_file_permission+0x1b4/0x1e0
+[ T1205]  rpc_pipe_write+0x84/0xb0
+[ T1205]  vfs_write+0x143/0x520
+[ T1205]  ksys_write+0xc9/0x170
+[ T1205]  ? __ia32_sys_read+0x50/0x50
+[ T1205]  ? ktime_get_coarse_real_ts64+0xfe/0x110
+[ T1205]  ? ktime_get_coarse_real_ts64+0xa2/0x110
+[ T1205]  do_syscall_64+0x33/0x40
+[ T1205]  entry_SYSCALL_64_after_hwframe+0x67/0xd1
+[ T1205] RIP: 0033:0x7fdbdb761bc7
+[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514
+[ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7
+[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008
+[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001
+[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b
+[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000
+[ T1205] ==================================================================
+
+Fix it by checking namelen.
+
+Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
+Fixes: 74725959c33c ("nfsd: un-deprecate nfsdcld")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Scott Mayhew <smayhew@redhat.com>
+Tested-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 78b8cd9651d5b..7d5d794e2e320 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -806,6 +806,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
+ 			ci = &cmsg->cm_u.cm_clntinfo;
+ 			if (get_user(namelen, &ci->cc_name.cn_len))
+ 				return -EFAULT;
++			if (!namelen) {
++				dprintk("%s: namelen should not be zero", __func__);
++				return -EINVAL;
++			}
+ 			name.data = memdup_user(&ci->cc_name.cn_id, namelen);
+ 			if (IS_ERR(name.data))
+ 				return PTR_ERR(name.data);
+@@ -828,6 +832,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
+ 			cnm = &cmsg->cm_u.cm_name;
+ 			if (get_user(namelen, &cnm->cn_len))
+ 				return -EFAULT;
++			if (!namelen) {
++				dprintk("%s: namelen should not be zero", __func__);
++				return -EINVAL;
++			}
+ 			name.data = memdup_user(&cnm->cn_id, namelen);
+ 			if (IS_ERR(name.data))
+ 				return PTR_ERR(name.data);
+-- 
+2.43.0
+
diff --git a/queue-6.1/nilfs2-determine-empty-node-blocks-as-corrupted.patch b/queue-6.1/nilfs2-determine-empty-node-blocks-as-corrupted.patch
new file mode 100644
index 00000000000..1bf25b39610
--- /dev/null
+++ b/queue-6.1/nilfs2-determine-empty-node-blocks-as-corrupted.patch
@@ -0,0 +1,47 @@
+From a02130445c6009055afd316ae6e43c12a975ab31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 17:13:08 +0900
+Subject: nilfs2: determine empty node blocks as corrupted
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+[ Upstream commit 111b812d3662f3a1b831d19208f83aa711583fe6 ]
+
+Due to the nature of b-trees, nilfs2 itself and admin tools such as
+mkfs.nilfs2 will never create an intermediate b-tree node block with 0
+child nodes, nor will they delete (key, pointer)-entries that would result
+in such a state.  However, it is possible that a b-tree node block is
+corrupted on the backing device and is read with 0 child nodes.
+
+Because operation is not guaranteed if the number of child nodes is 0 for
+intermediate node blocks other than the root node, modify
+nilfs_btree_node_broken(), which performs sanity checks when reading a
+b-tree node block, so that such cases will be judged as metadata
+corruption.
+
+Link: https://lkml.kernel.org/r/20240904081401.16682-3-konishi.ryusuke@gmail.com
+Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: Lizhi Xu <lizhi.xu@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nilfs2/btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index 56f7752ec19ac..4c81bc9f48ad6 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -350,7 +350,7 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
+ 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+ 		     level >= NILFS_BTREE_LEVEL_MAX ||
+ 		     (flags & NILFS_BTREE_NODE_ROOT) ||
+-		     nchildren < 0 ||
++		     nchildren <= 0 ||
+ 		     nchildren > NILFS_BTREE_NODE_NCHILDREN_MAX(size))) {
+ 		nilfs_crit(inode->i_sb,
+ 			   "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
+-- 
+2.43.0
+
diff --git a/queue-6.1/nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_i.patch b/queue-6.1/nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_i.patch
new file mode 100644
index 00000000000..2003cf3bec2
--- /dev/null
+++ b/queue-6.1/nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_i.patch
@@ -0,0 +1,66 @@
+From 9da07f016ecb8cf2c436ef8de10c017e7bec2ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 17:13:07 +0900
+Subject: nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+[ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ]
+
+Patch series "nilfs2: fix potential issues with empty b-tree nodes".
+
+This series addresses three potential issues with empty b-tree nodes that
+can occur with corrupted filesystem images, including one recently
+discovered by syzbot.
+
+This patch (of 3):
+
+If a b-tree is broken on the device, and the b-tree height is greater than
+2 (the level of the root node is greater than 1) even if the number of
+child nodes of the b-tree root is 0, a NULL pointer dereference occurs in
+nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().
+
+This is because, when the number of child nodes of the b-tree root is 0,
+nilfs_btree_do_lookup() does not set the block buffer head in any of
+path[x].bp_bh, leaving it as the initial value of NULL, but if the level
+of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),
+which accesses the buffer memory of path[x].bp_bh, is called.
+
+Fix this issue by adding a check to nilfs_btree_root_broken(), which
+performs sanity checks when reading the root node from the device, to
+detect this inconsistency.
+
+Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause
+early on.
+
+Link: https://lkml.kernel.org/r/20240904081401.16682-1-konishi.ryusuke@gmail.com
+Link: https://lkml.kernel.org/r/20240902084101.138971-1-lizhi.xu@windriver.com
+Link: https://lkml.kernel.org/r/20240904081401.16682-2-konishi.ryusuke@gmail.com
+Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: syzbot+9bff4c7b992038a7409f@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9bff4c7b992038a7409f
+Cc: Lizhi Xu <lizhi.xu@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nilfs2/btree.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index 42617080a8384..56f7752ec19ac 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+ 		     level >= NILFS_BTREE_LEVEL_MAX ||
+ 		     nchildren < 0 ||
+-		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
++		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX ||
++		     (nchildren == 0 && level > NILFS_BTREE_LEVEL_NODE_MIN))) {
+ 		nilfs_crit(inode->i_sb,
+ 			   "bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d",
+ 			   inode->i_ino, level, flags, nchildren);
+-- 
+2.43.0
+
diff --git a/queue-6.1/nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch b/queue-6.1/nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch
new file mode 100644
index 00000000000..463fb5c2f92
--- /dev/null
+++ b/queue-6.1/nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch
@@ -0,0 +1,68 @@
+From 5acf7a523543ca538da20e837bd0608f86e03e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 17:13:09 +0900
+Subject: nilfs2: fix potential oob read in nilfs_btree_check_delete()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+[ Upstream commit f9c96351aa6718b42a9f42eaf7adce0356bdb5e8 ]
+
+The function nilfs_btree_check_delete(), which checks whether degeneration
+to direct mapping occurs before deleting a b-tree entry, causes memory
+access outside the block buffer when retrieving the maximum key if the
+root node has no entries.
+
+This does not usually happen because b-tree mappings with 0 child nodes
+are never created by mkfs.nilfs2 or nilfs2 itself.  However, it can happen
+if the b-tree root node read from a device is configured that way, so fix
+this potential issue by adding a check for that case.
+
+Link: https://lkml.kernel.org/r/20240904081401.16682-4-konishi.ryusuke@gmail.com
+Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: Lizhi Xu <lizhi.xu@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nilfs2/btree.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index 4c81bc9f48ad6..3139a1863751b 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -1659,13 +1659,16 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)
+ 	int nchildren, ret;
+ 
+ 	root = nilfs_btree_get_root(btree);
++	nchildren = nilfs_btree_node_get_nchildren(root);
++	if (unlikely(nchildren == 0))
++		return 0;
++
+ 	switch (nilfs_btree_height(btree)) {
+ 	case 2:
+ 		bh = NULL;
+ 		node = root;
+ 		break;
+ 	case 3:
+-		nchildren = nilfs_btree_node_get_nchildren(root);
+ 		if (nchildren > 1)
+ 			return 0;
+ 		ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
+@@ -1674,12 +1677,12 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)
+ 		if (ret < 0)
+ 			return ret;
+ 		node = (struct nilfs_btree_node *)bh->b_data;
++		nchildren = nilfs_btree_node_get_nchildren(node);
+ 		break;
+ 	default:
+ 		return 0;
+ 	}
+ 
+-	nchildren = nilfs_btree_node_get_nchildren(node);
+ 	maxkey = nilfs_btree_node_get_key(node, nchildren - 1);
+ 	nextmaxkey = (nchildren > 1) ?
+ 		nilfs_btree_node_get_key(node, nchildren - 2) : 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ntb-force-physically-contiguous-allocation-of-rx-rin.patch b/queue-6.1/ntb-force-physically-contiguous-allocation-of-rx-rin.patch
new file mode 100644
index 00000000000..d0ffe2ef53e
--- /dev/null
+++ b/queue-6.1/ntb-force-physically-contiguous-allocation-of-rx-rin.patch
@@ -0,0 +1,88 @@
+From 8a83879f54f00c79f13f0c7ce104263be566754a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 14:22:07 -0700
+Subject: ntb: Force physically contiguous allocation of rx ring buffers
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 061a785a114f159e990ea8ed8d1b7dca4b41120f ]
+
+Physical addresses under IOVA on x86 platform are mapped contiguously
+as a side effect before the patch that removed CONFIG_DMA_REMAP. The
+NTB rx buffer ring is a single chunk DMA buffer that is allocated
+against the NTB PCI device. If the receive side is using a DMA device,
+then the buffers are remapped against the DMA device before being
+submitted via the dmaengine API. This scheme becomes a problem when
+the physical memory is discontiguous. When dma_map_page() is called
+on the kernel virtual address from the dma_alloc_coherent() call, the
+new IOVA mapping no longer points to all the physical memory allocated
+due to being discontiguous. Change dma_alloc_coherent() to dma_alloc_attrs()
+in order to force DMA_ATTR_FORCE_CONTIGUOUS attribute. This is the best
+fix for the circumstance. A potential future solution may be having the DMA
+mapping API providing a way to alias an existing IOVA mapping to a new
+device perhaps.
+
+This fix is not to fix the patch pointed to by the fixes tag, but to fix
+the issue arised in the ntb_transport driver on x86 platforms after the
+said patch is applied.
+
+Reported-by: Jerry Dai <jerry.dai@intel.com>
+Fixes: f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA_REMAP")
+Tested-by: Jerry Dai <jerry.dai@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/ntb_transport.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
+index 9532108d2dce1..5b25260e59253 100644
+--- a/drivers/ntb/ntb_transport.c
++++ b/drivers/ntb/ntb_transport.c
+@@ -807,16 +807,29 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw)
+ }
+ 
+ static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,
+-			       struct device *dma_dev, size_t align)
++			       struct device *ntb_dev, size_t align)
+ {
+ 	dma_addr_t dma_addr;
+ 	void *alloc_addr, *virt_addr;
+ 	int rc;
+ 
+-	alloc_addr = dma_alloc_coherent(dma_dev, mw->alloc_size,
+-					&dma_addr, GFP_KERNEL);
++	/*
++	 * The buffer here is allocated against the NTB device. The reason to
++	 * use dma_alloc_*() call is to allocate a large IOVA contiguous buffer
++	 * backing the NTB BAR for the remote host to write to. During receive
++	 * processing, the data is being copied out of the receive buffer to
++	 * the kernel skbuff. When a DMA device is being used, dma_map_page()
++	 * is called on the kvaddr of the receive buffer (from dma_alloc_*())
++	 * and remapped against the DMA device. It appears to be a double
++	 * DMA mapping of buffers, but first is mapped to the NTB device and
++	 * second is to the DMA device. DMA_ATTR_FORCE_CONTIGUOUS is necessary
++	 * in order for the later dma_map_page() to not fail.
++	 */
++	alloc_addr = dma_alloc_attrs(ntb_dev, mw->alloc_size,
++				     &dma_addr, GFP_KERNEL,
++				     DMA_ATTR_FORCE_CONTIGUOUS);
+ 	if (!alloc_addr) {
+-		dev_err(dma_dev, "Unable to alloc MW buff of size %zu\n",
++		dev_err(ntb_dev, "Unable to alloc MW buff of size %zu\n",
+ 			mw->alloc_size);
+ 		return -ENOMEM;
+ 	}
+@@ -845,7 +858,7 @@ static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,
+ 	return 0;
+ 
+ err:
+-	dma_free_coherent(dma_dev, mw->alloc_size, alloc_addr, dma_addr);
++	dma_free_coherent(ntb_dev, mw->alloc_size, alloc_addr, dma_addr);
+ 
+ 	return rc;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/ntb-intel-fix-the-null-vs-is_err-bug-for-debugfs_cre.patch b/queue-6.1/ntb-intel-fix-the-null-vs-is_err-bug-for-debugfs_cre.patch
new file mode 100644
index 00000000000..d139a271997
--- /dev/null
+++ b/queue-6.1/ntb-intel-fix-the-null-vs-is_err-bug-for-debugfs_cre.patch
@@ -0,0 +1,37 @@
+From 834f476f6d3a8b8ac320156aaa3109fb01b4fe0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 20:39:27 +0800
+Subject: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit e229897d373a87ee09ec5cc4ecd4bb2f895fc16b ]
+
+The debugfs_create_dir() function returns error pointers.
+It never returns NULL. So use IS_ERR() to check it.
+
+Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+index 60a4ebc7bf35a..f647693f8f929 100644
+--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
++++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+@@ -778,7 +778,7 @@ static void ndev_init_debugfs(struct intel_ntb_dev *ndev)
+ 		ndev->debugfs_dir =
+ 			debugfs_create_dir(pci_name(ndev->ntb.pdev),
+ 					   debugfs_dir);
+-		if (!ndev->debugfs_dir)
++		if (IS_ERR(ndev->debugfs_dir))
+ 			ndev->debugfs_info = NULL;
+ 		else
+ 			ndev->debugfs_info =
+-- 
+2.43.0
+
diff --git a/queue-6.1/ntb_perf-fix-printk-format.patch b/queue-6.1/ntb_perf-fix-printk-format.patch
new file mode 100644
index 00000000000..f6a787a939e
--- /dev/null
+++ b/queue-6.1/ntb_perf-fix-printk-format.patch
@@ -0,0 +1,35 @@
+From c6cffbd4c335bf0cfcf6bf58a99bdc28171938ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Oct 2023 20:45:16 -0700
+Subject: ntb_perf: Fix printk format
+
+From: Max Hawking <maxahawking@sonnenkinder.org>
+
+[ Upstream commit 1501ae7479c8d0f66efdbfdc9ae8d6136cefbd37 ]
+
+The correct printk format is %pa or %pap, but not %pa[p].
+
+Fixes: 99a06056124d ("NTB: ntb_perf: Fix address err in perf_copy_chunk")
+Signed-off-by: Max Hawking <maxahawking@sonnenkinder.org>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/test/ntb_perf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index 65e1e5cf1b29a..5a7a02408166e 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -1227,7 +1227,7 @@ static ssize_t perf_dbgfs_read_info(struct file *filep, char __user *ubuf,
+ 			"\tOut buffer addr 0x%pK\n", peer->outbuf);
+ 
+ 		pos += scnprintf(buf + pos, buf_size - pos,
+-			"\tOut buff phys addr %pa[p]\n", &peer->out_phys_addr);
++			"\tOut buff phys addr %pap\n", &peer->out_phys_addr);
+ 
+ 		pos += scnprintf(buf + pos, buf_size - pos,
+ 			"\tOut buffer size %pa\n", &peer->outbuf_size);
+-- 
+2.43.0
+
diff --git a/queue-6.1/nvdimm-fix-devs-leaks-in-scan_labels.patch b/queue-6.1/nvdimm-fix-devs-leaks-in-scan_labels.patch
new file mode 100644
index 00000000000..2a355d39bec
--- /dev/null
+++ b/queue-6.1/nvdimm-fix-devs-leaks-in-scan_labels.patch
@@ -0,0 +1,127 @@
+From 5ae6acb2c7097cce7a27f58ba2de495a93fe7513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 14:20:44 +0800
+Subject: nvdimm: Fix devs leaks in scan_labels()
+
+From: Li Zhijian <lizhijian@fujitsu.com>
+
+[ Upstream commit 62c2aa6b1f565d2fc1ec11a6e9e8336ce37a6426 ]
+
+scan_labels() leaks memory when label scanning fails and it falls back
+to just creating a default "seed" namespace for userspace to configure.
+Root can force the kernel to leak memory.
+
+Allocate the minimum resources unconditionally and release them when
+unneeded to avoid the memory leak.
+
+A kmemleak reports:
+unreferenced object 0xffff88800dda1980 (size 16):
+  comm "kworker/u10:5", pid 69, jiffies 4294671781
+  hex dump (first 16 bytes):
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace (crc 0):
+    [<00000000c5dea560>] __kmalloc+0x32c/0x470
+    [<000000009ed43c83>] nd_region_register_namespaces+0x6fb/0x1120 [libnvdimm]
+    [<000000000e07a65c>] nd_region_probe+0xfe/0x210 [libnvdimm]
+    [<000000007b79ce5f>] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]
+    [<00000000a5f3da2e>] really_probe+0xc6/0x390
+    [<00000000129e2a69>] __driver_probe_device+0x78/0x150
+    [<000000002dfed28b>] driver_probe_device+0x1e/0x90
+    [<00000000e7048de2>] __device_attach_driver+0x85/0x110
+    [<0000000032dca295>] bus_for_each_drv+0x85/0xe0
+    [<00000000391c5a7d>] __device_attach+0xbe/0x1e0
+    [<0000000026dabec0>] bus_probe_device+0x94/0xb0
+    [<00000000c590d936>] device_add+0x656/0x870
+    [<000000003d69bfaa>] nd_async_device_register+0xe/0x50 [libnvdimm]
+    [<000000003f4c52a4>] async_run_entry_fn+0x2e/0x110
+    [<00000000e201f4b0>] process_one_work+0x1ee/0x600
+    [<000000006d90d5a9>] worker_thread+0x183/0x350
+
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Ira Weiny <ira.weiny@intel.com>
+Fixes: 1b40e09a1232 ("libnvdimm: blk labels and namespace instantiation")
+Suggested-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Link: https://patch.msgid.link/20240819062045.1481298-1-lizhijian@fujitsu.com
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/namespace_devs.c | 34 ++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index c60ec0b373c51..a095a4916b02e 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1926,12 +1926,16 @@ static int cmp_dpa(const void *a, const void *b)
+ static struct device **scan_labels(struct nd_region *nd_region)
+ {
+ 	int i, count = 0;
+-	struct device *dev, **devs = NULL;
++	struct device *dev, **devs;
+ 	struct nd_label_ent *label_ent, *e;
+ 	struct nd_mapping *nd_mapping = &nd_region->mapping[0];
+ 	struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+ 	resource_size_t map_end = nd_mapping->start + nd_mapping->size - 1;
+ 
++	devs = kcalloc(2, sizeof(dev), GFP_KERNEL);
++	if (!devs)
++		return NULL;
++
+ 	/* "safe" because create_namespace_pmem() might list_move() label_ent */
+ 	list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list) {
+ 		struct nd_namespace_label *nd_label = label_ent->label;
+@@ -1950,12 +1954,14 @@ static struct device **scan_labels(struct nd_region *nd_region)
+ 			goto err;
+ 		if (i < count)
+ 			continue;
+-		__devs = kcalloc(count + 2, sizeof(dev), GFP_KERNEL);
+-		if (!__devs)
+-			goto err;
+-		memcpy(__devs, devs, sizeof(dev) * count);
+-		kfree(devs);
+-		devs = __devs;
++		if (count) {
++			__devs = kcalloc(count + 2, sizeof(dev), GFP_KERNEL);
++			if (!__devs)
++				goto err;
++			memcpy(__devs, devs, sizeof(dev) * count);
++			kfree(devs);
++			devs = __devs;
++		}
+ 
+ 		dev = create_namespace_pmem(nd_region, nd_mapping, nd_label);
+ 		if (IS_ERR(dev)) {
+@@ -1982,11 +1988,6 @@ static struct device **scan_labels(struct nd_region *nd_region)
+ 
+ 		/* Publish a zero-sized namespace for userspace to configure. */
+ 		nd_mapping_free_labels(nd_mapping);
+-
+-		devs = kcalloc(2, sizeof(dev), GFP_KERNEL);
+-		if (!devs)
+-			goto err;
+-
+ 		nspm = kzalloc(sizeof(*nspm), GFP_KERNEL);
+ 		if (!nspm)
+ 			goto err;
+@@ -2025,11 +2026,10 @@ static struct device **scan_labels(struct nd_region *nd_region)
+ 	return devs;
+ 
+  err:
+-	if (devs) {
+-		for (i = 0; devs[i]; i++)
+-			namespace_pmem_release(devs[i]);
+-		kfree(devs);
+-	}
++	for (i = 0; devs[i]; i++)
++		namespace_pmem_release(devs[i]);
++	kfree(devs);
++
+ 	return NULL;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/nvme-multipath-system-fails-to-create-generic-nvme-d.patch b/queue-6.1/nvme-multipath-system-fails-to-create-generic-nvme-d.patch
new file mode 100644
index 00000000000..b6e4f22bf41
--- /dev/null
+++ b/queue-6.1/nvme-multipath-system-fails-to-create-generic-nvme-d.patch
@@ -0,0 +1,42 @@
+From 08006647dab543364e64a48a5283ed0ab7f70436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2024 14:01:22 +0200
+Subject: nvme-multipath: system fails to create generic nvme device
+
+From: Hannes Reinecke <hare@kernel.org>
+
+[ Upstream commit 63bcf9014e95a7d279d10d8e2caa5d88db2b1855 ]
+
+NVME_NSHEAD_DISK_LIVE is a flag for struct nvme_ns_head, not nvme_ns.
+The current code has a typo causing NVME_NSHEAD_DISK_LIVE never to
+be cleared once device_add_disk_fails, causing the system never to
+create the 'generic' character device. Even several rescan attempts
+will change the situation and the system has to be rebooted to fix
+the issue.
+
+Fixes: 11384580e332 ("nvme-multipath: add error handling support for add_disk()")
+Signed-off-by: Hannes Reinecke <hare@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index d0154859421db..93ada8941a4c5 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -548,7 +548,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)
+ 		rc = device_add_disk(&head->subsys->dev, head->disk,
+ 				     nvme_ns_id_attr_groups);
+ 		if (rc) {
+-			clear_bit(NVME_NSHEAD_DISK_LIVE, &ns->flags);
++			clear_bit(NVME_NSHEAD_DISK_LIVE, &head->flags);
+ 			return;
+ 		}
+ 		nvme_add_ns_head_cdev(head);
+-- 
+2.43.0
+
diff --git a/queue-6.1/padata-honor-the-caller-s-alignment-in-case-of-chunk.patch b/queue-6.1/padata-honor-the-caller-s-alignment-in-case-of-chunk.patch
new file mode 100644
index 00000000000..0d600b07a06
--- /dev/null
+++ b/queue-6.1/padata-honor-the-caller-s-alignment-in-case-of-chunk.patch
@@ -0,0 +1,51 @@
+From affc850b4082d4b3939b1d3aad1ecb603a778575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 02:32:52 +0530
+Subject: padata: Honor the caller's alignment in case of chunk_size 0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kamlesh Gurudasani <kamlesh@ti.com>
+
+[ Upstream commit 24cc57d8faaa4060fd58adf810b858fcfb71a02f ]
+
+In the case where we are forcing the ps.chunk_size to be at least 1,
+we are ignoring the caller's alignment.
+
+Move the forcing of ps.chunk_size to be at least 1 before rounding it
+up to caller's alignment, so that caller's alignment is honored.
+
+While at it, use max() to force the ps.chunk_size to be at least 1 to
+improve readability.
+
+Fixes: 6d45e1c948a8 ("padata: Fix possible divide-by-0 panic in padata_mt_helper()")
+Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com>
+Acked-by:  Waiman Long <longman@redhat.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 11270ffca54e0..87b4db3772866 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -503,9 +503,12 @@ void __init padata_do_multithreaded(struct padata_mt_job *job)
+ 	 * thread function.  Load balance large jobs between threads by
+ 	 * increasing the number of chunks, guarantee at least the minimum
+ 	 * chunk size from the caller, and honor the caller's alignment.
++	 * Ensure chunk_size is at least 1 to prevent divide-by-0
++	 * panic in padata_mt_helper().
+ 	 */
+ 	ps.chunk_size = job->size / (ps.nworks * load_balance_factor);
+ 	ps.chunk_size = max(ps.chunk_size, job->min_chunk);
++	ps.chunk_size = max(ps.chunk_size, 1ul);
+ 	ps.chunk_size = roundup(ps.chunk_size, job->align);
+ 
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-keystone-fix-if-statement-expression-in-ks_pcie_.patch b/queue-6.1/pci-keystone-fix-if-statement-expression-in-ks_pcie_.patch
new file mode 100644
index 00000000000..82c2670c04c
--- /dev/null
+++ b/queue-6.1/pci-keystone-fix-if-statement-expression-in-ks_pcie_.patch
@@ -0,0 +1,45 @@
+From 2273ae79d1cbf32aacf88af1dfdeacb8fa0b393d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2024 18:53:26 -0500
+Subject: PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 6188a1c762eb9bbd444f47696eda77a5eae6207a ]
+
+This code accidentally uses && where || was intended.  It potentially
+results in a NULL dereference.
+
+Thus, fix the if-statement expression to use the correct condition.
+
+Fixes: 86f271f22bbb ("PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)")
+Link: https://lore.kernel.org/linux-pci/1b762a93-e1b2-4af3-8c04-c8843905c279@stanley.mountain
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-keystone.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
+index e738013c6d4f5..ae5506293557e 100644
+--- a/drivers/pci/controller/dwc/pci-keystone.c
++++ b/drivers/pci/controller/dwc/pci-keystone.c
+@@ -580,7 +580,7 @@ static void ks_pcie_quirk(struct pci_dev *dev)
+ 	 */
+ 	if (pci_match_id(am6_pci_devids, bridge)) {
+ 		bridge_dev = pci_get_host_bridge_device(dev);
+-		if (!bridge_dev && !bridge_dev->parent)
++		if (!bridge_dev || !bridge_dev->parent)
+ 			return;
+ 
+ 		ks_pcie = dev_get_drvdata(bridge_dev->parent);
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-kirin-fix-buffer-overflow-in-kirin_pcie_parse_po.patch b/queue-6.1/pci-kirin-fix-buffer-overflow-in-kirin_pcie_parse_po.patch
new file mode 100644
index 00000000000..5e753acea21
--- /dev/null
+++ b/queue-6.1/pci-kirin-fix-buffer-overflow-in-kirin_pcie_parse_po.patch
@@ -0,0 +1,55 @@
+From 1e4b85d3997de9519a784bf647fb0b5b80d82d1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 14:58:23 +0300
+Subject: PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandra Diupina <adiupina@astralinux.ru>
+
+[ Upstream commit c500a86693a126c9393e602741e348f80f1b0fc5 ]
+
+Within kirin_pcie_parse_port(), the pcie->num_slots is compared to
+pcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead
+to an overflow.
+
+Thus, fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move
+pcie->num_slots increment below the if-statement to avoid out-of-bounds
+array access.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: b22dbbb24571 ("PCI: kirin: Support PERST# GPIOs for HiKey970 external PEX 8606 bridge")
+Link: https://lore.kernel.org/linux-pci/20240903115823.30647-1-adiupina@astralinux.ru
+Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-kirin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c
+index a824d8e8edb9d..68395d19a2644 100644
+--- a/drivers/pci/controller/dwc/pcie-kirin.c
++++ b/drivers/pci/controller/dwc/pcie-kirin.c
+@@ -416,12 +416,12 @@ static int kirin_pcie_parse_port(struct kirin_pcie *pcie,
+ 			if (pcie->gpio_id_reset[i] < 0)
+ 				continue;
+ 
+-			pcie->num_slots++;
+-			if (pcie->num_slots > MAX_PCI_SLOTS) {
++			if (pcie->num_slots + 1 >= MAX_PCI_SLOTS) {
+ 				dev_err(dev, "Too many PCI slots!\n");
+ 				ret = -EINVAL;
+ 				goto put_node;
+ 			}
++			pcie->num_slots++;
+ 
+ 			ret = of_pci_get_devfn(child);
+ 			if (ret < 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-pm-drop-pci_bridge_wait_for_secondary_bus-timeou.patch b/queue-6.1/pci-pm-drop-pci_bridge_wait_for_secondary_bus-timeou.patch
new file mode 100644
index 00000000000..f1de1dbb2d7
--- /dev/null
+++ b/queue-6.1/pci-pm-drop-pci_bridge_wait_for_secondary_bus-timeou.patch
@@ -0,0 +1,142 @@
+From b2df05d276b9df6b0f6085a318108b789ef7860c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 15:32:55 -0500
+Subject: PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit e74b2b58ff715ca17bb49c3ad89f665a7150e14b ]
+
+All callers of pci_bridge_wait_for_secondary_bus() supply a timeout of
+PCIE_RESET_READY_POLL_MS, so drop the parameter.  Move the definition of
+PCIE_RESET_READY_POLL_MS into pci.c, the only user.
+
+[bhelgaas: extracted from
+https: //lore.kernel.org/r/20230404052714.51315-3-mika.westerberg@linux.intel.com]
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Stable-dep-of: 3e40aa29d47e ("PCI: Wait for Link before restoring Downstream Buses")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c |  4 ++--
+ drivers/pci/pci.c        | 18 ++++++++++++------
+ drivers/pci/pci.h        |  9 +--------
+ drivers/pci/pcie/dpc.c   |  3 +--
+ 4 files changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index bafe7c9e6d190..cbe47fad4714c 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -579,8 +579,8 @@ static void pci_pm_default_resume_early(struct pci_dev *pci_dev)
+ 
+ static void pci_pm_bridge_power_up_actions(struct pci_dev *pci_dev)
+ {
+-	pci_bridge_wait_for_secondary_bus(pci_dev, "resume",
+-					  PCIE_RESET_READY_POLL_MS);
++	pci_bridge_wait_for_secondary_bus(pci_dev, "resume");
++
+ 	/*
+ 	 * When powering on a bridge from D3cold, the whole hierarchy may be
+ 	 * powered on into D0uninitialized state, resume them to give them a
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index f7592348ebeee..c845bc3e38e3f 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -64,6 +64,14 @@ struct pci_pme_device {
+ 
+ #define PME_TIMEOUT 1000 /* How long between PME checks */
+ 
++/*
++ * Devices may extend the 1 sec period through Request Retry Status
++ * completions (PCIe r6.0 sec 2.3.1).  The spec does not provide an upper
++ * limit, but 60 sec ought to be enough for any device to become
++ * responsive.
++ */
++#define PCIE_RESET_READY_POLL_MS 60000 /* msec */
++
+ static void pci_dev_d3_sleep(struct pci_dev *dev)
+ {
+ 	unsigned int delay_ms = max(dev->d3hot_delay, pci_pm_d3hot_delay);
+@@ -4991,7 +4999,6 @@ static int pci_bus_max_d3cold_delay(const struct pci_bus *bus)
+  * pci_bridge_wait_for_secondary_bus - Wait for secondary bus to be accessible
+  * @dev: PCI bridge
+  * @reset_type: reset type in human-readable form
+- * @timeout: maximum time to wait for devices on secondary bus (milliseconds)
+  *
+  * Handle necessary delays before access to the devices on the secondary
+  * side of the bridge are permitted after D3cold to D0 transition
+@@ -5004,8 +5011,7 @@ static int pci_bus_max_d3cold_delay(const struct pci_bus *bus)
+  * Return 0 on success or -ENOTTY if the first device on the secondary bus
+  * failed to become accessible.
+  */
+-int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type,
+-				      int timeout)
++int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type)
+ {
+ 	struct pci_dev *child __free(pci_dev_put) = NULL;
+ 	int delay;
+@@ -5083,7 +5089,8 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type,
+ 		}
+ 	}
+ 
+-	return pci_dev_wait(child, reset_type, timeout - delay);
++	return pci_dev_wait(child, reset_type,
++			    PCIE_RESET_READY_POLL_MS - delay);
+ }
+ 
+ void pci_reset_secondary_bus(struct pci_dev *dev)
+@@ -5120,8 +5127,7 @@ int pci_bridge_secondary_bus_reset(struct pci_dev *dev)
+ {
+ 	pcibios_reset_secondary_bus(dev);
+ 
+-	return pci_bridge_wait_for_secondary_bus(dev, "bus reset",
+-						 PCIE_RESET_READY_POLL_MS);
++	return pci_bridge_wait_for_secondary_bus(dev, "bus reset");
+ }
+ EXPORT_SYMBOL_GPL(pci_bridge_secondary_bus_reset);
+ 
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 88576a22fecb1..5d5813aa5b458 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -69,12 +69,6 @@ struct pci_cap_saved_state *pci_find_saved_ext_cap(struct pci_dev *dev,
+  * Reset (PCIe r6.0 sec 5.8).
+  */
+ #define PCI_RESET_WAIT		1000	/* msec */
+-/*
+- * Devices may extend the 1 sec period through Request Retry Status completions
+- * (PCIe r6.0 sec 2.3.1).  The spec does not provide an upper limit, but 60 sec
+- * ought to be enough for any device to become responsive.
+- */
+-#define PCIE_RESET_READY_POLL_MS 60000	/* msec */
+ 
+ void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
+ void pci_refresh_power_state(struct pci_dev *dev);
+@@ -99,8 +93,7 @@ void pci_msix_init(struct pci_dev *dev);
+ bool pci_bridge_d3_possible(struct pci_dev *dev);
+ void pci_bridge_d3_update(struct pci_dev *dev);
+ void pci_bridge_reconfigure_ltr(struct pci_dev *dev);
+-int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type,
+-				      int timeout);
++int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type);
+ 
+ static inline void pci_wakeup_event(struct pci_dev *dev)
+ {
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index acdbf9e770a8a..a5cec2a4e057d 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -171,8 +171,7 @@ pci_ers_result_t dpc_reset_link(struct pci_dev *pdev)
+ 	pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS,
+ 			      PCI_EXP_DPC_STATUS_TRIGGER);
+ 
+-	if (pci_bridge_wait_for_secondary_bus(pdev, "DPC",
+-					      PCIE_RESET_READY_POLL_MS)) {
++	if (pci_bridge_wait_for_secondary_bus(pdev, "DPC")) {
+ 		clear_bit(PCI_DPC_RECOVERED, &pdev->priv_flags);
+ 		ret = PCI_ERS_RESULT_DISCONNECT;
+ 	} else {
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-pm-increase-wait-time-after-resume.patch b/queue-6.1/pci-pm-increase-wait-time-after-resume.patch
new file mode 100644
index 00000000000..56743087923
--- /dev/null
+++ b/queue-6.1/pci-pm-increase-wait-time-after-resume.patch
@@ -0,0 +1,56 @@
+From 2ff94489dbcd02c98e2f0a0a49f44906819d8d70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 08:27:13 +0300
+Subject: PCI/PM: Increase wait time after resume
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit e8b908146d44310473e43b3382eca126e12d279c ]
+
+PCIe r6.0 sec 6.6.1 prescribes that a device must be able to respond to
+config requests within 1.0 s (PCI_RESET_WAIT) after exiting conventional
+reset and this same delay is prescribed when coming out of D3cold (as that
+involves reset too).
+
+A device that requires more than 1 second to initialize after reset may
+respond to config requests with Request Retry Status completions (sec
+2.3.1), and we accommodate that in Linux with a 60 second cap
+(PCIE_RESET_READY_POLL_MS).
+
+Previously we waited up to PCIE_RESET_READY_POLL_MS only in the reset code
+path, not in the resume path.  However, a device has surfaced, namely Intel
+Titan Ridge xHCI, which requires a longer delay also in the resume code
+path.
+
+Make the resume code path to use this same extended delay as the reset
+path.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216728
+Link: https://lore.kernel.org/r/20230404052714.51315-2-mika.westerberg@linux.intel.com
+Reported-by: Chris Chiu <chris.chiu@canonical.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Lukas Wunner <lukas@wunner.de>
+Stable-dep-of: 3e40aa29d47e ("PCI: Wait for Link before restoring Downstream Buses")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 8dda3b205dfd0..bafe7c9e6d190 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -579,7 +579,8 @@ static void pci_pm_default_resume_early(struct pci_dev *pci_dev)
+ 
+ static void pci_pm_bridge_power_up_actions(struct pci_dev *pci_dev)
+ {
+-	pci_bridge_wait_for_secondary_bus(pci_dev, "resume", PCI_RESET_WAIT);
++	pci_bridge_wait_for_secondary_bus(pci_dev, "resume",
++					  PCIE_RESET_READY_POLL_MS);
+ 	/*
+ 	 * When powering on a bridge from D3cold, the whole hierarchy may be
+ 	 * powered on into D0uninitialized state, resume them to give them a
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-wait-for-link-before-restoring-downstream-buses.patch b/queue-6.1/pci-wait-for-link-before-restoring-downstream-buses.patch
new file mode 100644
index 00000000000..b6a5e1d3db0
--- /dev/null
+++ b/queue-6.1/pci-wait-for-link-before-restoring-downstream-buses.patch
@@ -0,0 +1,69 @@
+From a0314bf50111fa741f892444f0e856d2c66bc5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2024 15:17:07 +0300
+Subject: PCI: Wait for Link before restoring Downstream Buses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 3e40aa29d47e231a54640addf6a09c1f64c5b63f ]
+
+__pci_reset_bus() calls pci_bridge_secondary_bus_reset() to perform the
+reset and also waits for the Secondary Bus to become again accessible.
+__pci_reset_bus() then calls pci_bus_restore_locked() that restores the PCI
+devices connected to the bus, and if necessary, recursively restores also
+the subordinate buses and their devices.
+
+The logic in pci_bus_restore_locked() does not take into account that after
+restoring a device on one level, there might be another Link Downstream
+that can only start to come up after restore has been performed for its
+Downstream Port device. That is, the Link may require additional wait until
+it becomes accessible.
+
+Similarly, pci_slot_restore_locked() lacks wait.
+
+Amend pci_bus_restore_locked() and pci_slot_restore_locked() to wait for
+the Secondary Bus before recursively performing the restore of that bus.
+
+Fixes: 090a3c5322e9 ("PCI: Add pci_reset_slot() and pci_reset_bus()")
+Link: https://lore.kernel.org/r/20240808121708.2523-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c845bc3e38e3f..0baf5c03ef4cb 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5747,8 +5747,10 @@ static void pci_bus_restore_locked(struct pci_bus *bus)
+ 
+ 	list_for_each_entry(dev, &bus->devices, bus_list) {
+ 		pci_dev_restore(dev);
+-		if (dev->subordinate)
++		if (dev->subordinate) {
++			pci_bridge_wait_for_secondary_bus(dev, "bus reset");
+ 			pci_bus_restore_locked(dev->subordinate);
++		}
+ 	}
+ }
+ 
+@@ -5782,8 +5784,10 @@ static void pci_slot_restore_locked(struct pci_slot *slot)
+ 		if (!dev->slot || dev->slot != slot)
+ 			continue;
+ 		pci_dev_restore(dev);
+-		if (dev->subordinate)
++		if (dev->subordinate) {
++			pci_bridge_wait_for_secondary_bus(dev, "slot reset");
+ 			pci_bus_restore_locked(dev->subordinate);
++		}
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-xilinx-nwl-clean-up-clock-on-probe-failure-remov.patch b/queue-6.1/pci-xilinx-nwl-clean-up-clock-on-probe-failure-remov.patch
new file mode 100644
index 00000000000..b27a3aa3b21
--- /dev/null
+++ b/queue-6.1/pci-xilinx-nwl-clean-up-clock-on-probe-failure-remov.patch
@@ -0,0 +1,85 @@
+From a4f70892156f936cc7591791f4d3bbf8e1633ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 May 2024 12:13:35 -0400
+Subject: PCI: xilinx-nwl: Clean up clock on probe failure/removal
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit cfd67903977b13f63340a4eb5a1cc890994f2c62 ]
+
+Make sure we turn off the clock on probe failure and device removal.
+
+Fixes: de0a01f52966 ("PCI: xilinx-nwl: Enable the clock through CCF")
+Link: https://lore.kernel.org/r/20240531161337.864994-6-sean.anderson@linux.dev
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-xilinx-nwl.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
+index 18c6519e7d1da..0311fed2a25e2 100644
+--- a/drivers/pci/controller/pcie-xilinx-nwl.c
++++ b/drivers/pci/controller/pcie-xilinx-nwl.c
+@@ -792,6 +792,7 @@ static int nwl_pcie_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 
+ 	pcie = pci_host_bridge_priv(bridge);
++	platform_set_drvdata(pdev, pcie);
+ 
+ 	pcie->dev = dev;
+ 	pcie->ecam_value = NWL_ECAM_VALUE_DEFAULT;
+@@ -815,13 +816,13 @@ static int nwl_pcie_probe(struct platform_device *pdev)
+ 	err = nwl_pcie_bridge_init(pcie);
+ 	if (err) {
+ 		dev_err(dev, "HW Initialization failed\n");
+-		return err;
++		goto err_clk;
+ 	}
+ 
+ 	err = nwl_pcie_init_irq_domain(pcie);
+ 	if (err) {
+ 		dev_err(dev, "Failed creating IRQ Domain\n");
+-		return err;
++		goto err_clk;
+ 	}
+ 
+ 	bridge->sysdata = pcie;
+@@ -831,11 +832,24 @@ static int nwl_pcie_probe(struct platform_device *pdev)
+ 		err = nwl_pcie_enable_msi(pcie);
+ 		if (err < 0) {
+ 			dev_err(dev, "failed to enable MSI support: %d\n", err);
+-			return err;
++			goto err_clk;
+ 		}
+ 	}
+ 
+-	return pci_host_probe(bridge);
++	err = pci_host_probe(bridge);
++	if (!err)
++		return 0;
++
++err_clk:
++	clk_disable_unprepare(pcie->clk);
++	return err;
++}
++
++static void nwl_pcie_remove(struct platform_device *pdev)
++{
++	struct nwl_pcie *pcie = platform_get_drvdata(pdev);
++
++	clk_disable_unprepare(pcie->clk);
+ }
+ 
+ static struct platform_driver nwl_pcie_driver = {
+@@ -845,5 +859,6 @@ static struct platform_driver nwl_pcie_driver = {
+ 		.of_match_table = nwl_pcie_of_match,
+ 	},
+ 	.probe = nwl_pcie_probe,
++	.remove_new = nwl_pcie_remove,
+ };
+ builtin_platform_driver(nwl_pcie_driver);
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-xilinx-nwl-fix-register-misspelling.patch b/queue-6.1/pci-xilinx-nwl-fix-register-misspelling.patch
new file mode 100644
index 00000000000..4195ca4006c
--- /dev/null
+++ b/queue-6.1/pci-xilinx-nwl-fix-register-misspelling.patch
@@ -0,0 +1,62 @@
+From 341843094363cd475f7e8a3fce54855c677f8368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 May 2024 12:13:33 -0400
+Subject: PCI: xilinx-nwl: Fix register misspelling
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit a437027ae1730b8dc379c75fa0dd7d3036917400 ]
+
+MSIC -> MISC
+
+Fixes: c2a7ff18edcd ("PCI: xilinx-nwl: Expand error logging")
+Link: https://lore.kernel.org/r/20240531161337.864994-4-sean.anderson@linux.dev
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
+index 40d070e54ad2e..18c6519e7d1da 100644
+--- a/drivers/pci/controller/pcie-xilinx-nwl.c
++++ b/drivers/pci/controller/pcie-xilinx-nwl.c
+@@ -81,8 +81,8 @@
+ #define MSGF_MISC_SR_NON_FATAL_DEV	BIT(22)
+ #define MSGF_MISC_SR_FATAL_DEV		BIT(23)
+ #define MSGF_MISC_SR_LINK_DOWN		BIT(24)
+-#define MSGF_MSIC_SR_LINK_AUTO_BWIDTH	BIT(25)
+-#define MSGF_MSIC_SR_LINK_BWIDTH	BIT(26)
++#define MSGF_MISC_SR_LINK_AUTO_BWIDTH	BIT(25)
++#define MSGF_MISC_SR_LINK_BWIDTH	BIT(26)
+ 
+ #define MSGF_MISC_SR_MASKALL		(MSGF_MISC_SR_RXMSG_AVAIL | \
+ 					MSGF_MISC_SR_RXMSG_OVER | \
+@@ -97,8 +97,8 @@
+ 					MSGF_MISC_SR_NON_FATAL_DEV | \
+ 					MSGF_MISC_SR_FATAL_DEV | \
+ 					MSGF_MISC_SR_LINK_DOWN | \
+-					MSGF_MSIC_SR_LINK_AUTO_BWIDTH | \
+-					MSGF_MSIC_SR_LINK_BWIDTH)
++					MSGF_MISC_SR_LINK_AUTO_BWIDTH | \
++					MSGF_MISC_SR_LINK_BWIDTH)
+ 
+ /* Legacy interrupt status mask bits */
+ #define MSGF_LEG_SR_INTA		BIT(0)
+@@ -302,10 +302,10 @@ static irqreturn_t nwl_pcie_misc_handler(int irq, void *data)
+ 	if (misc_stat & MSGF_MISC_SR_FATAL_DEV)
+ 		dev_err(dev, "Fatal Error Detected\n");
+ 
+-	if (misc_stat & MSGF_MSIC_SR_LINK_AUTO_BWIDTH)
++	if (misc_stat & MSGF_MISC_SR_LINK_AUTO_BWIDTH)
+ 		dev_info(dev, "Link Autonomous Bandwidth Management Status bit set\n");
+ 
+-	if (misc_stat & MSGF_MSIC_SR_LINK_BWIDTH)
++	if (misc_stat & MSGF_MISC_SR_LINK_BWIDTH)
+ 		dev_info(dev, "Link Bandwidth Management Status bit set\n");
+ 
+ 	/* Clear misc interrupt status */
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-arm-cmn-ensure-dtm_idx-is-big-enough.patch b/queue-6.1/perf-arm-cmn-ensure-dtm_idx-is-big-enough.patch
new file mode 100644
index 00000000000..d1d56091118
--- /dev/null
+++ b/queue-6.1/perf-arm-cmn-ensure-dtm_idx-is-big-enough.patch
@@ -0,0 +1,50 @@
+From 50bf33fdfb844a1c9ad69f4a59aec479fbdb685d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 18:51:59 +0100
+Subject: perf/arm-cmn: Ensure dtm_idx is big enough
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 359414b33e00bae91e4eabf3e4ef8e76024c7673 ]
+
+While CMN_MAX_DIMENSION was bumped to 12 for CMN-650, that only supports
+up to a 10x10 mesh, so bumping dtm_idx to 256 bits at the time worked
+out OK in practice. However CMN-700 did finally support up to 144 XPs,
+and thus needs a worst-case 288 bits of dtm_idx for an aggregated XP
+event on a maxed-out config. Oops.
+
+Fixes: 23760a014417 ("perf/arm-cmn: Add CMN-700 support")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/e771b358526a0d7fc06efee2c3a2fdc0c9f51d44.1725296395.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 60bca69bb3592..0d68da9dc358c 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -35,6 +35,9 @@
+ #define CMN_MAX_XPS			(CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)
+ #define CMN_MAX_DTMS			(CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4)
+ 
++/* Currently XPs are the node type we can have most of; others top out at 128 */
++#define CMN_MAX_NODES_PER_EVENT		CMN_MAX_XPS
++
+ /* The CFG node has various info besides the discovery tree */
+ #define CMN_CFGM_PERIPH_ID_01		0x0008
+ #define CMN_CFGM_PID0_PART_0		GENMASK_ULL(7, 0)
+@@ -556,7 +559,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}
+ 
+ struct arm_cmn_hw_event {
+ 	struct arm_cmn_node *dn;
+-	u64 dtm_idx[4];
++	u64 dtm_idx[DIV_ROUND_UP(CMN_MAX_NODES_PER_EVENT * 2, 64)];
+ 	s8 dtc_idx[CMN_MAX_DTCS];
+ 	u8 num_dns;
+ 	u8 dtm_offset;
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-arm-cmn-improve-debugfs-pretty-printing-for-lar.patch b/queue-6.1/perf-arm-cmn-improve-debugfs-pretty-printing-for-lar.patch
new file mode 100644
index 00000000000..a2b5340667d
--- /dev/null
+++ b/queue-6.1/perf-arm-cmn-improve-debugfs-pretty-printing-for-lar.patch
@@ -0,0 +1,75 @@
+From a93ed9ce03f59a4ff9c231bbd45f43f139d85bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 16:24:07 +0000
+Subject: perf/arm-cmn: Improve debugfs pretty-printing for large configs
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit a1083ee717e9bde012268782e084d343314490a4 ]
+
+The debugfs pretty-printer was written for the CMN-600 assumptions of a
+maximum 8x8 mesh, but CMN-700 now allows coordinates and ID values up to
+12 and 128 respectively, which can overflow the format strings, mess up
+the alignment of the table and hurt overall readability. This table does
+prove useful for double-checking that the driver is picking up the
+topology of new systems correctly and for verifying user expectations,
+so tweak the formatting to stay nice and readable with wider values.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/1d1517eadd1bac5992fab679c9dc531b381944da.1702484646.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 0ab6fe93f5e2b..5ddb6a8611d8c 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -485,6 +485,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)
+ 
+ 	for (dn = cmn->dns; dn->type; dn++) {
+ 		struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
++		int pad = dn->logid < 10;
+ 
+ 		if (dn->type == CMN_TYPE_XP)
+ 			continue;
+@@ -495,7 +496,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)
+ 		if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d)
+ 			continue;
+ 
+-		seq_printf(s, "   #%-2d  |", dn->logid);
++		seq_printf(s, " %*c#%-*d  |", pad + 1, ' ', 3 - pad, dn->logid);
+ 		return;
+ 	}
+ 	seq_puts(s, "        |");
+@@ -508,7 +509,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 
+ 	seq_puts(s, "     X");
+ 	for (x = 0; x < cmn->mesh_x; x++)
+-		seq_printf(s, "    %d    ", x);
++		seq_printf(s, "    %-2d   ", x);
+ 	seq_puts(s, "\nY P D+");
+ 	y = cmn->mesh_y;
+ 	while (y--) {
+@@ -518,13 +519,13 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 		for (x = 0; x < cmn->mesh_x; x++)
+ 			seq_puts(s, "--------+");
+ 
+-		seq_printf(s, "\n%d    |", y);
++		seq_printf(s, "\n%-2d   |", y);
+ 		for (x = 0; x < cmn->mesh_x; x++) {
+ 			struct arm_cmn_node *xp = cmn->xps + xp_base + x;
+ 
+ 			for (p = 0; p < CMN_MAX_PORTS; p++)
+ 				port[p][x] = arm_cmn_device_connect_info(cmn, xp, p);
+-			seq_printf(s, " XP #%-2d |", xp_base + x);
++			seq_printf(s, " XP #%-3d|", xp_base + x);
+ 		}
+ 
+ 		seq_puts(s, "\n     |");
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-arm-cmn-refactor-node-id-handling.-again.patch b/queue-6.1/perf-arm-cmn-refactor-node-id-handling.-again.patch
new file mode 100644
index 00000000000..cfbd617acf1
--- /dev/null
+++ b/queue-6.1/perf-arm-cmn-refactor-node-id-handling.-again.patch
@@ -0,0 +1,261 @@
+From be19ee416445216f73c974057f5fe541409d89db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 18:51:57 +0100
+Subject: perf/arm-cmn: Refactor node ID handling. Again.
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit e79634b53e398966c49f803c49701bc74dc3ccf8 ]
+
+The scope of the "extra device ports" configuration is not made clear by
+the CMN documentation - so far we've assumed it applies globally, based
+on the sole example which suggests as much. However it transpires that
+this is incorrect, and the format does in fact vary based on each
+individual XP's port configuration. As a consequence, we're currenly
+liable to decode the port/device indices from a node ID incorrectly,
+thus program the wrong event source in the DTM leading to bogus event
+counts, and also show device topology on the wrong ports in debugfs.
+
+To put this right, rework node IDs yet again to carry around the
+additional data necessary to decode them properly per-XP. At this point
+the notion of fully decomposing an ID becomes more impractical than it's
+worth, so unabstracting the XY mesh coordinates (where 2/3 users were
+just debug anyway) ends up leaving things a bit simpler overall.
+
+Fixes: 60d1504070c2 ("perf/arm-cmn: Support new IP features")
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/5195f990152fc37adba5fbf5929a6b11063d9f09.1725296395.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 94 ++++++++++++++++++------------------------
+ 1 file changed, 40 insertions(+), 54 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 5ddb6a8611d8c..60bca69bb3592 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -24,14 +24,6 @@
+ #define CMN_NI_NODE_ID			GENMASK_ULL(31, 16)
+ #define CMN_NI_LOGICAL_ID		GENMASK_ULL(47, 32)
+ 
+-#define CMN_NODEID_DEVID(reg)		((reg) & 3)
+-#define CMN_NODEID_EXT_DEVID(reg)	((reg) & 1)
+-#define CMN_NODEID_PID(reg)		(((reg) >> 2) & 1)
+-#define CMN_NODEID_EXT_PID(reg)		(((reg) >> 1) & 3)
+-#define CMN_NODEID_1x1_PID(reg)		(((reg) >> 2) & 7)
+-#define CMN_NODEID_X(reg, bits)		((reg) >> (3 + (bits)))
+-#define CMN_NODEID_Y(reg, bits)		(((reg) >> 3) & ((1U << (bits)) - 1))
+-
+ #define CMN_CHILD_INFO			0x0080
+ #define CMN_CI_CHILD_COUNT		GENMASK_ULL(15, 0)
+ #define CMN_CI_CHILD_PTR_OFFSET		GENMASK_ULL(31, 16)
+@@ -273,8 +265,11 @@ struct arm_cmn_node {
+ 	u16 id, logid;
+ 	enum cmn_node_type type;
+ 
++	/* XP properties really, but replicated to children for convenience */
+ 	u8 dtm;
+ 	s8 dtc;
++	u8 portid_bits:4;
++	u8 deviceid_bits:4;
+ 	/* DN/HN-F/CXHA */
+ 	struct {
+ 		u8 val : 4;
+@@ -350,49 +345,33 @@ struct arm_cmn {
+ static int arm_cmn_hp_state;
+ 
+ struct arm_cmn_nodeid {
+-	u8 x;
+-	u8 y;
+ 	u8 port;
+ 	u8 dev;
+ };
+ 
+ static int arm_cmn_xyidbits(const struct arm_cmn *cmn)
+ {
+-	return fls((cmn->mesh_x - 1) | (cmn->mesh_y - 1) | 2);
++	return fls((cmn->mesh_x - 1) | (cmn->mesh_y - 1));
+ }
+ 
+-static struct arm_cmn_nodeid arm_cmn_nid(const struct arm_cmn *cmn, u16 id)
++static struct arm_cmn_nodeid arm_cmn_nid(const struct arm_cmn_node *dn)
+ {
+ 	struct arm_cmn_nodeid nid;
+ 
+-	if (cmn->num_xps == 1) {
+-		nid.x = 0;
+-		nid.y = 0;
+-		nid.port = CMN_NODEID_1x1_PID(id);
+-		nid.dev = CMN_NODEID_DEVID(id);
+-	} else {
+-		int bits = arm_cmn_xyidbits(cmn);
+-
+-		nid.x = CMN_NODEID_X(id, bits);
+-		nid.y = CMN_NODEID_Y(id, bits);
+-		if (cmn->ports_used & 0xc) {
+-			nid.port = CMN_NODEID_EXT_PID(id);
+-			nid.dev = CMN_NODEID_EXT_DEVID(id);
+-		} else {
+-			nid.port = CMN_NODEID_PID(id);
+-			nid.dev = CMN_NODEID_DEVID(id);
+-		}
+-	}
++	nid.dev = dn->id & ((1U << dn->deviceid_bits) - 1);
++	nid.port = (dn->id >> dn->deviceid_bits) & ((1U << dn->portid_bits) - 1);
+ 	return nid;
+ }
+ 
+ static struct arm_cmn_node *arm_cmn_node_to_xp(const struct arm_cmn *cmn,
+ 					       const struct arm_cmn_node *dn)
+ {
+-	struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
+-	int xp_idx = cmn->mesh_x * nid.y + nid.x;
++	int id = dn->id >> (dn->portid_bits + dn->deviceid_bits);
++	int bits = arm_cmn_xyidbits(cmn);
++	int x = id >> bits;
++	int y = id & ((1U << bits) - 1);
+ 
+-	return cmn->xps + xp_idx;
++	return cmn->xps + cmn->mesh_x * y + x;
+ }
+ static struct arm_cmn_node *arm_cmn_node(const struct arm_cmn *cmn,
+ 					 enum cmn_node_type type)
+@@ -478,13 +457,13 @@ static const char *arm_cmn_device_type(u8 type)
+ 	}
+ }
+ 
+-static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)
++static void arm_cmn_show_logid(struct seq_file *s, const struct arm_cmn_node *xp, int p, int d)
+ {
+ 	struct arm_cmn *cmn = s->private;
+ 	struct arm_cmn_node *dn;
++	u16 id = xp->id | d | (p << xp->deviceid_bits);
+ 
+ 	for (dn = cmn->dns; dn->type; dn++) {
+-		struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
+ 		int pad = dn->logid < 10;
+ 
+ 		if (dn->type == CMN_TYPE_XP)
+@@ -493,7 +472,7 @@ static void arm_cmn_show_logid(struct seq_file *s, int x, int y, int p, int d)
+ 		if (dn->type < CMN_TYPE_HNI)
+ 			continue;
+ 
+-		if (nid.x != x || nid.y != y || nid.port != p || nid.dev != d)
++		if (dn->id != id)
+ 			continue;
+ 
+ 		seq_printf(s, " %*c#%-*d  |", pad + 1, ' ', 3 - pad, dn->logid);
+@@ -514,6 +493,7 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 	y = cmn->mesh_y;
+ 	while (y--) {
+ 		int xp_base = cmn->mesh_x * y;
++		struct arm_cmn_node *xp = cmn->xps + xp_base;
+ 		u8 port[CMN_MAX_PORTS][CMN_MAX_DIMENSION];
+ 
+ 		for (x = 0; x < cmn->mesh_x; x++)
+@@ -521,16 +501,14 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 
+ 		seq_printf(s, "\n%-2d   |", y);
+ 		for (x = 0; x < cmn->mesh_x; x++) {
+-			struct arm_cmn_node *xp = cmn->xps + xp_base + x;
+-
+ 			for (p = 0; p < CMN_MAX_PORTS; p++)
+-				port[p][x] = arm_cmn_device_connect_info(cmn, xp, p);
++				port[p][x] = arm_cmn_device_connect_info(cmn, xp + x, p);
+ 			seq_printf(s, " XP #%-3d|", xp_base + x);
+ 		}
+ 
+ 		seq_puts(s, "\n     |");
+ 		for (x = 0; x < cmn->mesh_x; x++) {
+-			s8 dtc = cmn->xps[xp_base + x].dtc;
++			s8 dtc = xp[x].dtc;
+ 
+ 			if (dtc < 0)
+ 				seq_puts(s, " DTC ?? |");
+@@ -547,10 +525,10 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 				seq_puts(s, arm_cmn_device_type(port[p][x]));
+ 			seq_puts(s, "\n    0|");
+ 			for (x = 0; x < cmn->mesh_x; x++)
+-				arm_cmn_show_logid(s, x, y, p, 0);
++				arm_cmn_show_logid(s, xp + x, p, 0);
+ 			seq_puts(s, "\n    1|");
+ 			for (x = 0; x < cmn->mesh_x; x++)
+-				arm_cmn_show_logid(s, x, y, p, 1);
++				arm_cmn_show_logid(s, xp + x, p, 1);
+ 		}
+ 		seq_puts(s, "\n-----+");
+ 	}
+@@ -1629,10 +1607,7 @@ static int arm_cmn_event_init(struct perf_event *event)
+ 	}
+ 
+ 	if (!hw->num_dns) {
+-		struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, nodeid);
+-
+-		dev_dbg(cmn->dev, "invalid node 0x%x (%d,%d,%d,%d) type 0x%x\n",
+-			nodeid, nid.x, nid.y, nid.port, nid.dev, type);
++		dev_dbg(cmn->dev, "invalid node 0x%x type 0x%x\n", nodeid, type);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -1727,7 +1702,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags)
+ 			dtm->wp_event[wp_idx] = hw->dtc_idx[d];
+ 			writel_relaxed(cfg, dtm->base + CMN_DTM_WPn_CONFIG(wp_idx));
+ 		} else {
+-			struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
++			struct arm_cmn_nodeid nid = arm_cmn_nid(dn);
+ 
+ 			if (cmn->multi_dtm)
+ 				nid.port %= 2;
+@@ -1973,10 +1948,12 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
+ 			continue;
+ 
+ 		xp = arm_cmn_node_to_xp(cmn, dn);
++		dn->portid_bits = xp->portid_bits;
++		dn->deviceid_bits = xp->deviceid_bits;
+ 		dn->dtc = xp->dtc;
+ 		dn->dtm = xp->dtm;
+ 		if (cmn->multi_dtm)
+-			dn->dtm += arm_cmn_nid(cmn, dn->id).port / 2;
++			dn->dtm += arm_cmn_nid(dn).port / 2;
+ 
+ 		if (dn->type == CMN_TYPE_DTC) {
+ 			int err = arm_cmn_init_dtc(cmn, dn, dtc_idx++);
+@@ -2146,18 +2123,27 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ 		arm_cmn_init_dtm(dtm++, xp, 0);
+ 		/*
+ 		 * Keeping track of connected ports will let us filter out
+-		 * unnecessary XP events easily. We can also reliably infer the
+-		 * "extra device ports" configuration for the node ID format
+-		 * from this, since in that case we will see at least one XP
+-		 * with port 2 connected, for the HN-D.
++		 * unnecessary XP events easily, and also infer the per-XP
++		 * part of the node ID format.
+ 		 */
+ 		for (int p = 0; p < CMN_MAX_PORTS; p++)
+ 			if (arm_cmn_device_connect_info(cmn, xp, p))
+ 				xp_ports |= BIT(p);
+ 
+-		if (cmn->multi_dtm && (xp_ports & 0xc))
++		if (cmn->num_xps == 1) {
++			xp->portid_bits = 3;
++			xp->deviceid_bits = 2;
++		} else if (xp_ports > 0x3) {
++			xp->portid_bits = 2;
++			xp->deviceid_bits = 1;
++		} else {
++			xp->portid_bits = 1;
++			xp->deviceid_bits = 2;
++		}
++
++		if (cmn->multi_dtm && (xp_ports > 0x3))
+ 			arm_cmn_init_dtm(dtm++, xp, 1);
+-		if (cmn->multi_dtm && (xp_ports & 0x30))
++		if (cmn->multi_dtm && (xp_ports > 0xf))
+ 			arm_cmn_init_dtm(dtm++, xp, 2);
+ 
+ 		cmn->ports_used |= xp_ports;
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-arm-cmn-rework-dtc-counters-again.patch b/queue-6.1/perf-arm-cmn-rework-dtc-counters-again.patch
new file mode 100644
index 00000000000..0bacfcd5e4d
--- /dev/null
+++ b/queue-6.1/perf-arm-cmn-rework-dtc-counters-again.patch
@@ -0,0 +1,339 @@
+From ea4e4656e970340200d63f52fe44d00320108742 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 18:51:26 +0100
+Subject: perf/arm-cmn: Rework DTC counters (again)
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 7633ec2c262fab3e7c5bf3cd3876b5748f584a57 ]
+
+The bitmap-based scheme for tracking DTC counter usage turns out to be a
+complete dead-end for its imagined purpose, since by the time we have to
+keep track of a per-DTC counter index anyway, we already have enough
+information to make the bitmap itself redundant. Revert the remains of
+it back to almost the original scheme, but now expanded to track per-DTC
+indices, in preparation for making use of them in anger.
+
+Note that since cycle count events always use a dedicated counter on a
+single DTC, we reuse the field to encode their DTC index directly.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/5f6ade76b47f033836d7a36c03555da896dfb4a3.1697824215.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Stable-dep-of: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 126 +++++++++++++++++++++--------------------
+ 1 file changed, 64 insertions(+), 62 deletions(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 899e4ed49905c..0ab6fe93f5e2b 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -273,16 +273,13 @@ struct arm_cmn_node {
+ 	u16 id, logid;
+ 	enum cmn_node_type type;
+ 
+-	int dtm;
+-	union {
+-		/* DN/HN-F/CXHA */
+-		struct {
+-			u8 val : 4;
+-			u8 count : 4;
+-		} occupid[SEL_MAX];
+-		/* XP */
+-		u8 dtc;
+-	};
++	u8 dtm;
++	s8 dtc;
++	/* DN/HN-F/CXHA */
++	struct {
++		u8 val : 4;
++		u8 count : 4;
++	} occupid[SEL_MAX];
+ 	union {
+ 		u8 event[4];
+ 		__le32 event_sel;
+@@ -532,12 +529,12 @@ static int arm_cmn_map_show(struct seq_file *s, void *data)
+ 
+ 		seq_puts(s, "\n     |");
+ 		for (x = 0; x < cmn->mesh_x; x++) {
+-			u8 dtc = cmn->xps[xp_base + x].dtc;
++			s8 dtc = cmn->xps[xp_base + x].dtc;
+ 
+-			if (dtc & (dtc - 1))
++			if (dtc < 0)
+ 				seq_puts(s, " DTC ?? |");
+ 			else
+-				seq_printf(s, " DTC %ld  |", __ffs(dtc));
++				seq_printf(s, " DTC %d  |", dtc);
+ 		}
+ 		seq_puts(s, "\n     |");
+ 		for (x = 0; x < cmn->mesh_x; x++)
+@@ -581,8 +578,7 @@ static void arm_cmn_debugfs_init(struct arm_cmn *cmn, int id) {}
+ struct arm_cmn_hw_event {
+ 	struct arm_cmn_node *dn;
+ 	u64 dtm_idx[4];
+-	unsigned int dtc_idx;
+-	u8 dtcs_used;
++	s8 dtc_idx[CMN_MAX_DTCS];
+ 	u8 num_dns;
+ 	u8 dtm_offset;
+ 	bool wide_sel;
+@@ -592,6 +588,10 @@ struct arm_cmn_hw_event {
+ #define for_each_hw_dn(hw, dn, i) \
+ 	for (i = 0, dn = hw->dn; i < hw->num_dns; i++, dn++)
+ 
++/* @i is the DTC number, @idx is the counter index on that DTC */
++#define for_each_hw_dtc_idx(hw, i, idx) \
++	for (int i = 0, idx; i < CMN_MAX_DTCS; i++) if ((idx = hw->dtc_idx[i]) >= 0)
++
+ static struct arm_cmn_hw_event *to_cmn_hw(struct perf_event *event)
+ {
+ 	BUILD_BUG_ON(sizeof(struct arm_cmn_hw_event) > offsetof(struct hw_perf_event, target));
+@@ -1311,12 +1311,11 @@ static void arm_cmn_init_counter(struct perf_event *event)
+ {
+ 	struct arm_cmn *cmn = to_cmn(event->pmu);
+ 	struct arm_cmn_hw_event *hw = to_cmn_hw(event);
+-	unsigned int i, pmevcnt = CMN_DT_PMEVCNT(hw->dtc_idx);
+ 	u64 count;
+ 
+-	for (i = 0; hw->dtcs_used & (1U << i); i++) {
+-		writel_relaxed(CMN_COUNTER_INIT, cmn->dtc[i].base + pmevcnt);
+-		cmn->dtc[i].counters[hw->dtc_idx] = event;
++	for_each_hw_dtc_idx(hw, i, idx) {
++		writel_relaxed(CMN_COUNTER_INIT, cmn->dtc[i].base + CMN_DT_PMEVCNT(idx));
++		cmn->dtc[i].counters[idx] = event;
+ 	}
+ 
+ 	count = arm_cmn_read_dtm(cmn, hw, false);
+@@ -1329,11 +1328,9 @@ static void arm_cmn_event_read(struct perf_event *event)
+ 	struct arm_cmn_hw_event *hw = to_cmn_hw(event);
+ 	u64 delta, new, prev;
+ 	unsigned long flags;
+-	unsigned int i;
+ 
+-	if (hw->dtc_idx == CMN_DT_NUM_COUNTERS) {
+-		i = __ffs(hw->dtcs_used);
+-		delta = arm_cmn_read_cc(cmn->dtc + i);
++	if (CMN_EVENT_TYPE(event) == CMN_TYPE_DTC) {
++		delta = arm_cmn_read_cc(cmn->dtc + hw->dtc_idx[0]);
+ 		local64_add(delta, &event->count);
+ 		return;
+ 	}
+@@ -1343,8 +1340,8 @@ static void arm_cmn_event_read(struct perf_event *event)
+ 	delta = new - prev;
+ 
+ 	local_irq_save(flags);
+-	for (i = 0; hw->dtcs_used & (1U << i); i++) {
+-		new = arm_cmn_read_counter(cmn->dtc + i, hw->dtc_idx);
++	for_each_hw_dtc_idx(hw, i, idx) {
++		new = arm_cmn_read_counter(cmn->dtc + i, idx);
+ 		delta += new << 16;
+ 	}
+ 	local_irq_restore(flags);
+@@ -1396,7 +1393,7 @@ static void arm_cmn_event_start(struct perf_event *event, int flags)
+ 	int i;
+ 
+ 	if (type == CMN_TYPE_DTC) {
+-		i = __ffs(hw->dtcs_used);
++		i = hw->dtc_idx[0];
+ 		writeq_relaxed(CMN_CC_INIT, cmn->dtc[i].base + CMN_DT_PMCCNTR);
+ 		cmn->dtc[i].cc_active = true;
+ 	} else if (type == CMN_TYPE_WP) {
+@@ -1427,7 +1424,7 @@ static void arm_cmn_event_stop(struct perf_event *event, int flags)
+ 	int i;
+ 
+ 	if (type == CMN_TYPE_DTC) {
+-		i = __ffs(hw->dtcs_used);
++		i = hw->dtc_idx[0];
+ 		cmn->dtc[i].cc_active = false;
+ 	} else if (type == CMN_TYPE_WP) {
+ 		int wp_idx = arm_cmn_wp_idx(event);
+@@ -1613,12 +1610,19 @@ static int arm_cmn_event_init(struct perf_event *event)
+ 	hw->dn = arm_cmn_node(cmn, type);
+ 	if (!hw->dn)
+ 		return -EINVAL;
++
++	memset(hw->dtc_idx, -1, sizeof(hw->dtc_idx));
+ 	for (dn = hw->dn; dn->type == type; dn++) {
+ 		if (bynodeid && dn->id != nodeid) {
+ 			hw->dn++;
+ 			continue;
+ 		}
+ 		hw->num_dns++;
++		if (dn->dtc < 0)
++			memset(hw->dtc_idx, 0, cmn->num_dtcs);
++		else
++			hw->dtc_idx[dn->dtc] = 0;
++
+ 		if (bynodeid)
+ 			break;
+ 	}
+@@ -1630,12 +1634,6 @@ static int arm_cmn_event_init(struct perf_event *event)
+ 			nodeid, nid.x, nid.y, nid.port, nid.dev, type);
+ 		return -EINVAL;
+ 	}
+-	/*
+-	 * Keep assuming non-cycles events count in all DTC domains; turns out
+-	 * it's hard to make a worthwhile optimisation around this, short of
+-	 * going all-in with domain-local counter allocation as well.
+-	 */
+-	hw->dtcs_used = (1U << cmn->num_dtcs) - 1;
+ 
+ 	return arm_cmn_validate_group(cmn, event);
+ }
+@@ -1661,28 +1659,25 @@ static void arm_cmn_event_clear(struct arm_cmn *cmn, struct perf_event *event,
+ 	}
+ 	memset(hw->dtm_idx, 0, sizeof(hw->dtm_idx));
+ 
+-	for (i = 0; hw->dtcs_used & (1U << i); i++)
+-		cmn->dtc[i].counters[hw->dtc_idx] = NULL;
++	for_each_hw_dtc_idx(hw, j, idx)
++		cmn->dtc[j].counters[idx] = NULL;
+ }
+ 
+ static int arm_cmn_event_add(struct perf_event *event, int flags)
+ {
+ 	struct arm_cmn *cmn = to_cmn(event->pmu);
+ 	struct arm_cmn_hw_event *hw = to_cmn_hw(event);
+-	struct arm_cmn_dtc *dtc = &cmn->dtc[0];
+ 	struct arm_cmn_node *dn;
+ 	enum cmn_node_type type = CMN_EVENT_TYPE(event);
+-	unsigned int i, dtc_idx, input_sel;
++	unsigned int input_sel, i = 0;
+ 
+ 	if (type == CMN_TYPE_DTC) {
+-		i = 0;
+ 		while (cmn->dtc[i].cycles)
+ 			if (++i == cmn->num_dtcs)
+ 				return -ENOSPC;
+ 
+ 		cmn->dtc[i].cycles = event;
+-		hw->dtc_idx = CMN_DT_NUM_COUNTERS;
+-		hw->dtcs_used = 1U << i;
++		hw->dtc_idx[0] = i;
+ 
+ 		if (flags & PERF_EF_START)
+ 			arm_cmn_event_start(event, 0);
+@@ -1690,17 +1685,22 @@ static int arm_cmn_event_add(struct perf_event *event, int flags)
+ 	}
+ 
+ 	/* Grab a free global counter first... */
+-	dtc_idx = 0;
+-	while (dtc->counters[dtc_idx])
+-		if (++dtc_idx == CMN_DT_NUM_COUNTERS)
+-			return -ENOSPC;
+-
+-	hw->dtc_idx = dtc_idx;
++	for_each_hw_dtc_idx(hw, j, idx) {
++		if (j > 0) {
++			idx = hw->dtc_idx[0];
++		} else {
++			idx = 0;
++			while (cmn->dtc[j].counters[idx])
++				if (++idx == CMN_DT_NUM_COUNTERS)
++					goto free_dtms;
++		}
++		hw->dtc_idx[j] = idx;
++	}
+ 
+ 	/* ...then the local counters to feed it. */
+ 	for_each_hw_dn(hw, dn, i) {
+ 		struct arm_cmn_dtm *dtm = &cmn->dtms[dn->dtm] + hw->dtm_offset;
+-		unsigned int dtm_idx, shift;
++		unsigned int dtm_idx, shift, d = 0;
+ 		u64 reg;
+ 
+ 		dtm_idx = 0;
+@@ -1719,11 +1719,11 @@ static int arm_cmn_event_add(struct perf_event *event, int flags)
+ 
+ 			tmp = dtm->wp_event[wp_idx ^ 1];
+ 			if (tmp >= 0 && CMN_EVENT_WP_COMBINE(event) !=
+-					CMN_EVENT_WP_COMBINE(dtc->counters[tmp]))
++					CMN_EVENT_WP_COMBINE(cmn->dtc[d].counters[tmp]))
+ 				goto free_dtms;
+ 
+ 			input_sel = CMN__PMEVCNT0_INPUT_SEL_WP + wp_idx;
+-			dtm->wp_event[wp_idx] = dtc_idx;
++			dtm->wp_event[wp_idx] = hw->dtc_idx[d];
+ 			writel_relaxed(cfg, dtm->base + CMN_DTM_WPn_CONFIG(wp_idx));
+ 		} else {
+ 			struct arm_cmn_nodeid nid = arm_cmn_nid(cmn, dn->id);
+@@ -1743,7 +1743,7 @@ static int arm_cmn_event_add(struct perf_event *event, int flags)
+ 		dtm->input_sel[dtm_idx] = input_sel;
+ 		shift = CMN__PMEVCNTn_GLOBAL_NUM_SHIFT(dtm_idx);
+ 		dtm->pmu_config_low &= ~(CMN__PMEVCNT0_GLOBAL_NUM << shift);
+-		dtm->pmu_config_low |= FIELD_PREP(CMN__PMEVCNT0_GLOBAL_NUM, dtc_idx) << shift;
++		dtm->pmu_config_low |= FIELD_PREP(CMN__PMEVCNT0_GLOBAL_NUM, hw->dtc_idx[d]) << shift;
+ 		dtm->pmu_config_low |= CMN__PMEVCNT_PAIRED(dtm_idx);
+ 		reg = (u64)le32_to_cpu(dtm->pmu_config_high) << 32 | dtm->pmu_config_low;
+ 		writeq_relaxed(reg, dtm->base + CMN_DTM_PMU_CONFIG);
+@@ -1771,7 +1771,7 @@ static void arm_cmn_event_del(struct perf_event *event, int flags)
+ 	arm_cmn_event_stop(event, PERF_EF_UPDATE);
+ 
+ 	if (type == CMN_TYPE_DTC)
+-		cmn->dtc[__ffs(hw->dtcs_used)].cycles = NULL;
++		cmn->dtc[hw->dtc_idx[0]].cycles = NULL;
+ 	else
+ 		arm_cmn_event_clear(cmn, event, hw->num_dns);
+ }
+@@ -1951,7 +1951,6 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
+ {
+ 	struct arm_cmn_node *dn, *xp;
+ 	int dtc_idx = 0;
+-	u8 dtcs_present = (1 << cmn->num_dtcs) - 1;
+ 
+ 	cmn->dtc = devm_kcalloc(cmn->dev, cmn->num_dtcs, sizeof(cmn->dtc[0]), GFP_KERNEL);
+ 	if (!cmn->dtc)
+@@ -1961,23 +1960,26 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn)
+ 
+ 	cmn->xps = arm_cmn_node(cmn, CMN_TYPE_XP);
+ 
++	if (cmn->part == PART_CMN600 && cmn->num_dtcs > 1) {
++		/* We do at least know that a DTC's XP must be in that DTC's domain */
++		dn = arm_cmn_node(cmn, CMN_TYPE_DTC);
++		for (int i = 0; i < cmn->num_dtcs; i++)
++			arm_cmn_node_to_xp(cmn, dn + i)->dtc = i;
++	}
++
+ 	for (dn = cmn->dns; dn->type; dn++) {
+-		if (dn->type == CMN_TYPE_XP) {
+-			dn->dtc &= dtcs_present;
++		if (dn->type == CMN_TYPE_XP)
+ 			continue;
+-		}
+ 
+ 		xp = arm_cmn_node_to_xp(cmn, dn);
++		dn->dtc = xp->dtc;
+ 		dn->dtm = xp->dtm;
+ 		if (cmn->multi_dtm)
+ 			dn->dtm += arm_cmn_nid(cmn, dn->id).port / 2;
+ 
+ 		if (dn->type == CMN_TYPE_DTC) {
+-			int err;
+-			/* We do at least know that a DTC's XP must be in that DTC's domain */
+-			if (xp->dtc == 0xf)
+-				xp->dtc = 1 << dtc_idx;
+-			err = arm_cmn_init_dtc(cmn, dn, dtc_idx++);
++			int err = arm_cmn_init_dtc(cmn, dn, dtc_idx++);
++
+ 			if (err)
+ 				return err;
+ 		}
+@@ -2135,9 +2137,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
+ 			cmn->mesh_x = xp->logid;
+ 
+ 		if (cmn->part == PART_CMN600)
+-			xp->dtc = 0xf;
++			xp->dtc = -1;
+ 		else
+-			xp->dtc = 1 << arm_cmn_dtc_domain(cmn, xp_region);
++			xp->dtc = arm_cmn_dtc_domain(cmn, xp_region);
+ 
+ 		xp->dtm = dtm - cmn->dtms;
+ 		arm_cmn_init_dtm(dtm++, xp, 0);
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-inject-fix-leader-sampling-inserting-additional.patch b/queue-6.1/perf-inject-fix-leader-sampling-inserting-additional.patch
new file mode 100644
index 00000000000..b30522386ef
--- /dev/null
+++ b/queue-6.1/perf-inject-fix-leader-sampling-inserting-additional.patch
@@ -0,0 +1,129 @@
+From 74d862894ba16b6e1c2fb89fd1ffc58773e36424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 15:06:20 -0700
+Subject: perf inject: Fix leader sampling inserting additional samples
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 79bcd34e0f3da39fda841406ccc957405e724852 ]
+
+The processing of leader samples would turn an individual sample with
+a group of read values into multiple samples. 'perf inject' would pass
+through the additional samples increasing the output data file size:
+
+  $ perf record -g -e "{instructions,cycles}:S" -o perf.orig.data true
+  $ perf script -D -i perf.orig.data | sed -e 's/perf.orig.data/perf.data/g' > orig.txt
+  $ perf inject -i perf.orig.data -o perf.new.data
+  $ perf script -D -i perf.new.data | sed -e 's/perf.new.data/perf.data/g' > new.txt
+  $ diff -u orig.txt new.txt
+  --- orig.txt    2024-07-29 14:29:40.606576769 -0700
+  +++ new.txt     2024-07-29 14:30:04.142737434 -0700
+  ...
+  -0xc550@perf.data [0x30]: event: 3
+  +0xc550@perf.data [0xd0]: event: 9
+  +.
+  +. ... raw event: size 208 bytes
+  +.  0000:  09 00 00 00 01 00 d0 00 fc 72 01 86 ff ff ff ff  .........r......
+  +.  0010:  74 7d 2c 00 74 7d 2c 00 fb c3 79 f9 ba d5 05 00  t},.t},...y.....
+  +.  0020:  e6 cb 1a 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
+  +.  0030:  02 00 00 00 00 00 00 00 76 01 00 00 00 00 00 00  ........v.......
+  +.  0040:  e6 cb 1a 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  +.  0050:  62 18 00 00 00 00 00 00 f6 cb 1a 00 00 00 00 00  b...............
+  +.  0060:  00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00  ................
+  +.  0070:  80 ff ff ff ff ff ff ff fc 72 01 86 ff ff ff ff  .........r......
+  +.  0080:  f3 0e 6e 85 ff ff ff ff 0c cb 7f 85 ff ff ff ff  ..n.............
+  +.  0090:  bc f2 87 85 ff ff ff ff 44 af 7f 85 ff ff ff ff  ........D.......
+  +.  00a0:  bd be 7f 85 ff ff ff ff 26 d0 7f 85 ff ff ff ff  ........&.......
+  +.  00b0:  6d a4 ff 85 ff ff ff ff ea 00 20 86 ff ff ff ff  m......... .....
+  +.  00c0:  00 fe ff ff ff ff ff ff 57 14 4f 43 fc 7e 00 00  ........W.OC.~..
+  +
+  +1642373909693435 0xc550 [0xd0]: PERF_RECORD_SAMPLE(IP, 0x1): 2915700/2915700: 0xffffffff860172fc period: 1 addr: 0
+  +... FP chain: nr:12
+  +.....  0: ffffffffffffff80
+  +.....  1: ffffffff860172fc
+  +.....  2: ffffffff856e0ef3
+  +.....  3: ffffffff857fcb0c
+  +.....  4: ffffffff8587f2bc
+  +.....  5: ffffffff857faf44
+  +.....  6: ffffffff857fbebd
+  +.....  7: ffffffff857fd026
+  +.....  8: ffffffff85ffa46d
+  +.....  9: ffffffff862000ea
+  +..... 10: fffffffffffffe00
+  +..... 11: 00007efc434f1457
+  +... sample_read:
+  +.... group nr 2
+  +..... id 00000000001acbe6, value 0000000000000176, lost 0
+  +..... id 00000000001acbf6, value 0000000000001862, lost 0
+  +
+  +0xc620@perf.data [0x30]: event: 3
+  ...
+
+This behavior is incorrect as in the case above 'perf inject' should
+have done nothing. Fix this behavior by disabling separating samples
+for a tool that requests it. Only request this for `perf inject` so as
+to not affect other perf tools. With the patch and the test above
+there are no differences between the orig.txt and new.txt.
+
+Fixes: e4caec0d1af3d608 ("perf evsel: Add PERF_SAMPLE_READ sample related processing")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20240729220620.2957754-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-inject.c | 1 +
+ tools/perf/util/session.c   | 3 +++
+ tools/perf/util/tool.h      | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
+index 333d8941ce4de..bcd510d9b4345 100644
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -2173,6 +2173,7 @@ int cmd_inject(int argc, const char **argv)
+ 			.finished_init	= perf_event__repipe_op2_synth,
+ 			.compressed	= perf_event__repipe_op4_synth,
+ 			.auxtrace	= perf_event__repipe_auxtrace,
++			.dont_split_sample_group = true,
+ 		},
+ 		.input_name  = "-",
+ 		.samples = LIST_HEAD_INIT(inject.samples),
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 1a4f10de29ffe..c8f7634f9846c 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1497,6 +1497,9 @@ static int deliver_sample_group(struct evlist *evlist,
+ 	int ret = -EINVAL;
+ 	struct sample_read_value *v = sample->read.group.values;
+ 
++	if (tool->dont_split_sample_group)
++		return deliver_sample_value(evlist, tool, event, sample, v, machine);
++
+ 	sample_read_group__for_each(v, sample->read.group.nr, read_format) {
+ 		ret = deliver_sample_value(evlist, tool, event, sample, v,
+ 					   machine);
+diff --git a/tools/perf/util/tool.h b/tools/perf/util/tool.h
+index c957fb849ac63..62bbc9cec151b 100644
+--- a/tools/perf/util/tool.h
++++ b/tools/perf/util/tool.h
+@@ -85,6 +85,7 @@ struct perf_tool {
+ 	bool		namespace_events;
+ 	bool		cgroup_events;
+ 	bool		no_warn;
++	bool		dont_split_sample_group;
+ 	enum show_feature_header show_feat_hdr;
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-mem-free-the-allocated-sort-string-fixing-a-lea.patch b/queue-6.1/perf-mem-free-the-allocated-sort-string-fixing-a-lea.patch
new file mode 100644
index 00000000000..ce08c06f353
--- /dev/null
+++ b/queue-6.1/perf-mem-free-the-allocated-sort-string-fixing-a-lea.patch
@@ -0,0 +1,45 @@
+From 8927866e4c430e32fb218f66e5dba029c3a9ea0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2024 16:55:01 -0700
+Subject: perf mem: Free the allocated sort string, fixing a leak
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 3da209bb1177462b6fe8e3021a5527a5a49a9336 ]
+
+The get_sort_order() returns either a new string (from strdup) or NULL
+but it never gets freed.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Fixes: 2e7f545096f954a9 ("perf mem: Factor out a function to generate sort order")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/r/20240731235505.710436-3-namhyung@kernel.org
+[ Added Fixes tag ]
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-mem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
+index 923fb8316fdae..fbd05617c2ddd 100644
+--- a/tools/perf/builtin-mem.c
++++ b/tools/perf/builtin-mem.c
+@@ -368,6 +368,7 @@ static int report_events(int argc, const char **argv, struct perf_mem *mem)
+ 		rep_argv[i] = argv[j];
+ 
+ 	ret = cmd_report(i, rep_argv);
++	free(new_sort_order);
+ 	free(rep_argv);
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-sched-timehist-fix-missing-free-of-session-in-p.patch b/queue-6.1/perf-sched-timehist-fix-missing-free-of-session-in-p.patch
new file mode 100644
index 00000000000..7240a7735d9
--- /dev/null
+++ b/queue-6.1/perf-sched-timehist-fix-missing-free-of-session-in-p.patch
@@ -0,0 +1,49 @@
+From 8becc41e24fceb764e04ff7f5d9f30adcdca5b39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 10:35:33 +0800
+Subject: perf sched timehist: Fix missing free of session in
+ perf_sched__timehist()
+
+From: Yang Jihong <yangjihong@bytedance.com>
+
+[ Upstream commit 6bdf5168b6fb19541b0c1862bdaa596d116c7bfb ]
+
+When perf_time__parse_str() fails in perf_sched__timehist(),
+need to free session that was previously created, fix it.
+
+Fixes: 853b74071110bed3 ("perf sched timehist: Add option to specify time window of interest")
+Signed-off-by: Yang Jihong <yangjihong@bytedance.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsa@cumulusnetworks.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20240806023533.1316348-1-yangjihong@bytedance.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index f93737eef07ba..22d781c1acd43 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3056,7 +3056,8 @@ static int perf_sched__timehist(struct perf_sched *sched)
+ 
+ 	if (perf_time__parse_str(&sched->ptime, sched->time_str) != 0) {
+ 		pr_err("Invalid time string\n");
+-		return -EINVAL;
++		err = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	if (timehist_check_attr(sched, evlist) != 0)
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-sched-timehist-fixed-timestamp-error-when-unabl.patch b/queue-6.1/perf-sched-timehist-fixed-timestamp-error-when-unabl.patch
new file mode 100644
index 00000000000..61c6bf9fd55
--- /dev/null
+++ b/queue-6.1/perf-sched-timehist-fixed-timestamp-error-when-unabl.patch
@@ -0,0 +1,99 @@
+From e28307b96a21e313301d1335aa9e3b5ee9014dc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 10:47:20 +0800
+Subject: perf sched timehist: Fixed timestamp error when unable to confirm
+ event sched_in time
+
+From: Yang Jihong <yangjihong@bytedance.com>
+
+[ Upstream commit 39c243411bdb8fb35777adf49ee32549633c4e12 ]
+
+If sched_in event for current task is not recorded, sched_in timestamp
+will be set to end_time of time window interest, causing an error in
+timestamp show. In this case, we choose to ignore this event.
+
+Test scenario:
+
+  perf[1229608] does not record the first sched_in event, run time and sch delay are both 0
+
+  # perf sched timehist
+  Samples of sched_switch event do not have callchains.
+             time    cpu  task name                       wait time  sch delay   run time
+                          [tid/pid]                          (msec)     (msec)     (msec)
+  --------------- ------  ------------------------------  ---------  ---------  ---------
+   2090450.763231 [0000]  perf[1229608]                       0.000      0.000      0.000
+   2090450.763235 [0000]  migration/0[15]                     0.000      0.001      0.003
+   2090450.763263 [0001]  perf[1229608]                       0.000      0.000      0.000
+   2090450.763268 [0001]  migration/1[21]                     0.000      0.001      0.004
+   2090450.763302 [0002]  perf[1229608]                       0.000      0.000      0.000
+   2090450.763309 [0002]  migration/2[27]                     0.000      0.001      0.007
+   2090450.763338 [0003]  perf[1229608]                       0.000      0.000      0.000
+   2090450.763343 [0003]  migration/3[33]                     0.000      0.001      0.004
+
+Before:
+
+  arbitrarily specify a time window of interest, timestamp will be set to an incorrect value
+
+  # perf sched timehist --time 100,200
+  Samples of sched_switch event do not have callchains.
+             time    cpu  task name                       wait time  sch delay   run time
+                          [tid/pid]                          (msec)     (msec)     (msec)
+  --------------- ------  ------------------------------  ---------  ---------  ---------
+       200.000000 [0000]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0001]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0002]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0003]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0004]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0005]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0006]  perf[1229608]                       0.000      0.000      0.000
+       200.000000 [0007]  perf[1229608]                       0.000      0.000      0.000
+
+ After:
+
+  # perf sched timehist --time 100,200
+  Samples of sched_switch event do not have callchains.
+             time    cpu  task name                       wait time  sch delay   run time
+                          [tid/pid]                          (msec)     (msec)     (msec)
+  --------------- ------  ------------------------------  ---------  ---------  ---------
+
+Fixes: 853b74071110bed3 ("perf sched timehist: Add option to specify time window of interest")
+Signed-off-by: Yang Jihong <yangjihong@bytedance.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsa@cumulusnetworks.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20240819024720.2405244-1-yangjihong@bytedance.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 22d781c1acd43..d83a7569db0e2 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -2604,9 +2604,12 @@ static int timehist_sched_change_event(struct perf_tool *tool,
+ 	 * - previous sched event is out of window - we are done
+ 	 * - sample time is beyond window user cares about - reset it
+ 	 *   to close out stats for time window interest
++	 * - If tprev is 0, that is, sched_in event for current task is
++	 *   not recorded, cannot determine whether sched_in event is
++	 *   within time window interest - ignore it
+ 	 */
+ 	if (ptime->end) {
+-		if (tprev > ptime->end)
++		if (!tprev || tprev > ptime->end)
+ 			goto out;
+ 
+ 		if (t > ptime->end)
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-stat-display-iostat-headers-correctly.patch b/queue-6.1/perf-stat-display-iostat-headers-correctly.patch
new file mode 100644
index 00000000000..8a09816e7dd
--- /dev/null
+++ b/queue-6.1/perf-stat-display-iostat-headers-correctly.patch
@@ -0,0 +1,66 @@
+From d857ae4c48c1a36a0f3239122ce9653600f61490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2024 14:58:00 +0800
+Subject: perf stat: Display iostat headers correctly
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 2615639352420e6e3115952c5b8f46846e1c6d0e ]
+
+Currently we'll only print metric headers for metric leader in
+aggregration mode. This will make `perf iostat` header not shown
+since it'll aggregrated globally but don't have metric events:
+
+  root@ubuntu204:/home/yang/linux/tools/perf# ./perf stat --iostat --timeout 1000
+   Performance counter stats for 'system wide':
+      port
+  0000:00                    0                    0                    0                    0
+  0000:80                    0                    0                    0                    0
+  [...]
+
+Fix this by excluding the iostat in the check of printing metric
+headers. Then we can see the headers:
+
+  root@ubuntu204:/home/yang/linux/tools/perf# ./perf stat --iostat --timeout 1000
+   Performance counter stats for 'system wide':
+      port             Inbound Read(MB)    Inbound Write(MB)    Outbound Read(MB)   Outbound Write(MB)
+  0000:00                    0                    0                    0                    0
+  0000:80                    0                    0                    0                    0
+  [...]
+
+Fixes: 193a9e30207f5477 ("perf stat: Don't display metric header for non-leader uncore events")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jonathan Cameron <jonathan.cameron@huawei.com>
+Cc: Junhao He <hejunhao3@huawei.com>
+Cc: linuxarm@huawei.com
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Shameerali Kolothum Thodi <shameerali.kolothum.thodi@huawei.com>
+Cc: Zeng Tao <prime.zeng@hisilicon.com>
+Link: https://lore.kernel.org/r/20240802065800.48774-1-yangyicong@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-display.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 9053db0dc00a1..3e94159ea96cc 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -1162,7 +1162,8 @@ static void print_metric_headers(struct perf_stat_config *config,
+ 
+ 	/* Print metrics headers only */
+ 	evlist__for_each_entry(evlist, counter) {
+-		if (config->aggr_mode != AGGR_NONE && counter->metric_leader != counter)
++		if (!config->iostat_run &&
++		    config->aggr_mode != AGGR_NONE && counter->metric_leader != counter)
+ 			continue;
+ 
+ 		os.evsel = counter;
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-time-utils-fix-32-bit-nsec-parsing.patch b/queue-6.1/perf-time-utils-fix-32-bit-nsec-parsing.patch
new file mode 100644
index 00000000000..8574c8544a8
--- /dev/null
+++ b/queue-6.1/perf-time-utils-fix-32-bit-nsec-parsing.patch
@@ -0,0 +1,70 @@
+From a818fda3566af156ee34145dc0253dc6455db38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2024 00:04:11 -0700
+Subject: perf time-utils: Fix 32-bit nsec parsing
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 38e2648a81204c9fc5b4c87a8ffce93a6ed91b65 ]
+
+The "time utils" test fails in 32-bit builds:
+  ...
+  parse_nsec_time("18446744073.709551615")
+  Failed. ptime 4294967295709551615 expected 18446744073709551615
+  ...
+
+Switch strtoul to strtoull as an unsigned long in 32-bit build isn't
+64-bits.
+
+Fixes: c284d669a20d408b ("perf tools: Move parse_nsec_time to time-utils.c")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Chaitanya S Prakash <chaitanyas.prakash@arm.com>
+Cc: Colin Ian King <colin.i.king@gmail.com>
+Cc: David Ahern <dsa@cumulusnetworks.com>
+Cc: Dominique Martinet <asmadeus@codewreck.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Junhao He <hejunhao3@huawei.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Yang Jihong <yangjihong@bytedance.com>
+Link: https://lore.kernel.org/r/20240831070415.506194-3-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/time-utils.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/time-utils.c b/tools/perf/util/time-utils.c
+index 3024439216816..1b91ccd4d5234 100644
+--- a/tools/perf/util/time-utils.c
++++ b/tools/perf/util/time-utils.c
+@@ -20,7 +20,7 @@ int parse_nsec_time(const char *str, u64 *ptime)
+ 	u64 time_sec, time_nsec;
+ 	char *end;
+ 
+-	time_sec = strtoul(str, &end, 10);
++	time_sec = strtoull(str, &end, 10);
+ 	if (*end != '.' && *end != '\0')
+ 		return -1;
+ 
+@@ -38,7 +38,7 @@ int parse_nsec_time(const char *str, u64 *ptime)
+ 		for (i = strlen(nsec_buf); i < 9; i++)
+ 			nsec_buf[i] = '0';
+ 
+-		time_nsec = strtoul(nsec_buf, &end, 10);
++		time_nsec = strtoull(nsec_buf, &end, 10);
+ 		if (*end != '\0')
+ 			return -1;
+ 	} else
+-- 
+2.43.0
+
diff --git a/queue-6.1/pinctrl-mvebu-fix-devinit_dove_pinctrl_probe-functio.patch b/queue-6.1/pinctrl-mvebu-fix-devinit_dove_pinctrl_probe-functio.patch
new file mode 100644
index 00000000000..8d55bca6c27
--- /dev/null
+++ b/queue-6.1/pinctrl-mvebu-fix-devinit_dove_pinctrl_probe-functio.patch
@@ -0,0 +1,119 @@
+From 3e3aa9dd33dfa55b957fde601717c18266edb980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 14:48:23 +0800
+Subject: pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
+
+From: Wang Jianzheng <wangjianzheng@vivo.com>
+
+[ Upstream commit c25478419f6fd3f74c324a21ec007cf14f2688d7 ]
+
+When an error occurs during the execution of the function
+__devinit_dove_pinctrl_probe, the clk is not properly disabled.
+
+Fix this by calling clk_disable_unprepare before return.
+
+Fixes: ba607b6238a1 ("pinctrl: mvebu: make pdma clock on dove mandatory")
+Signed-off-by: Wang Jianzheng <wangjianzheng@vivo.com>
+Link: https://lore.kernel.org/20240829064823.19808-1-wangjianzheng@vivo.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-dove.c | 42 +++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
+index bd74daa9ed666..c84326dfe371c 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
++++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
+@@ -769,7 +769,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 		of_match_device(dove_pinctrl_of_match, &pdev->dev);
+ 	struct mvebu_mpp_ctrl_data *mpp_data;
+ 	void __iomem *base;
+-	int i;
++	int i, ret;
+ 
+ 	pdev->dev.platform_data = (void *)match->data;
+ 
+@@ -785,13 +785,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 	clk_prepare_enable(clk);
+ 
+ 	base = devm_platform_get_and_ioremap_resource(pdev, 0, &mpp_res);
+-	if (IS_ERR(base))
+-		return PTR_ERR(base);
++	if (IS_ERR(base)) {
++		ret = PTR_ERR(base);
++		goto err_probe;
++	}
+ 
+ 	mpp_data = devm_kcalloc(&pdev->dev, dove_pinctrl_info.ncontrols,
+ 				sizeof(*mpp_data), GFP_KERNEL);
+-	if (!mpp_data)
+-		return -ENOMEM;
++	if (!mpp_data) {
++		ret = -ENOMEM;
++		goto err_probe;
++	}
+ 
+ 	dove_pinctrl_info.control_data = mpp_data;
+ 	for (i = 0; i < ARRAY_SIZE(dove_mpp_controls); i++)
+@@ -810,8 +814,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	mpp4_base = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(mpp4_base))
+-		return PTR_ERR(mpp4_base);
++	if (IS_ERR(mpp4_base)) {
++		ret = PTR_ERR(mpp4_base);
++		goto err_probe;
++	}
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+ 	if (!res) {
+@@ -822,8 +828,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	pmu_base = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(pmu_base))
+-		return PTR_ERR(pmu_base);
++	if (IS_ERR(pmu_base)) {
++		ret = PTR_ERR(pmu_base);
++		goto err_probe;
++	}
+ 
+ 	gconfmap = syscon_regmap_lookup_by_compatible("marvell,dove-global-config");
+ 	if (IS_ERR(gconfmap)) {
+@@ -833,12 +841,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 		adjust_resource(&fb_res,
+ 			(mpp_res->start & INT_REGS_MASK) + GC_REGS_OFFS, 0x14);
+ 		gc_base = devm_ioremap_resource(&pdev->dev, &fb_res);
+-		if (IS_ERR(gc_base))
+-			return PTR_ERR(gc_base);
++		if (IS_ERR(gc_base)) {
++			ret = PTR_ERR(gc_base);
++			goto err_probe;
++		}
++
+ 		gconfmap = devm_regmap_init_mmio(&pdev->dev,
+ 						 gc_base, &gc_regmap_config);
+-		if (IS_ERR(gconfmap))
+-			return PTR_ERR(gconfmap);
++		if (IS_ERR(gconfmap)) {
++			ret = PTR_ERR(gconfmap);
++			goto err_probe;
++		}
+ 	}
+ 
+ 	/* Warn on any missing DT resource */
+@@ -846,6 +859,9 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 		dev_warn(&pdev->dev, FW_BUG "Missing pinctrl regs in DTB. Please update your firmware.\n");
+ 
+ 	return mvebu_pinctrl_probe(pdev);
++err_probe:
++	clk_disable_unprepare(clk);
++	return ret;
+ }
+ 
+ static struct platform_driver dove_pinctrl_driver = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/pinctrl-mvebu-use-devm_platform_get_and_ioremap_reso.patch b/queue-6.1/pinctrl-mvebu-use-devm_platform_get_and_ioremap_reso.patch
new file mode 100644
index 00000000000..66c7dd52f74
--- /dev/null
+++ b/queue-6.1/pinctrl-mvebu-use-devm_platform_get_and_ioremap_reso.patch
@@ -0,0 +1,39 @@
+From afce0b8982b60a47c8aec1335897030c9f1d3480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 20:47:40 +0800
+Subject: pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 2d357f25663ddfef47ffe26da21155302153d168 ]
+
+Convert platform_get_resource(), devm_ioremap_resource() to a single
+call to devm_platform_get_and_ioremap_resource(), as this is exactly
+what this function does.
+
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Link: https://lore.kernel.org/r/20230704124742.9596-2-frank.li@vivo.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Stable-dep-of: c25478419f6f ("pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-dove.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
+index 545486d98532d..bd74daa9ed666 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
++++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
+@@ -784,8 +784,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
+ 	}
+ 	clk_prepare_enable(clk);
+ 
+-	mpp_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	base = devm_ioremap_resource(&pdev->dev, mpp_res);
++	base = devm_platform_get_and_ioremap_resource(pdev, 0, &mpp_res);
+ 	if (IS_ERR(base))
+ 		return PTR_ERR(base);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/pinctrl-single-fix-missing-error-code-in-pcs_probe.patch b/queue-6.1/pinctrl-single-fix-missing-error-code-in-pcs_probe.patch
new file mode 100644
index 00000000000..0418531cf6b
--- /dev/null
+++ b/queue-6.1/pinctrl-single-fix-missing-error-code-in-pcs_probe.patch
@@ -0,0 +1,37 @@
+From 21bf47068bdf7fbb58bcf42e799ec999523e2b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 10:46:25 +0800
+Subject: pinctrl: single: fix missing error code in pcs_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit cacd8cf79d7823b07619865e994a7916fcc8ae91 ]
+
+If pinctrl_enable() fails in pcs_probe(), it should return the error code.
+
+Fixes: 8f773bfbdd42 ("pinctrl: single: fix possible memory leak when pinctrl_enable() fails")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/20240819024625.154441-1-yangyingliang@huaweicloud.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-single.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index d32d5c5e99bcd..28f3fabc72e30 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -1919,7 +1919,8 @@ static int pcs_probe(struct platform_device *pdev)
+ 
+ 	dev_info(pcs->dev, "%i pins, size %u\n", pcs->desc.npins, pcs->size);
+ 
+-	if (pinctrl_enable(pcs->pctl))
++	ret = pinctrl_enable(pcs->pctl);
++	if (ret)
+ 		goto free;
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/pmdomain-core-harden-inter-column-space-in-debug-sum.patch b/queue-6.1/pmdomain-core-harden-inter-column-space-in-debug-sum.patch
new file mode 100644
index 00000000000..e7a4872a051
--- /dev/null
+++ b/queue-6.1/pmdomain-core-harden-inter-column-space-in-debug-sum.patch
@@ -0,0 +1,38 @@
+From caeeb31304a72a8d831a19568f5e2c5ce095cdb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 16:30:45 +0200
+Subject: pmdomain: core: Harden inter-column space in debug summary
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 692c20c4d075bd452acfbbc68200fc226c7c9496 ]
+
+The inter-column space in the debug summary is two spaces.  However, in
+one case, the extra space is handled implicitly in a field width
+specifier.  Make inter-column space explicit to ease future maintenance.
+
+Fixes: 45fbc464b047 ("PM: domains: Add "performance" column to debug summary")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/ae61eb363621b981edde878e1e74d701702a579f.1725459707.git.geert+renesas@glider.be
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index d238b47f74c34..e01bb359034b7 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -3119,7 +3119,7 @@ static int genpd_summary_one(struct seq_file *s,
+ 	else
+ 		snprintf(state, sizeof(state), "%s",
+ 			 status_lookup[genpd->status]);
+-	seq_printf(s, "%-30s  %-50s %u", genpd->name, state, genpd->performance_state);
++	seq_printf(s, "%-30s  %-49s  %u", genpd->name, state, genpd->performance_state);
+ 
+ 	/*
+ 	 * Modifications on the list require holding locks on both
+-- 
+2.43.0
+
diff --git a/queue-6.1/power-supply-axp20x_battery-remove-design-from-min-a.patch b/queue-6.1/power-supply-axp20x_battery-remove-design-from-min-a.patch
new file mode 100644
index 00000000000..6a65d9d7392
--- /dev/null
+++ b/queue-6.1/power-supply-axp20x_battery-remove-design-from-min-a.patch
@@ -0,0 +1,82 @@
+From 0ef2d8e4c7fafc35e337783eb6a4aa6993c58a7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 16:54:43 -0500
+Subject: power: supply: axp20x_battery: Remove design from min and max voltage
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 61978807b00f8a1817b0e5580981af1cd2f428a5 ]
+
+The POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN and
+POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN values should be immutable
+properties of the battery, but for this driver they are writable values
+and used as the minimum and maximum values for charging. Remove the
+DESIGN designation from these values.
+
+Fixes: 46c202b5f25f ("power: supply: add battery driver for AXP20X and AXP22X PMICs")
+Suggested-by: Chen-Yu Tsai <wens@kernel.org>
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240821215456.962564-3-macroalpha82@gmail.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp20x_battery.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c
+index 9106077c0dbb4..04d6024defb52 100644
+--- a/drivers/power/supply/axp20x_battery.c
++++ b/drivers/power/supply/axp20x_battery.c
+@@ -304,11 +304,11 @@ static int axp20x_battery_get_prop(struct power_supply *psy,
+ 		val->intval = reg & AXP209_FG_PERCENT;
+ 		break;
+ 
+-	case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
++	case POWER_SUPPLY_PROP_VOLTAGE_MAX:
+ 		return axp20x_batt->data->get_max_voltage(axp20x_batt,
+ 							  &val->intval);
+ 
+-	case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN:
++	case POWER_SUPPLY_PROP_VOLTAGE_MIN:
+ 		ret = regmap_read(axp20x_batt->regmap, AXP20X_V_OFF, &reg);
+ 		if (ret)
+ 			return ret;
+@@ -456,10 +456,10 @@ static int axp20x_battery_set_prop(struct power_supply *psy,
+ 	struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy);
+ 
+ 	switch (psp) {
+-	case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN:
++	case POWER_SUPPLY_PROP_VOLTAGE_MIN:
+ 		return axp20x_set_voltage_min_design(axp20x_batt, val->intval);
+ 
+-	case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
++	case POWER_SUPPLY_PROP_VOLTAGE_MAX:
+ 		return axp20x_batt->data->set_max_voltage(axp20x_batt, val->intval);
+ 
+ 	case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
+@@ -494,8 +494,8 @@ static enum power_supply_property axp20x_battery_props[] = {
+ 	POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT,
+ 	POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX,
+ 	POWER_SUPPLY_PROP_HEALTH,
+-	POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN,
+-	POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
++	POWER_SUPPLY_PROP_VOLTAGE_MAX,
++	POWER_SUPPLY_PROP_VOLTAGE_MIN,
+ 	POWER_SUPPLY_PROP_CAPACITY,
+ };
+ 
+@@ -503,8 +503,8 @@ static int axp20x_battery_prop_writeable(struct power_supply *psy,
+ 					 enum power_supply_property psp)
+ {
+ 	return psp == POWER_SUPPLY_PROP_STATUS ||
+-	       psp == POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN ||
+-	       psp == POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN ||
++	       psp == POWER_SUPPLY_PROP_VOLTAGE_MIN ||
++	       psp == POWER_SUPPLY_PROP_VOLTAGE_MAX ||
+ 	       psp == POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT ||
+ 	       psp == POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT_MAX;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/power-supply-max17042_battery-fix-soc-threshold-calc.patch b/queue-6.1/power-supply-max17042_battery-fix-soc-threshold-calc.patch
new file mode 100644
index 00000000000..01e31d41450
--- /dev/null
+++ b/queue-6.1/power-supply-max17042_battery-fix-soc-threshold-calc.patch
@@ -0,0 +1,59 @@
+From 7d5d90446b7f39c3555e4c6ae962e22ef350c5bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2024 12:51:14 +0200
+Subject: power: supply: max17042_battery: Fix SOC threshold calc w/ no current
+ sense
+
+From: Artur Weber <aweber.kernel@gmail.com>
+
+[ Upstream commit 3a3acf839b2cedf092bdd1ff65b0e9895df1656b ]
+
+Commit 223a3b82834f ("power: supply: max17042_battery: use VFSOC for
+capacity when no rsns") made it so that capacity on systems without
+current sensing would be read from VFSOC instead of RepSOC. However,
+the SOC threshold calculation still read RepSOC to get the SOC
+regardless of the current sensing option state.
+
+Fix this by applying the same conditional to determine which register
+should be read.
+
+This also seems to be the intended behavior as per the datasheet - SOC
+alert config value in MiscCFG on setups without current sensing is set
+to a value of 0b11, indicating SOC alerts being generated based on
+VFSOC, instead of 0b00 which indicates SOC alerts being generated based
+on RepSOC.
+
+This fixes an issue on the Galaxy S3/Midas boards, where the alert
+interrupt would be constantly retriggered, causing high CPU usage
+on idle (around ~12%-15%).
+
+Fixes: e5f3872d2044 ("max17042: Add support for signalling change in SOC")
+Signed-off-by: Artur Weber <aweber.kernel@gmail.com>
+Reviewed-by: Henrik Grimler <henrik@grimler.se>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240817-max17042-soc-threshold-fix-v1-1-72b45899c3cc@gmail.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max17042_battery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index ab031bbfbe785..605d2b05c7533 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -858,7 +858,10 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)
+ 	/* program interrupt thresholds such that we should
+ 	 * get interrupt for every 'off' perc change in the soc
+ 	 */
+-	regmap_read(map, MAX17042_RepSOC, &soc);
++	if (chip->pdata->enable_current_sense)
++		regmap_read(map, MAX17042_RepSOC, &soc);
++	else
++		regmap_read(map, MAX17042_VFSOC, &soc);
+ 	soc >>= 8;
+ 	soc_tr = (soc + off) << 8;
+ 	if (off < soc)
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-8xx-fix-initial-memory-mapping.patch b/queue-6.1/powerpc-8xx-fix-initial-memory-mapping.patch
new file mode 100644
index 00000000000..21316023ca3
--- /dev/null
+++ b/queue-6.1/powerpc-8xx-fix-initial-memory-mapping.patch
@@ -0,0 +1,48 @@
+From 7c7db984df500187d6f1e0c639826016081841ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 19:23:45 +0200
+Subject: powerpc/8xx: Fix initial memory mapping
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit f9f2bff64c2f0dbee57be3d8c2741357ad3d05e6 ]
+
+Commit cf209951fa7f ("powerpc/8xx: Map linear memory with huge pages")
+introduced an initial mapping of kernel TEXT using PAGE_KERNEL_TEXT,
+but the pages that contain kernel TEXT may also contain kernel RODATA,
+and depending on selected debug options PAGE_KERNEL_TEXT may be either
+RWX or ROX. RODATA must be writable during init because it also
+contains ro_after_init data.
+
+So use PAGE_KERNEL_X instead to be sure it is RWX.
+
+Fixes: cf209951fa7f ("powerpc/8xx: Map linear memory with huge pages")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/dac7a828d8497c4548c91840575a706657baa4f1.1724173828.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/nohash/8xx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/nohash/8xx.c b/arch/powerpc/mm/nohash/8xx.c
+index dbbfe897455dc..52f24fda2d5f6 100644
+--- a/arch/powerpc/mm/nohash/8xx.c
++++ b/arch/powerpc/mm/nohash/8xx.c
+@@ -147,11 +147,11 @@ unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top)
+ 
+ 	mmu_mapin_immr();
+ 
+-	mmu_mapin_ram_chunk(0, boundary, PAGE_KERNEL_TEXT, true);
++	mmu_mapin_ram_chunk(0, boundary, PAGE_KERNEL_X, true);
+ 	if (debug_pagealloc_enabled_or_kfence()) {
+ 		top = boundary;
+ 	} else {
+-		mmu_mapin_ram_chunk(boundary, einittext8, PAGE_KERNEL_TEXT, true);
++		mmu_mapin_ram_chunk(boundary, einittext8, PAGE_KERNEL_X, true);
+ 		mmu_mapin_ram_chunk(einittext8, top, PAGE_KERNEL, true);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-8xx-fix-kernel-vs-user-address-comparison.patch b/queue-6.1/powerpc-8xx-fix-kernel-vs-user-address-comparison.patch
new file mode 100644
index 00000000000..c653dcae717
--- /dev/null
+++ b/queue-6.1/powerpc-8xx-fix-kernel-vs-user-address-comparison.patch
@@ -0,0 +1,63 @@
+From 18de5e723bc423a780caf939307835ab0c93f9c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 19:23:46 +0200
+Subject: powerpc/8xx: Fix kernel vs user address comparison
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 65a82e117ffeeab0baf6f871a1cab11a28ace183 ]
+
+Since commit 9132a2e82adc ("powerpc/8xx: Define a MODULE area below
+kernel text"), module exec space is below PAGE_OFFSET so not only
+space above PAGE_OFFSET, but space above TASK_SIZE need to be seen
+as kernel space.
+
+Until now the problem went undetected because by default TASK_SIZE
+is 0x8000000 which means address space is determined by just
+checking upper address bit. But when TASK_SIZE is over 0x80000000,
+PAGE_OFFSET is used for comparison, leading to thinking module
+addresses are part of user space.
+
+Fix it by using TASK_SIZE instead of PAGE_OFFSET for address
+comparison.
+
+Fixes: 9132a2e82adc ("powerpc/8xx: Define a MODULE area below kernel text")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/3f574c9845ff0a023b46cb4f38d2c45aecd769bd.1724173828.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 0b05f2be66b9f..f267e1587a9ba 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -40,12 +40,12 @@
+ #include "head_32.h"
+ 
+ .macro compare_to_kernel_boundary scratch, addr
+-#if CONFIG_TASK_SIZE <= 0x80000000 && CONFIG_PAGE_OFFSET >= 0x80000000
++#if CONFIG_TASK_SIZE <= 0x80000000 && MODULES_VADDR >= 0x80000000
+ /* By simply checking Address >= 0x80000000, we know if its a kernel address */
+ 	not.	\scratch, \addr
+ #else
+ 	rlwinm	\scratch, \addr, 16, 0xfff8
+-	cmpli	cr0, \scratch, PAGE_OFFSET@h
++	cmpli	cr0, \scratch, TASK_SIZE@h
+ #endif
+ .endm
+ 
+@@ -403,7 +403,7 @@ FixupDAR:/* Entry point for dcbx workaround. */
+ 	mfspr	r10, SPRN_SRR0
+ 	mtspr	SPRN_MD_EPN, r10
+ 	rlwinm	r11, r10, 16, 0xfff8
+-	cmpli	cr1, r11, PAGE_OFFSET@h
++	cmpli	cr1, r11, TASK_SIZE@h
+ 	mfspr	r11, SPRN_M_TWB	/* Get level 1 table */
+ 	blt+	cr1, 3f
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch b/queue-6.1/powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch
new file mode 100644
index 00000000000..39d551aa407
--- /dev/null
+++ b/queue-6.1/powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch
@@ -0,0 +1,120 @@
+From 06216467a4fd418383ceeb60922ae907d8454279 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 10:33:43 +0200
+Subject: powerpc/vdso: Fix VDSO data access when running in a non-root time
+ namespace
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c73049389e58c01e2e3bbfae900c8daeee177191 ]
+
+When running in a non-root time namespace, the global VDSO data page
+is replaced by a dedicated namespace data page and the global data
+page is mapped next to it. Detailed explanations can be found at
+commit 660fd04f9317 ("lib/vdso: Prepare for time namespace support").
+
+When it happens, __kernel_get_syscall_map and __kernel_get_tbfreq
+and __kernel_sync_dicache don't work anymore because they read 0
+instead of the data they need.
+
+To address that, clock_mode has to be read. When it is set to
+VDSO_CLOCKMODE_TIMENS, it means it is a dedicated namespace data page
+and the global data is located on the following page.
+
+Add a macro called get_realdatapage which reads clock_mode and add
+PAGE_SIZE to the pointer provided by get_datapage macro when
+clock_mode is equal to VDSO_CLOCKMODE_TIMENS. Use this new macro
+instead of get_datapage macro except for time functions as they handle
+it internally.
+
+Fixes: 74205b3fc2ef ("powerpc/vdso: Add support for time namespaces")
+Reported-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Closes: https://lore.kernel.org/all/ZtnYqZI-nrsNslwy@zx2c4.com/
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/vdso_datapage.h | 15 +++++++++++++++
+ arch/powerpc/kernel/asm-offsets.c        |  2 ++
+ arch/powerpc/kernel/vdso/cacheflush.S    |  2 +-
+ arch/powerpc/kernel/vdso/datapage.S      |  4 ++--
+ 4 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h
+index a585c8e538ff0..939daf6b695ef 100644
+--- a/arch/powerpc/include/asm/vdso_datapage.h
++++ b/arch/powerpc/include/asm/vdso_datapage.h
+@@ -111,6 +111,21 @@ extern struct vdso_arch_data *vdso_data;
+ 	addi	\ptr, \ptr, (_vdso_datapage - 999b)@l
+ .endm
+ 
++#include <asm/asm-offsets.h>
++#include <asm/page.h>
++
++.macro get_realdatapage ptr scratch
++	get_datapage \ptr
++#ifdef CONFIG_TIME_NS
++	lwz	\scratch, VDSO_CLOCKMODE_OFFSET(\ptr)
++	xoris	\scratch, \scratch, VDSO_CLOCKMODE_TIMENS@h
++	xori	\scratch, \scratch, VDSO_CLOCKMODE_TIMENS@l
++	cntlzw	\scratch, \scratch
++	rlwinm	\scratch, \scratch, PAGE_SHIFT - 5, 1 << PAGE_SHIFT
++	add	\ptr, \ptr, \scratch
++#endif
++.endm
++
+ #endif /* __ASSEMBLY__ */
+ 
+ #endif /* __KERNEL__ */
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 4ce2a4aa39854..65d79dd0c92ce 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -347,6 +347,8 @@ int main(void)
+ #else
+ 	OFFSET(CFG_SYSCALL_MAP32, vdso_arch_data, syscall_map);
+ #endif
++	OFFSET(VDSO_CLOCKMODE_OFFSET, vdso_arch_data, data[0].clock_mode);
++	DEFINE(VDSO_CLOCKMODE_TIMENS, VDSO_CLOCKMODE_TIMENS);
+ 
+ #ifdef CONFIG_BUG
+ 	DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry));
+diff --git a/arch/powerpc/kernel/vdso/cacheflush.S b/arch/powerpc/kernel/vdso/cacheflush.S
+index 0085ae464dac9..3b2479bd2f9a1 100644
+--- a/arch/powerpc/kernel/vdso/cacheflush.S
++++ b/arch/powerpc/kernel/vdso/cacheflush.S
+@@ -30,7 +30,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE)
+ #ifdef CONFIG_PPC64
+ 	mflr	r12
+   .cfi_register lr,r12
+-	get_datapage	r10
++	get_realdatapage	r10, r11
+ 	mtlr	r12
+   .cfi_restore	lr
+ #endif
+diff --git a/arch/powerpc/kernel/vdso/datapage.S b/arch/powerpc/kernel/vdso/datapage.S
+index db8e167f01667..2b19b6201a33a 100644
+--- a/arch/powerpc/kernel/vdso/datapage.S
++++ b/arch/powerpc/kernel/vdso/datapage.S
+@@ -28,7 +28,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map)
+ 	mflr	r12
+   .cfi_register lr,r12
+ 	mr.	r4,r3
+-	get_datapage	r3
++	get_realdatapage	r3, r11
+ 	mtlr	r12
+ #ifdef __powerpc64__
+ 	addi	r3,r3,CFG_SYSCALL_MAP64
+@@ -52,7 +52,7 @@ V_FUNCTION_BEGIN(__kernel_get_tbfreq)
+   .cfi_startproc
+ 	mflr	r12
+   .cfi_register lr,r12
+-	get_datapage	r3
++	get_realdatapage	r3, r11
+ #ifndef __powerpc64__
+ 	lwz	r4,(CFG_TB_TICKS_PER_SEC + 4)(r3)
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.1/r8169-disable-aldps-per-default-for-rtl8125.patch b/queue-6.1/r8169-disable-aldps-per-default-for-rtl8125.patch
new file mode 100644
index 00000000000..fea668eadac
--- /dev/null
+++ b/queue-6.1/r8169-disable-aldps-per-default-for-rtl8125.patch
@@ -0,0 +1,51 @@
+From 5e6a07453892ea2c195b02eed0b9d3285aa5e359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 15:51:11 +0200
+Subject: r8169: disable ALDPS per default for RTL8125
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit b9c7ac4fe22c608acf6153a3329df2b6b6cd416c ]
+
+En-Wei reported that traffic breaks if cable is unplugged for more
+than 3s and then re-plugged. This was supposed to be fixed by
+621735f59064 ("r8169: fix rare issue with broken rx after link-down on
+RTL8125"). But apparently this didn't fix the issue for everybody.
+The 3s threshold rang a bell, as this is the delay after which ALDPS
+kicks in. And indeed disabling ALDPS fixes the issue for this user.
+Maybe this fixes the issue in general. In a follow-up step we could
+remove the first fix attempt and see whether anybody complains.
+
+Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
+Tested-by: En-Wei WU <en-wei.wu@canonical.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/778b9d86-05c4-4856-be59-cde4487b9e52@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c
+index b50f16786c246..6ab89f4782857 100644
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1060,6 +1060,7 @@ static void rtl8125a_2_hw_phy_config(struct rtl8169_private *tp,
+ 	phy_modify_paged(phydev, 0xa86, 0x15, 0x0001, 0x0000);
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 
++	rtl8168g_disable_aldps(phydev);
+ 	rtl8125a_config_eee_phy(phydev);
+ }
+ 
+@@ -1099,6 +1100,7 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,
+ 	phy_modify_paged(phydev, 0xbf8, 0x12, 0xe000, 0xa000);
+ 
+ 	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
+ 	rtl8125b_config_eee_phy(phydev);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rcu-nocb-fix-rt-throttling-hrtimer-armed-from-offlin.patch b/queue-6.1/rcu-nocb-fix-rt-throttling-hrtimer-armed-from-offlin.patch
new file mode 100644
index 00000000000..69ad60250a5
--- /dev/null
+++ b/queue-6.1/rcu-nocb-fix-rt-throttling-hrtimer-armed-from-offlin.patch
@@ -0,0 +1,73 @@
+From f9dc7f378b3524ecc1d8071c426c830a0299b94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2024 00:56:40 +0200
+Subject: rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit 9139f93209d1ffd7f489ab19dee01b7c3a1a43d2 ]
+
+After a CPU is marked offline and until it reaches its final trip to
+idle, rcuo has several opportunities to be woken up, either because
+a callback has been queued in the meantime or because
+rcutree_report_cpu_dead() has issued the final deferred NOCB wake up.
+
+If RCU-boosting is enabled, RCU kthreads are set to SCHED_FIFO policy.
+And if RT-bandwidth is enabled, the related hrtimer might be armed.
+However this then happens after hrtimers have been migrated at the
+CPUHP_AP_HRTIMERS_DYING stage, which is broken as reported by the
+following warning:
+
+ Call trace:
+  enqueue_hrtimer+0x7c/0xf8
+  hrtimer_start_range_ns+0x2b8/0x300
+  enqueue_task_rt+0x298/0x3f0
+  enqueue_task+0x94/0x188
+  ttwu_do_activate+0xb4/0x27c
+  try_to_wake_up+0x2d8/0x79c
+  wake_up_process+0x18/0x28
+  __wake_nocb_gp+0x80/0x1a0
+  do_nocb_deferred_wakeup_common+0x3c/0xcc
+  rcu_report_dead+0x68/0x1ac
+  cpuhp_report_idle_dead+0x48/0x9c
+  do_idle+0x288/0x294
+  cpu_startup_entry+0x34/0x3c
+  secondary_start_kernel+0x138/0x158
+
+Fix this with waking up rcuo using an IPI if necessary. Since the
+existing API to deal with this situation only handles swait queue, rcuo
+is only woken up from offline CPUs if it's not already waiting on a
+grace period. In the worst case some callbacks will just wait for a
+grace period to complete before being assigned to a subsequent one.
+
+Reported-by: "Cheng-Jui Wang (王正睿)" <Cheng-Jui.Wang@mediatek.com>
+Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier")
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Neeraj Upadhyay <neeraj.upadhyay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_nocb.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_nocb.h b/kernel/rcu/tree_nocb.h
+index 6499eefa06603..7c28d154b0940 100644
+--- a/kernel/rcu/tree_nocb.h
++++ b/kernel/rcu/tree_nocb.h
+@@ -220,7 +220,10 @@ static bool __wake_nocb_gp(struct rcu_data *rdp_gp,
+ 	raw_spin_unlock_irqrestore(&rdp_gp->nocb_gp_lock, flags);
+ 	if (needwake) {
+ 		trace_rcu_nocb_wake(rcu_state.name, rdp->cpu, TPS("DoWake"));
+-		wake_up_process(rdp_gp->nocb_gp_kthread);
++		if (cpu_is_offline(raw_smp_processor_id()))
++			swake_up_one_online(&rdp_gp->nocb_gp_wq);
++		else
++			wake_up_process(rdp_gp->nocb_gp_kthread);
+ 	}
+ 
+ 	return needwake;
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-cxgb4-added-null-check-for-lookup_atid.patch b/queue-6.1/rdma-cxgb4-added-null-check-for-lookup_atid.patch
new file mode 100644
index 00000000000..0db3631778d
--- /dev/null
+++ b/queue-6.1/rdma-cxgb4-added-null-check-for-lookup_atid.patch
@@ -0,0 +1,52 @@
+From 2397616176ddc798c8cec08c567cc2885f051788 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 10:58:39 -0400
+Subject: RDMA/cxgb4: Added NULL check for lookup_atid
+
+From: Mikhail Lobanov <m.lobanov@rosalinux.ru>
+
+[ Upstream commit e766e6a92410ca269161de059fff0843b8ddd65f ]
+
+The lookup_atid() function can return NULL if the ATID is
+invalid or does not exist in the identifier table, which
+could lead to dereferencing a null pointer without a
+check in the `act_establish()` and `act_open_rpl()` functions.
+Add a NULL check to prevent null pointer dereferencing.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
+Signed-off-by: Mikhail Lobanov <m.lobanov@rosalinux.ru>
+Link: https://patch.msgid.link/20240912145844.77516-1-m.lobanov@rosalinux.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 040ba2224f9ff..b3757c6a0457a 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -1222,6 +1222,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	int ret;
+ 
+ 	ep = lookup_atid(t, atid);
++	if (!ep)
++		return -EINVAL;
+ 
+ 	pr_debug("ep %p tid %u snd_isn %u rcv_isn %u\n", ep, tid,
+ 		 be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn));
+@@ -2279,6 +2281,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	int ret = 0;
+ 
+ 	ep = lookup_atid(t, atid);
++	if (!ep)
++		return -EINVAL;
++
+ 	la = (struct sockaddr_in *)&ep->com.local_addr;
+ 	ra = (struct sockaddr_in *)&ep->com.remote_addr;
+ 	la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-erdma-return-qp-state-in-erdma_query_qp.patch b/queue-6.1/rdma-erdma-return-qp-state-in-erdma_query_qp.patch
new file mode 100644
index 00000000000..3ca2459cac0
--- /dev/null
+++ b/queue-6.1/rdma-erdma-return-qp-state-in-erdma_query_qp.patch
@@ -0,0 +1,71 @@
+From 4b1cd21ca02688f7cf3329fb41075b97f9432cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 19:29:20 +0800
+Subject: RDMA/erdma: Return QP state in erdma_query_qp
+
+From: Cheng Xu <chengyou@linux.alibaba.com>
+
+[ Upstream commit e77127ff6416b17e0b3e630ac46ee5c9a6570f57 ]
+
+Fix qp_state and cur_qp_state to return correct values in
+struct ib_qp_attr.
+
+Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation")
+Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
+Link: https://patch.msgid.link/20240902112920.58749-4-chengyou@linux.alibaba.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/erdma/erdma_verbs.c | 25 ++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
+index 654d8513873ec..2edf0d882c6a2 100644
+--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
+@@ -1292,11 +1292,31 @@ int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
+ 	return ret;
+ }
+ 
++static enum ib_qp_state query_qp_state(struct erdma_qp *qp)
++{
++	switch (qp->attrs.state) {
++	case ERDMA_QP_STATE_IDLE:
++		return IB_QPS_INIT;
++	case ERDMA_QP_STATE_RTR:
++		return IB_QPS_RTR;
++	case ERDMA_QP_STATE_RTS:
++		return IB_QPS_RTS;
++	case ERDMA_QP_STATE_CLOSING:
++		return IB_QPS_ERR;
++	case ERDMA_QP_STATE_TERMINATE:
++		return IB_QPS_ERR;
++	case ERDMA_QP_STATE_ERROR:
++		return IB_QPS_ERR;
++	default:
++		return IB_QPS_ERR;
++	}
++}
++
+ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ 		   int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr)
+ {
+-	struct erdma_qp *qp;
+ 	struct erdma_dev *dev;
++	struct erdma_qp *qp;
+ 
+ 	if (ibqp && qp_attr && qp_init_attr) {
+ 		qp = to_eqp(ibqp);
+@@ -1323,6 +1343,9 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ 
+ 	qp_init_attr->cap = qp_attr->cap;
+ 
++	qp_attr->qp_state = query_qp_state(qp);
++	qp_attr->cur_qp_state = query_qp_state(qp);
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-don-t-modify-rq-next-block-addr-in-hip09-qp.patch b/queue-6.1/rdma-hns-don-t-modify-rq-next-block-addr-in-hip09-qp.patch
new file mode 100644
index 00000000000..fecb8c8ee8e
--- /dev/null
+++ b/queue-6.1/rdma-hns-don-t-modify-rq-next-block-addr-in-hip09-qp.patch
@@ -0,0 +1,49 @@
+From afa38613f147172c0797ab645d0681079182e647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:36 +0800
+Subject: RDMA/hns: Don't modify rq next block addr in HIP09 QPC
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 6928d264e328e0cb5ee7663003a6e46e4cba0a7e ]
+
+The field 'rq next block addr' in QPC can be updated by driver only
+on HIP08. On HIP09 HW updates this field while driver is not allowed.
+
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index c4521ab66ee45..3318d27233e0d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4572,12 +4572,14 @@ static int config_qp_rq_buf(struct hns_roce_dev *hr_dev,
+ 		     upper_32_bits(to_hr_hw_page_addr(mtts[0])));
+ 	hr_reg_clear(qpc_mask, QPC_RQ_CUR_BLK_ADDR_H);
+ 
+-	context->rq_nxt_blk_addr = cpu_to_le32(to_hr_hw_page_addr(mtts[1]));
+-	qpc_mask->rq_nxt_blk_addr = 0;
+-
+-	hr_reg_write(context, QPC_RQ_NXT_BLK_ADDR_H,
+-		     upper_32_bits(to_hr_hw_page_addr(mtts[1])));
+-	hr_reg_clear(qpc_mask, QPC_RQ_NXT_BLK_ADDR_H);
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
++		context->rq_nxt_blk_addr =
++				cpu_to_le32(to_hr_hw_page_addr(mtts[1]));
++		qpc_mask->rq_nxt_blk_addr = 0;
++		hr_reg_write(context, QPC_RQ_NXT_BLK_ADDR_H,
++			     upper_32_bits(to_hr_hw_page_addr(mtts[1])));
++		hr_reg_clear(qpc_mask, QPC_RQ_NXT_BLK_ADDR_H);
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-1bit-ecc-recovery-address-in-non-4k-os.patch b/queue-6.1/rdma-hns-fix-1bit-ecc-recovery-address-in-non-4k-os.patch
new file mode 100644
index 00000000000..aac8ab5e100
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-1bit-ecc-recovery-address-in-non-4k-os.patch
@@ -0,0 +1,41 @@
+From d766f0930c09937bc8a5b9e9240834918edf2c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:42 +0800
+Subject: RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit ce196f6297c7f3ab7780795e40efd6c521f60c8b ]
+
+The 1bit-ECC recovery address read from HW only contain bits 64:12, so
+it should be fixed left-shifted 12 bits when used.
+
+Currently, the driver will shift the address left by PAGE_SHIFT when
+used, which is wrong in non-4K OS.
+
+Fixes: 2de949abd6a5 ("RDMA/hns: Recover 1bit-ECC error of RAM on chip")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-8-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 42636aa28b4bb..56c0e87c494ec 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -6314,7 +6314,7 @@ static u64 fmea_get_ram_res_addr(u32 res_type, __le64 *data)
+ 	    res_type == ECC_RESOURCE_SCCC)
+ 		return le64_to_cpu(*data);
+ 
+-	return le64_to_cpu(*data) << PAGE_SHIFT;
++	return le64_to_cpu(*data) << HNS_HW_PAGE_SHIFT;
+ }
+ 
+ static int fmea_recover_others(struct hns_roce_dev *hr_dev, u32 res_type,
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-spin_unlock_irqrestore-called-with-irqs.patch b/queue-6.1/rdma-hns-fix-spin_unlock_irqrestore-called-with-irqs.patch
new file mode 100644
index 00000000000..865680a58d0
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-spin_unlock_irqrestore-called-with-irqs.patch
@@ -0,0 +1,97 @@
+From d53dcf758a75a970c22e09f62c1325890355b762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:40 +0800
+Subject: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit 74d315b5af180220d561684d15897730135733a6 ]
+
+Fix missuse of spin_lock_irq()/spin_unlock_irq() when
+spin_lock_irqsave()/spin_lock_irqrestore() was hold.
+
+This was discovered through the lock debugging, and the corresponding
+log is as follows:
+
+raw_local_irq_restore() called with IRQs enabled
+WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40
+...
+Call trace:
+ warn_bogus_irq_restore+0x30/0x40
+ _raw_spin_unlock_irqrestore+0x84/0xc8
+ add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]
+ hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]
+ hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]
+ create_qp+0x138/0x258
+ ib_create_qp_kernel+0x50/0xe8
+ create_mad_qp+0xa8/0x128
+ ib_mad_port_open+0x218/0x448
+ ib_mad_init_device+0x70/0x1f8
+ add_client_context+0xfc/0x220
+ enable_device_and_get+0xd0/0x140
+ ib_register_device.part.0+0xf4/0x1c8
+ ib_register_device+0x34/0x50
+ hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2]
+ hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2]
+ __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2]
+ hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2]
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index c97b5dba17728..e158ed9e6c83c 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1443,19 +1443,19 @@ void hns_roce_lock_cqs(struct hns_roce_cq *send_cq, struct hns_roce_cq *recv_cq)
+ 		__acquire(&send_cq->lock);
+ 		__acquire(&recv_cq->lock);
+ 	} else if (unlikely(send_cq != NULL && recv_cq == NULL)) {
+-		spin_lock_irq(&send_cq->lock);
++		spin_lock(&send_cq->lock);
+ 		__acquire(&recv_cq->lock);
+ 	} else if (unlikely(send_cq == NULL && recv_cq != NULL)) {
+-		spin_lock_irq(&recv_cq->lock);
++		spin_lock(&recv_cq->lock);
+ 		__acquire(&send_cq->lock);
+ 	} else if (send_cq == recv_cq) {
+-		spin_lock_irq(&send_cq->lock);
++		spin_lock(&send_cq->lock);
+ 		__acquire(&recv_cq->lock);
+ 	} else if (send_cq->cqn < recv_cq->cqn) {
+-		spin_lock_irq(&send_cq->lock);
++		spin_lock(&send_cq->lock);
+ 		spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING);
+ 	} else {
+-		spin_lock_irq(&recv_cq->lock);
++		spin_lock(&recv_cq->lock);
+ 		spin_lock_nested(&send_cq->lock, SINGLE_DEPTH_NESTING);
+ 	}
+ }
+@@ -1475,13 +1475,13 @@ void hns_roce_unlock_cqs(struct hns_roce_cq *send_cq,
+ 		spin_unlock(&recv_cq->lock);
+ 	} else if (send_cq == recv_cq) {
+ 		__release(&recv_cq->lock);
+-		spin_unlock_irq(&send_cq->lock);
++		spin_unlock(&send_cq->lock);
+ 	} else if (send_cq->cqn < recv_cq->cqn) {
+ 		spin_unlock(&recv_cq->lock);
+-		spin_unlock_irq(&send_cq->lock);
++		spin_unlock(&send_cq->lock);
+ 	} else {
+ 		spin_unlock(&send_cq->lock);
+-		spin_unlock_irq(&recv_cq->lock);
++		spin_unlock(&recv_cq->lock);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-the-overflow-risk-of-hem_list_calc_ba_r.patch b/queue-6.1/rdma-hns-fix-the-overflow-risk-of-hem_list_calc_ba_r.patch
new file mode 100644
index 00000000000..7c5d0f5f0e7
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-the-overflow-risk-of-hem_list_calc_ba_r.patch
@@ -0,0 +1,77 @@
+From 0cb220be59ac899d042870245607aff4372a7794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:39 +0800
+Subject: RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
+
+From: wenglianfa <wenglianfa@huawei.com>
+
+[ Upstream commit d586628b169d14bbf36be64d2b3ec9d9d2fe0432 ]
+
+The max value of 'unit' and 'hop_num' is 2^24 and 2, so the value of
+'step' may exceed the range of u32. Change the type of 'step' to u64.
+
+Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing")
+Signed-off-by: wenglianfa <wenglianfa@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-5-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index f30274986c0da..156bc710e0dbb 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -1082,9 +1082,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level)
+  * @bt_level: base address table level
+  * @unit: ba entries per bt page
+  */
+-static u32 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)
++static u64 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)
+ {
+-	u32 step;
++	u64 step;
+ 	int max;
+ 	int i;
+ 
+@@ -1120,7 +1120,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions,
+ {
+ 	struct hns_roce_buf_region *r;
+ 	int total = 0;
+-	int step;
++	u64 step;
+ 	int i;
+ 
+ 	for (i = 0; i < region_cnt; i++) {
+@@ -1151,7 +1151,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
+ 	int ret = 0;
+ 	int max_ofs;
+ 	int level;
+-	u32 step;
++	u64 step;
+ 	int end;
+ 
+ 	if (hopnum <= 1)
+@@ -1188,7 +1188,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
+ 		}
+ 
+ 		start_aligned = (distance / step) * step + r->offset;
+-		end = min_t(int, start_aligned + step - 1, max_ofs);
++		end = min_t(u64, start_aligned + step - 1, max_ofs);
+ 		cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit,
+ 					  true);
+ 		if (!cur) {
+@@ -1277,7 +1277,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,
+ 	struct hns_roce_hem_item *hem, *temp_hem;
+ 	int total = 0;
+ 	int offset;
+-	int step;
++	u64 step;
+ 
+ 	step = hem_list_calc_ba_range(r->hopnum, 1, unit);
+ 	if (step < 1)
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-use-after-free-of-rsv_qp-on-hip08.patch b/queue-6.1/rdma-hns-fix-use-after-free-of-rsv_qp-on-hip08.patch
new file mode 100644
index 00000000000..17285fa8fc7
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-use-after-free-of-rsv_qp-on-hip08.patch
@@ -0,0 +1,51 @@
+From 04b887337d09305a3d2a9a9ac53e83249fd19a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:37 +0800
+Subject: RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
+
+From: wenglianfa <wenglianfa@huawei.com>
+
+[ Upstream commit fd8489294dd2beefb70f12ec4f6132aeec61a4d0 ]
+
+Currently rsv_qp is freed before ib_unregister_device() is called
+on HIP08. During the time interval, users can still dereg MR and
+rsv_qp will be used in this process, leading to a UAF. Move the
+release of rsv_qp after calling ib_unregister_device() to fix it.
+
+Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
+Signed-off-by: wenglianfa <wenglianfa@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-3-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 3318d27233e0d..7ca85dcb5458c 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3058,6 +3058,9 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev)
+ 
+ static void hns_roce_v2_exit(struct hns_roce_dev *hr_dev)
+ {
++	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
++		free_mr_exit(hr_dev);
++
+ 	hns_roce_function_clear(hr_dev);
+ 
+ 	if (!hr_dev->is_vf)
+@@ -6935,9 +6938,6 @@ static void __hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle,
+ 	hr_dev->state = HNS_ROCE_DEVICE_STATE_UNINIT;
+ 	hns_roce_handle_device_err(hr_dev);
+ 
+-	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
+-		free_mr_exit(hr_dev);
+-
+ 	hns_roce_exit(hr_dev);
+ 	kfree(hr_dev->priv);
+ 	ib_dealloc_device(&hr_dev->ib_dev);
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-fix-vf-triggering-pf-reset-in-abnormal-inte.patch b/queue-6.1/rdma-hns-fix-vf-triggering-pf-reset-in-abnormal-inte.patch
new file mode 100644
index 00000000000..6938d3aab3d
--- /dev/null
+++ b/queue-6.1/rdma-hns-fix-vf-triggering-pf-reset-in-abnormal-inte.patch
@@ -0,0 +1,51 @@
+From b47a6abb7ce4fd9be331666d6bc7aa55774159eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:41 +0800
+Subject: RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 4321feefa5501a746ebf6a7d8b59e6b955ae1860 ]
+
+In abnormal interrupt handler, a PF reset will be triggered even if
+the device is a VF. It should be a VF reset.
+
+Fixes: 2b9acb9a97fe ("RDMA/hns: Add the process of AEQ overflow for hip08")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-7-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 7ca85dcb5458c..42636aa28b4bb 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -6227,6 +6227,7 @@ static irqreturn_t abnormal_interrupt_basic(struct hns_roce_dev *hr_dev,
+ 	struct pci_dev *pdev = hr_dev->pci_dev;
+ 	struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev);
+ 	const struct hnae3_ae_ops *ops = ae_dev->ops;
++	enum hnae3_reset_type reset_type;
+ 	irqreturn_t int_work = IRQ_NONE;
+ 	u32 int_en;
+ 
+@@ -6238,10 +6239,12 @@ static irqreturn_t abnormal_interrupt_basic(struct hns_roce_dev *hr_dev,
+ 		roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG,
+ 			   1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S);
+ 
++		reset_type = hr_dev->is_vf ?
++			     HNAE3_VF_FUNC_RESET : HNAE3_FUNC_RESET;
++
+ 		/* Set reset level for reset_event() */
+ 		if (ops->set_default_reset_request)
+-			ops->set_default_reset_request(ae_dev,
+-						       HNAE3_FUNC_RESET);
++			ops->set_default_reset_request(ae_dev, reset_type);
+ 		if (ops->reset_event)
+ 			ops->reset_event(pdev, NULL);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-hns-optimize-hem-allocation-performance.patch b/queue-6.1/rdma-hns-optimize-hem-allocation-performance.patch
new file mode 100644
index 00000000000..52eb5b34e4a
--- /dev/null
+++ b/queue-6.1/rdma-hns-optimize-hem-allocation-performance.patch
@@ -0,0 +1,57 @@
+From d744ea2629a5e801998d45a4304e81ab47521b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:34:43 +0800
+Subject: RDMA/hns: Optimize hem allocation performance
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit fe51f6254d81f5a69c31df16353d6539b2b51630 ]
+
+When allocating MTT hem, for each hop level of each hem that is being
+allocated, the driver iterates the hem list to find out whether the
+bt page has been allocated in this hop level. If not, allocate a new
+one and splice it to the list. The time complexity is O(n^2) in worst
+cases.
+
+Currently the allocation for-loop uses 'unit' as the step size. This
+actually has taken into account the reuse of last-hop-level MTT bt
+pages by multiple buffer pages. Thus pages of last hop level will
+never have been allocated, so there is no need to iterate the hem list
+in last hop level.
+
+Removing this unnecessary iteration can reduce the time complexity to
+O(n).
+
+Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20240906093444.3571619-9-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index 156bc710e0dbb..2c8f0fd9557d1 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -1175,10 +1175,12 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
+ 
+ 	/* config L1 bt to last bt and link them to corresponding parent */
+ 	for (level = 1; level < hopnum; level++) {
+-		cur = hem_list_search_item(&mid_bt[level], offset);
+-		if (cur) {
+-			hem_ptrs[level] = cur;
+-			continue;
++		if (!hem_list_is_bottom_bt(hopnum, level)) {
++			cur = hem_list_search_item(&mid_bt[level], offset);
++			if (cur) {
++				hem_ptrs[level] = cur;
++				continue;
++			}
+ 		}
+ 
+ 		step = hem_list_calc_ba_range(hopnum, level, unit);
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-irdma-fix-error-message-in-irdma_modify_qp_roce.patch b/queue-6.1/rdma-irdma-fix-error-message-in-irdma_modify_qp_roce.patch
new file mode 100644
index 00000000000..321d8723f00
--- /dev/null
+++ b/queue-6.1/rdma-irdma-fix-error-message-in-irdma_modify_qp_roce.patch
@@ -0,0 +1,40 @@
+From 5f068c76f30f4bdfe74fd33f21947f5cc7a66f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 21:58:05 +0500
+Subject: RDMA/irdma: fix error message in irdma_modify_qp_roce()
+
+From: Vitaliy Shevtsov <v.shevtsov@maxima.ru>
+
+[ Upstream commit 9f0eafe86ea0a589676209d0cff1a1ed49a037d3 ]
+
+Use a correct field max_dest_rd_atomic instead of max_rd_atomic for the
+error output.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace.
+
+Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
+Signed-off-by: Vitaliy Shevtsov <v.shevtsov@maxima.ru>
+Link: https://lore.kernel.org/stable/20240916165817.14691-1-v.shevtsov%40maxima.ru
+Link: https://patch.msgid.link/20240916165817.14691-1-v.shevtsov@maxima.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
+index 76c5f461faca0..baa3dff6faab1 100644
+--- a/drivers/infiniband/hw/irdma/verbs.c
++++ b/drivers/infiniband/hw/irdma/verbs.c
+@@ -1324,7 +1324,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ 		if (attr->max_dest_rd_atomic > dev->hw_attrs.max_hw_ird) {
+ 			ibdev_err(&iwdev->ibdev,
+ 				  "rd_atomic = %d, above max_hw_ird=%d\n",
+-				   attr->max_rd_atomic,
++				   attr->max_dest_rd_atomic,
+ 				   dev->hw_attrs.max_hw_ird);
+ 			return -EINVAL;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-iwcm-fix-warning-at_kernel-workqueue.c-check_fl.patch b/queue-6.1/rdma-iwcm-fix-warning-at_kernel-workqueue.c-check_fl.patch
new file mode 100644
index 00000000000..5ff58670003
--- /dev/null
+++ b/queue-6.1/rdma-iwcm-fix-warning-at_kernel-workqueue.c-check_fl.patch
@@ -0,0 +1,83 @@
+From cf165b6a7d20caf16355c5ebf77476ca3416a1fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 13:33:36 +0200
+Subject: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit 86dfdd8288907f03c18b7fb462e0e232c4f98d89 ]
+
+In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to
+destroying CM IDs"), the function flush_workqueue is invoked to flush the
+work queue iwcm_wq.
+
+But at that time, the work queue iwcm_wq was created via the function
+alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM.
+
+Because the current process is trying to flush the whole iwcm_wq, if
+iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current
+process is not reclaiming memory or running on a workqueue which doesn't
+have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee
+leading to a deadlock.
+
+The call trace is as below:
+
+[  125.350876][ T1430] Call Trace:
+[  125.356281][ T1430]  <TASK>
+[ 125.361285][ T1430] ? __warn (kernel/panic.c:693)
+[ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))
+[ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219)
+[ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239)
+[ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))
+[ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621)
+[ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))
+[ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9))
+[ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970)
+[ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151)
+[ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm
+[ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910)
+[ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162)
+[ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161)
+[ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm
+[ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma
+[ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma
+[ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231)
+[ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393)
+[ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339)
+[ 125.531837][ T1430] kthread (kernel/kthread.c:389)
+[ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342)
+[ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147)
+[ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342)
+[ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
+[  125.566487][ T1430]  </TASK>
+[  125.566488][ T1430] ---[ end trace 0000000000000000 ]---
+
+Fixes: aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs")
+Link: https://patch.msgid.link/r/20240820113336.19860-1-yanjun.zhu@linux.dev
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202408151633.fc01893c-oliver.sang@intel.com
+Tested-by: kernel test robot <oliver.sang@intel.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/iwcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index 2d09d1be38f19..3e4941754b48d 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -1191,7 +1191,7 @@ static int __init iw_cm_init(void)
+ 	if (ret)
+ 		return ret;
+ 
+-	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
++	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", WQ_MEM_RECLAIM);
+ 	if (!iwcm_wq)
+ 		goto err_alloc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch b/queue-6.1/rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch
new file mode 100644
index 00000000000..b2c356929b5
--- /dev/null
+++ b/queue-6.1/rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch
@@ -0,0 +1,47 @@
+From 8ebd1b4f91773aedadd4ca744878ae14a8ee804e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 13:22:12 +0200
+Subject: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
+
+From: Md Haris Iqbal <haris.iqbal@ionos.com>
+
+[ Upstream commit 3e4289b29e216a55d08a89e126bc0b37cbad9f38 ]
+
+In the function init_conns(), after the create_con() and create_cm() for
+loop if something fails. In the cleanup for loop after the destroy tag, we
+access out of bound memory because cid is set to clt_path->s.con_num.
+
+This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds
+in the cleanup loop later.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Link: https://patch.msgid.link/20240821112217.41827-7-haris.iqbal@ionos.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 9beae1e50d115..dac8ddfc89e7d 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -2343,6 +2343,12 @@ static int init_conns(struct rtrs_clt_path *clt_path)
+ 		if (err)
+ 			goto destroy;
+ 	}
++
++	/*
++	 * Set the cid to con_num - 1, since if we fail later, we want to stay in bounds.
++	 */
++	cid = clt_path->s.con_num - 1;
++
+ 	err = alloc_path_reqs(clt_path);
+ 	if (err)
+ 		goto destroy;
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-rtrs-reset-hb_missed_cnt-after-receiving-other-.patch b/queue-6.1/rdma-rtrs-reset-hb_missed_cnt-after-receiving-other-.patch
new file mode 100644
index 00000000000..fe745868dbd
--- /dev/null
+++ b/queue-6.1/rdma-rtrs-reset-hb_missed_cnt-after-receiving-other-.patch
@@ -0,0 +1,68 @@
+From 76140afbc8bca10b6b67a3a60c831de8ea1d8a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 13:22:10 +0200
+Subject: RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from
+ peer
+
+From: Jack Wang <jinpu.wang@ionos.com>
+
+[ Upstream commit 3258cbbd86deaa2675e1799bc3d18bd1ef472641 ]
+
+Reset hb_missed_cnt after receiving traffic from other peer, so
+hb is more robust again high load on host or network.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
+Link: https://patch.msgid.link/20240821112217.41827-5-haris.iqbal@ionos.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 ++-
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index cc07c91f9c549..9beae1e50d115 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -624,6 +624,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ 		 */
+ 		if (WARN_ON(wc->wr_cqe->done != rtrs_clt_rdma_done))
+ 			return;
++		clt_path->s.hb_missed_cnt = 0;
+ 		rtrs_from_imm(be32_to_cpu(wc->ex.imm_data),
+ 			       &imm_type, &imm_payload);
+ 		if (imm_type == RTRS_IO_RSP_IMM ||
+@@ -641,7 +642,6 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ 				return  rtrs_clt_recv_done(con, wc);
+ 		} else if (imm_type == RTRS_HB_ACK_IMM) {
+ 			WARN_ON(con->c.cid);
+-			clt_path->s.hb_missed_cnt = 0;
+ 			clt_path->s.hb_cur_latency =
+ 				ktime_sub(ktime_get(), clt_path->s.hb_last_sent);
+ 			if (clt_path->flags & RTRS_MSG_NEW_RKEY_F)
+@@ -668,6 +668,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ 		/*
+ 		 * Key invalidations from server side
+ 		 */
++		clt_path->s.hb_missed_cnt = 0;
+ 		WARN_ON(!(wc->wc_flags & IB_WC_WITH_INVALIDATE ||
+ 			  wc->wc_flags & IB_WC_WITH_IMM));
+ 		WARN_ON(wc->wr_cqe->done != rtrs_clt_rdma_done);
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index e978ee4bb73ae..726b690ebe652 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1234,6 +1234,7 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc)
+ 		 */
+ 		if (WARN_ON(wc->wr_cqe != &io_comp_cqe))
+ 			return;
++		srv_path->s.hb_missed_cnt = 0;
+ 		err = rtrs_post_recv_empty(&con->c, &io_comp_cqe);
+ 		if (err) {
+ 			rtrs_err(s, "rtrs_post_recv(), err: %d\n", err);
+-- 
+2.43.0
+
diff --git a/queue-6.1/regulator-return-actual-error-in-of_regulator_bulk_g.patch b/queue-6.1/regulator-return-actual-error-in-of_regulator_bulk_g.patch
new file mode 100644
index 00000000000..738847197b7
--- /dev/null
+++ b/queue-6.1/regulator-return-actual-error-in-of_regulator_bulk_g.patch
@@ -0,0 +1,41 @@
+From 7a8316593c69f9431dc1feb07fb187f4af5aab8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 15:20:45 +0800
+Subject: regulator: Return actual error in of_regulator_bulk_get_all()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 395a41a1d3e377462f3eea8a205ee72be8885ff6 ]
+
+If regulator_get() in of_regulator_bulk_get_all() returns an error, that
+error gets overridden and -EINVAL is always passed out. This masks probe
+deferral requests and likely won't work properly in all cases.
+
+Fix this by letting of_regulator_bulk_get_all() return the original
+error code.
+
+Fixes: 27b9ecc7a9ba ("regulator: Add of_regulator_bulk_get_all")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20240822072047.3097740-3-wenst@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/of_regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index 1b65e5e4e40ff..59e71fd0db439 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -768,7 +768,7 @@ int of_regulator_bulk_get_all(struct device *dev, struct device_node *np,
+ 			name[i] = '\0';
+ 			tmp = regulator_get(dev, name);
+ 			if (IS_ERR(tmp)) {
+-				ret = -EINVAL;
++				ret = PTR_ERR(tmp);
+ 				goto error;
+ 			}
+ 			(*consumers)[n].consumer = tmp;
+-- 
+2.43.0
+
diff --git a/queue-6.1/remoteproc-imx_rproc-correct-ddr-alias-for-i.mx8m.patch b/queue-6.1/remoteproc-imx_rproc-correct-ddr-alias-for-i.mx8m.patch
new file mode 100644
index 00000000000..e8ff2e27361
--- /dev/null
+++ b/queue-6.1/remoteproc-imx_rproc-correct-ddr-alias-for-i.mx8m.patch
@@ -0,0 +1,40 @@
+From bd8dd9a6cbbeb5d3f199289f3769054fce7e1e11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2024 16:36:11 +0800
+Subject: remoteproc: imx_rproc: Correct ddr alias for i.MX8M
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit c901f817792822eda9cec23814a4621fa3e66695 ]
+
+The DDR Alias address should be 0x40000000 according to RM, so correct
+it.
+
+Fixes: 4ab8f9607aad ("remoteproc: imx_rproc: support i.MX8MQ/M")
+Reported-by: Terry Lv <terry.lv@nxp.com>
+Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://lore.kernel.org/r/20240719-imx_rproc-v2-1-10d0268c7eb1@nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_rproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
+index bc26fe5416627..7dad5cbec7ede 100644
+--- a/drivers/remoteproc/imx_rproc.c
++++ b/drivers/remoteproc/imx_rproc.c
+@@ -160,7 +160,7 @@ static const struct imx_rproc_att imx_rproc_att_imx8mq[] = {
+ 	/* QSPI Code - alias */
+ 	{ 0x08000000, 0x08000000, 0x08000000, 0 },
+ 	/* DDR (Code) - alias */
+-	{ 0x10000000, 0x80000000, 0x0FFE0000, 0 },
++	{ 0x10000000, 0x40000000, 0x0FFE0000, 0 },
+ 	/* TCML */
+ 	{ 0x1FFE0000, 0x007E0000, 0x00020000, ATT_OWN  | ATT_IOMEM},
+ 	/* TCMU */
+-- 
+2.43.0
+
diff --git a/queue-6.1/remoteproc-imx_rproc-initialize-workqueue-earlier.patch b/queue-6.1/remoteproc-imx_rproc-initialize-workqueue-earlier.patch
new file mode 100644
index 00000000000..78b324f93ef
--- /dev/null
+++ b/queue-6.1/remoteproc-imx_rproc-initialize-workqueue-earlier.patch
@@ -0,0 +1,48 @@
+From 8c480cd41877181853cab4d9eb8097cae8eacd78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2024 16:36:13 +0800
+Subject: remoteproc: imx_rproc: Initialize workqueue earlier
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 858e57c1d3dd7b92cc0fa692ba130a0a5d57e49d ]
+
+Initialize workqueue before requesting mailbox channel, otherwise if
+mailbox interrupt comes before workqueue ready, the imx_rproc_rx_callback
+will trigger issue.
+
+Fixes: 2df7062002d0 ("remoteproc: imx_proc: enable virtio/mailbox")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://lore.kernel.org/r/20240719-imx_rproc-v2-3-10d0268c7eb1@nxp.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/imx_rproc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
+index 7dad5cbec7ede..00a0c8f4a2200 100644
+--- a/drivers/remoteproc/imx_rproc.c
++++ b/drivers/remoteproc/imx_rproc.c
+@@ -796,6 +796,8 @@ static int imx_rproc_probe(struct platform_device *pdev)
+ 		goto err_put_rproc;
+ 	}
+ 
++	INIT_WORK(&priv->rproc_work, imx_rproc_vq_work);
++
+ 	ret = imx_rproc_xtr_mbox_init(rproc);
+ 	if (ret)
+ 		goto err_put_wkq;
+@@ -814,8 +816,6 @@ static int imx_rproc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		goto err_put_mbox;
+ 
+-	INIT_WORK(&priv->rproc_work, imx_rproc_vq_work);
+-
+ 	if (rproc->state != RPROC_DETACHED)
+ 		rproc->auto_boot = of_property_read_bool(np, "fsl,auto-boot");
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/reset-berlin-fix-of-node-leak-in-probe-error-path.patch b/queue-6.1/reset-berlin-fix-of-node-leak-in-probe-error-path.patch
new file mode 100644
index 00000000000..8cd4f581be9
--- /dev/null
+++ b/queue-6.1/reset-berlin-fix-of-node-leak-in-probe-error-path.patch
@@ -0,0 +1,46 @@
+From b7de3147792d4fd7e8a7a27ebd18f46ad79a3999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Aug 2024 16:14:24 +0200
+Subject: reset: berlin: fix OF node leak in probe() error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b ]
+
+Driver is leaking OF node reference on memory allocation failure.
+Acquire the OF node reference after memory allocation to fix this and
+keep it simple.
+
+Fixes: aed6f3cadc86 ("reset: berlin: convert to a platform driver")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20240825-reset-cleanup-scoped-v1-1-03f6d834f8c0@linaro.org
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-berlin.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/reset/reset-berlin.c b/drivers/reset/reset-berlin.c
+index 2537ec05eceef..578fe867080ce 100644
+--- a/drivers/reset/reset-berlin.c
++++ b/drivers/reset/reset-berlin.c
+@@ -68,13 +68,14 @@ static int berlin_reset_xlate(struct reset_controller_dev *rcdev,
+ 
+ static int berlin2_reset_probe(struct platform_device *pdev)
+ {
+-	struct device_node *parent_np = of_get_parent(pdev->dev.of_node);
++	struct device_node *parent_np;
+ 	struct berlin_reset_priv *priv;
+ 
+ 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
++	parent_np = of_get_parent(pdev->dev.of_node);
+ 	priv->regmap = syscon_node_to_regmap(parent_np);
+ 	of_node_put(parent_np);
+ 	if (IS_ERR(priv->regmap))
+-- 
+2.43.0
+
diff --git a/queue-6.1/reset-k210-fix-of-node-leak-in-probe-error-path.patch b/queue-6.1/reset-k210-fix-of-node-leak-in-probe-error-path.patch
new file mode 100644
index 00000000000..4e3697dec37
--- /dev/null
+++ b/queue-6.1/reset-k210-fix-of-node-leak-in-probe-error-path.patch
@@ -0,0 +1,47 @@
+From 7aa6b06d49ca00fa89b3641ff16a1f613894f98b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Aug 2024 16:14:25 +0200
+Subject: reset: k210: fix OF node leak in probe() error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b14e40f5dc7cd0dd7e958010e6ca9ad32ff2ddad ]
+
+Driver is leaking OF node reference on memory allocation failure.
+Acquire the OF node reference after memory allocation to fix this and
+keep it simple.
+
+Fixes: 5a2308da9f60 ("riscv: Add Canaan Kendryte K210 reset controller")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20240825-reset-cleanup-scoped-v1-2-03f6d834f8c0@linaro.org
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-k210.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/reset/reset-k210.c b/drivers/reset/reset-k210.c
+index 1b6e03522b40d..b0f4546b2b1e5 100644
+--- a/drivers/reset/reset-k210.c
++++ b/drivers/reset/reset-k210.c
+@@ -91,7 +91,7 @@ static const struct reset_control_ops k210_rst_ops = {
+ static int k210_rst_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+-	struct device_node *parent_np = of_get_parent(dev->of_node);
++	struct device_node *parent_np;
+ 	struct k210_rst *ksr;
+ 
+ 	dev_info(dev, "K210 reset controller\n");
+@@ -100,6 +100,7 @@ static int k210_rst_probe(struct platform_device *pdev)
+ 	if (!ksr)
+ 		return -ENOMEM;
+ 
++	parent_np = of_get_parent(dev->of_node);
+ 	ksr->map = syscon_node_to_regmap(parent_np);
+ 	of_node_put(parent_np);
+ 	if (IS_ERR(ksr->map))
+-- 
+2.43.0
+
diff --git a/queue-6.1/revert-dm-requeue-io-if-mapping-table-not-yet-availa.patch b/queue-6.1/revert-dm-requeue-io-if-mapping-table-not-yet-availa.patch
new file mode 100644
index 00000000000..cc2de041e01
--- /dev/null
+++ b/queue-6.1/revert-dm-requeue-io-if-mapping-table-not-yet-availa.patch
@@ -0,0 +1,84 @@
+From 911310e283877a82cfaf76faa3b5462aea77166a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 15:05:18 +0200
+Subject: Revert "dm: requeue IO if mapping table not yet available"
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit c8691cd0fc11197515ed148de0780d927bfca38b ]
+
+This reverts commit fa247089de9936a46e290d4724cb5f0b845600f5.
+
+The following sequence of commands causes a livelock - there will be
+workqueue process looping and consuming 100% CPU:
+
+dmsetup create --notable test
+truncate -s 1MiB testdata
+losetup /dev/loop0 testdata
+dmsetup load test --table '0 2048 linear /dev/loop0 0'
+dd if=/dev/zero of=/dev/dm-0 bs=16k count=1 conv=fdatasync
+
+The livelock is caused by the commit fa247089de99. The commit claims that
+it fixes a race condition, however, it is unknown what the actual race
+condition is and what program is involved in the race condition.
+
+When the inactive table is loaded, the nodes /dev/dm-0 and
+/sys/block/dm-0 are created. /dev/dm-0 has zero size at this point. When
+the device is suspended and resumed, the nodes /dev/mapper/test and
+/dev/disk/* are created.
+
+If some program opens a block device before it is created by dmsetup or
+lvm, the program is buggy, so dm could just report an error as it used to
+do before.
+
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Fixes: fa247089de99 ("dm: requeue IO if mapping table not yet available")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c |  4 +++-
+ drivers/md/dm.c    | 11 ++++++++---
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 80f46e01bca44..6685dc3b8b448 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -493,8 +493,10 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
+ 
+ 		map = dm_get_live_table(md, &srcu_idx);
+ 		if (unlikely(!map)) {
++			DMERR_LIMIT("%s: mapping table unavailable, erroring io",
++				    dm_device_name(md));
+ 			dm_put_live_table(md, srcu_idx);
+-			return BLK_STS_RESOURCE;
++			return BLK_STS_IOERR;
+ 		}
+ 		ti = dm_table_find_target(map, 0);
+ 		dm_put_live_table(md, srcu_idx);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index ddd44a7f79dbf..f70129bc703b8 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1789,10 +1789,15 @@ static void dm_submit_bio(struct bio *bio)
+ 	struct dm_table *map;
+ 
+ 	map = dm_get_live_table(md, &srcu_idx);
++	if (unlikely(!map)) {
++		DMERR_LIMIT("%s: mapping table unavailable, erroring io",
++			    dm_device_name(md));
++		bio_io_error(bio);
++		goto out;
++	}
+ 
+-	/* If suspended, or map not yet available, queue this IO for later */
+-	if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) ||
+-	    unlikely(!map)) {
++	/* If suspended, queue this IO for later */
++	if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) {
+ 		if (bio->bi_opf & REQ_NOWAIT)
+ 			bio_wouldblock_error(bio);
+ 		else if (bio->bi_opf & REQ_RAHEAD)
+-- 
+2.43.0
+
diff --git a/queue-6.1/risc-v-kvm-fix-sbiret-init-before-forwarding-to-user.patch b/queue-6.1/risc-v-kvm-fix-sbiret-init-before-forwarding-to-user.patch
new file mode 100644
index 00000000000..cf07dc354f0
--- /dev/null
+++ b/queue-6.1/risc-v-kvm-fix-sbiret-init-before-forwarding-to-user.patch
@@ -0,0 +1,48 @@
+From dedcbd3cd5680cf0a4d7f5def80d46bbd8b5a34e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 17:49:44 +0200
+Subject: RISC-V: KVM: Fix sbiret init before forwarding to userspace
+
+From: Andrew Jones <ajones@ventanamicro.com>
+
+[ Upstream commit 6b7b282e6baea06ba65b55ae7d38326ceb79cebf ]
+
+When forwarding SBI calls to userspace ensure sbiret.error is
+initialized to SBI_ERR_NOT_SUPPORTED first, in case userspace
+neglects to set it to anything. If userspace neglects it then we
+can't be sure it did anything else either, so we just report it
+didn't do or try anything. Just init sbiret.value to zero, which is
+the preferred value to return when nothing special is specified.
+
+KVM was already initializing both sbiret.error and sbiret.value, but
+the values used appear to come from a copy+paste of the __sbi_ecall()
+implementation, i.e. a0 and a1, which don't apply prior to the call
+being executed, nor at all when forwarding to userspace.
+
+Fixes: dea8ee31a039 ("RISC-V: KVM: Add SBI v0.1 support")
+Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20240807154943.150540-2-ajones@ventanamicro.com
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/vcpu_sbi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c
+index f96991d230bfc..bc575f6921504 100644
+--- a/arch/riscv/kvm/vcpu_sbi.c
++++ b/arch/riscv/kvm/vcpu_sbi.c
+@@ -67,8 +67,8 @@ void kvm_riscv_vcpu_sbi_forward(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ 	run->riscv_sbi.args[3] = cp->a3;
+ 	run->riscv_sbi.args[4] = cp->a4;
+ 	run->riscv_sbi.args[5] = cp->a5;
+-	run->riscv_sbi.ret[0] = cp->a0;
+-	run->riscv_sbi.ret[1] = cp->a1;
++	run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
++	run->riscv_sbi.ret[1] = 0;
+ }
+ 
+ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
+-- 
+2.43.0
+
diff --git a/queue-6.1/riscv-fix-fp-alignment-bug-in-perf_callchain_user.patch b/queue-6.1/riscv-fix-fp-alignment-bug-in-perf_callchain_user.patch
new file mode 100644
index 00000000000..3e443f67448
--- /dev/null
+++ b/queue-6.1/riscv-fix-fp-alignment-bug-in-perf_callchain_user.patch
@@ -0,0 +1,46 @@
+From 47bb68fc7a724869c57461054e3b59fe317bf230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2024 11:28:46 +0800
+Subject: riscv: Fix fp alignment bug in perf_callchain_user()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 22ab08955ea13be04a8efd20cc30890e0afaa49c ]
+
+The standard RISC-V calling convention said:
+	"The stack grows downward and the stack pointer is always
+	kept 16-byte aligned".
+
+So perf_callchain_user() should check whether 16-byte aligned for fp.
+
+Link: https://riscv.org/wp-content/uploads/2015/01/riscv-calling.pdf
+
+Fixes: dbeb90b0c1eb ("riscv: Add perf callchain support")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Cc: Björn Töpel <bjorn@kernel.org>
+Link: https://lore.kernel.org/r/20240708032847.2998158-2-ruanjinjie@huawei.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/perf_callchain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c
+index 3348a61de7d99..2932791e93882 100644
+--- a/arch/riscv/kernel/perf_callchain.c
++++ b/arch/riscv/kernel/perf_callchain.c
+@@ -62,7 +62,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
+ 	perf_callchain_store(entry, regs->epc);
+ 
+ 	fp = user_backtrace(entry, fp, regs->ra);
+-	while (fp && !(fp & 0x3) && entry->nr < entry->max_stack)
++	while (fp && !(fp & 0x7) && entry->nr < entry->max_stack)
+ 		fp = user_backtrace(entry, fp, 0);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-elx-libefc-fix-potential-use-after-free-in-efc_.patch b/queue-6.1/scsi-elx-libefc-fix-potential-use-after-free-in-efc_.patch
new file mode 100644
index 00000000000..3035f30cd2f
--- /dev/null
+++ b/queue-6.1/scsi-elx-libefc-fix-potential-use-after-free-in-efc_.patch
@@ -0,0 +1,43 @@
+From 8990588a200f0d1d492f6aa65aa000e2bb97df87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2024 14:29:05 +0300
+Subject: scsi: elx: libefc: Fix potential use after free in
+ efc_nport_vport_del()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 2e4b02fad094976763af08fec2c620f4f8edd9ae ]
+
+The kref_put() function will call nport->release if the refcount drops to
+zero.  The nport->release release function is _efc_nport_free() which frees
+"nport".  But then we dereference "nport" on the next line which is a use
+after free.  Re-order these lines to avoid the use after free.
+
+Fixes: fcd427303eb9 ("scsi: elx: libefc: SLI and FC PORT state machine interfaces")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/b666ab26-6581-4213-9a3d-32a9147f0399@stanley.mountain
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/elx/libefc/efc_nport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/elx/libefc/efc_nport.c b/drivers/scsi/elx/libefc/efc_nport.c
+index 2e83a667901fe..1a7437f4328e8 100644
+--- a/drivers/scsi/elx/libefc/efc_nport.c
++++ b/drivers/scsi/elx/libefc/efc_nport.c
+@@ -705,9 +705,9 @@ efc_nport_vport_del(struct efc *efc, struct efc_domain *domain,
+ 	spin_lock_irqsave(&efc->lock, flags);
+ 	list_for_each_entry(nport, &domain->nport_list, list_entry) {
+ 		if (nport->wwpn == wwpn && nport->wwnn == wwnn) {
+-			kref_put(&nport->ref, nport->release);
+ 			/* Shutdown this NPORT */
+ 			efc_sm_post_event(&nport->sm, EFC_EVT_SHUTDOWN, NULL);
++			kref_put(&nport->ref, nport->release);
+ 			break;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-ncr5380-check-for-phase-match-during-pdma-fixup.patch b/queue-6.1/scsi-ncr5380-check-for-phase-match-during-pdma-fixup.patch
new file mode 100644
index 00000000000..4956604ed55
--- /dev/null
+++ b/queue-6.1/scsi-ncr5380-check-for-phase-match-during-pdma-fixup.patch
@@ -0,0 +1,135 @@
+From 24dd43f7af30719286859c9bcf510f400801c4b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 13:36:28 +1000
+Subject: scsi: NCR5380: Check for phase match during PDMA fixup
+
+From: Finn Thain <fthain@linux-m68k.org>
+
+[ Upstream commit 5768718da9417331803fc4bc090544c2a93b88dc ]
+
+It's not an error for a target to change the bus phase during a transfer.
+Unfortunately, the FLAG_DMA_FIXUP workaround does not allow for that -- a
+phase change produces a DRQ timeout error and the device borken flag will
+be set.
+
+Check the phase match bit during FLAG_DMA_FIXUP processing. Don't forget to
+decrement the command residual. While we are here, change shost_printk()
+into scmd_printk() for better consistency with other DMA error messages.
+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Fixes: 55181be8ced1 ("ncr5380: Replace redundant flags with FLAG_NO_DMA_FIXUP")
+Signed-off-by: Finn Thain <fthain@linux-m68k.org>
+Link: https://lore.kernel.org/r/99dc7d1f4c825621b5b120963a69f6cd3e9ca659.1723001788.git.fthain@linux-m68k.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 78 +++++++++++++++++++++---------------------
+ 1 file changed, 39 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index dece7d9eb4d36..ecd24af4b3f29 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -1485,6 +1485,7 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,
+ 				unsigned char **data)
+ {
+ 	struct NCR5380_hostdata *hostdata = shost_priv(instance);
++	struct NCR5380_cmd *ncmd = NCR5380_to_ncmd(hostdata->connected);
+ 	int c = *count;
+ 	unsigned char p = *phase;
+ 	unsigned char *d = *data;
+@@ -1496,7 +1497,7 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,
+ 		return -1;
+ 	}
+ 
+-	NCR5380_to_ncmd(hostdata->connected)->phase = p;
++	ncmd->phase = p;
+ 
+ 	if (p & SR_IO) {
+ 		if (hostdata->read_overruns)
+@@ -1608,45 +1609,44 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,
+  * request.
+  */
+ 
+-	if (hostdata->flags & FLAG_DMA_FIXUP) {
+-		if (p & SR_IO) {
+-			/*
+-			 * The workaround was to transfer fewer bytes than we
+-			 * intended to with the pseudo-DMA read function, wait for
+-			 * the chip to latch the last byte, read it, and then disable
+-			 * pseudo-DMA mode.
+-			 *
+-			 * After REQ is asserted, the NCR5380 asserts DRQ and ACK.
+-			 * REQ is deasserted when ACK is asserted, and not reasserted
+-			 * until ACK goes false.  Since the NCR5380 won't lower ACK
+-			 * until DACK is asserted, which won't happen unless we twiddle
+-			 * the DMA port or we take the NCR5380 out of DMA mode, we
+-			 * can guarantee that we won't handshake another extra
+-			 * byte.
+-			 */
+-
+-			if (NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+-			                          BASR_DRQ, BASR_DRQ, 0) < 0) {
+-				result = -1;
+-				shost_printk(KERN_ERR, instance, "PDMA read: DRQ timeout\n");
+-			}
+-			if (NCR5380_poll_politely(hostdata, STATUS_REG,
+-			                          SR_REQ, 0, 0) < 0) {
+-				result = -1;
+-				shost_printk(KERN_ERR, instance, "PDMA read: !REQ timeout\n");
+-			}
+-			d[*count - 1] = NCR5380_read(INPUT_DATA_REG);
+-		} else {
+-			/*
+-			 * Wait for the last byte to be sent.  If REQ is being asserted for
+-			 * the byte we're interested, we'll ACK it and it will go false.
+-			 */
+-			if (NCR5380_poll_politely2(hostdata,
+-			     BUS_AND_STATUS_REG, BASR_DRQ, BASR_DRQ,
+-			     BUS_AND_STATUS_REG, BASR_PHASE_MATCH, 0, 0) < 0) {
+-				result = -1;
+-				shost_printk(KERN_ERR, instance, "PDMA write: DRQ and phase timeout\n");
++	if ((hostdata->flags & FLAG_DMA_FIXUP) &&
++	    (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH)) {
++		/*
++		 * The workaround was to transfer fewer bytes than we
++		 * intended to with the pseudo-DMA receive function, wait for
++		 * the chip to latch the last byte, read it, and then disable
++		 * DMA mode.
++		 *
++		 * After REQ is asserted, the NCR5380 asserts DRQ and ACK.
++		 * REQ is deasserted when ACK is asserted, and not reasserted
++		 * until ACK goes false. Since the NCR5380 won't lower ACK
++		 * until DACK is asserted, which won't happen unless we twiddle
++		 * the DMA port or we take the NCR5380 out of DMA mode, we
++		 * can guarantee that we won't handshake another extra
++		 * byte.
++		 *
++		 * If sending, wait for the last byte to be sent. If REQ is
++		 * being asserted for the byte we're interested, we'll ACK it
++		 * and it will go false.
++		 */
++		if (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
++					   BASR_DRQ, BASR_DRQ, 0)) {
++			if ((p & SR_IO) &&
++			    (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH)) {
++				if (!NCR5380_poll_politely(hostdata, STATUS_REG,
++							   SR_REQ, 0, 0)) {
++					d[c] = NCR5380_read(INPUT_DATA_REG);
++					--ncmd->this_residual;
++				} else {
++					result = -1;
++					scmd_printk(KERN_ERR, hostdata->connected,
++						    "PDMA fixup: !REQ timeout\n");
++				}
+ 			}
++		} else if (NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH) {
++			result = -1;
++			scmd_printk(KERN_ERR, hostdata->connected,
++				    "PDMA fixup: DRQ timeout\n");
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-smartpqi-revert-propagate-the-multipath-failure.patch b/queue-6.1/scsi-smartpqi-revert-propagate-the-multipath-failure.patch
new file mode 100644
index 00000000000..f5b03961faf
--- /dev/null
+++ b/queue-6.1/scsi-smartpqi-revert-propagate-the-multipath-failure.patch
@@ -0,0 +1,93 @@
+From 5c315c6da34f54fdec8f6280d17beef2fa8410f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 14:47:02 -0500
+Subject: scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quickly
+
+From: Gilbert Wu <Gilbert.Wu@microchip.com>
+
+[ Upstream commit f1393d52e6cda9c20f12643cbecf1e1dc357e0e2 ]
+
+Correct a rare multipath failure issue by reverting commit 94a68c814328
+("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer") [1].
+
+Reason for revert: The patch propagated the path failure to SML quickly
+when one of the path fails during IO and AIO path gets disabled for a
+multipath device.
+
+But it created a new issue: when creating a volume on an encryption-enabled
+controller, the firmware reports the AIO path is disabled, which cause the
+driver to report a path failure to SML for a multipath device.
+
+There will be a new fix to handle "Illegal request" and "Invalid field in
+parameter list" on RAID path when the AIO path is disabled on a multipath
+device.
+
+[1] https://lore.kernel.org/all/164375209313.440833.9992416628621839233.stgit@brunhilda.pdev.net/
+
+Fixes: 94a68c814328 ("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer")
+Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
+Reviewed-by: Scott Teel <scott.teel@microchip.com>
+Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com>
+Signed-off-by: Gilbert Wu <Gilbert.Wu@microchip.com>
+Signed-off-by: Don Brace <don.brace@microchip.com>
+Link: https://lore.kernel.org/r/20240711194704.982400-4-don.brace@microchip.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 20 ++------------------
+ 1 file changed, 2 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index e44f6bb25a8ea..4a004e0c93690 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -2334,14 +2334,6 @@ static inline void pqi_mask_device(u8 *scsi3addr)
+ 	scsi3addr[3] |= 0xc0;
+ }
+ 
+-static inline bool pqi_is_multipath_device(struct pqi_scsi_dev *device)
+-{
+-	if (pqi_is_logical_device(device))
+-		return false;
+-
+-	return (device->path_map & (device->path_map - 1)) != 0;
+-}
+-
+ static inline bool pqi_expose_device(struct pqi_scsi_dev *device)
+ {
+ 	return !device->is_physical_device || !pqi_skip_device(device->scsi3addr);
+@@ -3238,14 +3230,12 @@ static void pqi_process_aio_io_error(struct pqi_io_request *io_request)
+ 	int residual_count;
+ 	int xfer_count;
+ 	bool device_offline;
+-	struct pqi_scsi_dev *device;
+ 
+ 	scmd = io_request->scmd;
+ 	error_info = io_request->error_info;
+ 	host_byte = DID_OK;
+ 	sense_data_length = 0;
+ 	device_offline = false;
+-	device = scmd->device->hostdata;
+ 
+ 	switch (error_info->service_response) {
+ 	case PQI_AIO_SERV_RESPONSE_COMPLETE:
+@@ -3270,14 +3260,8 @@ static void pqi_process_aio_io_error(struct pqi_io_request *io_request)
+ 			break;
+ 		case PQI_AIO_STATUS_AIO_PATH_DISABLED:
+ 			pqi_aio_path_disabled(io_request);
+-			if (pqi_is_multipath_device(device)) {
+-				pqi_device_remove_start(device);
+-				host_byte = DID_NO_CONNECT;
+-				scsi_status = SAM_STAT_CHECK_CONDITION;
+-			} else {
+-				scsi_status = SAM_STAT_GOOD;
+-				io_request->status = -EAGAIN;
+-			}
++			scsi_status = SAM_STAT_GOOD;
++			io_request->status = -EAGAIN;
+ 			break;
+ 		case PQI_AIO_STATUS_NO_PATH_TO_DEVICE:
+ 		case PQI_AIO_STATUS_INVALID_DEVICE:
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-add-a-cgroup-prog-bpf_get_ns_current_p.patch b/queue-6.1/selftests-bpf-add-a-cgroup-prog-bpf_get_ns_current_p.patch
new file mode 100644
index 00000000000..9690a23b588
--- /dev/null
+++ b/queue-6.1/selftests-bpf-add-a-cgroup-prog-bpf_get_ns_current_p.patch
@@ -0,0 +1,145 @@
+From 47a7b6368bf922e674467a8e1d42c7ca5b134209 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 11:49:10 -0700
+Subject: selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 87ade6cd859ea9dbde6e80b3fcf717ed9a73b4a9 ]
+
+Add a cgroup bpf program test where the bpf program is running
+in a pid namespace. The test is successfully:
+  #165/3   ns_current_pid_tgid/new_ns_cgrp:OK
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240315184910.2976522-1-yonghong.song@linux.dev
+Stable-dep-of: 21f0b0af9772 ("selftests/bpf: Fix include of <sys/fcntl.h>")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/ns_current_pid_tgid.c      | 73 +++++++++++++++++++
+ .../bpf/progs/test_ns_current_pid_tgid.c      |  7 ++
+ 2 files changed, 80 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+index 847d7b70e2902..fded38d24aae4 100644
+--- a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+@@ -12,6 +12,7 @@
+ #include <sys/wait.h>
+ #include <sys/mount.h>
+ #include <sys/fcntl.h>
++#include "network_helpers.h"
+ 
+ #define STACK_SIZE (1024 * 1024)
+ static char child_stack[STACK_SIZE];
+@@ -74,6 +75,50 @@ static int test_current_pid_tgid_tp(void *args)
+ 	return ret;
+ }
+ 
++static int test_current_pid_tgid_cgrp(void *args)
++{
++	struct test_ns_current_pid_tgid__bss *bss;
++	struct test_ns_current_pid_tgid *skel;
++	int server_fd = -1, ret = -1, err;
++	int cgroup_fd = *(int *)args;
++	pid_t tgid, pid;
++
++	skel = test_ns_current_pid_tgid__open();
++	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open"))
++		return ret;
++
++	bpf_program__set_autoload(skel->progs.cgroup_bind4, true);
++
++	err = test_ns_current_pid_tgid__load(skel);
++	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__load"))
++		goto cleanup;
++
++	bss = skel->bss;
++	if (get_pid_tgid(&pid, &tgid, bss))
++		goto cleanup;
++
++	skel->links.cgroup_bind4 = bpf_program__attach_cgroup(
++		skel->progs.cgroup_bind4, cgroup_fd);
++	if (!ASSERT_OK_PTR(skel->links.cgroup_bind4, "bpf_program__attach_cgroup"))
++		goto cleanup;
++
++	server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0);
++	if (!ASSERT_GE(server_fd, 0, "start_server"))
++		goto cleanup;
++
++	if (!ASSERT_EQ(bss->user_pid, pid, "pid"))
++		goto cleanup;
++	if (!ASSERT_EQ(bss->user_tgid, tgid, "tgid"))
++		goto cleanup;
++	ret = 0;
++
++cleanup:
++	if (server_fd >= 0)
++		close(server_fd);
++	test_ns_current_pid_tgid__destroy(skel);
++	return ret;
++}
++
+ static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg)
+ {
+ 	int wstatus;
+@@ -95,6 +140,25 @@ static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg)
+ 		return;
+ }
+ 
++static void test_in_netns(int (*fn)(void *), void *arg)
++{
++	struct nstoken *nstoken = NULL;
++
++	SYS(cleanup, "ip netns add ns_current_pid_tgid");
++	SYS(cleanup, "ip -net ns_current_pid_tgid link set dev lo up");
++
++	nstoken = open_netns("ns_current_pid_tgid");
++	if (!ASSERT_OK_PTR(nstoken, "open_netns"))
++		goto cleanup;
++
++	test_ns_current_pid_tgid_new_ns(fn, arg);
++
++cleanup:
++	if (nstoken)
++		close_netns(nstoken);
++	SYS_NOFAIL("ip netns del ns_current_pid_tgid");
++}
++
+ /* TODO: use a different tracepoint */
+ void serial_test_ns_current_pid_tgid(void)
+ {
+@@ -102,4 +166,13 @@ void serial_test_ns_current_pid_tgid(void)
+ 		test_current_pid_tgid_tp(NULL);
+ 	if (test__start_subtest("new_ns_tp"))
+ 		test_ns_current_pid_tgid_new_ns(test_current_pid_tgid_tp, NULL);
++	if (test__start_subtest("new_ns_cgrp")) {
++		int cgroup_fd = -1;
++
++		cgroup_fd = test__join_cgroup("/sock_addr");
++		if (ASSERT_GE(cgroup_fd, 0, "join_cgroup")) {
++			test_in_netns(test_current_pid_tgid_cgrp, &cgroup_fd);
++			close(cgroup_fd);
++		}
++	}
+ }
+diff --git a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
+index aa3ec7ca16d9b..d0010e698f668 100644
+--- a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
+@@ -28,4 +28,11 @@ int tp_handler(const void *ctx)
+ 	return 0;
+ }
+ 
++SEC("?cgroup/bind4")
++int cgroup_bind4(struct bpf_sock_addr *ctx)
++{
++	get_pid_tgid();
++	return 1;
++}
++
+ char _license[] SEC("license") = "GPL";
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-add-selftest-deny_namespace-to-s390x-d.patch b/queue-6.1/selftests-bpf-add-selftest-deny_namespace-to-s390x-d.patch
new file mode 100644
index 00000000000..72fa3a7674e
--- /dev/null
+++ b/queue-6.1/selftests-bpf-add-selftest-deny_namespace-to-s390x-d.patch
@@ -0,0 +1,45 @@
+From 8198d08d8f04fa02b981f0bfb31143ec48dbaa87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Oct 2022 22:34:29 -0700
+Subject: selftests/bpf: Add selftest deny_namespace to s390x deny list
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 8206e4e95230daeeba43c59fc7c39656883ecd62 ]
+
+BPF CI reported that selftest deny_namespace failed with s390x.
+
+  test_unpriv_userns_create_no_bpf:PASS:no-bpf unpriv new user ns 0 nsec
+  test_deny_namespace:PASS:skel load 0 nsec
+  libbpf: prog 'test_userns_create': failed to attach: ERROR: strerror_r(-524)=22
+  libbpf: prog 'test_userns_create': failed to auto-attach: -524
+  test_deny_namespace:FAIL:attach unexpected error: -524 (errno 524)
+  #57/1    deny_namespace/unpriv_userns_create_no_bpf:FAIL
+  #57      deny_namespace:FAIL
+
+BPF program test_userns_create is a BPF LSM type program which is
+based on trampoline and s390x does not support s390x. Let add the
+test to x390x deny list to avoid this failure in BPF CI.
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20221006053429.3549165-1-yhs@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: aa8ebb270c66 ("selftests/bpf: Workaround strict bpf_lsm return value check.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/DENYLIST.s390x | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/DENYLIST.s390x b/tools/testing/selftests/bpf/DENYLIST.s390x
+index 17e074eb42b8a..0fb03b8047d53 100644
+--- a/tools/testing/selftests/bpf/DENYLIST.s390x
++++ b/tools/testing/selftests/bpf/DENYLIST.s390x
+@@ -75,3 +75,4 @@ user_ringbuf                             # failed to find kernel BTF type ID of
+ lookup_key                               # JIT does not support calling kernel function                                (kfunc)
+ verify_pkcs7_sig                         # JIT does not support calling kernel function                                (kfunc)
+ kfunc_dynptr_param                       # JIT does not support calling kernel function                                (kfunc)
++deny_namespace                           # failed to attach: ERROR: strerror_r(-524)=22                                (trampoline)
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-add-tests-for-_opts-variants-of-bpf_-_.patch b/queue-6.1/selftests-bpf-add-tests-for-_opts-variants-of-bpf_-_.patch
new file mode 100644
index 00000000000..c856edb3599
--- /dev/null
+++ b/queue-6.1/selftests-bpf-add-tests-for-_opts-variants-of-bpf_-_.patch
@@ -0,0 +1,185 @@
+From 0518935ec5cbf2164071978f6e007ec8a5bf27e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Oct 2022 13:07:36 +0200
+Subject: selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit a9c7c18b57594c72a63fad749021b743c65a098b ]
+
+Introduce the data_input map, write-protected with a small eBPF program
+implementing the lsm/bpf_map hook.
+
+Then, ensure that bpf_map_get_fd_by_id() and bpf_map_get_fd_by_id_opts()
+with NULL opts don't succeed due to requesting read-write access to the
+write-protected map. Also, ensure that bpf_map_get_fd_by_id_opts() with
+open_flags in opts set to BPF_F_RDONLY instead succeeds.
+
+After obtaining a read-only fd, ensure that only map lookup succeeds and
+not update. Ensure that update works only with the read-write fd obtained
+at program loading time, when the write protection was not yet enabled.
+
+Finally, ensure that the other _opts variants of bpf_*_get_fd_by_id() don't
+work if the BPF_F_RDONLY flag is set in opts (due to the kernel not
+handling the open_flags member of bpf_attr).
+
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221006110736.84253-7-roberto.sassu@huaweicloud.com
+Stable-dep-of: aa8ebb270c66 ("selftests/bpf: Workaround strict bpf_lsm return value check.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/DENYLIST.s390x    |  1 +
+ .../bpf/prog_tests/libbpf_get_fd_by_id_opts.c | 87 +++++++++++++++++++
+ .../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 36 ++++++++
+ 3 files changed, 124 insertions(+)
+ create mode 100644 tools/testing/selftests/bpf/prog_tests/libbpf_get_fd_by_id_opts.c
+ create mode 100644 tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+
+diff --git a/tools/testing/selftests/bpf/DENYLIST.s390x b/tools/testing/selftests/bpf/DENYLIST.s390x
+index 0fb03b8047d53..beef1232a47ae 100644
+--- a/tools/testing/selftests/bpf/DENYLIST.s390x
++++ b/tools/testing/selftests/bpf/DENYLIST.s390x
+@@ -76,3 +76,4 @@ lookup_key                               # JIT does not support calling kernel f
+ verify_pkcs7_sig                         # JIT does not support calling kernel function                                (kfunc)
+ kfunc_dynptr_param                       # JIT does not support calling kernel function                                (kfunc)
+ deny_namespace                           # failed to attach: ERROR: strerror_r(-524)=22                                (trampoline)
++libbpf_get_fd_by_id_opts                 # failed to attach: ERROR: strerror_r(-524)=22                                (trampoline)
+diff --git a/tools/testing/selftests/bpf/prog_tests/libbpf_get_fd_by_id_opts.c b/tools/testing/selftests/bpf/prog_tests/libbpf_get_fd_by_id_opts.c
+new file mode 100644
+index 0000000000000..25e5dfa9c315c
+--- /dev/null
++++ b/tools/testing/selftests/bpf/prog_tests/libbpf_get_fd_by_id_opts.c
+@@ -0,0 +1,87 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
++ *
++ * Author: Roberto Sassu <roberto.sassu@huawei.com>
++ */
++
++#include <test_progs.h>
++
++#include "test_libbpf_get_fd_by_id_opts.skel.h"
++
++void test_libbpf_get_fd_by_id_opts(void)
++{
++	struct test_libbpf_get_fd_by_id_opts *skel;
++	struct bpf_map_info info_m = {};
++	__u32 len = sizeof(info_m), value;
++	int ret, zero = 0, fd = -1;
++	LIBBPF_OPTS(bpf_get_fd_by_id_opts, fd_opts_rdonly,
++		.open_flags = BPF_F_RDONLY,
++	);
++
++	skel = test_libbpf_get_fd_by_id_opts__open_and_load();
++	if (!ASSERT_OK_PTR(skel,
++			   "test_libbpf_get_fd_by_id_opts__open_and_load"))
++		return;
++
++	ret = test_libbpf_get_fd_by_id_opts__attach(skel);
++	if (!ASSERT_OK(ret, "test_libbpf_get_fd_by_id_opts__attach"))
++		goto close_prog;
++
++	ret = bpf_obj_get_info_by_fd(bpf_map__fd(skel->maps.data_input),
++				     &info_m, &len);
++	if (!ASSERT_OK(ret, "bpf_obj_get_info_by_fd"))
++		goto close_prog;
++
++	fd = bpf_map_get_fd_by_id(info_m.id);
++	if (!ASSERT_LT(fd, 0, "bpf_map_get_fd_by_id"))
++		goto close_prog;
++
++	fd = bpf_map_get_fd_by_id_opts(info_m.id, NULL);
++	if (!ASSERT_LT(fd, 0, "bpf_map_get_fd_by_id_opts"))
++		goto close_prog;
++
++	fd = bpf_map_get_fd_by_id_opts(info_m.id, &fd_opts_rdonly);
++	if (!ASSERT_GE(fd, 0, "bpf_map_get_fd_by_id_opts"))
++		goto close_prog;
++
++	/* Map lookup should work with read-only fd. */
++	ret = bpf_map_lookup_elem(fd, &zero, &value);
++	if (!ASSERT_OK(ret, "bpf_map_lookup_elem"))
++		goto close_prog;
++
++	if (!ASSERT_EQ(value, 0, "map value mismatch"))
++		goto close_prog;
++
++	/* Map update should not work with read-only fd. */
++	ret = bpf_map_update_elem(fd, &zero, &len, BPF_ANY);
++	if (!ASSERT_LT(ret, 0, "bpf_map_update_elem"))
++		goto close_prog;
++
++	/* Map update should work with read-write fd. */
++	ret = bpf_map_update_elem(bpf_map__fd(skel->maps.data_input), &zero,
++				  &len, BPF_ANY);
++	if (!ASSERT_OK(ret, "bpf_map_update_elem"))
++		goto close_prog;
++
++	/* Prog get fd with opts set should not work (no kernel support). */
++	ret = bpf_prog_get_fd_by_id_opts(0, &fd_opts_rdonly);
++	if (!ASSERT_EQ(ret, -EINVAL, "bpf_prog_get_fd_by_id_opts"))
++		goto close_prog;
++
++	/* Link get fd with opts set should not work (no kernel support). */
++	ret = bpf_link_get_fd_by_id_opts(0, &fd_opts_rdonly);
++	if (!ASSERT_EQ(ret, -EINVAL, "bpf_link_get_fd_by_id_opts"))
++		goto close_prog;
++
++	/* BTF get fd with opts set should not work (no kernel support). */
++	ret = bpf_btf_get_fd_by_id_opts(0, &fd_opts_rdonly);
++	ASSERT_EQ(ret, -EINVAL, "bpf_btf_get_fd_by_id_opts");
++
++close_prog:
++	if (fd >= 0)
++		close(fd);
++
++	test_libbpf_get_fd_by_id_opts__destroy(skel);
++}
+diff --git a/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c b/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+new file mode 100644
+index 0000000000000..f5ac5f3e89196
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+@@ -0,0 +1,36 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * Copyright (C) 2022 Huawei Technologies Duesseldorf GmbH
++ *
++ * Author: Roberto Sassu <roberto.sassu@huawei.com>
++ */
++
++#include "vmlinux.h"
++#include <errno.h>
++#include <bpf/bpf_helpers.h>
++#include <bpf/bpf_tracing.h>
++
++/* From include/linux/mm.h. */
++#define FMODE_WRITE	0x2
++
++struct {
++	__uint(type, BPF_MAP_TYPE_ARRAY);
++	__uint(max_entries, 1);
++	__type(key, __u32);
++	__type(value, __u32);
++} data_input SEC(".maps");
++
++char _license[] SEC("license") = "GPL";
++
++SEC("lsm/bpf_map")
++int BPF_PROG(check_access, struct bpf_map *map, fmode_t fmode)
++{
++	if (map != (struct bpf_map *)&data_input)
++		return 0;
++
++	if (fmode & FMODE_WRITE)
++		return -EACCES;
++
++	return 0;
++}
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-c-compile-error-from-missing-_bool.patch b/queue-6.1/selftests-bpf-fix-c-compile-error-from-missing-_bool.patch
new file mode 100644
index 00000000000..f03b9103b11
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-c-compile-error-from-missing-_bool.patch
@@ -0,0 +1,55 @@
+From 0dadfc1a7a5c69670dadb325d07b4a19933de997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 02:24:20 -0700
+Subject: selftests/bpf: Fix C++ compile error from missing _Bool type
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit aa95073fd290b5b3e45f067fa22bb25e59e1ff7c ]
+
+While building, bpftool makes a skeleton from test_core_extern.c, which
+itself includes <stdbool.h> and uses the 'bool' type. However, the skeleton
+test_core_extern.skel.h generated *does not* include <stdbool.h> or use the
+'bool' type, instead using the C-only '_Bool' type. Compiling test_cpp.cpp
+with g++ 12.3 for mips64el/musl-libc then fails with error:
+
+  In file included from test_cpp.cpp:9:
+  test_core_extern.skel.h:45:17: error: '_Bool' does not name a type
+     45 |                 _Bool CONFIG_BOOL;
+        |                 ^~~~~
+
+This was likely missed previously because glibc uses a GNU extension for
+<stdbool.h> with C++ (#define _Bool bool), not supported by musl libc.
+
+Normally, a C fragment would include <stdbool.h> and use the 'bool' type,
+and thus cleanly work after import by C++. The ideal fix would be for
+'bpftool gen skeleton' to output the correct type/include supporting C++,
+but in the meantime add a conditional define as above.
+
+Fixes: 7c8dce4b1661 ("bpftool: Make skeleton C code compilable with C++ compiler")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/6fc1dd28b8bda49e51e4f610bdc9d22f4455632d.1722244708.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_cpp.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_cpp.cpp b/tools/testing/selftests/bpf/test_cpp.cpp
+index 19ad172036daa..2d2ffd772228d 100644
+--- a/tools/testing/selftests/bpf/test_cpp.cpp
++++ b/tools/testing/selftests/bpf/test_cpp.cpp
+@@ -6,6 +6,10 @@
+ #pragma GCC diagnostic pop
+ #include <bpf/bpf.h>
+ #include <bpf/btf.h>
++
++#ifndef _Bool
++#define _Bool bool
++#endif
+ #include "test_core_extern.skel.h"
+ 
+ template <typename T>
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compile-error-from-rlim_t-in-sk_st.patch b/queue-6.1/selftests-bpf-fix-compile-error-from-rlim_t-in-sk_st.patch
new file mode 100644
index 00000000000..2f1dbef66bd
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compile-error-from-rlim_t-in-sk_st.patch
@@ -0,0 +1,57 @@
+From 448f621a74dc0b0aaf60f1bd55ec96c7db492c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:29 -0700
+Subject: selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit d393f9479d4aaab0fa4c3caf513f28685e831f13 ]
+
+Cast 'rlim_t' argument to match expected type of printf() format and avoid
+compile errors seen building for mips64el/musl-libc:
+
+  In file included from map_tests/sk_storage_map.c:20:
+  map_tests/sk_storage_map.c: In function 'test_sk_storage_map_stress_free':
+  map_tests/sk_storage_map.c:414:56: error: format '%lu' expects argument of type 'long unsigned int', but argument 2 has type 'rlim_t' {aka 'long long unsigned int'} [-Werror=format=]
+    414 |                 CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
+        |                                                        ^~~~~~~~~~~~~~~~~~~~~~~
+    415 |                       rlim_new.rlim_cur, errno);
+        |                       ~~~~~~~~~~~~~~~~~
+        |                               |
+        |                               rlim_t {aka long long unsigned int}
+  ./test_maps.h:12:24: note: in definition of macro 'CHECK'
+     12 |                 printf(format);                                         \
+        |                        ^~~~~~
+  map_tests/sk_storage_map.c:414:68: note: format string is defined here
+    414 |                 CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
+        |                                                                  ~~^
+        |                                                                    |
+        |                                                                    long unsigned int
+        |                                                                  %llu
+  cc1: all warnings being treated as errors
+
+Fixes: 51a0e301a563 ("bpf: Add BPF_MAP_TYPE_SK_STORAGE test to test_maps")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/1e00a1fa7acf91b4ca135c4102dc796d518bad86.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/map_tests/sk_storage_map.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/map_tests/sk_storage_map.c b/tools/testing/selftests/bpf/map_tests/sk_storage_map.c
+index 18405c3b7cee9..af10c309359a7 100644
+--- a/tools/testing/selftests/bpf/map_tests/sk_storage_map.c
++++ b/tools/testing/selftests/bpf/map_tests/sk_storage_map.c
+@@ -412,7 +412,7 @@ static void test_sk_storage_map_stress_free(void)
+ 		rlim_new.rlim_max = rlim_new.rlim_cur + 128;
+ 		err = setrlimit(RLIMIT_NOFILE, &rlim_new);
+ 		CHECK(err, "setrlimit(RLIMIT_NOFILE)", "rlim_new:%lu errno:%d",
+-		      rlim_new.rlim_cur, errno);
++		      (unsigned long) rlim_new.rlim_cur, errno);
+ 	}
+ 
+ 	err = do_sk_storage_map_stress_free();
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compile-if-backtrace-support-missi.patch b/queue-6.1/selftests-bpf-fix-compile-if-backtrace-support-missi.patch
new file mode 100644
index 00000000000..a258b4150f6
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compile-if-backtrace-support-missi.patch
@@ -0,0 +1,69 @@
+From 3d2138e1413511bebf74be17bc9ee8241e2be1ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 02:24:22 -0700
+Subject: selftests/bpf: Fix compile if backtrace support missing in libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit c9a83e76b5a96801a2c7ea0a79ca77c356d8b38d ]
+
+Include GNU <execinfo.h> header only with glibc and provide weak, stubbed
+backtrace functions as a fallback in test_progs.c. This allows for non-GNU
+replacements while avoiding compile errors (e.g. with musl libc) like:
+
+  test_progs.c:13:10: fatal error: execinfo.h: No such file or directory
+     13 | #include <execinfo.h> /* backtrace */
+        |          ^~~~~~~~~~~~
+  test_progs.c: In function 'crash_handler':
+  test_progs.c:1034:14: error: implicit declaration of function 'backtrace' [-Werror=implicit-function-declaration]
+   1034 |         sz = backtrace(bt, ARRAY_SIZE(bt));
+        |              ^~~~~~~~~
+  test_progs.c:1045:9: error: implicit declaration of function 'backtrace_symbols_fd' [-Werror=implicit-function-declaration]
+   1045 |         backtrace_symbols_fd(bt, sz, STDERR_FILENO);
+        |         ^~~~~~~~~~~~~~~~~~~~
+
+Fixes: 9fb156bb82a3 ("selftests/bpf: Print backtrace on SIGSEGV in test_progs")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/aa6dc8e23710cb457b278039d0081de7e7b4847d.1722244708.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index e78289b72739f..11d4c51c7d211 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -10,13 +10,27 @@
+ #include <sched.h>
+ #include <signal.h>
+ #include <string.h>
+-#include <execinfo.h> /* backtrace */
+ #include <sys/sysinfo.h> /* get_nprocs */
+ #include <netinet/in.h>
+ #include <sys/select.h>
+ #include <sys/socket.h>
+ #include <sys/un.h>
+ 
++#ifdef __GLIBC__
++#include <execinfo.h> /* backtrace */
++#endif
++
++/* Default backtrace funcs if missing at link */
++__weak int backtrace(void **buffer, int size)
++{
++	return 0;
++}
++
++__weak void backtrace_symbols_fd(void *const *buffer, int size, int fd)
++{
++	dprintf(fd, "<backtrace not supported>\n");
++}
++
+ static bool verbose(void)
+ {
+ 	return env.verbosity > VERBOSE_NONE;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compiling-core_reloc.c-with-musl-l.patch b/queue-6.1/selftests-bpf-fix-compiling-core_reloc.c-with-musl-l.patch
new file mode 100644
index 00000000000..6d2b584b0db
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compiling-core_reloc.c-with-musl-l.patch
@@ -0,0 +1,43 @@
+From 0a9b20f39e3b823a3a0ae9cf5adfec54bc944f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:42 -0700
+Subject: selftests/bpf: Fix compiling core_reloc.c with musl-libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit debfa4f628f271f72933bf38d581cc53cfe1def5 ]
+
+The type 'loff_t' is a GNU extension and not exposed by the musl 'fcntl.h'
+header unless _GNU_SOURCE is defined. Add this definition to fix errors
+seen compiling for mips64el/musl-libc:
+
+  In file included from tools/testing/selftests/bpf/prog_tests/core_reloc.c:4:
+  ./bpf_testmod/bpf_testmod.h:10:9: error: unknown type name 'loff_t'
+     10 |         loff_t off;
+        |         ^~~~~~
+  ./bpf_testmod/bpf_testmod.h:16:9: error: unknown type name 'loff_t'
+     16 |         loff_t off;
+        |         ^~~~~~
+
+Fixes: 6bcd39d366b6 ("selftests/bpf: Add CO-RE relocs selftest relying on kernel module BTF")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/11c3af75a7eb6bcb7ad9acfae6a6f470c572eb82.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/core_reloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+index 47f42e6801056..26019313e1fc2 100644
+--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c
++++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <test_progs.h>
+ #include "progs/core_reloc_types.h"
+ #include "bpf_testmod/bpf_testmod.h"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compiling-flow_dissector.c-with-mu.patch b/queue-6.1/selftests-bpf-fix-compiling-flow_dissector.c-with-mu.patch
new file mode 100644
index 00000000000..b0283e0fddf
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compiling-flow_dissector.c-with-mu.patch
@@ -0,0 +1,46 @@
+From ee40684c914b875cd695dabedcf9e3c6a176bb4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:40 -0700
+Subject: selftests/bpf: Fix compiling flow_dissector.c with musl-libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 5e4c43bcb85973243d7274e0058b6e8f5810e4f7 ]
+
+The GNU version of 'struct tcphdr' has members 'doff', 'source' and 'dest',
+which are not exposed by musl libc headers unless _GNU_SOURCE is defined.
+
+Add this definition to fix errors seen compiling for mips64el/musl-libc:
+
+  flow_dissector.c:118:30: error: 'struct tcphdr' has no member named 'doff'
+    118 |                         .tcp.doff = 5,
+        |                              ^~~~
+  flow_dissector.c:119:30: error: 'struct tcphdr' has no member named 'source'
+    119 |                         .tcp.source = 80,
+        |                              ^~~~~~
+  flow_dissector.c:120:30: error: 'struct tcphdr' has no member named 'dest'
+    120 |                         .tcp.dest = 8080,
+        |                              ^~~~
+
+Fixes: ae173a915785 ("selftests/bpf: support BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/8f7ab21a73f678f9cebd32b26c444a686e57414d.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/flow_dissector.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+index 7acca37a3d2b5..657b5dbdafaf6 100644
+--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
++++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <test_progs.h>
+ #include <network_helpers.h>
+ #include <error.h>
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compiling-kfree_skb.c-with-musl-li.patch b/queue-6.1/selftests-bpf-fix-compiling-kfree_skb.c-with-musl-li.patch
new file mode 100644
index 00000000000..7619faaa1af
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compiling-kfree_skb.c-with-musl-li.patch
@@ -0,0 +1,41 @@
+From 2abd1492dbb4f65d4540bbb8692c0962221496db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:39 -0700
+Subject: selftests/bpf: Fix compiling kfree_skb.c with musl-libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit bae9a5ce7d3a9b3a9e07b31ab9e9c58450e3e9fd ]
+
+The GNU version of 'struct tcphdr' with member 'doff' is not exposed by
+musl headers unless _GNU_SOURCE is defined. Add this definition to fix
+errors seen compiling for mips64el/musl-libc:
+
+  In file included from kfree_skb.c:2:
+  kfree_skb.c: In function 'on_sample':
+  kfree_skb.c:45:30: error: 'struct tcphdr' has no member named 'doff'
+     45 |         if (CHECK(pkt_v6->tcp.doff != 5, "check_tcp",
+        |                              ^
+
+Fixes: 580d656d80cf ("selftests/bpf: Add kfree_skb raw_tp test")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/e2d8cedc790959c10d6822a51f01a7a3616bea1b.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/kfree_skb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/kfree_skb.c b/tools/testing/selftests/bpf/prog_tests/kfree_skb.c
+index 73579370bfbd6..353499cfb1e41 100644
+--- a/tools/testing/selftests/bpf/prog_tests/kfree_skb.c
++++ b/tools/testing/selftests/bpf/prog_tests/kfree_skb.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <test_progs.h>
+ #include <network_helpers.h>
+ #include "kfree_skb.skel.h"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-compiling-tcp_rtt.c-with-musl-libc.patch b/queue-6.1/selftests-bpf-fix-compiling-tcp_rtt.c-with-musl-libc.patch
new file mode 100644
index 00000000000..ab53dc02603
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-compiling-tcp_rtt.c-with-musl-libc.patch
@@ -0,0 +1,43 @@
+From 7e2fe012367303d90db834ce295f04b8a161807b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:41 -0700
+Subject: selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 18826fb0b79c3c3cd1fe765d85f9c6f1a902c722 ]
+
+The GNU version of 'struct tcp_info' in 'netinet/tcp.h' is not exposed by
+musl headers unless _GNU_SOURCE is defined.
+
+Add this definition to fix errors seen compiling for mips64el/musl-libc:
+
+  tcp_rtt.c: In function 'wait_for_ack':
+  tcp_rtt.c:24:25: error: storage size of 'info' isn't known
+     24 |         struct tcp_info info;
+        |                         ^~~~
+  tcp_rtt.c:24:25: error: unused variable 'info' [-Werror=unused-variable]
+  cc1: all warnings being treated as errors
+
+Fixes: 1f4f80fed217 ("selftests/bpf: test_progs: convert test_tcp_rtt")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/f2329767b15df206f08a5776d35a47c37da855ae.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/tcp_rtt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c b/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c
+index 8fe84da1b9b49..6a2da7a64419a 100644
+--- a/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c
++++ b/tools/testing/selftests/bpf/prog_tests/tcp_rtt.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <test_progs.h>
+ #include "cgroup_helpers.h"
+ #include "network_helpers.h"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-error-compiling-bpf_iter_setsockop.patch b/queue-6.1/selftests-bpf-fix-error-compiling-bpf_iter_setsockop.patch
new file mode 100644
index 00000000000..d25473b1783
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-error-compiling-bpf_iter_setsockop.patch
@@ -0,0 +1,59 @@
+From 8b127a47ee35e179141047310e9fc0f81e022844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:30 -0700
+Subject: selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl
+ libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 7b10f0c227ce3fa055d601f058dc411092a62a78 ]
+
+Existing code calls getsockname() with a 'struct sockaddr_in6 *' argument
+where a 'struct sockaddr *' argument is declared, yielding compile errors
+when building for mips64el/musl-libc:
+
+  bpf_iter_setsockopt.c: In function 'get_local_port':
+  bpf_iter_setsockopt.c:98:30: error: passing argument 2 of 'getsockname' from incompatible pointer type [-Werror=incompatible-pointer-types]
+     98 |         if (!getsockname(fd, &addr, &addrlen))
+        |                              ^~~~~
+        |                              |
+        |                              struct sockaddr_in6 *
+  In file included from .../netinet/in.h:10,
+                   from .../arpa/inet.h:9,
+                   from ./test_progs.h:17,
+                   from bpf_iter_setsockopt.c:5:
+  .../sys/socket.h:391:23: note: expected 'struct sockaddr * restrict' but argument is of type 'struct sockaddr_in6 *'
+    391 | int getsockname (int, struct sockaddr *__restrict, socklen_t *__restrict);
+        |                       ^
+  cc1: all warnings being treated as errors
+
+This compiled under glibc only because the argument is declared to be a
+"funky" transparent union which includes both types above. Explicitly cast
+the argument to allow compiling for both musl and glibc.
+
+Fixes: eed92afdd14c ("bpf: selftest: Test batching and bpf_(get|set)sockopt in bpf tcp iter")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Geliang Tang <geliang@kernel.org>
+Link: https://lore.kernel.org/bpf/f41def0f17b27a23b1709080e4e3f37f4cc11ca9.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c b/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c
+index b52ff8ce34db8..16bed9dd8e6a3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c
++++ b/tools/testing/selftests/bpf/prog_tests/bpf_iter_setsockopt.c
+@@ -95,7 +95,7 @@ static unsigned short get_local_port(int fd)
+ 	struct sockaddr_in6 addr;
+ 	socklen_t addrlen = sizeof(addr);
+ 
+-	if (!getsockname(fd, &addr, &addrlen))
++	if (!getsockname(fd, (struct sockaddr *)&addr, &addrlen))
+ 		return ntohs(addr.sin6_port);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-error-compiling-test_lru_map.c.patch b/queue-6.1/selftests-bpf-fix-error-compiling-test_lru_map.c.patch
new file mode 100644
index 00000000000..200db1a9892
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-error-compiling-test_lru_map.c.patch
@@ -0,0 +1,46 @@
+From 75bfdcfa2b9a5b0314760918ec731587661aa4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 02:24:19 -0700
+Subject: selftests/bpf: Fix error compiling test_lru_map.c
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit cacf2a5a78cd1f5f616eae043ebc6f024104b721 ]
+
+Although the post-increment in macro 'CPU_SET(next++, &cpuset)' seems safe,
+the sequencing can raise compile errors, so move the increment outside the
+macro. This avoids an error seen using gcc 12.3.0 for mips64el/musl-libc:
+
+  In file included from test_lru_map.c:11:
+  test_lru_map.c: In function 'sched_next_online':
+  test_lru_map.c:129:29: error: operation on 'next' may be undefined [-Werror=sequence-point]
+    129 |                 CPU_SET(next++, &cpuset);
+        |                             ^
+  cc1: all warnings being treated as errors
+
+Fixes: 3fbfadce6012 ("bpf: Fix test_lru_sanity5() in test_lru_map.c")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/22993dfb11ccf27925a626b32672fd3324cb76c4.1722244708.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lru_map.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
+index 4d0650cfb5cd8..fda7589c50236 100644
+--- a/tools/testing/selftests/bpf/test_lru_map.c
++++ b/tools/testing/selftests/bpf/test_lru_map.c
+@@ -126,7 +126,8 @@ static int sched_next_online(int pid, int *next_to_try)
+ 
+ 	while (next < nr_cpus) {
+ 		CPU_ZERO(&cpuset);
+-		CPU_SET(next++, &cpuset);
++		CPU_SET(next, &cpuset);
++		next++;
+ 		if (!sched_setaffinity(pid, sizeof(cpuset), &cpuset)) {
+ 			ret = 0;
+ 			break;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-errors-compiling-cg_storage_multi..patch b/queue-6.1/selftests-bpf-fix-errors-compiling-cg_storage_multi..patch
new file mode 100644
index 00000000000..ef623bde8ee
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-errors-compiling-cg_storage_multi..patch
@@ -0,0 +1,49 @@
+From 1b66f0316ef977567ec16633a23b8a89708bdcce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:46 -0700
+Subject: selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 730561d3c08d4a327cceaabf11365958a1c00cec ]
+
+Remove a redundant include of '<asm/types.h>', whose needed definitions are
+already included (via '<linux/types.h>') in cg_storage_multi_egress_only.c,
+cg_storage_multi_isolated.c, and cg_storage_multi_shared.c. This avoids
+redefinition errors seen compiling for mips64el/musl-libc like:
+
+  In file included from progs/cg_storage_multi_egress_only.c:13:
+  In file included from progs/cg_storage_multi.h:6:
+  In file included from /usr/mips64el-linux-gnuabi64/include/asm/types.h:23:
+  /usr/include/asm-generic/int-l64.h:29:25: error: typedef redefinition with different types ('long' vs 'long long')
+     29 | typedef __signed__ long __s64;
+        |                         ^
+  /usr/include/asm-generic/int-ll64.h:30:44: note: previous definition is here
+     30 | __extension__ typedef __signed__ long long __s64;
+        |                                            ^
+
+Fixes: 9e5bd1f7633b ("selftests/bpf: Test CGROUP_STORAGE map can't be used by multiple progs")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/4f4702e9f6115b7f84fea01b2326ca24c6df7ba8.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/cg_storage_multi.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/cg_storage_multi.h b/tools/testing/selftests/bpf/progs/cg_storage_multi.h
+index a0778fe7857a1..41d59f0ee606c 100644
+--- a/tools/testing/selftests/bpf/progs/cg_storage_multi.h
++++ b/tools/testing/selftests/bpf/progs/cg_storage_multi.h
+@@ -3,8 +3,6 @@
+ #ifndef __PROGS_CG_STORAGE_MULTI_H
+ #define __PROGS_CG_STORAGE_MULTI_H
+ 
+-#include <asm/types.h>
+-
+ struct cgroup_value {
+ 	__u32 egress_pkts;
+ 	__u32 ingress_pkts;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-include-of-sys-fcntl.h.patch b/queue-6.1/selftests-bpf-fix-include-of-sys-fcntl.h.patch
new file mode 100644
index 00000000000..535021e18db
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-include-of-sys-fcntl.h.patch
@@ -0,0 +1,43 @@
+From 01c801b775c7a597a288d610d8ba94900b656258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:37 -0700
+Subject: selftests/bpf: Fix include of <sys/fcntl.h>
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 21f0b0af977203220ad58aff95e372151288ec47 ]
+
+Update ns_current_pid_tgid.c to use '#include <fcntl.h>' and avoid compile
+error against mips64el/musl libc:
+
+  In file included from .../prog_tests/ns_current_pid_tgid.c:14:
+  .../include/sys/fcntl.h:1:2: error: #warning redirecting incorrect #include <sys/fcntl.h> to <fcntl.h> [-Werror=cpp]
+      1 | #warning redirecting incorrect #include <sys/fcntl.h> to <fcntl.h>
+        |  ^~~~~~~
+  cc1: all warnings being treated as errors
+
+Fixes: 09c02d553c49 ("bpf, selftests: Fold test_current_pid_tgid_new_ns into test_progs.")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/8bdc869749177b575025bf69600a4ce591822609.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+index fded38d24aae4..2c57ceede095e 100644
+--- a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+@@ -11,7 +11,7 @@
+ #include <sched.h>
+ #include <sys/wait.h>
+ #include <sys/mount.h>
+-#include <sys/fcntl.h>
++#include <fcntl.h>
+ #include "network_helpers.h"
+ 
+ #define STACK_SIZE (1024 * 1024)
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-missing-array_size-definition-in-b.patch b/queue-6.1/selftests-bpf-fix-missing-array_size-definition-in-b.patch
new file mode 100644
index 00000000000..3f4c3e4958c
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-missing-array_size-definition-in-b.patch
@@ -0,0 +1,42 @@
+From 9512a38d4a2a00be025582be6ee1707fd7d5af2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:34 -0700
+Subject: selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit d44c93fc2f5a0c47b23fa03d374e45259abd92d2 ]
+
+Add a "bpf_util.h" include to avoid the following error seen compiling for
+mips64el with musl libc:
+
+  bench.c: In function 'find_benchmark':
+  bench.c:590:25: error: implicit declaration of function 'ARRAY_SIZE' [-Werror=implicit-function-declaration]
+    590 |         for (i = 0; i < ARRAY_SIZE(benchs); i++) {
+        |                         ^~~~~~~~~~
+  cc1: all warnings being treated as errors
+
+Fixes: 8e7c2a023ac0 ("selftests/bpf: Add benchmark runner infrastructure")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/bc4dde77dfcd17a825d8f28f72f3292341966810.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/bench.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c
+index c1f20a1474624..dd39df9c2b0f4 100644
+--- a/tools/testing/selftests/bpf/bench.c
++++ b/tools/testing/selftests/bpf/bench.c
+@@ -10,6 +10,7 @@
+ #include <sys/sysinfo.h>
+ #include <signal.h>
+ #include "bench.h"
++#include "bpf_util.h"
+ #include "testing_helpers.h"
+ 
+ struct env env = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-missing-build_bug_on-declaration.patch b/queue-6.1/selftests-bpf-fix-missing-build_bug_on-declaration.patch
new file mode 100644
index 00000000000..0f472d9a3d7
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-missing-build_bug_on-declaration.patch
@@ -0,0 +1,42 @@
+From ef41fc6ff8a445d2ecaaa799a9c8ef4f67f71a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:36 -0700
+Subject: selftests/bpf: Fix missing BUILD_BUG_ON() declaration
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit 6495eb79ca7d15bd87c38d77307e8f9b6b7bf4ef ]
+
+Explicitly include '<linux/build_bug.h>' to fix errors seen compiling with
+gcc targeting mips64el/musl-libc:
+
+  user_ringbuf.c: In function 'test_user_ringbuf_loop':
+  user_ringbuf.c:426:9: error: implicit declaration of function 'BUILD_BUG_ON' [-Werror=implicit-function-declaration]
+    426 |         BUILD_BUG_ON(total_samples <= c_max_entries);
+        |         ^~~~~~~~~~~~
+  cc1: all warnings being treated as errors
+
+Fixes: e5a9df51c746 ("selftests/bpf: Add selftests validating the user ringbuf")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/b28575f9221ec54871c46a2e87612bb4bbf46ccd.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/user_ringbuf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
+index 02b18d018b36a..ca81d660eb96f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
++++ b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
+@@ -4,6 +4,7 @@
+ #define _GNU_SOURCE
+ #include <linux/compiler.h>
+ #include <linux/ring_buffer.h>
++#include <linux/build_bug.h>
+ #include <pthread.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-missing-uint_max-definitions-in-be.patch b/queue-6.1/selftests-bpf-fix-missing-uint_max-definitions-in-be.patch
new file mode 100644
index 00000000000..3f7b8661738
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-missing-uint_max-definitions-in-be.patch
@@ -0,0 +1,48 @@
+From 19cef8bc7f76918ddda4d07e478dfa0fbb38a089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:35 -0700
+Subject: selftests/bpf: Fix missing UINT_MAX definitions in benchmarks
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit a2c155131b710959beb508ca6a54769b6b1bd488 ]
+
+Include <limits.h> in 'bench.h' to provide a UINT_MAX definition and avoid
+multiple compile errors against mips64el/musl-libc like:
+
+  benchs/bench_local_storage.c: In function 'parse_arg':
+  benchs/bench_local_storage.c:40:38: error: 'UINT_MAX' undeclared (first use in this function)
+     40 |                 if (ret < 1 || ret > UINT_MAX) {
+        |                                      ^~~~~~~~
+  benchs/bench_local_storage.c:11:1: note: 'UINT_MAX' is defined in header '<limits.h>'; did you forget to '#include <limits.h>'?
+     10 | #include <test_btf.h>
+    +++ |+#include <limits.h>
+     11 |
+
+seen with bench_local_storage.c, bench_local_storage_rcu_tasks_trace.c, and
+bench_bpf_hashmap_lookup.c.
+
+Fixes: 73087489250d ("selftests/bpf: Add benchmark for local_storage get")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/8f64a9d9fcff40a7fca090a65a68a9b62a468e16.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/bench.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/bench.h b/tools/testing/selftests/bpf/bench.h
+index d748255877e2d..6695938714837 100644
+--- a/tools/testing/selftests/bpf/bench.h
++++ b/tools/testing/selftests/bpf/bench.h
+@@ -10,6 +10,7 @@
+ #include <math.h>
+ #include <time.h>
+ #include <sys/syscall.h>
++#include <limits.h>
+ 
+ struct cpu_set {
+ 	bool *cpus;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-move-test_progs-helpers-to-testing_hel.patch b/queue-6.1/selftests-bpf-move-test_progs-helpers-to-testing_hel.patch
new file mode 100644
index 00000000000..5ce675361ec
--- /dev/null
+++ b/queue-6.1/selftests-bpf-move-test_progs-helpers-to-testing_hel.patch
@@ -0,0 +1,247 @@
+From 76e1329e901fe717855579f483a161edca3eeae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 15:37:49 +0200
+Subject: selftests/bpf: Move test_progs helpers to testing_helpers object
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 45db310984bfea977177fb5fc0ea23ab430129bd ]
+
+Moving test_progs helpers to testing_helpers object so they can be
+used from test_verifier in following changes.
+
+Also adding missing ifndef header guard to testing_helpers.h header.
+
+Using stderr instead of env.stderr because un/load_bpf_testmod helpers
+will be used outside test_progs. Also at the point of calling them
+in test_progs the std files are not hijacked yet and stderr is the
+same as env.stderr.
+
+Acked-by: David Vernet <void@manifault.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230515133756.1658301-4-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: c9a83e76b5a9 ("selftests/bpf: Fix compile if backtrace support missing in libc")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c      | 67 +------------------
+ tools/testing/selftests/bpf/test_progs.h      |  1 -
+ tools/testing/selftests/bpf/testing_helpers.c | 63 +++++++++++++++++
+ tools/testing/selftests/bpf/testing_helpers.h |  9 +++
+ 4 files changed, 74 insertions(+), 66 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 513ee92e4f67c..e78289b72739f 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -11,7 +11,6 @@
+ #include <signal.h>
+ #include <string.h>
+ #include <execinfo.h> /* backtrace */
+-#include <linux/membarrier.h>
+ #include <sys/sysinfo.h> /* get_nprocs */
+ #include <netinet/in.h>
+ #include <sys/select.h>
+@@ -583,68 +582,6 @@ int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len)
+ 	return err;
+ }
+ 
+-static int finit_module(int fd, const char *param_values, int flags)
+-{
+-	return syscall(__NR_finit_module, fd, param_values, flags);
+-}
+-
+-static int delete_module(const char *name, int flags)
+-{
+-	return syscall(__NR_delete_module, name, flags);
+-}
+-
+-/*
+- * Trigger synchronize_rcu() in kernel.
+- */
+-int kern_sync_rcu(void)
+-{
+-	return syscall(__NR_membarrier, MEMBARRIER_CMD_SHARED, 0, 0);
+-}
+-
+-static void unload_bpf_testmod(void)
+-{
+-	if (kern_sync_rcu())
+-		fprintf(env.stderr, "Failed to trigger kernel-side RCU sync!\n");
+-	if (delete_module("bpf_testmod", 0)) {
+-		if (errno == ENOENT) {
+-			if (verbose())
+-				fprintf(stdout, "bpf_testmod.ko is already unloaded.\n");
+-			return;
+-		}
+-		fprintf(env.stderr, "Failed to unload bpf_testmod.ko from kernel: %d\n", -errno);
+-		return;
+-	}
+-	if (verbose())
+-		fprintf(stdout, "Successfully unloaded bpf_testmod.ko.\n");
+-}
+-
+-static int load_bpf_testmod(void)
+-{
+-	int fd;
+-
+-	/* ensure previous instance of the module is unloaded */
+-	unload_bpf_testmod();
+-
+-	if (verbose())
+-		fprintf(stdout, "Loading bpf_testmod.ko...\n");
+-
+-	fd = open("bpf_testmod.ko", O_RDONLY);
+-	if (fd < 0) {
+-		fprintf(env.stderr, "Can't find bpf_testmod.ko kernel module: %d\n", -errno);
+-		return -ENOENT;
+-	}
+-	if (finit_module(fd, "", 0)) {
+-		fprintf(env.stderr, "Failed to load bpf_testmod.ko into the kernel: %d\n", -errno);
+-		close(fd);
+-		return -EINVAL;
+-	}
+-	close(fd);
+-
+-	if (verbose())
+-		fprintf(stdout, "Successfully loaded bpf_testmod.ko.\n");
+-	return 0;
+-}
+-
+ /* extern declarations for test funcs */
+ #define DEFINE_TEST(name)				\
+ 	extern void test_##name(void) __weak;		\
+@@ -1586,7 +1523,7 @@ int main(int argc, char **argv)
+ 	env.stderr = stderr;
+ 
+ 	env.has_testmod = true;
+-	if (!env.list_test_names && load_bpf_testmod()) {
++	if (!env.list_test_names && load_bpf_testmod(verbose())) {
+ 		fprintf(env.stderr, "WARNING! Selftests relying on bpf_testmod.ko will be skipped.\n");
+ 		env.has_testmod = false;
+ 	}
+@@ -1685,7 +1622,7 @@ int main(int argc, char **argv)
+ 	close(env.saved_netns_fd);
+ out:
+ 	if (!env.list_test_names && env.has_testmod)
+-		unload_bpf_testmod();
++		unload_bpf_testmod(verbose());
+ 
+ 	free_test_selector(&env.test_selector);
+ 	free_test_selector(&env.subtest_selector);
+diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
+index 924764f6ba976..feb14f14006d9 100644
+--- a/tools/testing/selftests/bpf/test_progs.h
++++ b/tools/testing/selftests/bpf/test_progs.h
+@@ -380,7 +380,6 @@ static inline void *u64_to_ptr(__u64 ptr)
+ int bpf_find_map(const char *test, struct bpf_object *obj, const char *name);
+ int compare_map_keys(int map1_fd, int map2_fd);
+ int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len);
+-int kern_sync_rcu(void);
+ int trigger_module_test_read(int read_sz);
+ int trigger_module_test_write(int write_sz);
+ int write_sysctl(const char *sysctl, const char *value);
+diff --git a/tools/testing/selftests/bpf/testing_helpers.c b/tools/testing/selftests/bpf/testing_helpers.c
+index 9c3de39023f60..cbf7e8cdd3e2f 100644
+--- a/tools/testing/selftests/bpf/testing_helpers.c
++++ b/tools/testing/selftests/bpf/testing_helpers.c
+@@ -8,6 +8,7 @@
+ #include <bpf/libbpf.h>
+ #include "test_progs.h"
+ #include "testing_helpers.h"
++#include <linux/membarrier.h>
+ 
+ int parse_num_list(const char *s, bool **num_set, int *num_set_len)
+ {
+@@ -249,3 +250,65 @@ __u64 read_perf_max_sample_freq(void)
+ 	fclose(f);
+ 	return sample_freq;
+ }
++
++static int finit_module(int fd, const char *param_values, int flags)
++{
++	return syscall(__NR_finit_module, fd, param_values, flags);
++}
++
++static int delete_module(const char *name, int flags)
++{
++	return syscall(__NR_delete_module, name, flags);
++}
++
++void unload_bpf_testmod(bool verbose)
++{
++	if (kern_sync_rcu())
++		fprintf(stderr, "Failed to trigger kernel-side RCU sync!\n");
++	if (delete_module("bpf_testmod", 0)) {
++		if (errno == ENOENT) {
++			if (verbose)
++				fprintf(stdout, "bpf_testmod.ko is already unloaded.\n");
++			return;
++		}
++		fprintf(stderr, "Failed to unload bpf_testmod.ko from kernel: %d\n", -errno);
++		return;
++	}
++	if (verbose)
++		fprintf(stdout, "Successfully unloaded bpf_testmod.ko.\n");
++}
++
++int load_bpf_testmod(bool verbose)
++{
++	int fd;
++
++	/* ensure previous instance of the module is unloaded */
++	unload_bpf_testmod(verbose);
++
++	if (verbose)
++		fprintf(stdout, "Loading bpf_testmod.ko...\n");
++
++	fd = open("bpf_testmod.ko", O_RDONLY);
++	if (fd < 0) {
++		fprintf(stderr, "Can't find bpf_testmod.ko kernel module: %d\n", -errno);
++		return -ENOENT;
++	}
++	if (finit_module(fd, "", 0)) {
++		fprintf(stderr, "Failed to load bpf_testmod.ko into the kernel: %d\n", -errno);
++		close(fd);
++		return -EINVAL;
++	}
++	close(fd);
++
++	if (verbose)
++		fprintf(stdout, "Successfully loaded bpf_testmod.ko.\n");
++	return 0;
++}
++
++/*
++ * Trigger synchronize_rcu() in kernel.
++ */
++int kern_sync_rcu(void)
++{
++	return syscall(__NR_membarrier, MEMBARRIER_CMD_SHARED, 0, 0);
++}
+diff --git a/tools/testing/selftests/bpf/testing_helpers.h b/tools/testing/selftests/bpf/testing_helpers.h
+index eb8790f928e4c..f72fb24f8e90f 100644
+--- a/tools/testing/selftests/bpf/testing_helpers.h
++++ b/tools/testing/selftests/bpf/testing_helpers.h
+@@ -1,5 +1,9 @@
+ /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
+ /* Copyright (C) 2020 Facebook, Inc. */
++
++#ifndef __TESTING_HELPERS_H
++#define __TESTING_HELPERS_H
++
+ #include <stdbool.h>
+ #include <bpf/bpf.h>
+ #include <bpf/libbpf.h>
+@@ -22,3 +26,8 @@ int parse_test_list(const char *s,
+ 		    bool is_glob_pattern);
+ 
+ __u64 read_perf_max_sample_freq(void);
++int load_bpf_testmod(bool verbose);
++void unload_bpf_testmod(bool verbose);
++int kern_sync_rcu(void);
++
++#endif /* __TESTING_HELPERS_H */
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-refactor-out-some-functions-in-ns_curr.patch b/queue-6.1/selftests-bpf-refactor-out-some-functions-in-ns_curr.patch
new file mode 100644
index 00000000000..58122a32096
--- /dev/null
+++ b/queue-6.1/selftests-bpf-refactor-out-some-functions-in-ns_curr.patch
@@ -0,0 +1,158 @@
+From 003835cf80c166f7050328e357a0210518964d1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 11:49:04 -0700
+Subject: selftests/bpf: Refactor out some functions in ns_current_pid_tgid
+ test
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 4d4bd29e363c467752536f874a2cba10a5923c59 ]
+
+Refactor some functions in both user space code and bpf program
+as these functions are used by later cgroup/sk_msg tests.
+Another change is to mark tp program optional loading as later
+patches will use optional loading as well since they have quite
+different attachment and testing logic.
+
+There is no functionality change.
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240315184904.2976123-1-yonghong.song@linux.dev
+Stable-dep-of: 21f0b0af9772 ("selftests/bpf: Fix include of <sys/fcntl.h>")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/ns_current_pid_tgid.c      | 53 ++++++++++++-------
+ .../bpf/progs/test_ns_current_pid_tgid.c      | 10 ++--
+ 2 files changed, 41 insertions(+), 22 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+index 3a0664a86243e..847d7b70e2902 100644
+--- a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+@@ -16,30 +16,46 @@
+ #define STACK_SIZE (1024 * 1024)
+ static char child_stack[STACK_SIZE];
+ 
+-static int test_current_pid_tgid(void *args)
++static int get_pid_tgid(pid_t *pid, pid_t *tgid,
++			struct test_ns_current_pid_tgid__bss *bss)
+ {
+-	struct test_ns_current_pid_tgid__bss  *bss;
+-	struct test_ns_current_pid_tgid *skel;
+-	int ret = -1, err;
+-	pid_t tgid, pid;
+ 	struct stat st;
++	int err;
+ 
+-	skel = test_ns_current_pid_tgid__open_and_load();
+-	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open_and_load"))
+-		goto out;
+-
+-	pid = syscall(SYS_gettid);
+-	tgid = getpid();
++	*pid = syscall(SYS_gettid);
++	*tgid = getpid();
+ 
+ 	err = stat("/proc/self/ns/pid", &st);
+ 	if (!ASSERT_OK(err, "stat /proc/self/ns/pid"))
+-		goto cleanup;
++		return err;
+ 
+-	bss = skel->bss;
+ 	bss->dev = st.st_dev;
+ 	bss->ino = st.st_ino;
+ 	bss->user_pid = 0;
+ 	bss->user_tgid = 0;
++	return 0;
++}
++
++static int test_current_pid_tgid_tp(void *args)
++{
++	struct test_ns_current_pid_tgid__bss  *bss;
++	struct test_ns_current_pid_tgid *skel;
++	int ret = -1, err;
++	pid_t tgid, pid;
++
++	skel = test_ns_current_pid_tgid__open();
++	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open"))
++		return ret;
++
++	bpf_program__set_autoload(skel->progs.tp_handler, true);
++
++	err = test_ns_current_pid_tgid__load(skel);
++	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__load"))
++		goto cleanup;
++
++	bss = skel->bss;
++	if (get_pid_tgid(&pid, &tgid, bss))
++		goto cleanup;
+ 
+ 	err = test_ns_current_pid_tgid__attach(skel);
+ 	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__attach"))
+@@ -55,11 +71,10 @@ static int test_current_pid_tgid(void *args)
+ 
+ cleanup:
+ 	test_ns_current_pid_tgid__destroy(skel);
+-out:
+ 	return ret;
+ }
+ 
+-static void test_ns_current_pid_tgid_new_ns(void)
++static void test_ns_current_pid_tgid_new_ns(int (*fn)(void *), void *arg)
+ {
+ 	int wstatus;
+ 	pid_t cpid;
+@@ -67,8 +82,8 @@ static void test_ns_current_pid_tgid_new_ns(void)
+ 	/* Create a process in a new namespace, this process
+ 	 * will be the init process of this new namespace hence will be pid 1.
+ 	 */
+-	cpid = clone(test_current_pid_tgid, child_stack + STACK_SIZE,
+-		     CLONE_NEWPID | SIGCHLD, NULL);
++	cpid = clone(fn, child_stack + STACK_SIZE,
++		     CLONE_NEWPID | SIGCHLD, arg);
+ 
+ 	if (!ASSERT_NEQ(cpid, -1, "clone"))
+ 		return;
+@@ -84,7 +99,7 @@ static void test_ns_current_pid_tgid_new_ns(void)
+ void serial_test_ns_current_pid_tgid(void)
+ {
+ 	if (test__start_subtest("root_ns_tp"))
+-		test_current_pid_tgid(NULL);
++		test_current_pid_tgid_tp(NULL);
+ 	if (test__start_subtest("new_ns_tp"))
+-		test_ns_current_pid_tgid_new_ns();
++		test_ns_current_pid_tgid_new_ns(test_current_pid_tgid_tp, NULL);
+ }
+diff --git a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
+index 0763d49f9c421..aa3ec7ca16d9b 100644
+--- a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
+@@ -10,17 +10,21 @@ __u64 user_tgid = 0;
+ __u64 dev = 0;
+ __u64 ino = 0;
+ 
+-SEC("tracepoint/syscalls/sys_enter_nanosleep")
+-int handler(const void *ctx)
++static void get_pid_tgid(void)
+ {
+ 	struct bpf_pidns_info nsdata;
+ 
+ 	if (bpf_get_ns_current_pid_tgid(dev, ino, &nsdata, sizeof(struct bpf_pidns_info)))
+-		return 0;
++		return;
+ 
+ 	user_pid = nsdata.pid;
+ 	user_tgid = nsdata.tgid;
++}
+ 
++SEC("?tracepoint/syscalls/sys_enter_nanosleep")
++int tp_handler(const void *ctx)
++{
++	get_pid_tgid();
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-replace-check-with-assert_-in-ns_curre.patch b/queue-6.1/selftests-bpf-replace-check-with-assert_-in-ns_curre.patch
new file mode 100644
index 00000000000..6e0eddb57ab
--- /dev/null
+++ b/queue-6.1/selftests-bpf-replace-check-with-assert_-in-ns_curre.patch
@@ -0,0 +1,121 @@
+From b70627f2da012f9f85546ed152cc3676a309a19f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 11:48:59 -0700
+Subject: selftests/bpf: Replace CHECK with ASSERT_* in ns_current_pid_tgid
+ test
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 84239a24d10174fcfc7d6760cb120435a6ff69af ]
+
+Replace CHECK in selftest ns_current_pid_tgid with recommended ASSERT_* style.
+I also shortened subtest name as the prefix of subtest name is covered
+by the test name already.
+
+This patch does fix a testing issue. Currently even if bss->user_{pid,tgid}
+is not correct, the test still passed since the clone func returns 0.
+I fixed it to return a non-zero value if bss->user_{pid,tgid} is incorrect.
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20240315184859.2975543-1-yonghong.song@linux.dev
+Stable-dep-of: 21f0b0af9772 ("selftests/bpf: Fix include of <sys/fcntl.h>")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/ns_current_pid_tgid.c      | 36 ++++++++++---------
+ 1 file changed, 19 insertions(+), 17 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+index 24d493482ffc7..3a0664a86243e 100644
+--- a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
++++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
+@@ -20,19 +20,19 @@ static int test_current_pid_tgid(void *args)
+ {
+ 	struct test_ns_current_pid_tgid__bss  *bss;
+ 	struct test_ns_current_pid_tgid *skel;
+-	int err = -1, duration = 0;
++	int ret = -1, err;
+ 	pid_t tgid, pid;
+ 	struct stat st;
+ 
+ 	skel = test_ns_current_pid_tgid__open_and_load();
+-	if (CHECK(!skel, "skel_open_load", "failed to load skeleton\n"))
+-		goto cleanup;
++	if (!ASSERT_OK_PTR(skel, "test_ns_current_pid_tgid__open_and_load"))
++		goto out;
+ 
+ 	pid = syscall(SYS_gettid);
+ 	tgid = getpid();
+ 
+ 	err = stat("/proc/self/ns/pid", &st);
+-	if (CHECK(err, "stat", "failed /proc/self/ns/pid: %d\n", err))
++	if (!ASSERT_OK(err, "stat /proc/self/ns/pid"))
+ 		goto cleanup;
+ 
+ 	bss = skel->bss;
+@@ -42,24 +42,26 @@ static int test_current_pid_tgid(void *args)
+ 	bss->user_tgid = 0;
+ 
+ 	err = test_ns_current_pid_tgid__attach(skel);
+-	if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
++	if (!ASSERT_OK(err, "test_ns_current_pid_tgid__attach"))
+ 		goto cleanup;
+ 
+ 	/* trigger tracepoint */
+ 	usleep(1);
+-	ASSERT_EQ(bss->user_pid, pid, "pid");
+-	ASSERT_EQ(bss->user_tgid, tgid, "tgid");
+-	err = 0;
++	if (!ASSERT_EQ(bss->user_pid, pid, "pid"))
++		goto cleanup;
++	if (!ASSERT_EQ(bss->user_tgid, tgid, "tgid"))
++		goto cleanup;
++	ret = 0;
+ 
+ cleanup:
+-	 test_ns_current_pid_tgid__destroy(skel);
+-
+-	return err;
++	test_ns_current_pid_tgid__destroy(skel);
++out:
++	return ret;
+ }
+ 
+ static void test_ns_current_pid_tgid_new_ns(void)
+ {
+-	int wstatus, duration = 0;
++	int wstatus;
+ 	pid_t cpid;
+ 
+ 	/* Create a process in a new namespace, this process
+@@ -68,21 +70,21 @@ static void test_ns_current_pid_tgid_new_ns(void)
+ 	cpid = clone(test_current_pid_tgid, child_stack + STACK_SIZE,
+ 		     CLONE_NEWPID | SIGCHLD, NULL);
+ 
+-	if (CHECK(cpid == -1, "clone", "%s\n", strerror(errno)))
++	if (!ASSERT_NEQ(cpid, -1, "clone"))
+ 		return;
+ 
+-	if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", "%s\n", strerror(errno)))
++	if (!ASSERT_NEQ(waitpid(cpid, &wstatus, 0), -1, "waitpid"))
+ 		return;
+ 
+-	if (CHECK(WEXITSTATUS(wstatus) != 0, "newns_pidtgid", "failed"))
++	if (!ASSERT_OK(WEXITSTATUS(wstatus), "newns_pidtgid"))
+ 		return;
+ }
+ 
+ /* TODO: use a different tracepoint */
+ void serial_test_ns_current_pid_tgid(void)
+ {
+-	if (test__start_subtest("ns_current_pid_tgid_root_ns"))
++	if (test__start_subtest("root_ns_tp"))
+ 		test_current_pid_tgid(NULL);
+-	if (test__start_subtest("ns_current_pid_tgid_new_ns"))
++	if (test__start_subtest("new_ns_tp"))
+ 		test_ns_current_pid_tgid_new_ns();
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-replace-extract_build_id-with-read_bui.patch b/queue-6.1/selftests-bpf-replace-extract_build_id-with-read_bui.patch
new file mode 100644
index 00000000000..7e7a3fa4080
--- /dev/null
+++ b/queue-6.1/selftests-bpf-replace-extract_build_id-with-read_bui.patch
@@ -0,0 +1,181 @@
+From ddb7b64da01119248fb34b92b835ca52c991a4d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Mar 2023 11:31:57 +0200
+Subject: selftests/bpf: Replace extract_build_id with read_build_id
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit dcc46f51d770bde625e4845cac42e808b3302b62 ]
+
+Replacing extract_build_id with read_build_id that parses out
+build id directly from elf without using readelf tool.
+
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230331093157.1749137-4-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: c9a83e76b5a9 ("selftests/bpf: Fix compile if backtrace support missing in libc")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/stacktrace_build_id.c      | 19 ++++++--------
+ .../bpf/prog_tests/stacktrace_build_id_nmi.c  | 17 +++++--------
+ tools/testing/selftests/bpf/test_progs.c      | 25 -------------------
+ tools/testing/selftests/bpf/test_progs.h      |  1 -
+ 4 files changed, 13 insertions(+), 49 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
+index 9ad09a6c538a5..b7ba5cd47d96f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
+@@ -7,13 +7,12 @@ void test_stacktrace_build_id(void)
+ 
+ 	int control_map_fd, stackid_hmap_fd, stackmap_fd, stack_amap_fd;
+ 	struct test_stacktrace_build_id *skel;
+-	int err, stack_trace_len;
++	int err, stack_trace_len, build_id_size;
+ 	__u32 key, prev_key, val, duration = 0;
+-	char buf[256];
+-	int i, j;
++	char buf[BPF_BUILD_ID_SIZE];
+ 	struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ 	int build_id_matches = 0;
+-	int retry = 1;
++	int i, retry = 1;
+ 
+ retry:
+ 	skel = test_stacktrace_build_id__open_and_load();
+@@ -52,9 +51,10 @@ void test_stacktrace_build_id(void)
+ 		  "err %d errno %d\n", err, errno))
+ 		goto cleanup;
+ 
+-	err = extract_build_id(buf, 256);
++	build_id_size = read_build_id("urandom_read", buf, sizeof(buf));
++	err = build_id_size < 0 ? build_id_size : 0;
+ 
+-	if (CHECK(err, "get build_id with readelf",
++	if (CHECK(err, "read_build_id",
+ 		  "err %d errno %d\n", err, errno))
+ 		goto cleanup;
+ 
+@@ -64,8 +64,6 @@ void test_stacktrace_build_id(void)
+ 		goto cleanup;
+ 
+ 	do {
+-		char build_id[64];
+-
+ 		err = bpf_map_lookup_elem(stackmap_fd, &key, id_offs);
+ 		if (CHECK(err, "lookup_elem from stackmap",
+ 			  "err %d, errno %d\n", err, errno))
+@@ -73,10 +71,7 @@ void test_stacktrace_build_id(void)
+ 		for (i = 0; i < PERF_MAX_STACK_DEPTH; ++i)
+ 			if (id_offs[i].status == BPF_STACK_BUILD_ID_VALID &&
+ 			    id_offs[i].offset != 0) {
+-				for (j = 0; j < 20; ++j)
+-					sprintf(build_id + 2 * j, "%02x",
+-						id_offs[i].build_id[j] & 0xff);
+-				if (strstr(buf, build_id) != NULL)
++				if (memcmp(buf, id_offs[i].build_id, build_id_size) == 0)
+ 					build_id_matches = 1;
+ 			}
+ 		prev_key = key;
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+index 704f7f6c3704a..5db9eec24b5bd 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+@@ -13,11 +13,10 @@ void test_stacktrace_build_id_nmi(void)
+ 		.config = PERF_COUNT_HW_CPU_CYCLES,
+ 	};
+ 	__u32 key, prev_key, val, duration = 0;
+-	char buf[256];
+-	int i, j;
++	char buf[BPF_BUILD_ID_SIZE];
+ 	struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+-	int build_id_matches = 0;
+-	int retry = 1;
++	int build_id_matches = 0, build_id_size;
++	int i, retry = 1;
+ 
+ 	attr.sample_freq = read_perf_max_sample_freq();
+ 
+@@ -79,7 +78,8 @@ void test_stacktrace_build_id_nmi(void)
+ 		  "err %d errno %d\n", err, errno))
+ 		goto cleanup;
+ 
+-	err = extract_build_id(buf, 256);
++	build_id_size = read_build_id("urandom_read", buf, sizeof(buf));
++	err = build_id_size < 0 ? build_id_size : 0;
+ 
+ 	if (CHECK(err, "get build_id with readelf",
+ 		  "err %d errno %d\n", err, errno))
+@@ -91,8 +91,6 @@ void test_stacktrace_build_id_nmi(void)
+ 		goto cleanup;
+ 
+ 	do {
+-		char build_id[64];
+-
+ 		err = bpf_map__lookup_elem(skel->maps.stackmap, &key, sizeof(key),
+ 					   id_offs, sizeof(id_offs), 0);
+ 		if (CHECK(err, "lookup_elem from stackmap",
+@@ -101,10 +99,7 @@ void test_stacktrace_build_id_nmi(void)
+ 		for (i = 0; i < PERF_MAX_STACK_DEPTH; ++i)
+ 			if (id_offs[i].status == BPF_STACK_BUILD_ID_VALID &&
+ 			    id_offs[i].offset != 0) {
+-				for (j = 0; j < 20; ++j)
+-					sprintf(build_id + 2 * j, "%02x",
+-						id_offs[i].build_id[j] & 0xff);
+-				if (strstr(buf, build_id) != NULL)
++				if (memcmp(buf, id_offs[i].build_id, build_id_size) == 0)
+ 					build_id_matches = 1;
+ 			}
+ 		prev_key = key;
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index a952d614ffbbd..513ee92e4f67c 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -583,31 +583,6 @@ int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len)
+ 	return err;
+ }
+ 
+-int extract_build_id(char *build_id, size_t size)
+-{
+-	FILE *fp;
+-	char *line = NULL;
+-	size_t len = 0;
+-
+-	fp = popen("readelf -n ./urandom_read | grep 'Build ID'", "r");
+-	if (fp == NULL)
+-		return -1;
+-
+-	if (getline(&line, &len, fp) == -1)
+-		goto err;
+-	pclose(fp);
+-
+-	if (len > size)
+-		len = size;
+-	memcpy(build_id, line, len);
+-	build_id[len] = '\0';
+-	free(line);
+-	return 0;
+-err:
+-	pclose(fp);
+-	return -1;
+-}
+-
+ static int finit_module(int fd, const char *param_values, int flags)
+ {
+ 	return syscall(__NR_finit_module, fd, param_values, flags);
+diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
+index b090996daee5c..924764f6ba976 100644
+--- a/tools/testing/selftests/bpf/test_progs.h
++++ b/tools/testing/selftests/bpf/test_progs.h
+@@ -380,7 +380,6 @@ static inline void *u64_to_ptr(__u64 ptr)
+ int bpf_find_map(const char *test, struct bpf_object *obj, const char *name);
+ int compare_map_keys(int map1_fd, int map2_fd);
+ int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len);
+-int extract_build_id(char *build_id, size_t size);
+ int kern_sync_rcu(void);
+ int trigger_module_test_read(int read_sz);
+ int trigger_module_test_write(int write_sz);
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-use-pid_t-consistently-in-test_progs.c.patch b/queue-6.1/selftests-bpf-use-pid_t-consistently-in-test_progs.c.patch
new file mode 100644
index 00000000000..b9316393d5b
--- /dev/null
+++ b/queue-6.1/selftests-bpf-use-pid_t-consistently-in-test_progs.c.patch
@@ -0,0 +1,45 @@
+From f8028670652cde615a479930f7d9b2c787c233ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:54:28 -0700
+Subject: selftests/bpf: Use pid_t consistently in test_progs.c
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit ec4fe2f0fa12fd2d0115df7e58414dc26899cc5e ]
+
+Use pid_t rather than __pid_t when allocating memory for 'worker_pids' in
+'struct test_env', as this is its declared type and also avoids compile
+errors seen building against musl libc on mipsel64:
+
+  test_progs.c:1738:49: error: '__pid_t' undeclared (first use in this function); did you mean 'pid_t'?
+   1738 |                 env.worker_pids = calloc(sizeof(__pid_t), env.workers);
+        |                                                 ^~~~~~~
+        |                                                 pid_t
+  test_progs.c:1738:49: note: each undeclared identifier is reported only once for each function it appears in
+
+Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Geliang Tang <geliang@kernel.org>
+Link: https://lore.kernel.org/bpf/c6447da51a94babc1931711a43e2ceecb135c93d.1721713597.git.tony.ambardar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 3fef451d88313..a952d614ffbbd 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1639,7 +1639,7 @@ int main(int argc, char **argv)
+ 	/* launch workers if requested */
+ 	env.worker_id = -1; /* main process */
+ 	if (env.workers) {
+-		env.worker_pids = calloc(sizeof(__pid_t), env.workers);
++		env.worker_pids = calloc(sizeof(pid_t), env.workers);
+ 		env.worker_socks = calloc(sizeof(int), env.workers);
+ 		if (env.debug)
+ 			fprintf(stdout, "Launching %d workers.\n", env.workers);
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-workaround-strict-bpf_lsm-return-value.patch b/queue-6.1/selftests-bpf-workaround-strict-bpf_lsm-return-value.patch
new file mode 100644
index 00000000000..72b8fbe049e
--- /dev/null
+++ b/queue-6.1/selftests-bpf-workaround-strict-bpf_lsm-return-value.patch
@@ -0,0 +1,47 @@
+From 2d4ba54b27a263d88ab320fcb0ea93fff8e50d86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 19:08:15 -0700
+Subject: selftests/bpf: Workaround strict bpf_lsm return value check.
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit aa8ebb270c66cea1f56a25d0f938036e91ad085a ]
+
+test_progs-no_alu32 -t libbpf_get_fd_by_id_opts
+is being rejected by the verifier with the following error
+due to compiler optimization:
+
+6: (67) r0 <<= 62                     ; R0_w=scalar(smax=0x4000000000000000,umax=0xc000000000000000,smin32=0,smax32=umax32=0,var_off=(0x0; 0xc000000000000000))
+7: (c7) r0 s>>= 63                    ; R0_w=scalar(smin=smin32=-1,smax=smax32=0)
+;  @ test_libbpf_get_fd_by_id_opts.c:0
+8: (57) r0 &= -13                     ; R0_w=scalar(smax=0x7ffffffffffffff3,umax=0xfffffffffffffff3,smax32=0x7ffffff3,umax32=0xfffffff3,var_off=(0x0; 0xfffffffffffffff3))
+; int BPF_PROG(check_access, struct bpf_map *map, fmode_t fmode) @ test_libbpf_get_fd_by_id_opts.c:27
+9: (95) exit
+At program exit the register R0 has smax=9223372036854775795 should have been in [-4095, 0]
+
+Workaround by adding barrier().
+Eventually the verifier will be able to recognize it.
+
+Fixes: 5d99e198be27 ("bpf, lsm: Add check for BPF LSM return value")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c  | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c b/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+index f5ac5f3e89196..568816307f712 100644
+--- a/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
++++ b/tools/testing/selftests/bpf/progs/test_libbpf_get_fd_by_id_opts.c
+@@ -31,6 +31,7 @@ int BPF_PROG(check_access, struct bpf_map *map, fmode_t fmode)
+ 
+ 	if (fmode & FMODE_WRITE)
+ 		return -EACCES;
++	barrier();
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch b/queue-6.1/selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
new file mode 100644
index 00000000000..f22e26d3930
--- /dev/null
+++ b/queue-6.1/selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
@@ -0,0 +1,78 @@
+From 5a5c45df0c8587683a5562737f174cb54d08a30b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 10:50:14 +0200
+Subject: selftests: vDSO: fix ELF hash table entry size for s390x
+
+From: Jens Remus <jremus@linux.ibm.com>
+
+[ Upstream commit 14be4e6f35221c4731b004553ecf7cbc6dc1d2d8 ]
+
+The vDSO self tests fail on s390x for a vDSO linked with the GNU linker
+ld as follows:
+
+  # ./vdso_test_gettimeofday
+  Floating point exception (core dumped)
+
+On s390x the ELF hash table entries are 64 bits instead of 32 bits in
+size (see Glibc sysdeps/unix/sysv/linux/s390/bits/elfclass.h).
+
+Fixes: 40723419f407 ("kselftest: Enable vDSO test on non x86 platforms")
+Reported-by: Heiko Carstens <hca@linux.ibm.com>
+Tested-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Jens Remus <jremus@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/parse_vdso.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c
+index d9ccc5acac182..7dd5668ea8a6e 100644
+--- a/tools/testing/selftests/vDSO/parse_vdso.c
++++ b/tools/testing/selftests/vDSO/parse_vdso.c
+@@ -36,6 +36,12 @@
+ #define ELF_BITS_XFORM(bits, x) ELF_BITS_XFORM2(bits, x)
+ #define ELF(x) ELF_BITS_XFORM(ELF_BITS, x)
+ 
++#ifdef __s390x__
++#define ELF_HASH_ENTRY ELF(Xword)
++#else
++#define ELF_HASH_ENTRY ELF(Word)
++#endif
++
+ static struct vdso_info
+ {
+ 	bool valid;
+@@ -47,8 +53,8 @@ static struct vdso_info
+ 	/* Symbol table */
+ 	ELF(Sym) *symtab;
+ 	const char *symstrings;
+-	ELF(Word) *bucket, *chain;
+-	ELF(Word) nbucket, nchain;
++	ELF_HASH_ENTRY *bucket, *chain;
++	ELF_HASH_ENTRY nbucket, nchain;
+ 
+ 	/* Version table */
+ 	ELF(Versym) *versym;
+@@ -115,7 +121,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base)
+ 	/*
+ 	 * Fish out the useful bits of the dynamic table.
+ 	 */
+-	ELF(Word) *hash = 0;
++	ELF_HASH_ENTRY *hash = 0;
+ 	vdso_info.symstrings = 0;
+ 	vdso_info.symtab = 0;
+ 	vdso_info.versym = 0;
+@@ -133,7 +139,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base)
+ 				 + vdso_info.load_offset);
+ 			break;
+ 		case DT_HASH:
+-			hash = (ELF(Word) *)
++			hash = (ELF_HASH_ENTRY *)
+ 				((uintptr_t)dyn[i].d_un.d_ptr
+ 				 + vdso_info.load_offset);
+ 			break;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-vdso-fix-vdso-name-for-powerpc.patch b/queue-6.1/selftests-vdso-fix-vdso-name-for-powerpc.patch
new file mode 100644
index 00000000000..093c4934c96
--- /dev/null
+++ b/queue-6.1/selftests-vdso-fix-vdso-name-for-powerpc.patch
@@ -0,0 +1,52 @@
+From cd3a2a359f0e98c910c105c86b8ae8e62750097e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 14:28:35 +0200
+Subject: selftests: vDSO: fix vDSO name for powerpc
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 59eb856c3ed9b3552befd240c0c339f22eed3fa1 ]
+
+Following error occurs when running vdso_test_correctness on powerpc:
+
+~ # ./vdso_test_correctness
+[WARN]	failed to find vDSO
+[SKIP]	No vDSO, so skipping clock_gettime() tests
+[SKIP]	No vDSO, so skipping clock_gettime64() tests
+[RUN]	Testing getcpu...
+[OK]	CPU 0: syscall: cpu 0, node 0
+
+On powerpc, vDSO is neither called linux-vdso.so.1 nor linux-gate.so.1
+but linux-vdso32.so.1 or linux-vdso64.so.1.
+
+Also search those two names before giving up.
+
+Fixes: c7e5789b24d3 ("kselftest: Move test_vdso to the vDSO test suite")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_correctness.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_correctness.c b/tools/testing/selftests/vDSO/vdso_test_correctness.c
+index e691a3cf14911..cdb697ae8343c 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_correctness.c
++++ b/tools/testing/selftests/vDSO/vdso_test_correctness.c
+@@ -114,6 +114,12 @@ static void fill_function_pointers()
+ 	if (!vdso)
+ 		vdso = dlopen("linux-gate.so.1",
+ 			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
++	if (!vdso)
++		vdso = dlopen("linux-vdso32.so.1",
++			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
++	if (!vdso)
++		vdso = dlopen("linux-vdso64.so.1",
++			      RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+ 	if (!vdso) {
+ 		printf("[WARN]\tfailed to find vDSO\n");
+ 		return;
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-vdso-fix-vdso-symbols-lookup-for-powerpc64.patch b/queue-6.1/selftests-vdso-fix-vdso-symbols-lookup-for-powerpc64.patch
new file mode 100644
index 00000000000..d92d8929340
--- /dev/null
+++ b/queue-6.1/selftests-vdso-fix-vdso-symbols-lookup-for-powerpc64.patch
@@ -0,0 +1,108 @@
+From caecd01d9c51cf9413169493cce94e355e9a60f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 14:28:37 +0200
+Subject: selftests: vDSO: fix vDSO symbols lookup for powerpc64
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit ba83b3239e657469709d15dcea5f9b65bf9dbf34 ]
+
+On powerpc64, following tests fail locating vDSO functions:
+
+  ~ # ./vdso_test_abi
+  TAP version 13
+  1..16
+  # [vDSO kselftest] VDSO_VERSION: LINUX_2.6.15
+  # Couldn't find __kernel_gettimeofday
+  ok 1 # SKIP __kernel_gettimeofday
+  # clock_id: CLOCK_REALTIME
+  # Couldn't find __kernel_clock_gettime
+  ok 2 # SKIP __kernel_clock_gettime CLOCK_REALTIME
+  # Couldn't find __kernel_clock_getres
+  ok 3 # SKIP __kernel_clock_getres CLOCK_REALTIME
+  ...
+  # Couldn't find __kernel_time
+  ok 16 # SKIP __kernel_time
+  # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:16 error:0
+
+  ~ # ./vdso_test_getrandom
+  __kernel_getrandom is missing!
+
+  ~ # ./vdso_test_gettimeofday
+  Could not find __kernel_gettimeofday
+
+  ~ # ./vdso_test_getcpu
+  Could not find __kernel_getcpu
+
+On powerpc64, as shown below by readelf, vDSO functions symbols have
+type NOTYPE, so also accept that type when looking for symbols.
+
+$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg
+ELF Header:
+  Magic:   7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00
+  Class:                             ELF64
+  Data:                              2's complement, big endian
+  Version:                           1 (current)
+  OS/ABI:                            UNIX - System V
+  ABI Version:                       0
+  Type:                              DYN (Shared object file)
+  Machine:                           PowerPC64
+  Version:                           0x1
+...
+
+Symbol table '.dynsym' contains 12 entries:
+   Num:    Value          Size Type    Bind   Vis      Ndx Name
+     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND
+     1: 0000000000000524    84 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     2: 00000000000005f0    36 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     3: 0000000000000578    68 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     4: 0000000000000000     0 OBJECT  GLOBAL DEFAULT  ABS LINUX_2.6.15
+     5: 00000000000006c0    48 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     6: 0000000000000614   172 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     7: 00000000000006f0    84 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     8: 000000000000047c    84 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+     9: 0000000000000454    12 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+    10: 00000000000004d0    84 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+    11: 00000000000005bc    52 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+
+Symbol table '.symtab' contains 56 entries:
+   Num:    Value          Size Type    Bind   Vis      Ndx Name
+...
+    45: 0000000000000000     0 OBJECT  GLOBAL DEFAULT  ABS LINUX_2.6.15
+    46: 00000000000006c0    48 NOTYPE  GLOBAL DEFAULT    8 __kernel_getcpu
+    47: 0000000000000524    84 NOTYPE  GLOBAL DEFAULT    8 __kernel_clock_getres
+    48: 00000000000005f0    36 NOTYPE  GLOBAL DEFAULT    8 __kernel_get_tbfreq
+    49: 000000000000047c    84 NOTYPE  GLOBAL DEFAULT    8 __kernel_gettimeofday
+    50: 0000000000000614   172 NOTYPE  GLOBAL DEFAULT    8 __kernel_sync_dicache
+    51: 00000000000006f0    84 NOTYPE  GLOBAL DEFAULT    8 __kernel_getrandom
+    52: 0000000000000454    12 NOTYPE  GLOBAL DEFAULT    8 __kernel_sigtram[...]
+    53: 0000000000000578    68 NOTYPE  GLOBAL DEFAULT    8 __kernel_time
+    54: 00000000000004d0    84 NOTYPE  GLOBAL DEFAULT    8 __kernel_clock_g[...]
+    55: 00000000000005bc    52 NOTYPE  GLOBAL DEFAULT    8 __kernel_get_sys[...]
+
+Fixes: 98eedc3a9dbf ("Document the vDSO and add a reference parser")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/parse_vdso.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c
+index 4ae417372e9eb..d9ccc5acac182 100644
+--- a/tools/testing/selftests/vDSO/parse_vdso.c
++++ b/tools/testing/selftests/vDSO/parse_vdso.c
+@@ -216,7 +216,8 @@ void *vdso_sym(const char *version, const char *name)
+ 		ELF(Sym) *sym = &vdso_info.symtab[chain];
+ 
+ 		/* Check for a defined global or weak function w/ right name. */
+-		if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC)
++		if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC &&
++		    ELF64_ST_TYPE(sym->st_info) != STT_NOTYPE)
+ 			continue;
+ 		if (ELF64_ST_BIND(sym->st_info) != STB_GLOBAL &&
+ 		    ELF64_ST_BIND(sym->st_info) != STB_WEAK)
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-vdso-fix-vdso_config-for-powerpc.patch b/queue-6.1/selftests-vdso-fix-vdso_config-for-powerpc.patch
new file mode 100644
index 00000000000..b26ee95dc95
--- /dev/null
+++ b/queue-6.1/selftests-vdso-fix-vdso_config-for-powerpc.patch
@@ -0,0 +1,52 @@
+From 32da8020739266b4334de22d28a7c1735993d10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 14:28:36 +0200
+Subject: selftests: vDSO: fix vdso_config for powerpc
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7d297c419b08eafa69ce27243ee9bbecab4fcaa4 ]
+
+Running vdso_test_correctness on powerpc64 gives the following warning:
+
+  ~ # ./vdso_test_correctness
+  Warning: failed to find clock_gettime64 in vDSO
+
+This is because vdso_test_correctness was built with VDSO_32BIT defined.
+
+__powerpc__ macro is defined on both powerpc32 and powerpc64 so
+__powerpc64__ needs to be checked first in vdso_config.h
+
+Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_config.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_config.h b/tools/testing/selftests/vDSO/vdso_config.h
+index cdfed403ba13f..f9890584f6fb4 100644
+--- a/tools/testing/selftests/vDSO/vdso_config.h
++++ b/tools/testing/selftests/vDSO/vdso_config.h
+@@ -18,13 +18,13 @@
+ #elif defined(__aarch64__)
+ #define VDSO_VERSION		3
+ #define VDSO_NAMES		0
+-#elif defined(__powerpc__)
++#elif defined(__powerpc64__)
+ #define VDSO_VERSION		1
+ #define VDSO_NAMES		0
+-#define VDSO_32BIT		1
+-#elif defined(__powerpc64__)
++#elif defined(__powerpc__)
+ #define VDSO_VERSION		1
+ #define VDSO_NAMES		0
++#define VDSO_32BIT		1
+ #elif defined (__s390__)
+ #define VDSO_VERSION		2
+ #define VDSO_NAMES		0
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-vdso-fix-vdso_config-for-s390.patch b/queue-6.1/selftests-vdso-fix-vdso_config-for-s390.patch
new file mode 100644
index 00000000000..d29e7fb9806
--- /dev/null
+++ b/queue-6.1/selftests-vdso-fix-vdso_config-for-s390.patch
@@ -0,0 +1,51 @@
+From 4d2b1a420aa0d8ef7d96c07ed092c6fe49dab73d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 10:50:15 +0200
+Subject: selftests: vDSO: fix vdso_config for s390
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit a6e23fb8d3c0e3904da70beaf5d7e840a983c97f ]
+
+Running vdso_test_correctness on s390x (aka s390 64 bit) emits a warning:
+
+Warning: failed to find clock_gettime64 in vDSO
+
+This is caused by the "#elif defined (__s390__)" check in vdso_config.h
+which the defines VDSO_32BIT.
+
+If __s390x__ is defined also __s390__ is defined. Therefore the correct
+check must make sure that only __s390__ is defined.
+
+Therefore add the missing !defined(__s390x__). Also use common
+__s390x__ define instead of __s390X__.
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_config.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_config.h b/tools/testing/selftests/vDSO/vdso_config.h
+index f9890584f6fb4..72de45f587b2c 100644
+--- a/tools/testing/selftests/vDSO/vdso_config.h
++++ b/tools/testing/selftests/vDSO/vdso_config.h
+@@ -25,11 +25,11 @@
+ #define VDSO_VERSION		1
+ #define VDSO_NAMES		0
+ #define VDSO_32BIT		1
+-#elif defined (__s390__)
++#elif defined (__s390__) && !defined(__s390x__)
+ #define VDSO_VERSION		2
+ #define VDSO_NAMES		0
+ #define VDSO_32BIT		1
+-#elif defined (__s390X__)
++#elif defined (__s390x__)
+ #define VDSO_VERSION		2
+ #define VDSO_NAMES		0
+ #elif defined(__mips__)
+-- 
+2.43.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
new file mode 100644
index 00000000000..55f5470f103
--- /dev/null
+++ b/queue-6.1/series
@@ -0,0 +1,291 @@
+edac-synopsys-fix-ecc-status-and-irq-control-race-co.patch
+edac-synopsys-fix-error-injection-on-zynq-ultrascale.patch
+wifi-rtw88-always-wait-for-both-firmware-loading-att.patch
+crypto-xor-fix-template-benchmarking.patch
+acpi-pmic-remove-unneeded-check-in-tps68470_pmic_opr.patch
+wifi-ath9k-fix-parameter-check-in-ath9k_init_debug.patch
+wifi-ath9k-remove-error-checks-when-creating-debugfs.patch
+net-stmmac-dwmac-loongson-init-ref-and-ptp-clocks-ra.patch
+wifi-rtw88-remove-cpt-execution-branch-never-used.patch
+risc-v-kvm-fix-sbiret-init-before-forwarding-to-user.patch
+fs-namespace-fnic-switch-to-use-pttd.patch
+mount-handle-oom-on-mnt_warn_timestamp_expiry.patch
+kselftest-arm64-don-t-pass-headers-to-the-compiler-a.patch
+kselftest-arm64-verify-simultaneous-ssve-and-za-cont.patch
+kselftest-arm64-fix-enumeration-of-systems-without-1.patch
+kselftest-arm64-signal-fix-refactor-sve-vector-lengt.patch
+drivers-perf-fix-ali_drw_pmu-driver-interrupt-status.patch
+wifi-mac80211-don-t-use-rate-mask-for-offchannel-tx-.patch
+wifi-iwlwifi-mvm-increase-the-time-between-ranging-m.patch
+acpica-implement-acpi_warning_once-and-acpi_error_on.patch
+acpica-executer-exsystem-don-t-nag-user-about-every-.patch
+padata-honor-the-caller-s-alignment-in-case-of-chunk.patch
+drivers-perf-hisi_pcie-record-hardware-counts-correc.patch
+kselftest-arm64-actually-test-sme-vector-length-chan.patch
+can-j1939-use-correct-function-name-in-comment.patch
+acpi-cppc-fix-mask_val-usage.patch
+netfilter-nf_tables-elements-with-timeout-below-conf.patch
+netfilter-nf_tables-reject-element-expiration-with-n.patch
+netfilter-nf_tables-reject-expiration-higher-than-ti.patch
+netfilter-nf_tables-remove-annotation-to-access-set-.patch
+perf-arm-cmn-rework-dtc-counters-again.patch
+perf-arm-cmn-improve-debugfs-pretty-printing-for-lar.patch
+perf-arm-cmn-refactor-node-id-handling.-again.patch
+perf-arm-cmn-ensure-dtm_idx-is-big-enough.patch
+cpufreq-ti-cpufreq-introduce-quirks-to-handle-syscon.patch
+x86-sgx-fix-deadlock-in-sgx-numa-node-search.patch
+crypto-hisilicon-hpre-enable-sva-error-interrupt-eve.patch
+crypto-hisilicon-hpre-mask-cluster-timeout-error.patch
+crypto-hisilicon-qm-fix-coding-style-issues.patch
+crypto-hisilicon-qm-reset-device-before-enabling-it.patch
+crypto-hisilicon-qm-inject-error-before-stopping-que.patch
+wifi-cfg80211-fix-ubsan-noise-in-cfg80211_wext_siwsc.patch
+wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch
+wifi-cfg80211-fix-two-more-possible-ubsan-detected-o.patch
+wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch
+wifi-wilc1000-fix-potential-rcu-dereference-issue-in.patch
+bluetooth-hci_core-fix-sending-mgmt_ev_connect_faile.patch
+bluetooth-hci_sync-ignore-errors-from-hci_op_remote_.patch
+sock_map-add-a-cond_resched-in-sock_hash_free.patch
+can-bcm-clear-bo-bcm_proc_read-after-remove_proc_ent.patch
+can-m_can-remove-repeated-check-for-is_peripheral.patch
+can-m_can-enable-napi-before-enabling-interrupts.patch
+can-m_can-m_can_close-stop-clocks-after-device-has-b.patch
+bluetooth-btusb-fix-not-handling-zpl-short-transfer.patch
+bareudp-pull-inner-ip-header-in-bareudp_udp_encap_re.patch
+bareudp-pull-inner-ip-header-on-xmit.patch
+net-enetc-use-irqf_no_autoen-flag-in-request_irq.patch
+r8169-disable-aldps-per-default-for-rtl8125.patch
+net-ipv6-rpl_iptunnel-fix-memory-leak-in-rpl_input.patch
+net-tipc-avoid-possible-garbage-value.patch
+ipv6-avoid-possible-null-deref-in-rt6_uncached_list_.patch
+nbd-fix-race-between-timeout-and-normal-completion.patch
+block-bfq-fix-possible-uaf-for-bfqq-bic-with-merge-c.patch
+block-bfq-choose-the-last-bfqq-from-merge-chain-in-b.patch
+block-bfq-don-t-break-merge-chain-in-bfq_split_bfqq.patch
+block-print-symbolic-error-name-instead-of-error-cod.patch
+block-fix-potential-invalid-pointer-dereference-in-b.patch
+spi-ppc4xx-handle-irq_of_parse_and_map-errors.patch
+arm64-dts-exynos-exynos7885-jackpotlte-correct-ram-a.patch
+firmware-arm_scmi-fix-double-free-in-optee-transport.patch
+spi-ppc4xx-avoid-returning-0-when-failed-to-parse-an.patch
+regulator-return-actual-error-in-of_regulator_bulk_g.patch
+arm64-dts-renesas-r9a07g043u-correct-gicd-and-gicr-s.patch
+arm64-dts-renesas-r9a07g054-correct-gicd-and-gicr-si.patch
+arm64-dts-renesas-r9a07g044-correct-gicd-and-gicr-si.patch
+arm-dts-microchip-sam9x60-fix-rtc-rtt-clocks.patch
+arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-carveout-l.patch
+arm-dts-microchip-sama7g5-fix-rtt-clock.patch
+arm-dts-imx7d-zii-rmu2-fix-ethernet-phy-pinctrl-prop.patch
+arm-versatile-fix-of-node-leak-in-cpus-prepare.patch
+reset-berlin-fix-of-node-leak-in-probe-error-path.patch
+reset-k210-fix-of-node-leak-in-probe-error-path.patch
+clocksource-drivers-qcom-add-missing-iounmap-on-erro.patch
+asoc-rt5682s-return-devm_of_clk_add_hw_provider-to-t.patch
+alsa-hda-cs35l41-fix-module-autoloading.patch
+m68k-fix-kernel_clone_args.flags-in-m68k_clone.patch
+hwmon-max16065-fix-overflows-seen-when-writing-limit.patch
+i2c-add-i2c_get_match_data.patch
+hwmon-max16065-remove-use-of-i2c_match_id.patch
+hwmon-max16065-fix-alarm-attributes.patch
+mtd-slram-insert-break-after-errors-in-parsing-the-m.patch
+hwmon-ntc_thermistor-fix-module-autoloading.patch
+power-supply-axp20x_battery-remove-design-from-min-a.patch
+power-supply-max17042_battery-fix-soc-threshold-calc.patch
+fbdev-hpfb-fix-an-error-handling-path-in-hpfb_dio_pr.patch
+iommu-amd-do-not-set-the-d-bit-on-amd-v2-table-entri.patch
+mtd-powernv-add-check-devm_kasprintf-returned-value.patch
+rcu-nocb-fix-rt-throttling-hrtimer-armed-from-offlin.patch
+mtd-rawnand-mtk-use-for_each_child_of_node_scoped.patch
+mtd-rawnand-mtk-factorize-out-the-logic-cleaning-mtk.patch
+mtd-rawnand-mtk-fix-init-error-path.patch
+pmdomain-core-harden-inter-column-space-in-debug-sum.patch
+drm-stm-fix-an-error-handling-path-in-stm_drm_platfo.patch
+drm-stm-ltdc-check-memory-returned-by-devm_kzalloc.patch
+drm-amd-display-add-null-check-for-set_output_gamma-.patch
+drm-amdgpu-replace-one-element-array-with-flexible-a.patch
+drm-amdgpu-properly-handle-vbios-fake-edid-sizing.patch
+drm-radeon-replace-one-element-array-with-flexible-a.patch
+drm-radeon-properly-handle-vbios-fake-edid-sizing.patch
+scsi-smartpqi-revert-propagate-the-multipath-failure.patch
+scsi-ncr5380-check-for-phase-match-during-pdma-fixup.patch
+drm-amd-amdgpu-properly-tune-the-size-of-struct.patch
+drm-rockchip-vop-allow-4096px-width-scaling.patch
+drm-rockchip-dw_hdmi-fix-reading-edid-when-using-a-f.patch
+drm-radeon-evergreen_cs-fix-int-overflow-errors-in-c.patch
+drm-bridge-lontium-lt8912b-validate-mode-in-drm_brid.patch
+drm-vc4-hdmi-handle-error-case-of-pm_runtime_resume_.patch
+scsi-elx-libefc-fix-potential-use-after-free-in-efc_.patch
+jfs-fix-out-of-bounds-in-dbnextag-and-dialloc.patch
+drm-mediatek-fix-missing-configuration-flags-in-mtk_.patch
+drm-mediatek-use-spin_lock_irqsave-for-crtc-event-lo.patch
+powerpc-8xx-fix-initial-memory-mapping.patch
+powerpc-8xx-fix-kernel-vs-user-address-comparison.patch
+selftests-vdso-fix-vdso-name-for-powerpc.patch
+selftests-vdso-fix-vdso_config-for-powerpc.patch
+selftests-vdso-fix-vdso-symbols-lookup-for-powerpc64.patch
+drm-msm-fix-incorrect-file-name-output-in-adreno_req.patch
+drm-msm-a5xx-disable-preemption-in-submits-by-defaul.patch
+drm-msm-a5xx-properly-clear-preemption-records-on-re.patch
+drm-msm-a5xx-fix-races-in-preemption-evaluation-stag.patch
+drm-msm-a5xx-workaround-early-ring-buffer-emptiness-.patch
+ipmi-docs-don-t-advertise-deprecated-sysfs-entries.patch
+drm-msm-fix-s-null-argument-error.patch
+drivers-drm-exynos_drm_gsc-fix-wrong-assignment-in-g.patch
+xen-use-correct-end-address-of-kernel-for-conflict-c.patch
+hid-wacom-support-sequence-numbers-smaller-than-16-b.patch
+hid-wacom-do-not-warn-about-dropped-packets-for-firs.patch
+minmax-avoid-overly-complex-min-max-macro-arguments-.patch
+xen-introduce-generic-helper-checking-for-memory-map.patch
+xen-move-max_pfn-in-xen_memory_setup-out-of-function.patch
+xen-add-capability-to-remap-non-ram-pages-to-differe.patch
+xen-tolerate-acpi-nvs-memory-overlapping-with-xen-al.patch
+powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch
+selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
+selftests-vdso-fix-vdso_config-for-s390.patch
+xen-swiotlb-add-alignment-check-for-dma-buffers.patch
+xen-swiotlb-fix-allocated-size.patch
+tpm-clean-up-tpm-space-after-command-failure.patch
+selftests-bpf-add-selftest-deny_namespace-to-s390x-d.patch
+selftests-bpf-add-tests-for-_opts-variants-of-bpf_-_.patch
+selftests-bpf-workaround-strict-bpf_lsm-return-value.patch
+selftests-bpf-use-pid_t-consistently-in-test_progs.c.patch
+selftests-bpf-fix-compile-error-from-rlim_t-in-sk_st.patch
+selftests-bpf-fix-error-compiling-bpf_iter_setsockop.patch
+selftests-bpf-fix-missing-array_size-definition-in-b.patch
+selftests-bpf-fix-missing-uint_max-definitions-in-be.patch
+selftests-bpf-fix-missing-build_bug_on-declaration.patch
+selftests-bpf-replace-check-with-assert_-in-ns_curre.patch
+selftests-bpf-refactor-out-some-functions-in-ns_curr.patch
+selftests-bpf-add-a-cgroup-prog-bpf_get_ns_current_p.patch
+selftests-bpf-fix-include-of-sys-fcntl.h.patch
+selftests-bpf-fix-compiling-kfree_skb.c-with-musl-li.patch
+selftests-bpf-fix-compiling-flow_dissector.c-with-mu.patch
+selftests-bpf-fix-compiling-tcp_rtt.c-with-musl-libc.patch
+selftests-bpf-fix-compiling-core_reloc.c-with-musl-l.patch
+selftests-bpf-fix-errors-compiling-cg_storage_multi..patch
+libbpf-create-a-bpf_link-in-bpf_map__attach_struct_o.patch
+libbpf-ensure-fd-3-during-bpf_map__reuse_fd.patch
+libbpf-use-stable-map-placeholder-fds.patch
+libbpf-find-correct-module-btfs-for-struct_ops-maps-.patch
+libbpf-convert-st_ops-data-to-shadow-type.patch
+libbpf-sync-progs-autoload-with-maps-autocreate-for-.patch
+libbpf-don-t-take-direct-pointers-into-btf-data-from.patch
+selftests-bpf-fix-error-compiling-test_lru_map.c.patch
+selftests-bpf-fix-c-compile-error-from-missing-_bool.patch
+selftests-bpf-replace-extract_build_id-with-read_bui.patch
+selftests-bpf-move-test_progs-helpers-to-testing_hel.patch
+selftests-bpf-fix-compile-if-backtrace-support-missi.patch
+bpf-correctly-handle-malformed-bpf_core_type_id_loca.patch
+xz-cleanup-crc32-edits-from-2018.patch
+kthread-fix-task-state-in-kthread-worker-if-being-fr.patch
+ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch
+smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch
+ext4-avoid-buffer_head-leak-in-ext4_mark_inode_used.patch
+ext4-avoid-potential-buffer_head-leak-in-__ext4_new_.patch
+ext4-avoid-negative-min_clusters-in-find_group_orlov.patch
+ext4-return-error-on-ext4_find_inline_entry.patch
+ext4-avoid-oob-when-system.data-xattr-changes-undern.patch
+nilfs2-fix-potential-null-ptr-deref-in-nilfs_btree_i.patch
+nilfs2-determine-empty-node-blocks-as-corrupted.patch
+nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch
+bpf-fix-bpf_strtol-and-bpf_strtoul-helpers-for-32bit.patch
+bpf-improve-check_raw_mode_ok-test-for-mem_uninit-ta.patch
+bpf-zero-former-arg_ptr_to_-long-int-args-in-case-of.patch
+perf-mem-free-the-allocated-sort-string-fixing-a-lea.patch
+perf-inject-fix-leader-sampling-inserting-additional.patch
+perf-sched-timehist-fix-missing-free-of-session-in-p.patch
+perf-stat-display-iostat-headers-correctly.patch
+perf-sched-timehist-fixed-timestamp-error-when-unabl.patch
+perf-time-utils-fix-32-bit-nsec-parsing.patch
+clk-imx-composite-8m-less-function-calls-in-__imx8m_.patch
+clk-imx-composite-8m-enable-gate-clk-with-mcore_boot.patch
+clk-imx-composite-7ulp-check-the-pcc-present-bit.patch
+clk-imx-fracn-gppll-support-integer-pll.patch
+clk-imx-fracn-gppll-fix-fractional-part-of-pll-getti.patch
+clk-imx-imx8mp-fix-clock-tree-update-of-tf-a-managed.patch
+clk-imx-imx8qxp-register-dc0_bypass0_clk-before-disp.patch
+clk-imx-imx8qxp-parent-should-be-initialized-earlier.patch
+remoteproc-imx_rproc-correct-ddr-alias-for-i.mx8m.patch
+remoteproc-imx_rproc-initialize-workqueue-earlier.patch
+clk-rockchip-set-parent-rate-for-dclk_vop-clock-on-r.patch
+input-ilitek_ts_i2c-avoid-wrong-input-subsystem-sync.patch
+input-ilitek_ts_i2c-add-report-id-message-validation.patch
+drivers-media-dvb-frontends-rtl2832-fix-an-out-of-bo.patch
+drivers-media-dvb-frontends-rtl2830-fix-an-out-of-bo.patch
+pci-pm-increase-wait-time-after-resume.patch
+pci-pm-drop-pci_bridge_wait_for_secondary_bus-timeou.patch
+pci-wait-for-link-before-restoring-downstream-buses.patch
+pci-keystone-fix-if-statement-expression-in-ks_pcie_.patch
+clk-qcom-dispcc-sm8250-use-special-function-for-luci.patch
+nvdimm-fix-devs-leaks-in-scan_labels.patch
+pci-xilinx-nwl-fix-register-misspelling.patch
+pci-xilinx-nwl-clean-up-clock-on-probe-failure-remov.patch
+rdma-iwcm-fix-warning-at_kernel-workqueue.c-check_fl.patch
+pinctrl-single-fix-missing-error-code-in-pcs_probe.patch
+rdma-rtrs-reset-hb_missed_cnt-after-receiving-other-.patch
+rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch
+clk-ti-dra7-atl-fix-leak-of-of_nodes.patch
+nfsd-remove-unneeded-eexist-error-check-in-nfsd_do_f.patch
+nfsd-fix-refcount-leak-when-file-is-unhashed-after-b.patch
+pinctrl-mvebu-use-devm_platform_get_and_ioremap_reso.patch
+pinctrl-mvebu-fix-devinit_dove_pinctrl_probe-functio.patch
+ib-core-fix-ib_cache_setup_one-error-flow-cleanup.patch
+pci-kirin-fix-buffer-overflow-in-kirin_pcie_parse_po.patch
+rdma-erdma-return-qp-state-in-erdma_query_qp.patch
+watchdog-imx_sc_wdt-don-t-disable-wdt-in-suspend.patch
+rdma-hns-don-t-modify-rq-next-block-addr-in-hip09-qp.patch
+rdma-hns-fix-use-after-free-of-rsv_qp-on-hip08.patch
+rdma-hns-fix-the-overflow-risk-of-hem_list_calc_ba_r.patch
+rdma-hns-fix-spin_unlock_irqrestore-called-with-irqs.patch
+rdma-hns-fix-vf-triggering-pf-reset-in-abnormal-inte.patch
+rdma-hns-fix-1bit-ecc-recovery-address-in-non-4k-os.patch
+rdma-hns-optimize-hem-allocation-performance.patch
+input-ps2-gpio-use-irqf_no_autoen-flag-in-request_ir.patch
+riscv-fix-fp-alignment-bug-in-perf_callchain_user.patch
+rdma-cxgb4-added-null-check-for-lookup_atid.patch
+rdma-irdma-fix-error-message-in-irdma_modify_qp_roce.patch
+ntb-intel-fix-the-null-vs-is_err-bug-for-debugfs_cre.patch
+ntb_perf-fix-printk-format.patch
+ntb-force-physically-contiguous-allocation-of-rx-rin.patch
+nfsd-call-cache_put-if-xdr_reserve_space-returns-nul.patch
+nfsd-return-einval-when-namelen-is-0.patch
+f2fs-fix-to-update-i_ctime-in-__f2fs_setxattr.patch
+f2fs-remove-unneeded-check-condition-in-__f2fs_setxa.patch
+f2fs-reduce-expensive-checkpoint-trigger-frequency.patch
+f2fs-factor-the-read-write-tracing-logic-into-a-help.patch
+f2fs-fix-to-avoid-racing-in-between-read-and-opu-dio.patch
+f2fs-fix-to-wait-page-writeback-before-setting-gcing.patch
+f2fs-atomic-fix-to-truncate-pagecache-before-on-disk.patch
+f2fs-clean-up-w-dotdot_name.patch
+f2fs-get-rid-of-online-repaire-on-corrupted-director.patch
+spi-atmel-quadspi-undo-runtime-pm-changes-at-driver-.patch
+spi-spi-fsl-lpspi-undo-runtime-pm-changes-at-driver-.patch
+lib-sbitmap-define-swap_lock-as-raw_spinlock_t.patch
+nvme-multipath-system-fails-to-create-generic-nvme-d.patch
+iio-adc-ad7606-fix-oversampling-gpio-array.patch
+iio-adc-ad7606-fix-standby-gpio-state-to-match-the-d.patch
+usb-dwc2-skip-clock-gating-on-broadcom-socs.patch
+abi-testing-fix-admv8818-attr-description.patch
+iio-chemical-bme680-fix-read-write-ops-to-device-by-.patch
+iio-magnetometer-ak8975-convert-enum-pointer-for-dat.patch
+iio-magnetometer-ak8975-drop-incorrect-ak09116-compa.patch
+dt-bindings-iio-asahi-kasei-ak8975-drop-incorrect-ak.patch
+coresight-tmc-sg-do-not-leak-sg_table.patch
+cxl-pci-break-out-range-register-decoding-from-cxl_h.patch
+cxl-pci-fix-to-record-only-non-zero-ranges.patch
+vdpa-add-eventfd-for-the-vdpa-callback.patch
+vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
+ep93xx-clock-fix-off-by-one-in-ep93xx_div_recalc_rat.patch
+revert-dm-requeue-io-if-mapping-table-not-yet-availa.patch
+net-xilinx-axienet-schedule-napi-in-two-steps.patch
+net-xilinx-axienet-fix-packet-counting.patch
+netfilter-nf_reject_ipv6-fix-nf_reject_ip6_tcphdr_pu.patch
+net-seeq-fix-use-after-free-vulnerability-in-ether3-.patch
+net-ipv6-select-dst_cache-from-ipv6_rpl_lwtunnel.patch
+tcp-check-skb-is-non-null-in-tcp_rto_delta_us.patch
+net-qrtr-update-packets-cloning-when-broadcasting.patch
+bonding-fix-unnecessary-warnings-and-logs-from-bond_.patch
+net-stmmac-set-pp_flag_dma_sync_dev-only-if-xdp-is-e.patch
+netfilter-nf_tables-keep-deleted-flowtable-hooks-unt.patch
+netfilter-ctnetlink-compile-ctnetlink_label_size-wit.patch
diff --git a/queue-6.1/smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch b/queue-6.1/smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch
new file mode 100644
index 00000000000..d9b8d730ad6
--- /dev/null
+++ b/queue-6.1/smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch
@@ -0,0 +1,49 @@
+From b93b0d7f33b4ae288d470c4f907209b91edc96de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 08:47:26 +0000
+Subject: smackfs: Use rcu_assign_pointer() to ensure safe assignment in
+ smk_set_cipso
+
+From: Jiawei Ye <jiawei.ye@foxmail.com>
+
+[ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]
+
+In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
+field is directly assigned to a new value without using the appropriate
+RCU pointer assignment functions. According to RCU usage rules, this is
+illegal and can lead to unpredictable behavior, including data
+inconsistencies and impossible-to-diagnose memory corruption issues.
+
+This possible bug was identified using a static analysis tool developed
+by myself, specifically designed to detect RCU-related issues.
+
+To address this, the assignment is now done using rcu_assign_pointer(),
+which ensures that the pointer assignment is done safely, with the
+necessary memory barriers and synchronization. This change prevents
+potential RCU dereference issues by ensuring that the `cat` field is
+safely updated while still adhering to RCU's requirements.
+
+Fixes: 0817534ff9ea ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
+Signed-off-by: Jiawei Ye <jiawei.ye@foxmail.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smackfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index da7db9e22ce7c..d955f3dcb3a5e 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -921,7 +921,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ 	rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
+ 	if (rc >= 0) {
+ 		old_cat = skp->smk_netlabel.attr.mls.cat;
+-		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
++		rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat);
+ 		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
+ 		synchronize_rcu();
+ 		netlbl_catmap_free(old_cat);
+-- 
+2.43.0
+
diff --git a/queue-6.1/sock_map-add-a-cond_resched-in-sock_hash_free.patch b/queue-6.1/sock_map-add-a-cond_resched-in-sock_hash_free.patch
new file mode 100644
index 00000000000..8fbb6a7ab6b
--- /dev/null
+++ b/queue-6.1/sock_map-add-a-cond_resched-in-sock_hash_free.patch
@@ -0,0 +1,41 @@
+From d8983d4b01e7427310cd972fbd21559aec314a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 15:44:49 +0000
+Subject: sock_map: Add a cond_resched() in sock_hash_free()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]
+
+Several syzbot soft lockup reports all have in common sock_hash_free()
+
+If a map with a large number of buckets is destroyed, we need to yield
+the cpu when needed.
+
+Fixes: 75e68e5bf2c7 ("bpf, sockhash: Synchronize delete from bucket list on map free")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20240906154449.3742932-1-edumazet@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index c1fb071eed9b1..25b5abab60ed0 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -1172,6 +1172,7 @@ static void sock_hash_free(struct bpf_map *map)
+ 			sock_put(elem->sk);
+ 			sock_hash_free_elem(htab, elem);
+ 		}
++		cond_resched();
+ 	}
+ 
+ 	/* wait for psock readers accessing its map link */
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-atmel-quadspi-undo-runtime-pm-changes-at-driver-.patch b/queue-6.1/spi-atmel-quadspi-undo-runtime-pm-changes-at-driver-.patch
new file mode 100644
index 00000000000..309a219708d
--- /dev/null
+++ b/queue-6.1/spi-atmel-quadspi-undo-runtime-pm-changes-at-driver-.patch
@@ -0,0 +1,41 @@
+From da18874a7b38acab6134eb3613c2c52811dd467a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 10:39:56 +0800
+Subject: spi: atmel-quadspi: Undo runtime PM changes at driver exit time
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 438efb23f9581659495b85f1f6c7d5946200660c ]
+
+It's important to undo pm_runtime_use_autosuspend() with
+pm_runtime_dont_use_autosuspend() at driver exit time unless driver
+initially enabled pm_runtime with devm_pm_runtime_enable()
+(which handles it for you).
+
+Hence, call pm_runtime_dont_use_autosuspend() at driver exit time
+to fix it.
+
+Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20240906023956.1004440-1-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/atmel-quadspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
+index 1f1aee28b1f79..d96c40e7c8123 100644
+--- a/drivers/spi/atmel-quadspi.c
++++ b/drivers/spi/atmel-quadspi.c
+@@ -692,6 +692,7 @@ static int atmel_qspi_remove(struct platform_device *pdev)
+ 	clk_unprepare(aq->pclk);
+ 
+ 	pm_runtime_disable(&pdev->dev);
++	pm_runtime_dont_use_autosuspend(&pdev->dev);
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-ppc4xx-avoid-returning-0-when-failed-to-parse-an.patch b/queue-6.1/spi-ppc4xx-avoid-returning-0-when-failed-to-parse-an.patch
new file mode 100644
index 00000000000..e48b17b0df7
--- /dev/null
+++ b/queue-6.1/spi-ppc4xx-avoid-returning-0-when-failed-to-parse-an.patch
@@ -0,0 +1,50 @@
+From 8422c6c21dc11fd444927ae7b20dcc6eef163308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2024 17:45:12 +0300
+Subject: spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 7781f1d120fec8624fc654eda900fc8748262082 ]
+
+0 is incorrect error code when failed to parse and map IRQ.
+Replace OF specific old API for IRQ retrieval with a generic
+one to fix this issue.
+
+Fixes: 0f245463b01e ("spi: ppc4xx: handle irq_of_parse_and_map() errors")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20240814144525.2648450-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-ppc4xx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
+index edfe0896046f9..be1dd4e6a3e7d 100644
+--- a/drivers/spi/spi-ppc4xx.c
++++ b/drivers/spi/spi-ppc4xx.c
+@@ -26,7 +26,6 @@
+ #include <linux/errno.h>
+ #include <linux/wait.h>
+ #include <linux/of_address.h>
+-#include <linux/of_irq.h>
+ #include <linux/of_platform.h>
+ #include <linux/interrupt.h>
+ #include <linux/delay.h>
+@@ -410,9 +409,10 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)
+ 	}
+ 
+ 	/* Request IRQ */
+-	hw->irqnum = irq_of_parse_and_map(np, 0);
+-	if (hw->irqnum <= 0)
++	ret = platform_get_irq(op, 0);
++	if (ret < 0)
+ 		goto free_host;
++	hw->irqnum = ret;
+ 
+ 	ret = request_irq(hw->irqnum, spi_ppc4xx_int,
+ 			  0, "spi_ppc4xx_of", (void *)hw);
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-ppc4xx-handle-irq_of_parse_and_map-errors.patch b/queue-6.1/spi-ppc4xx-handle-irq_of_parse_and_map-errors.patch
new file mode 100644
index 00000000000..8bedf4e9eb1
--- /dev/null
+++ b/queue-6.1/spi-ppc4xx-handle-irq_of_parse_and_map-errors.patch
@@ -0,0 +1,39 @@
+From 84af931efa522e58bc783a2bb4a10682934ac212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2024 16:40:47 +0800
+Subject: spi: ppc4xx: handle irq_of_parse_and_map() errors
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+[ Upstream commit 0f245463b01ea254ae90e1d0389e90b0e7d8dc75 ]
+
+Zero and negative number is not a valid IRQ for in-kernel code and the
+irq_of_parse_and_map() function returns zero on error.  So this check for
+valid IRQs should only accept values > 0.
+
+Fixes: 44dab88e7cc9 ("spi: add spi_ppc4xx driver")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://patch.msgid.link/20240724084047.1506084-1-make24@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-ppc4xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c
+index 1179a1115137f..edfe0896046f9 100644
+--- a/drivers/spi/spi-ppc4xx.c
++++ b/drivers/spi/spi-ppc4xx.c
+@@ -411,6 +411,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)
+ 
+ 	/* Request IRQ */
+ 	hw->irqnum = irq_of_parse_and_map(np, 0);
++	if (hw->irqnum <= 0)
++		goto free_host;
++
+ 	ret = request_irq(hw->irqnum, spi_ppc4xx_int,
+ 			  0, "spi_ppc4xx_of", (void *)hw);
+ 	if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/spi-spi-fsl-lpspi-undo-runtime-pm-changes-at-driver-.patch b/queue-6.1/spi-spi-fsl-lpspi-undo-runtime-pm-changes-at-driver-.patch
new file mode 100644
index 00000000000..e4263dea116
--- /dev/null
+++ b/queue-6.1/spi-spi-fsl-lpspi-undo-runtime-pm-changes-at-driver-.patch
@@ -0,0 +1,41 @@
+From 22bbc934a94d96727bea640b7729b2ebb3eaaaa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 10:12:51 +0800
+Subject: spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 3b577de206d52dbde9428664b6d823d35a803d75 ]
+
+It's important to undo pm_runtime_use_autosuspend() with
+pm_runtime_dont_use_autosuspend() at driver exit time unless driver
+initially enabled pm_runtime with devm_pm_runtime_enable()
+(which handles it for you).
+
+Hence, call pm_runtime_dont_use_autosuspend() at driver exit time
+to fix it.
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20240906021251.610462-1-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index dd2381ac27f67..7d016464037c3 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -947,6 +947,7 @@ static int fsl_lpspi_remove(struct platform_device *pdev)
+ 
+ 	fsl_lpspi_dma_exit(controller);
+ 
++	pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);
+ 	pm_runtime_disable(fsl_lpspi->dev);
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/tcp-check-skb-is-non-null-in-tcp_rto_delta_us.patch b/queue-6.1/tcp-check-skb-is-non-null-in-tcp_rto_delta_us.patch
new file mode 100644
index 00000000000..2a2e135083c
--- /dev/null
+++ b/queue-6.1/tcp-check-skb-is-non-null-in-tcp_rto_delta_us.patch
@@ -0,0 +1,351 @@
+From 6757e8e7c6d818da2e471f720f78d9d05d3af35e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 15:08:22 -0400
+Subject: tcp: check skb is non-NULL in tcp_rto_delta_us()
+
+From: Josh Hunt <johunt@akamai.com>
+
+[ Upstream commit c8770db2d54437a5f49417ae7b46f7de23d14db6 ]
+
+We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic
+kernel that are running ceph and recently hit a null ptr dereference in
+tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also
+saw it getting hit from the RACK case as well. Here are examples of the oops
+messages we saw in each of those cases:
+
+Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020
+Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode
+Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page
+Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0
+Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI
+Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu
+Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
+Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160
+Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
+Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246
+Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
+Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60
+Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8
+Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900
+Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30
+Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000
+Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0
+Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554
+Jul 26 15:05:02 rx [11061395.916786] Call Trace:
+Jul 26 15:05:02 rx [11061395.919488]
+Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f
+Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9
+Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380
+Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0
+Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50
+Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0
+Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20
+Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450
+Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140
+Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90
+Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0
+Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40
+Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160
+Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160
+Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220
+Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240
+Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0
+Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240
+Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130
+Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280
+Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10
+Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30
+Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_event+0x21/0x30
+Jul 26 15:05:02 rx [11061396.021984] ? clockevents_program_event+0x8f/0xe0
+Jul 26 15:05:02 rx [11061396.027035] run_timer_softirq+0x2a/0x50
+Jul 26 15:05:02 rx [11061396.031212] __do_softirq+0xd1/0x2c1
+Jul 26 15:05:02 rx [11061396.035044] do_softirq_own_stack+0x2a/0x40
+Jul 26 15:05:02 rx [11061396.039480]
+Jul 26 15:05:02 rx [11061396.041840] do_softirq.part.0+0x46/0x50
+Jul 26 15:05:02 rx [11061396.046022] __local_bh_enable_ip+0x50/0x60
+Jul 26 15:05:02 rx [11061396.050460] _raw_spin_unlock_bh+0x1e/0x20
+Jul 26 15:05:02 rx [11061396.054817] nf_conntrack_tcp_packet+0x29e/0xbe0 [nf_conntrack]
+Jul 26 15:05:02 rx [11061396.060994] ? get_l4proto+0xe7/0x190 [nf_conntrack]
+Jul 26 15:05:02 rx [11061396.066220] nf_conntrack_in+0xe9/0x670 [nf_conntrack]
+Jul 26 15:05:02 rx [11061396.071618] ipv6_conntrack_local+0x14/0x20 [nf_conntrack]
+Jul 26 15:05:02 rx [11061396.077356] nf_hook_slow+0x45/0xb0
+Jul 26 15:05:02 rx [11061396.081098] ip6_xmit+0x3f0/0x5d0
+Jul 26 15:05:02 rx [11061396.084670] ? ipv6_anycast_cleanup+0x50/0x50
+Jul 26 15:05:02 rx [11061396.089282] ? __sk_dst_check+0x38/0x70
+Jul 26 15:05:02 rx [11061396.093381] ? inet6_csk_route_socket+0x13b/0x200
+Jul 26 15:05:02 rx [11061396.098346] inet6_csk_xmit+0xa7/0xf0
+Jul 26 15:05:02 rx [11061396.102263] __tcp_transmit_skb+0x550/0xb30
+Jul 26 15:05:02 rx [11061396.106701] tcp_write_xmit+0x3c6/0xc20
+Jul 26 15:05:02 rx [11061396.110792] ? __alloc_skb+0x98/0x1d0
+Jul 26 15:05:02 rx [11061396.114708] __tcp_push_pending_frames+0x37/0x100
+Jul 26 15:05:02 rx [11061396.119667] tcp_push+0xfd/0x100
+Jul 26 15:05:02 rx [11061396.123150] tcp_sendmsg_locked+0xc70/0xdd0
+Jul 26 15:05:02 rx [11061396.127588] tcp_sendmsg+0x2d/0x50
+Jul 26 15:05:02 rx [11061396.131245] inet6_sendmsg+0x43/0x70
+Jul 26 15:05:02 rx [11061396.135075] __sock_sendmsg+0x48/0x70
+Jul 26 15:05:02 rx [11061396.138994] ____sys_sendmsg+0x212/0x280
+Jul 26 15:05:02 rx [11061396.143172] ___sys_sendmsg+0x88/0xd0
+Jul 26 15:05:02 rx [11061396.147098] ? __seccomp_filter+0x7e/0x6b0
+Jul 26 15:05:02 rx [11061396.151446] ? __switch_to+0x39c/0x460
+Jul 26 15:05:02 rx [11061396.155453] ? __switch_to_asm+0x42/0x80
+Jul 26 15:05:02 rx [11061396.159636] ? __switch_to_asm+0x5a/0x80
+Jul 26 15:05:02 rx [11061396.163816] __sys_sendmsg+0x5c/0xa0
+Jul 26 15:05:02 rx [11061396.167647] __x64_sys_sendmsg+0x1f/0x30
+Jul 26 15:05:02 rx [11061396.171832] do_syscall_64+0x57/0x190
+Jul 26 15:05:02 rx [11061396.175748] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
+Jul 26 15:05:02 rx [11061396.181055] RIP: 0033:0x7f1ef692618d
+Jul 26 15:05:02 rx [11061396.184893] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48
+Jul 26 15:05:02 rx [11061396.203889] RSP: 002b:00007f1ef4a26aa0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
+Jul 26 15:05:02 rx [11061396.211708] RAX: ffffffffffffffda RBX: 000000000000084b RCX: 00007f1ef692618d
+Jul 26 15:05:02 rx [11061396.219091] RDX: 0000000000004000 RSI: 00007f1ef4a26b10 RDI: 0000000000000275
+Jul 26 15:05:02 rx [11061396.226475] RBP: 0000000000004000 R08: 0000000000000000 R09: 0000000000000020
+Jul 26 15:05:02 rx [11061396.233859] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000084b
+Jul 26 15:05:02 rx [11061396.241243] R13: 00007f1ef4a26b10 R14: 0000000000000275 R15: 000055592030f1e8
+Jul 26 15:05:02 rx [11061396.248628] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler nft_ct sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 mlx5_core hid_generic pci_hyperv_intf crc32_pclmul tls usbhid ahci mlxfw bnxt_en libahci hid nvme i2c_piix4 nvme_core wmi
+Jul 26 15:05:02 rx [11061396.324334] CR2: 0000000000000020
+Jul 26 15:05:02 rx [11061396.327944] ---[ end trace 68a2b679d1cfb4f1 ]---
+Jul 26 15:05:02 rx [11061396.433435] RIP: 0010:tcp_rearm_rto+0xe4/0x160
+Jul 26 15:05:02 rx [11061396.438137] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
+Jul 26 15:05:02 rx [11061396.457144] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246
+Jul 26 15:05:02 rx [11061396.462629] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
+Jul 26 15:05:02 rx [11061396.470012] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60
+Jul 26 15:05:02 rx [11061396.477396] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8
+Jul 26 15:05:02 rx [11061396.484779] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900
+Jul 26 15:05:02 rx [11061396.492164] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30
+Jul 26 15:05:02 rx [11061396.499547] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000
+Jul 26 15:05:02 rx [11061396.507886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Jul 26 15:05:02 rx [11061396.513884] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0
+Jul 26 15:05:02 rx [11061396.521267] PKRU: 55555554
+Jul 26 15:05:02 rx [11061396.524230] Kernel panic - not syncing: Fatal exception in interrupt
+Jul 26 15:05:02 rx [11061396.530885] Kernel Offset: 0x1b200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+Jul 26 15:05:03 rx [11061396.660181] ---[ end Kernel panic - not syncing: Fatal
+ exception in interrupt ]---
+
+After we hit this we disabled TLP by setting tcp_early_retrans to 0 and then hit the crash in the RACK case:
+
+Aug 7 07:26:16 rx [1006006.265582] BUG: kernel NULL pointer dereference, address: 0000000000000020
+Aug 7 07:26:16 rx [1006006.272719] #PF: supervisor read access in kernel mode
+Aug 7 07:26:16 rx [1006006.278030] #PF: error_code(0x0000) - not-present page
+Aug 7 07:26:16 rx [1006006.283343] PGD 0 P4D 0
+Aug 7 07:26:16 rx [1006006.286057] Oops: 0000 [#1] SMP NOPTI
+Aug 7 07:26:16 rx [1006006.289896] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G W 5.4.0-174-generic #193-Ubuntu
+Aug 7 07:26:16 rx [1006006.299107] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
+Aug 7 07:26:16 rx [1006006.309970] RIP: 0010:tcp_rearm_rto+0xe4/0x160
+Aug 7 07:26:16 rx [1006006.314584] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
+Aug 7 07:26:16 rx [1006006.333499] RSP: 0018:ffffb42600a50960 EFLAGS: 00010246
+Aug 7 07:26:16 rx [1006006.338895] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
+Aug 7 07:26:16 rx [1006006.346193] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff92d687ed8160
+Aug 7 07:26:16 rx [1006006.353489] RBP: ffffb42600a50978 R08: 0000000000000000 R09: 00000000cd896dcc
+Aug 7 07:26:16 rx [1006006.360786] R10: ffff92dc3404f400 R11: 0000000000000001 R12: ffff92d687ed8000
+Aug 7 07:26:16 rx [1006006.368084] R13: ffff92d687ed8160 R14: 00000000cd896dcc R15: 00000000cd8fca81
+Aug 7 07:26:16 rx [1006006.375381] FS: 0000000000000000(0000) GS:ffff93158ad40000(0000) knlGS:0000000000000000
+Aug 7 07:26:16 rx [1006006.383632] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Aug 7 07:26:16 rx [1006006.389544] CR2: 0000000000000020 CR3: 0000003e775ce006 CR4: 0000000000760ee0
+Aug 7 07:26:16 rx [1006006.396839] PKRU: 55555554
+Aug 7 07:26:16 rx [1006006.399717] Call Trace:
+Aug 7 07:26:16 rx [1006006.402335]
+Aug 7 07:26:16 rx [1006006.404525] ? show_regs.cold+0x1a/0x1f
+Aug 7 07:26:16 rx [1006006.408532] ? __die+0x90/0xd9
+Aug 7 07:26:16 rx [1006006.411760] ? no_context+0x196/0x380
+Aug 7 07:26:16 rx [1006006.415599] ? __bad_area_nosemaphore+0x50/0x1a0
+Aug 7 07:26:16 rx [1006006.420392] ? _raw_spin_lock+0x1e/0x30
+Aug 7 07:26:16 rx [1006006.424401] ? bad_area_nosemaphore+0x16/0x20
+Aug 7 07:26:16 rx [1006006.428927] ? do_user_addr_fault+0x267/0x450
+Aug 7 07:26:16 rx [1006006.433450] ? __do_page_fault+0x58/0x90
+Aug 7 07:26:16 rx [1006006.437542] ? do_page_fault+0x2c/0xe0
+Aug 7 07:26:16 rx [1006006.441470] ? page_fault+0x34/0x40
+Aug 7 07:26:16 rx [1006006.445134] ? tcp_rearm_rto+0xe4/0x160
+Aug 7 07:26:16 rx [1006006.449145] tcp_ack+0xa32/0xb30
+Aug 7 07:26:16 rx [1006006.452542] tcp_rcv_established+0x13c/0x670
+Aug 7 07:26:16 rx [1006006.456981] ? sk_filter_trim_cap+0x48/0x220
+Aug 7 07:26:16 rx [1006006.461419] tcp_v6_do_rcv+0xdb/0x450
+Aug 7 07:26:16 rx [1006006.465257] tcp_v6_rcv+0xc2b/0xd10
+Aug 7 07:26:16 rx [1006006.468918] ip6_protocol_deliver_rcu+0xd3/0x4e0
+Aug 7 07:26:16 rx [1006006.473706] ip6_input_finish+0x15/0x20
+Aug 7 07:26:16 rx [1006006.477710] ip6_input+0xa2/0xb0
+Aug 7 07:26:16 rx [1006006.481109] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0
+Aug 7 07:26:16 rx [1006006.486151] ip6_sublist_rcv_finish+0x3d/0x50
+Aug 7 07:26:16 rx [1006006.490679] ip6_sublist_rcv+0x1aa/0x250
+Aug 7 07:26:16 rx [1006006.494779] ? ip6_rcv_finish_core.isra.0+0xa0/0xa0
+Aug 7 07:26:16 rx [1006006.499828] ipv6_list_rcv+0x112/0x140
+Aug 7 07:26:16 rx [1006006.503748] __netif_receive_skb_list_core+0x1a4/0x250
+Aug 7 07:26:16 rx [1006006.509057] netif_receive_skb_list_internal+0x1a1/0x2b0
+Aug 7 07:26:16 rx [1006006.514538] gro_normal_list.part.0+0x1e/0x40
+Aug 7 07:26:16 rx [1006006.519068] napi_complete_done+0x91/0x130
+Aug 7 07:26:16 rx [1006006.523352] mlx5e_napi_poll+0x18e/0x610 [mlx5_core]
+Aug 7 07:26:16 rx [1006006.528481] net_rx_action+0x142/0x390
+Aug 7 07:26:16 rx [1006006.532398] __do_softirq+0xd1/0x2c1
+Aug 7 07:26:16 rx [1006006.536142] irq_exit+0xae/0xb0
+Aug 7 07:26:16 rx [1006006.539452] do_IRQ+0x5a/0xf0
+Aug 7 07:26:16 rx [1006006.542590] common_interrupt+0xf/0xf
+Aug 7 07:26:16 rx [1006006.546421]
+Aug 7 07:26:16 rx [1006006.548695] RIP: 0010:native_safe_halt+0xe/0x10
+Aug 7 07:26:16 rx [1006006.553399] Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65
+Aug 7 07:26:16 rx [1006006.572309] RSP: 0018:ffffb42600177e70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffc2
+Aug 7 07:26:16 rx [1006006.580040] RAX: ffffffff8ed08b20 RBX: 0000000000000005 RCX: 0000000000000001
+Aug 7 07:26:16 rx [1006006.587337] RDX: 00000000f48eeca2 RSI: 0000000000000082 RDI: 0000000000000082
+Aug 7 07:26:16 rx [1006006.594635] RBP: ffffb42600177e90 R08: 0000000000000000 R09: 000000000000020f
+Aug 7 07:26:16 rx [1006006.601931] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000005
+Aug 7 07:26:16 rx [1006006.609229] R13: ffff93157deb5f00 R14: 0000000000000000 R15: 0000000000000000
+Aug 7 07:26:16 rx [1006006.616530] ? __cpuidle_text_start+0x8/0x8
+Aug 7 07:26:16 rx [1006006.620886] ? default_idle+0x20/0x140
+Aug 7 07:26:16 rx [1006006.624804] arch_cpu_idle+0x15/0x20
+Aug 7 07:26:16 rx [1006006.628545] default_idle_call+0x23/0x30
+Aug 7 07:26:16 rx [1006006.632640] do_idle+0x1fb/0x270
+Aug 7 07:26:16 rx [1006006.636035] cpu_startup_entry+0x20/0x30
+Aug 7 07:26:16 rx [1006006.640126] start_secondary+0x178/0x1d0
+Aug 7 07:26:16 rx [1006006.644218] secondary_startup_64+0xa4/0xb0
+Aug 7 07:26:17 rx [1006006.648568] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet ast mii drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 hid_generic mlx5_core pci_hyperv_intf crc32_pclmul usbhid ahci tls mlxfw bnxt_en hid libahci nvme i2c_piix4 nvme_core wmi [last unloaded: cpuid]
+Aug 7 07:26:17 rx [1006006.726180] CR2: 0000000000000020
+Aug 7 07:26:17 rx [1006006.729718] ---[ end trace e0e2e37e4e612984 ]---
+
+Prior to seeing the first crash and on other machines we also see the warning in
+tcp_send_loss_probe() where packets_out is non-zero, but both transmit and retrans
+queues are empty so we know the box is seeing some accounting issue in this area:
+
+Jul 26 09:15:27 kernel: ------------[ cut here ]------------
+Jul 26 09:15:27 kernel: invalid inflight: 2 state 1 cwnd 68 mss 8988
+Jul 26 09:15:27 kernel: WARNING: CPU: 16 PID: 0 at net/ipv4/tcp_output.c:2605 tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif joydev input_leds rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_he>
+Jul 26 09:15:27 kernel: CPU: 16 PID: 0 Comm: swapper/16 Not tainted 5.4.0-174-generic #193-Ubuntu
+Jul 26 09:15:27 kernel: Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
+Jul 26 09:15:27 kernel: RIP: 0010:tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: Code: 08 26 01 00 75 e2 41 0f b6 54 24 12 41 8b 8c 24 c0 06 00 00 45 89 f0 48 c7 c7 e0 b4 20 a7 c6 05 8d 08 26 01 01 e8 4a c0 0f 00 <0f> 0b eb ba 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41
+Jul 26 09:15:27 kernel: RSP: 0018:ffffb7838088ce00 EFLAGS: 00010286
+Jul 26 09:15:27 kernel: RAX: 0000000000000000 RBX: ffff9b84b5630430 RCX: 0000000000000006
+Jul 26 09:15:27 kernel: RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9b8e4621c8c0
+Jul 26 09:15:27 kernel: RBP: ffffb7838088ce18 R08: 0000000000000927 R09: 0000000000000004
+Jul 26 09:15:27 kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9b84b5630000
+Jul 26 09:15:27 kernel: R13: 0000000000000000 R14: 000000000000231c R15: ffff9b84b5630430
+Jul 26 09:15:27 kernel: FS: 0000000000000000(0000) GS:ffff9b8e46200000(0000) knlGS:0000000000000000
+Jul 26 09:15:27 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Jul 26 09:15:27 kernel: CR2: 000056238cec2380 CR3: 0000003e49ede005 CR4: 0000000000760ee0
+Jul 26 09:15:27 kernel: PKRU: 55555554
+Jul 26 09:15:27 kernel: Call Trace:
+Jul 26 09:15:27 kernel: <IRQ>
+Jul 26 09:15:27 kernel: ? show_regs.cold+0x1a/0x1f
+Jul 26 09:15:27 kernel: ? __warn+0x98/0xe0
+Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: ? report_bug+0xd1/0x100
+Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0
+Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50
+Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30
+Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240
+Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0
+Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240
+Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130
+Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280
+Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0
+Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90
+Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0
+Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50
+Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30
+Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220
+Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240
+Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0
+Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240
+Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130
+Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280
+Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0
+Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90
+Jul 26 09:15:27 kernel: ? recalibrate_cpu_khz+0x10/0x10
+Jul 26 09:15:27 kernel: ? ktime_get+0x3e/0xa0
+Jul 26 09:15:27 kernel: ? native_x2apic_icr_write+0x30/0x30
+Jul 26 09:15:27 kernel: run_timer_softirq+0x2a/0x50
+Jul 26 09:15:27 kernel: __do_softirq+0xd1/0x2c1
+Jul 26 09:15:27 kernel: irq_exit+0xae/0xb0
+Jul 26 09:15:27 kernel: smp_apic_timer_interrupt+0x7b/0x140
+Jul 26 09:15:27 kernel: apic_timer_interrupt+0xf/0x20
+Jul 26 09:15:27 kernel: </IRQ>
+Jul 26 09:15:27 kernel: RIP: 0010:native_safe_halt+0xe/0x10
+Jul 26 09:15:27 kernel: Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 <c3> 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65
+Jul 26 09:15:27 kernel: RSP: 0018:ffffb783801cfe70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
+Jul 26 09:15:27 kernel: RAX: ffffffffa6908b20 RBX: 0000000000000010 RCX: 0000000000000001
+Jul 26 09:15:27 kernel: RDX: 000000006fc0c97e RSI: 0000000000000082 RDI: 0000000000000082
+Jul 26 09:15:27 kernel: RBP: ffffb783801cfe90 R08: 0000000000000000 R09: 0000000000000225
+Jul 26 09:15:27 kernel: R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000010
+Jul 26 09:15:27 kernel: R13: ffff9b8e390b0000 R14: 0000000000000000 R15: 0000000000000000
+Jul 26 09:15:27 kernel: ? __cpuidle_text_start+0x8/0x8
+Jul 26 09:15:27 kernel: ? default_idle+0x20/0x140
+Jul 26 09:15:27 kernel: arch_cpu_idle+0x15/0x20
+Jul 26 09:15:27 kernel: default_idle_call+0x23/0x30
+Jul 26 09:15:27 kernel: do_idle+0x1fb/0x270
+Jul 26 09:15:27 kernel: cpu_startup_entry+0x20/0x30
+Jul 26 09:15:27 kernel: start_secondary+0x178/0x1d0
+Jul 26 09:15:27 kernel: secondary_startup_64+0xa4/0xb0
+Jul 26 09:15:27 kernel: ---[ end trace e7ac822987e33be1 ]---
+
+The NULL ptr deref is coming from tcp_rto_delta_us() attempting to pull an skb
+off the head of the retransmit queue and then dereferencing that skb to get the
+skb_mstamp_ns value via tcp_skb_timestamp_us(skb).
+
+The crash is the same one that was reported a # of years ago here:
+https://lore.kernel.org/netdev/86c0f836-9a7c-438b-d81a-839be45f1f58@gmail.com/T/#t
+
+and the kernel we're running has the fix which was added to resolve this issue.
+
+Unfortunately we've been unsuccessful so far in reproducing this problem in the
+lab and do not have the luxury of pushing out a new kernel to try and test if
+newer kernels resolve this issue at the moment. I realize this is a report
+against both an Ubuntu kernel and also an older 5.4 kernel. I have reported this
+issue to Ubuntu here: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2077657
+however I feel like since this issue has possibly cropped up again it makes
+sense to build in some protection in this path (even on the latest kernel
+versions) since the code in question just blindly assumes there's a valid skb
+without testing if it's NULL b/f it looks at the timestamp.
+
+Given we have seen crashes in this path before and now this case it seems like
+we should protect ourselves for when packets_out accounting is incorrect.
+While we should fix that root cause we should also just make sure the skb
+is not NULL before dereferencing it. Also add a warn once here to capture
+some information if/when the problem case is hit again.
+
+Fixes: e1a10ef7fa87 ("tcp: introduce tcp_rto_delta_us() helper for xmit timer fix")
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index c7501ca66dd34..a770210fda9bc 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -2176,9 +2176,26 @@ static inline s64 tcp_rto_delta_us(const struct sock *sk)
+ {
+ 	const struct sk_buff *skb = tcp_rtx_queue_head(sk);
+ 	u32 rto = inet_csk(sk)->icsk_rto;
+-	u64 rto_time_stamp_us = tcp_skb_timestamp_us(skb) + jiffies_to_usecs(rto);
+ 
+-	return rto_time_stamp_us - tcp_sk(sk)->tcp_mstamp;
++	if (likely(skb)) {
++		u64 rto_time_stamp_us = tcp_skb_timestamp_us(skb) + jiffies_to_usecs(rto);
++
++		return rto_time_stamp_us - tcp_sk(sk)->tcp_mstamp;
++	} else {
++		WARN_ONCE(1,
++			"rtx queue emtpy: "
++			"out:%u sacked:%u lost:%u retrans:%u "
++			"tlp_high_seq:%u sk_state:%u ca_state:%u "
++			"advmss:%u mss_cache:%u pmtu:%u\n",
++			tcp_sk(sk)->packets_out, tcp_sk(sk)->sacked_out,
++			tcp_sk(sk)->lost_out, tcp_sk(sk)->retrans_out,
++			tcp_sk(sk)->tlp_high_seq, sk->sk_state,
++			inet_csk(sk)->icsk_ca_state,
++			tcp_sk(sk)->advmss, tcp_sk(sk)->mss_cache,
++			inet_csk(sk)->icsk_pmtu_cookie);
++		return jiffies_to_usecs(rto);
++	}
++
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.1/tpm-clean-up-tpm-space-after-command-failure.patch b/queue-6.1/tpm-clean-up-tpm-space-after-command-failure.patch
new file mode 100644
index 00000000000..e4c10e2c8b3
--- /dev/null
+++ b/queue-6.1/tpm-clean-up-tpm-space-after-command-failure.patch
@@ -0,0 +1,57 @@
+From 2f4bd0d2c5869b980787a279b1a1d5d23d87c0ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2024 12:55:46 +0100
+Subject: tpm: Clean up TPM space after command failure
+
+From: Jonathan McDowell <noodles@meta.com>
+
+[ Upstream commit e3aaebcbb7c6b403416f442d1de70d437ce313a7 ]
+
+tpm_dev_transmit prepares the TPM space before attempting command
+transmission. However if the command fails no rollback of this
+preparation is done. This can result in transient handles being leaked
+if the device is subsequently closed with no further commands performed.
+
+Fix this by flushing the space in the event of command transmission
+failure.
+
+Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces")
+Signed-off-by: Jonathan McDowell <noodles@meta.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm-dev-common.c | 2 ++
+ drivers/char/tpm/tpm2-space.c     | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
+index 30b4c288c1bbc..c3fbbf4d3db79 100644
+--- a/drivers/char/tpm/tpm-dev-common.c
++++ b/drivers/char/tpm/tpm-dev-common.c
+@@ -47,6 +47,8 @@ static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 
+ 	if (!ret)
+ 		ret = tpm2_commit_space(chip, space, buf, &len);
++	else
++		tpm2_flush_space(chip);
+ 
+ out_rc:
+ 	return ret ? ret : len;
+diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
+index ffb35f0154c16..c57404c6b98c9 100644
+--- a/drivers/char/tpm/tpm2-space.c
++++ b/drivers/char/tpm/tpm2-space.c
+@@ -166,6 +166,9 @@ void tpm2_flush_space(struct tpm_chip *chip)
+ 	struct tpm_space *space = &chip->work_space;
+ 	int i;
+ 
++	if (!space)
++		return;
++
+ 	for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++)
+ 		if (space->context_tbl[i] && ~space->context_tbl[i])
+ 			tpm2_flush_context(chip, space->context_tbl[i]);
+-- 
+2.43.0
+
diff --git a/queue-6.1/usb-dwc2-skip-clock-gating-on-broadcom-socs.patch b/queue-6.1/usb-dwc2-skip-clock-gating-on-broadcom-socs.patch
new file mode 100644
index 00000000000..1fce0b7f9fd
--- /dev/null
+++ b/queue-6.1/usb-dwc2-skip-clock-gating-on-broadcom-socs.patch
@@ -0,0 +1,72 @@
+From 35b0f4c3a4006ff371d22a4a0c0ce1e30bffb02b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 15:00:26 +0200
+Subject: usb: dwc2: Skip clock gating on Broadcom SoCs
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit d483f034f03261c8c8450d106aa243837122b5f0 ]
+
+On resume of the Raspberry Pi the dwc2 driver fails to enable
+HCD_FLAG_HW_ACCESSIBLE before re-enabling the interrupts.
+This causes a situation where both handler ignore a incoming port
+interrupt and force the upper layers to disable the dwc2 interrupt line.
+This leaves the USB interface in a unusable state:
+
+irq 66: nobody cared (try booting with the "irqpoll" option)
+CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W          6.10.0-rc3
+Hardware name: BCM2835
+Call trace:
+unwind_backtrace from show_stack+0x10/0x14
+show_stack from dump_stack_lvl+0x50/0x64
+dump_stack_lvl from __report_bad_irq+0x38/0xc0
+__report_bad_irq from note_interrupt+0x2ac/0x2f4
+note_interrupt from handle_irq_event+0x88/0x8c
+handle_irq_event from handle_level_irq+0xb4/0x1ac
+handle_level_irq from generic_handle_domain_irq+0x24/0x34
+generic_handle_domain_irq from bcm2836_chained_handle_irq+0x24/0x28
+bcm2836_chained_handle_irq from generic_handle_domain_irq+0x24/0x34
+generic_handle_domain_irq from generic_handle_arch_irq+0x34/0x44
+generic_handle_arch_irq from __irq_svc+0x88/0xb0
+Exception stack(0xc1b01f20 to 0xc1b01f68)
+1f20: 0005c0d4 00000001 00000000 00000000 c1b09780 c1d6b32c c1b04e54 c1a5eae8
+1f40: c1b04e90 00000000 00000000 00000000 c1d6a8a0 c1b01f70 c11d2da8 c11d4160
+1f60: 60000013 ffffffff
+__irq_svc from default_idle_call+0x1c/0xb0
+default_idle_call from do_idle+0x21c/0x284
+do_idle from cpu_startup_entry+0x28/0x2c
+cpu_startup_entry from kernel_init+0x0/0x12c
+handlers:
+[<f539e0f4>] dwc2_handle_common_intr
+[<75cd278b>] usb_hcd_irq
+Disabling IRQ #66
+
+Disabling clock gating workaround this issue.
+
+Fixes: 0112b7ce68ea ("usb: dwc2: Update dwc2_handle_usb_suspend_intr function.")
+Link: https://lore.kernel.org/linux-usb/3fd0c2fb-4752-45b3-94eb-42352703e1fd@gmx.net/T/
+Link: https://lore.kernel.org/all/5e8cbce0-3260-2971-484f-fc73a3b2bd28@synopsys.com/
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Link: https://lore.kernel.org/r/20240728130029.78279-5-wahrenst@gmx.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/params.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
+index 8eab5f38b1101..7c66a1dfe8975 100644
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -18,6 +18,7 @@ static void dwc2_set_bcm_params(struct dwc2_hsotg *hsotg)
+ 	p->max_transfer_size = 65535;
+ 	p->max_packet_count = 511;
+ 	p->ahbcfg = 0x10;
++	p->no_clock_gating = true;
+ }
+ 
+ static void dwc2_set_his_params(struct dwc2_hsotg *hsotg)
+-- 
+2.43.0
+
diff --git a/queue-6.1/vdpa-add-eventfd-for-the-vdpa-callback.patch b/queue-6.1/vdpa-add-eventfd-for-the-vdpa-callback.patch
new file mode 100644
index 00000000000..9a2d148266d
--- /dev/null
+++ b/queue-6.1/vdpa-add-eventfd-for-the-vdpa-callback.patch
@@ -0,0 +1,77 @@
+From b7542cab0e6ac19e9a04ffe76fe6541c967d5b6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 13:30:40 +0800
+Subject: vdpa: Add eventfd for the vdpa callback
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 5e68470f4e80a4120e9ecec408f6ab4ad386bd4a ]
+
+Add eventfd for the vdpa callback so that user
+can signal it directly instead of triggering the
+callback. It will be used for vhost-vdpa case.
+
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Message-Id: <20230323053043.35-9-xieyongji@bytedance.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Stable-dep-of: 02e9e9366fef ("vhost_vdpa: assign irq bypass producer token correctly")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c         | 2 ++
+ drivers/virtio/virtio_vdpa.c | 1 +
+ include/linux/vdpa.h         | 6 ++++++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 55f88eeb78a72..ef9e845a5a5c5 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -602,9 +602,11 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
+ 		if (vq->call_ctx.ctx) {
+ 			cb.callback = vhost_vdpa_virtqueue_cb;
+ 			cb.private = vq;
++			cb.trigger = vq->call_ctx.ctx;
+ 		} else {
+ 			cb.callback = NULL;
+ 			cb.private = NULL;
++			cb.trigger = NULL;
+ 		}
+ 		ops->set_vq_cb(vdpa, idx, &cb);
+ 		vhost_vdpa_setup_vq_irq(v, idx);
+diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c
+index 9670cc79371d8..056ba6c5bb083 100644
+--- a/drivers/virtio/virtio_vdpa.c
++++ b/drivers/virtio/virtio_vdpa.c
+@@ -188,6 +188,7 @@ virtio_vdpa_setup_vq(struct virtio_device *vdev, unsigned int index,
+ 	/* Setup virtqueue callback */
+ 	cb.callback = callback ? virtio_vdpa_virtqueue_cb : NULL;
+ 	cb.private = info;
++	cb.trigger = NULL;
+ 	ops->set_vq_cb(vdpa, index, &cb);
+ 	ops->set_vq_num(vdpa, index, virtqueue_get_vring_size(vq));
+ 
+diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h
+index 6d0f5e4e82c25..41bc78b3b8360 100644
+--- a/include/linux/vdpa.h
++++ b/include/linux/vdpa.h
+@@ -13,10 +13,16 @@
+  * struct vdpa_calllback - vDPA callback definition.
+  * @callback: interrupt callback function
+  * @private: the data passed to the callback function
++ * @trigger: the eventfd for the callback (Optional).
++ *           When it is set, the vDPA driver must guarantee that
++ *           signaling it is functional equivalent to triggering
++ *           the callback. Then vDPA parent can signal it directly
++ *           instead of triggering the callback.
+  */
+ struct vdpa_callback {
+ 	irqreturn_t (*callback)(void *data);
+ 	void *private;
++	struct eventfd_ctx *trigger;
+ };
+ 
+ /**
+-- 
+2.43.0
+
diff --git a/queue-6.1/vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch b/queue-6.1/vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
new file mode 100644
index 00000000000..ef5c1cbb2f1
--- /dev/null
+++ b/queue-6.1/vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
@@ -0,0 +1,95 @@
+From 3650229c7f793d0d72e9c22dbb406ca0bda80050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2024 11:19:00 +0800
+Subject: vhost_vdpa: assign irq bypass producer token correctly
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ]
+
+We used to call irq_bypass_unregister_producer() in
+vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
+token pointer is still valid or not.
+
+Actually, we use the eventfd_ctx as the token so the life cycle of the
+token should be bound to the VHOST_SET_VRING_CALL instead of
+vhost_vdpa_setup_vq_irq() which could be called by set_status().
+
+Fixing this by setting up irq bypass producer's token when handling
+VHOST_SET_VRING_CALL and un-registering the producer before calling
+vhost_vring_ioctl() to prevent a possible use after free as eventfd
+could have been released in vhost_vring_ioctl(). And such registering
+and unregistering will only be done if DRIVER_OK is set.
+
+Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
+Tested-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <20240816031900.18013-1-jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index ef9e845a5a5c5..59587f9880d3c 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -191,11 +191,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid)
+ 	if (irq < 0)
+ 		return;
+ 
+-	irq_bypass_unregister_producer(&vq->call_ctx.producer);
+ 	if (!vq->call_ctx.ctx)
+ 		return;
+ 
+-	vq->call_ctx.producer.token = vq->call_ctx.ctx;
+ 	vq->call_ctx.producer.irq = irq;
+ 	ret = irq_bypass_register_producer(&vq->call_ctx.producer);
+ 	if (unlikely(ret))
+@@ -571,6 +569,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
+ 			vq->last_avail_idx = vq_state.split.avail_index;
+ 		}
+ 		break;
++	case VHOST_SET_VRING_CALL:
++		if (vq->call_ctx.ctx) {
++			if (ops->get_status(vdpa) &
++			    VIRTIO_CONFIG_S_DRIVER_OK)
++				vhost_vdpa_unsetup_vq_irq(v, idx);
++			vq->call_ctx.producer.token = NULL;
++		}
++		break;
+ 	}
+ 
+ 	r = vhost_vring_ioctl(&v->vdev, cmd, argp);
+@@ -603,13 +609,16 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
+ 			cb.callback = vhost_vdpa_virtqueue_cb;
+ 			cb.private = vq;
+ 			cb.trigger = vq->call_ctx.ctx;
++			vq->call_ctx.producer.token = vq->call_ctx.ctx;
++			if (ops->get_status(vdpa) &
++			    VIRTIO_CONFIG_S_DRIVER_OK)
++				vhost_vdpa_setup_vq_irq(v, idx);
+ 		} else {
+ 			cb.callback = NULL;
+ 			cb.private = NULL;
+ 			cb.trigger = NULL;
+ 		}
+ 		ops->set_vq_cb(vdpa, idx, &cb);
+-		vhost_vdpa_setup_vq_irq(v, idx);
+ 		break;
+ 
+ 	case VHOST_SET_VRING_NUM:
+@@ -1235,6 +1244,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep)
+ 	for (i = 0; i < nvqs; i++) {
+ 		vqs[i] = &v->vqs[i];
+ 		vqs[i]->handle_kick = handle_vq_kick;
++		vqs[i]->call_ctx.ctx = NULL;
+ 	}
+ 	vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false,
+ 		       vhost_vdpa_process_iotlb_msg);
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-imx_sc_wdt-don-t-disable-wdt-in-suspend.patch b/queue-6.1/watchdog-imx_sc_wdt-don-t-disable-wdt-in-suspend.patch
new file mode 100644
index 00000000000..d09ec3f761f
--- /dev/null
+++ b/queue-6.1/watchdog-imx_sc_wdt-don-t-disable-wdt-in-suspend.patch
@@ -0,0 +1,73 @@
+From f1f36aa7ad50bed999b2382c061f41d43c9b6e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2024 14:18:45 +0200
+Subject: watchdog: imx_sc_wdt: Don't disable WDT in suspend
+
+From: Jonas Blixt <jonas.blixt@actia.se>
+
+[ Upstream commit 2d9d6d300fb0a4ae4431bb308027ac9385746d42 ]
+
+Parts of the suspend and resume chain is left unprotected if we disable
+the WDT here.
+
+>From experiments we can see that the SCU disables and re-enables the WDT
+when we enter and leave suspend to ram. By not touching the WDT here we
+are protected by the WDT all the way to the SCU.
+
+Signed-off-by: Jonas Blixt <jonas.blixt@actia.se>
+CC: Anson Huang <anson.huang@nxp.com>
+Fixes: 986857acbc9a ("watchdog: imx_sc: Add i.MX system controller watchdog support")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20240801121845.1465765-1-jonas.blixt@actia.se
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx_sc_wdt.c | 24 ------------------------
+ 1 file changed, 24 deletions(-)
+
+diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c
+index 8ac021748d160..79649b0e89e47 100644
+--- a/drivers/watchdog/imx_sc_wdt.c
++++ b/drivers/watchdog/imx_sc_wdt.c
+@@ -213,29 +213,6 @@ static int imx_sc_wdt_probe(struct platform_device *pdev)
+ 	return devm_watchdog_register_device(dev, wdog);
+ }
+ 
+-static int __maybe_unused imx_sc_wdt_suspend(struct device *dev)
+-{
+-	struct imx_sc_wdt_device *imx_sc_wdd = dev_get_drvdata(dev);
+-
+-	if (watchdog_active(&imx_sc_wdd->wdd))
+-		imx_sc_wdt_stop(&imx_sc_wdd->wdd);
+-
+-	return 0;
+-}
+-
+-static int __maybe_unused imx_sc_wdt_resume(struct device *dev)
+-{
+-	struct imx_sc_wdt_device *imx_sc_wdd = dev_get_drvdata(dev);
+-
+-	if (watchdog_active(&imx_sc_wdd->wdd))
+-		imx_sc_wdt_start(&imx_sc_wdd->wdd);
+-
+-	return 0;
+-}
+-
+-static SIMPLE_DEV_PM_OPS(imx_sc_wdt_pm_ops,
+-			 imx_sc_wdt_suspend, imx_sc_wdt_resume);
+-
+ static const struct of_device_id imx_sc_wdt_dt_ids[] = {
+ 	{ .compatible = "fsl,imx-sc-wdt", },
+ 	{ /* sentinel */ }
+@@ -247,7 +224,6 @@ static struct platform_driver imx_sc_wdt_driver = {
+ 	.driver		= {
+ 		.name	= "imx-sc-wdt",
+ 		.of_match_table = imx_sc_wdt_dt_ids,
+-		.pm	= &imx_sc_wdt_pm_ops,
+ 	},
+ };
+ module_platform_driver(imx_sc_wdt_driver);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-ath9k-fix-parameter-check-in-ath9k_init_debug.patch b/queue-6.1/wifi-ath9k-fix-parameter-check-in-ath9k_init_debug.patch
new file mode 100644
index 00000000000..9344306b5fc
--- /dev/null
+++ b/queue-6.1/wifi-ath9k-fix-parameter-check-in-ath9k_init_debug.patch
@@ -0,0 +1,41 @@
+From 67a1a03876cdd2d32b798646e3e7a52f70bf81ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jul 2023 19:47:40 +0800
+Subject: wifi: ath9k: fix parameter check in ath9k_init_debug()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Minjie Du <duminjie@vivo.com>
+
+[ Upstream commit 6edb4ba6fb5b946d112259f54f4657f82eb71e89 ]
+
+Make IS_ERR() judge the debugfs_create_dir() function return
+in ath9k_init_debug()
+
+Signed-off-by: Minjie Du <duminjie@vivo.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230712114740.13226-1-duminjie@vivo.com
+Stable-dep-of: f6ffe7f01847 ("wifi: ath9k: Remove error checks when creating debugfs entries")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index d9bac1c343490..72660a66be1df 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -1420,7 +1420,7 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 
+ 	sc->debug.debugfs_phy = debugfs_create_dir("ath9k",
+ 						   sc->hw->wiphy->debugfsdir);
+-	if (!sc->debug.debugfs_phy)
++	if (IS_ERR(sc->debug.debugfs_phy))
+ 		return -ENOMEM;
+ 
+ #ifdef CONFIG_ATH_DEBUG
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-ath9k-remove-error-checks-when-creating-debugfs.patch b/queue-6.1/wifi-ath9k-remove-error-checks-when-creating-debugfs.patch
new file mode 100644
index 00000000000..354bc1f7726
--- /dev/null
+++ b/queue-6.1/wifi-ath9k-remove-error-checks-when-creating-debugfs.patch
@@ -0,0 +1,68 @@
+From 28ba64c1dd64883cb792d96d14eff49417c44c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 13:02:22 +0200
+Subject: wifi: ath9k: Remove error checks when creating debugfs entries
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
+
+We should not be checking the return values from debugfs creation at all: the
+debugfs functions are designed to handle errors of previously called functions
+and just transparently abort the creation of debugfs entries when debugfs is
+disabled. If we check the return value and abort driver initialisation, we break
+the driver if debugfs is disabled (such as when booting with debugfs=off).
+
+Earlier versions of ath9k accidentally did the right thing by checking the
+return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two
+commits referenced below, breaking ath9k with debugfs=off starting from the 6.6
+kernel (as reported in the Bugzilla linked below).
+
+Restore functionality by just getting rid of the return value check entirely.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219122
+Fixes: 1e4134610d93 ("wifi: ath9k: use IS_ERR() with debugfs_create_dir()")
+Fixes: 6edb4ba6fb5b ("wifi: ath9k: fix parameter check in ath9k_init_debug()")
+Reported-by: Daniel Tobias <dan.g.tob@gmail.com>
+Tested-by: Daniel Tobias <dan.g.tob@gmail.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20240805110225.19690-1-toke@toke.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/debug.c         | 2 --
+ drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index 72660a66be1df..9955b9c4df2b4 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -1420,8 +1420,6 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 
+ 	sc->debug.debugfs_phy = debugfs_create_dir("ath9k",
+ 						   sc->hw->wiphy->debugfsdir);
+-	if (IS_ERR(sc->debug.debugfs_phy))
+-		return -ENOMEM;
+ 
+ #ifdef CONFIG_ATH_DEBUG
+ 	debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+index e79bbcd3279af..81332086e2899 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -491,8 +491,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
+ 
+ 	priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
+ 					     priv->hw->wiphy->debugfsdir);
+-	if (IS_ERR(priv->debug.debugfs_phy))
+-		return -ENOMEM;
+ 
+ 	ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-cfg80211-fix-two-more-possible-ubsan-detected-o.patch b/queue-6.1/wifi-cfg80211-fix-two-more-possible-ubsan-detected-o.patch
new file mode 100644
index 00000000000..887caa35e21
--- /dev/null
+++ b/queue-6.1/wifi-cfg80211-fix-two-more-possible-ubsan-detected-o.patch
@@ -0,0 +1,57 @@
+From 10a1717a867d810959f6bca7c49388ff7696dd85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 12:08:06 +0300
+Subject: wifi: cfg80211: fix two more possible UBSAN-detected off-by-one
+ errors
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
+
+Although not reproduced in practice, these two cases may be
+considered by UBSAN as off-by-one errors. So fix them in the
+same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN
+noise in cfg80211_wext_siwscan()").
+
+Fixes: 807f8a8c3004 ("cfg80211/nl80211: add support for scheduled scans")
+Fixes: 5ba63533bbf6 ("cfg80211: fix alignment problem in scan request")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Link: https://patch.msgid.link/20240909090806.1091956-1-dmantipov@yandex.ru
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 3 ++-
+ net/wireless/sme.c     | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index dd9695306fb85..fe14997ce2c08 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -9465,7 +9465,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	if (n_ssids)
+-		request->ssids = (void *)&request->channels[n_channels];
++		request->ssids = (void *)request +
++			struct_size(request, channels, n_channels);
+ 	request->n_ssids = n_ssids;
+ 	if (ie_len) {
+ 		if (n_ssids)
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index b97834284baef..e35c3c29cec7d 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -115,7 +115,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
+ 		n_channels = i;
+ 	}
+ 	request->n_channels = n_channels;
+-	request->ssids = (void *)&request->channels[n_channels];
++	request->ssids = (void *)request +
++		struct_size(request, channels, n_channels);
+ 	request->n_ssids = 1;
+ 
+ 	memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-cfg80211-fix-ubsan-noise-in-cfg80211_wext_siwsc.patch b/queue-6.1/wifi-cfg80211-fix-ubsan-noise-in-cfg80211_wext_siwsc.patch
new file mode 100644
index 00000000000..ed0b6122f19
--- /dev/null
+++ b/queue-6.1/wifi-cfg80211-fix-ubsan-noise-in-cfg80211_wext_siwsc.patch
@@ -0,0 +1,69 @@
+From d6b918ecea2fc51455d60d2ab33f104b0c13840e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 18:04:00 +0300
+Subject: wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
+
+Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
+and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the
+following:
+
+[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25
+[ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]'
+<...skipped...>
+[ T4985] Call Trace:
+[ T4985]  <TASK>
+[ T4985]  dump_stack_lvl+0x1c2/0x2a0
+[ T4985]  ? __pfx_dump_stack_lvl+0x10/0x10
+[ T4985]  ? __pfx__printk+0x10/0x10
+[ T4985]  __ubsan_handle_out_of_bounds+0x127/0x150
+[ T4985]  cfg80211_wext_siwscan+0x11a4/0x1260
+<...the rest is not too useful...>
+
+Even if we do 'creq->n_channels = n_channels' before 'creq->ssids =
+(void *)&creq->channels[n_channels]', UBSAN treats the latter as
+off-by-one error. Fix this by using pointer arithmetic rather than
+an expression with explicit array indexing and use convenient
+'struct_size()' to simplify the math here and in 'kzalloc()' above.
+
+Fixes: 5ba63533bbf6 ("cfg80211: fix alignment problem in scan request")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Reviewed-by: Kees Cook <kees@kernel.org>
+Link: https://patch.msgid.link/20240905150400.126386-1-dmantipov@yandex.ru
+[fix coding style for multi-line calculation]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index d18716e5b2cc2..398b6bab4b60e 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2750,8 +2750,8 @@ int cfg80211_wext_siwscan(struct net_device *dev,
+ 		n_channels = ieee80211_get_num_supported_channels(wiphy);
+ 	}
+ 
+-	creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
+-		       n_channels * sizeof(void *),
++	creq = kzalloc(struct_size(creq, channels, n_channels) +
++		       sizeof(struct cfg80211_ssid),
+ 		       GFP_ATOMIC);
+ 	if (!creq)
+ 		return -ENOMEM;
+@@ -2759,7 +2759,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
+ 	creq->wiphy = wiphy;
+ 	creq->wdev = dev->ieee80211_ptr;
+ 	/* SSIDs come after channels */
+-	creq->ssids = (void *)&creq->channels[n_channels];
++	creq->ssids = (void *)creq + struct_size(creq, channels, n_channels);
+ 	creq->n_channels = n_channels;
+ 	creq->n_ssids = 1;
+ 	creq->scan_start = jiffies;
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-iwlwifi-mvm-increase-the-time-between-ranging-m.patch b/queue-6.1/wifi-iwlwifi-mvm-increase-the-time-between-ranging-m.patch
new file mode 100644
index 00000000000..e19d899ea13
--- /dev/null
+++ b/queue-6.1/wifi-iwlwifi-mvm-increase-the-time-between-ranging-m.patch
@@ -0,0 +1,39 @@
+From c2a1b3c4d3aadf7118b4636fdcb4a5a38fc89425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 20:20:12 +0300
+Subject: wifi: iwlwifi: mvm: increase the time between ranging measurements
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 3a7ee94559dfd640604d0265739e86dec73b64e8 ]
+
+The algo running in fw may take a little longer than 5 milliseconds,
+(e.g. measurement on 80MHz while associated). Increase the minimum
+time between measurements to 7 milliseconds.
+
+Fixes: 830aa3e7d1ca ("iwlwifi: mvm: add support for range request command version 13")
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20240729201718.d3f3c26e00d9.I09e951290e8a3d73f147b88166fd9a678d1d69ed@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/constants.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
+index c604f9f39b248..685649b48c570 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
+@@ -103,7 +103,7 @@
+ #define IWL_MVM_FTM_INITIATOR_SECURE_LTF	false
+ #define IWL_MVM_FTM_RESP_NDP_SUPPORT		true
+ #define IWL_MVM_FTM_RESP_LMR_FEEDBACK_SUPPORT	true
+-#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR	5
++#define IWL_MVM_FTM_NON_TB_MIN_TIME_BETWEEN_MSR	7
+ #define IWL_MVM_FTM_NON_TB_MAX_TIME_BETWEEN_MSR	1000
+ #define IWL_MVM_D3_DEBUG			false
+ #define IWL_MVM_USE_TWT				true
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-mac80211-don-t-use-rate-mask-for-offchannel-tx-.patch b/queue-6.1/wifi-mac80211-don-t-use-rate-mask-for-offchannel-tx-.patch
new file mode 100644
index 00000000000..768dd686d2c
--- /dev/null
+++ b/queue-6.1/wifi-mac80211-don-t-use-rate-mask-for-offchannel-tx-.patch
@@ -0,0 +1,117 @@
+From f0b902056493b7b115642852dbb5ed24cb4fa408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2024 15:48:16 +0800
+Subject: wifi: mac80211: don't use rate mask for offchannel TX either
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit e7a7ef9a0742dbd0818d5b15fba2c5313ace765b ]
+
+Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for
+scanning"), ignore incorrect settings to avoid no supported rate warning
+reported by syzbot.
+
+The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211:
+fix default HE tx bitrate mask in 2G band"), which however corrects
+bitmask of HE MCS and recognizes correctly settings of empty legacy rate
+plus HE MCS rate instead of returning -EINVAL.
+
+As suggestions [1], follow the change of SCAN TX to consider this case of
+offchannel TX as well.
+
+[1] https://lore.kernel.org/linux-wireless/6ab2dc9c3afe753ca6fdcdd1421e7a1f47e87b84.camel@sipsolutions.net/T/#m2ac2a6d2be06a37c9c47a3d8a44b4f647ed4f024
+
+Reported-by: syzbot+8dd98a9e98ee28dc484a@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-wireless/000000000000fdef8706191a3f7b@google.com/
+Fixes: 9df66d5b9f45 ("cfg80211: fix default HE tx bitrate mask in 2G band")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20240729074816.20323-1-pkshih@realtek.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/mac80211.h    | 7 ++++---
+ net/mac80211/offchannel.c | 1 +
+ net/mac80211/rate.c       | 2 +-
+ net/mac80211/scan.c       | 2 +-
+ net/mac80211/tx.c         | 2 +-
+ 5 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 87a4f334c22a8..a5a5a29157364 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -885,8 +885,9 @@ enum mac80211_tx_info_flags {
+  *	of their QoS TID or other priority field values.
+  * @IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX: first MLO TX, used mostly internally
+  *	for sequence number assignment
+- * @IEEE80211_TX_CTRL_SCAN_TX: Indicates that this frame is transmitted
+- *	due to scanning, not in normal operation on the interface.
++ * @IEEE80211_TX_CTRL_DONT_USE_RATE_MASK: Don't use rate mask for this frame
++ *	which is transmitted due to scanning or offchannel TX, not in normal
++ *	operation on the interface.
+  * @IEEE80211_TX_CTRL_MLO_LINK: If not @IEEE80211_LINK_UNSPECIFIED, this
+  *	frame should be transmitted on the specific link. This really is
+  *	only relevant for frames that do not have data present, and is
+@@ -907,7 +908,7 @@ enum mac80211_tx_control_flags {
+ 	IEEE80211_TX_CTRL_NO_SEQNO		= BIT(7),
+ 	IEEE80211_TX_CTRL_DONT_REORDER		= BIT(8),
+ 	IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX	= BIT(9),
+-	IEEE80211_TX_CTRL_SCAN_TX		= BIT(10),
++	IEEE80211_TX_CTRL_DONT_USE_RATE_MASK	= BIT(10),
+ 	IEEE80211_TX_CTRL_MLO_LINK		= 0xf0000000,
+ };
+ 
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index 50dc379ca097e..b2f895ea752dd 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -940,6 +940,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 	}
+ 
+ 	IEEE80211_SKB_CB(skb)->flags = flags;
++	IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
+ 
+ 	skb->dev = sdata->dev;
+ 
+diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
+index 3cf252418bd38..78e7ac6c0af0b 100644
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -890,7 +890,7 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
+ 	if (ieee80211_is_tx_data(skb))
+ 		rate_control_apply_mask(sdata, sta, sband, dest, max_rates);
+ 
+-	if (!(info->control.flags & IEEE80211_TX_CTRL_SCAN_TX))
++	if (!(info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK))
+ 		mask = sdata->rc_rateidx_mask[info->band];
+ 
+ 	if (dest[0].idx < 0)
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 62c22ff329ad4..6432dd3ec2a7e 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -647,7 +647,7 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,
+ 				cpu_to_le16(IEEE80211_SN_TO_SEQ(sn));
+ 		}
+ 		IEEE80211_SKB_CB(skb)->flags |= tx_flags;
+-		IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_SCAN_TX;
++		IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK;
+ 		ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
+ 	}
+ }
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 0685ae2ea64eb..62b2817df2ba9 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -721,7 +721,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+ 	txrc.skb = tx->skb;
+ 	txrc.reported_rate.idx = -1;
+ 
+-	if (unlikely(info->control.flags & IEEE80211_TX_CTRL_SCAN_TX)) {
++	if (unlikely(info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK)) {
+ 		txrc.rate_idx_mask = ~0;
+ 	} else {
+ 		txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch b/queue-6.1/wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch
new file mode 100644
index 00000000000..5536cdd37b7
--- /dev/null
+++ b/queue-6.1/wifi-mac80211-use-two-phase-skb-reclamation-in-ieee8.patch
@@ -0,0 +1,103 @@
+From bbd678580a808d0641623aa5d3d3ccbd36739ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 15:31:51 +0300
+Subject: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
+
+Since '__dev_queue_xmit()' should be called with interrupts enabled,
+the following backtrace:
+
+ieee80211_do_stop()
+ ...
+ spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
+ ...
+ ieee80211_free_txskb()
+  ieee80211_report_used_skb()
+   ieee80211_report_ack_skb()
+    cfg80211_mgmt_tx_status_ext()
+     nl80211_frame_tx_status()
+      genlmsg_multicast_netns()
+       genlmsg_multicast_netns_filtered()
+        nlmsg_multicast_filtered()
+	 netlink_broadcast_filtered()
+	  do_one_broadcast()
+	   netlink_broadcast_deliver()
+	    __netlink_sendskb()
+	     netlink_deliver_tap()
+	      __netlink_deliver_tap_skb()
+	       dev_queue_xmit()
+	        __dev_queue_xmit() ; with IRQS disabled
+ ...
+ spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
+
+issues the warning (as reported by syzbot reproducer):
+
+WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
+
+Fix this by implementing a two-phase skb reclamation in
+'ieee80211_do_stop()', where actual work is performed
+outside of a section with interrupts disabled.
+
+Fixes: 5061b0c2b906 ("mac80211: cooperate more with network namespaces")
+Reported-by: syzbot+1a3986bbd3169c307819@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Link: https://patch.msgid.link/20240906123151.351647-1-dmantipov@yandex.ru
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/iface.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 6a9d81e9069c9..8861f63e2cfb9 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -466,6 +466,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	unsigned long flags;
++	struct sk_buff_head freeq;
+ 	struct sk_buff *skb, *tmp;
+ 	u32 hw_reconf_flags = 0;
+ 	int i, flushed;
+@@ -658,18 +659,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ 		skb_queue_purge(&sdata->status_queue);
+ 	}
+ 
++	/*
++	 * Since ieee80211_free_txskb() may issue __dev_queue_xmit()
++	 * which should be called with interrupts enabled, reclamation
++	 * is done in two phases:
++	 */
++	__skb_queue_head_init(&freeq);
++
++	/* unlink from local queues... */
+ 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+ 	for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
+ 		skb_queue_walk_safe(&local->pending[i], skb, tmp) {
+ 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 			if (info->control.vif == &sdata->vif) {
+ 				__skb_unlink(skb, &local->pending[i]);
+-				ieee80211_free_txskb(&local->hw, skb);
++				__skb_queue_tail(&freeq, skb);
+ 			}
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 
++	/* ... and perform actual reclamation with interrupts enabled. */
++	skb_queue_walk_safe(&freeq, skb, tmp) {
++		__skb_unlink(skb, &freeq);
++		ieee80211_free_txskb(&local->hw, skb);
++	}
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ 		ieee80211_txq_remove_vlan(local, sdata);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch b/queue-6.1/wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch
new file mode 100644
index 00000000000..42fc89143ea
--- /dev/null
+++ b/queue-6.1/wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch
@@ -0,0 +1,38 @@
+From f37c920b89a2a7f4825ebab5a0052e1e1b1fd0b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 11:30:08 +0200
+Subject: wifi: mt76: mt7915: fix rx filter setting for bfee functionality
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit 6ac80fce713e875a316a58975b830720a3e27721 ]
+
+Fix rx filter setting to prevent dropping NDPA frames. Without this
+change, bfee functionality may behave abnormally.
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Link: https://patch.msgid.link/20240827093011.18621-21-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index 3280843ea8566..e3cfed419f18e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -540,8 +540,7 @@ static void mt7915_configure_filter(struct ieee80211_hw *hw,
+ 
+ 	MT76_FILTER(CONTROL, MT_WF_RFCR_DROP_CTS |
+ 			     MT_WF_RFCR_DROP_RTS |
+-			     MT_WF_RFCR_DROP_CTL_RSV |
+-			     MT_WF_RFCR_DROP_NDPA);
++			     MT_WF_RFCR_DROP_CTL_RSV);
+ 
+ 	*total_flags = flags;
+ 	mt76_wr(dev, MT_WF_RFCR(band), phy->rxfilter);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtw88-always-wait-for-both-firmware-loading-att.patch b/queue-6.1/wifi-rtw88-always-wait-for-both-firmware-loading-att.patch
new file mode 100644
index 00000000000..77cf0f76fe7
--- /dev/null
+++ b/queue-6.1/wifi-rtw88-always-wait-for-both-firmware-loading-att.patch
@@ -0,0 +1,58 @@
+From e0acd5ced016abd5ea56d3b76761fa3885f80d5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2024 14:46:57 +0300
+Subject: wifi: rtw88: always wait for both firmware loading attempts
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d ]
+
+In 'rtw_wait_firmware_completion()', always wait for both (regular and
+wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()'
+has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue
+'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually
+the wowlan one) is still in progress, causing UAF detected by KASAN.
+
+Fixes: c8e5695eae99 ("rtw88: load wowlan firmware if wowlan is supported")
+Reported-by: syzbot+6c6c08700f9480c41fe3@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6c6c08700f9480c41fe3
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20240726114657.25396-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 81f3112923f1c..4620a0d5c77b2 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1286,20 +1286,21 @@ static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct rtw_fw_state *fw;
++	int ret = 0;
+ 
+ 	fw = &rtwdev->fw;
+ 	wait_for_completion(&fw->completion);
+ 	if (!fw->firmware)
+-		return -EINVAL;
++		ret = -EINVAL;
+ 
+ 	if (chip->wow_fw_name) {
+ 		fw = &rtwdev->wow_fw;
+ 		wait_for_completion(&fw->completion);
+ 		if (!fw->firmware)
+-			return -EINVAL;
++			ret = -EINVAL;
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtw88-remove-cpt-execution-branch-never-used.patch b/queue-6.1/wifi-rtw88-remove-cpt-execution-branch-never-used.patch
new file mode 100644
index 00000000000..094067b5f8a
--- /dev/null
+++ b/queue-6.1/wifi-rtw88-remove-cpt-execution-branch-never-used.patch
@@ -0,0 +1,95 @@
+From 04de4bd06dd99ae3c4ea62057f977c8c08f7e2c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 11:53:10 +0300
+Subject: wifi: rtw88: remove CPT execution branch never used
+
+From: Dmitry Kandybka <d.kandybka@gmail.com>
+
+[ Upstream commit 77c977327dfaa9ae2e154964cdb89ceb5c7b7cf1 ]
+
+In 'rtw_coex_action_bt_a2dp_pan', 'wl_cpt_test' and 'bt_cpt_test' are
+hardcoded to false, so corresponding 'table_case' and 'tdma_case'
+assignments are never met.
+Also 'rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1])' is never
+executed. Assuming that CPT was never fully implemented, remove
+lookalike leftovers. Compile tested only.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 76f631cb401f ("rtw88: coex: update the mechanism for A2DP + PAN")
+
+Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20240809085310.10512-1-d.kandybka@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 38 ++++++-----------------
+ 1 file changed, 10 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
+index a82476f47a7c4..8627ab0ce3bdf 100644
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -2195,7 +2195,6 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
+ 	struct rtw_coex_stat *coex_stat = &coex->stat;
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
+ 	u8 table_case, tdma_case;
+-	bool wl_cpt_test = false, bt_cpt_test = false;
+ 
+ 	rtw_dbg(rtwdev, RTW_DBG_COEX, "[BTCoex], %s()\n", __func__);
+ 
+@@ -2203,29 +2202,16 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
+ 	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
+ 	if (efuse->share_ant) {
+ 		/* Shared-Ant */
+-		if (wl_cpt_test) {
+-			if (coex_stat->wl_gl_busy) {
+-				table_case = 20;
+-				tdma_case = 17;
+-			} else {
+-				table_case = 10;
+-				tdma_case = 15;
+-			}
+-		} else if (bt_cpt_test) {
+-			table_case = 26;
+-			tdma_case = 26;
+-		} else {
+-			if (coex_stat->wl_gl_busy &&
+-			    coex_stat->wl_noisy_level == 0)
+-				table_case = 14;
+-			else
+-				table_case = 10;
++		if (coex_stat->wl_gl_busy &&
++		    coex_stat->wl_noisy_level == 0)
++			table_case = 14;
++		else
++			table_case = 10;
+ 
+-			if (coex_stat->wl_gl_busy)
+-				tdma_case = 15;
+-			else
+-				tdma_case = 20;
+-		}
++		if (coex_stat->wl_gl_busy)
++			tdma_case = 15;
++		else
++			tdma_case = 20;
+ 	} else {
+ 		/* Non-Shared-Ant */
+ 		table_case = 112;
+@@ -2236,11 +2222,7 @@ static void rtw_coex_action_bt_a2dp_pan(struct rtw_dev *rtwdev)
+ 			tdma_case = 120;
+ 	}
+ 
+-	if (wl_cpt_test)
+-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[1]);
+-	else
+-		rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
+-
++	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
+ 	rtw_coex_table(rtwdev, false, table_case);
+ 	rtw_coex_tdma(rtwdev, false, tdma_case);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-wilc1000-fix-potential-rcu-dereference-issue-in.patch b/queue-6.1/wifi-wilc1000-fix-potential-rcu-dereference-issue-in.patch
new file mode 100644
index 00000000000..a62a00c4ad8
--- /dev/null
+++ b/queue-6.1/wifi-wilc1000-fix-potential-rcu-dereference-issue-in.patch
@@ -0,0 +1,69 @@
+From b481a61d2b3e53c0e8a0477c78ddfdfa8eda81bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 08:17:09 +0000
+Subject: wifi: wilc1000: fix potential RCU dereference issue in
+ wilc_parse_join_bss_param
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiawei Ye <jiawei.ye@foxmail.com>
+
+[ Upstream commit 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 ]
+
+In the `wilc_parse_join_bss_param` function, the TSF field of the `ies`
+structure is accessed after the RCU read-side critical section is
+unlocked. According to RCU usage rules, this is illegal. Reusing this
+pointer can lead to unpredictable behavior, including accessing memory
+that has been updated or causing use-after-free issues.
+
+This possible bug was identified using a static analysis tool developed
+by myself, specifically designed to detect RCU-related issues.
+
+To address this, the TSF value is now stored in a local variable
+`ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is
+then assigned using this local variable, ensuring that the TSF value is
+safely accessed.
+
+Fixes: 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path")
+Signed-off-by: Jiawei Ye <jiawei.ye@foxmail.com>
+Reviewed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/tencent_466225AA599BA49627FB26F707EE17BC5407@qq.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index 13853fda3e047..420a3998d9ab2 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -381,6 +381,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 	struct wilc_join_bss_param *param;
+ 	u8 rates_len = 0;
+ 	int ies_len;
++	u64 ies_tsf;
+ 	int ret;
+ 
+ 	param = kzalloc(sizeof(*param), GFP_KERNEL);
+@@ -396,6 +397,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 		return NULL;
+ 	}
+ 	ies_len = ies->len;
++	ies_tsf = ies->tsf;
+ 	rcu_read_unlock();
+ 
+ 	param->beacon_period = cpu_to_le16(bss->beacon_interval);
+@@ -451,7 +453,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 				    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+ 				    (u8 *)&noa_attr, sizeof(noa_attr));
+ 	if (ret > 0) {
+-		param->tsf_lo = cpu_to_le32(ies->tsf);
++		param->tsf_lo = cpu_to_le32(ies_tsf);
+ 		param->noa_enabled = 1;
+ 		param->idx = noa_attr.index;
+ 		if (noa_attr.oppps_ctwindow & IEEE80211_P2P_OPPPS_ENABLE_BIT) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/x86-sgx-fix-deadlock-in-sgx-numa-node-search.patch b/queue-6.1/x86-sgx-fix-deadlock-in-sgx-numa-node-search.patch
new file mode 100644
index 00000000000..308336104aa
--- /dev/null
+++ b/queue-6.1/x86-sgx-fix-deadlock-in-sgx-numa-node-search.patch
@@ -0,0 +1,85 @@
+From cc9243aa02c218bf639d71ee3ef96e69c547e7ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 16:08:54 +0800
+Subject: x86/sgx: Fix deadlock in SGX NUMA node search
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit 9c936844010466535bd46ea4ce4656ef17653644 ]
+
+When the current node doesn't have an EPC section configured by firmware
+and all other EPC sections are used up, CPU can get stuck inside the
+while loop that looks for an available EPC page from remote nodes
+indefinitely, leading to a soft lockup. Note how nid_of_current will
+never be equal to nid in that while loop because nid_of_current is not
+set in sgx_numa_mask.
+
+Also worth mentioning is that it's perfectly fine for the firmware not
+to setup an EPC section on a node. While setting up an EPC section on
+each node can enhance performance, it is not a requirement for
+functionality.
+
+Rework the loop to start and end on *a* node that has SGX memory. This
+avoids the deadlock looking for the current SGX-lacking node to show up
+in the loop when it never will.
+
+Fixes: 901ddbb9ecf5 ("x86/sgx: Add a basic NUMA allocation scheme to sgx_alloc_epc_page()")
+Reported-by: "Molina Sabido, Gerardo" <gerardo.molina.sabido@intel.com>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Tested-by: Zhimin Luo <zhimin.luo@intel.com>
+Link: https://lore.kernel.org/all/20240905080855.1699814-2-aaron.lu%40intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/sgx/main.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
+index 0aad028f04d40..c4960b8e5195f 100644
+--- a/arch/x86/kernel/cpu/sgx/main.c
++++ b/arch/x86/kernel/cpu/sgx/main.c
+@@ -474,24 +474,25 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void)
+ {
+ 	struct sgx_epc_page *page;
+ 	int nid_of_current = numa_node_id();
+-	int nid = nid_of_current;
++	int nid_start, nid;
+ 
+-	if (node_isset(nid_of_current, sgx_numa_mask)) {
+-		page = __sgx_alloc_epc_page_from_node(nid_of_current);
+-		if (page)
+-			return page;
+-	}
+-
+-	/* Fall back to the non-local NUMA nodes: */
+-	while (true) {
+-		nid = next_node_in(nid, sgx_numa_mask);
+-		if (nid == nid_of_current)
+-			break;
++	/*
++	 * Try local node first. If it doesn't have an EPC section,
++	 * fall back to the non-local NUMA nodes.
++	 */
++	if (node_isset(nid_of_current, sgx_numa_mask))
++		nid_start = nid_of_current;
++	else
++		nid_start = next_node_in(nid_of_current, sgx_numa_mask);
+ 
++	nid = nid_start;
++	do {
+ 		page = __sgx_alloc_epc_page_from_node(nid);
+ 		if (page)
+ 			return page;
+-	}
++
++		nid = next_node_in(nid, sgx_numa_mask);
++	} while (nid != nid_start);
+ 
+ 	return ERR_PTR(-ENOMEM);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-add-capability-to-remap-non-ram-pages-to-differe.patch b/queue-6.1/xen-add-capability-to-remap-non-ram-pages-to-differe.patch
new file mode 100644
index 00000000000..8ec9d0aa9a9
--- /dev/null
+++ b/queue-6.1/xen-add-capability-to-remap-non-ram-pages-to-differe.patch
@@ -0,0 +1,130 @@
+From a8dfa1230459c1eb2274b6428e17472cfcf2b29b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2024 16:47:25 +0200
+Subject: xen: add capability to remap non-RAM pages to different PFNs
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit d05208cf7f05420ad10cc7f9550f91d485523659 ]
+
+When running as a Xen PV dom0 it can happen that the kernel is being
+loaded to a guest physical address conflicting with the host memory
+map.
+
+In order to be able to resolve this conflict, add the capability to
+remap non-RAM areas to different guest PFNs. A function to use this
+remapping information for other purposes than doing the remap will be
+added when needed.
+
+As the number of conflicts should be rather low (currently only
+machines with max. 1 conflict are known), save the remap data in a
+small statically allocated array.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Stable-dep-of: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/p2m.c     | 63 ++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/xen/xen-ops.h |  3 ++
+ 2 files changed, 66 insertions(+)
+
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index a02cc54338897..7376892730cd5 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -80,6 +80,7 @@
+ #include <asm/xen/hypervisor.h>
+ #include <xen/balloon.h>
+ #include <xen/grant_table.h>
++#include <xen/hvc-console.h>
+ 
+ #include "multicalls.h"
+ #include "xen-ops.h"
+@@ -799,6 +800,68 @@ int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
+ 	return ret;
+ }
+ 
++/* Remapped non-RAM areas */
++#define NR_NONRAM_REMAP 4
++static struct nonram_remap {
++	phys_addr_t maddr;
++	phys_addr_t paddr;
++	size_t size;
++} xen_nonram_remap[NR_NONRAM_REMAP] __ro_after_init;
++static unsigned int nr_nonram_remap __ro_after_init;
++
++/*
++ * Do the real remapping of non-RAM regions as specified in the
++ * xen_nonram_remap[] array.
++ * In case of an error just crash the system.
++ */
++void __init xen_do_remap_nonram(void)
++{
++	unsigned int i;
++	unsigned int remapped = 0;
++	const struct nonram_remap *remap = xen_nonram_remap;
++	unsigned long pfn, mfn, end_pfn;
++
++	for (i = 0; i < nr_nonram_remap; i++) {
++		end_pfn = PFN_UP(remap->paddr + remap->size);
++		pfn = PFN_DOWN(remap->paddr);
++		mfn = PFN_DOWN(remap->maddr);
++		while (pfn < end_pfn) {
++			if (!set_phys_to_machine(pfn, mfn))
++				panic("Failed to set p2m mapping for pfn=%lx mfn=%lx\n",
++				       pfn, mfn);
++
++			pfn++;
++			mfn++;
++			remapped++;
++		}
++
++		remap++;
++	}
++
++	pr_info("Remapped %u non-RAM page(s)\n", remapped);
++}
++
++/*
++ * Add a new non-RAM remap entry.
++ * In case of no free entry found, just crash the system.
++ */
++void __init xen_add_remap_nonram(phys_addr_t maddr, phys_addr_t paddr,
++				 unsigned long size)
++{
++	BUG_ON((maddr & ~PAGE_MASK) != (paddr & ~PAGE_MASK));
++
++	if (nr_nonram_remap == NR_NONRAM_REMAP) {
++		xen_raw_console_write("Number of required E820 entry remapping actions exceed maximum value\n");
++		BUG();
++	}
++
++	xen_nonram_remap[nr_nonram_remap].maddr = maddr;
++	xen_nonram_remap[nr_nonram_remap].paddr = paddr;
++	xen_nonram_remap[nr_nonram_remap].size = size;
++
++	nr_nonram_remap++;
++}
++
+ #ifdef CONFIG_XEN_DEBUG_FS
+ #include <linux/debugfs.h>
+ #include "debugfs.h"
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 35670a44ef4c5..793caab79055b 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -43,6 +43,9 @@ void xen_mm_unpin_all(void);
+ #ifdef CONFIG_X86_64
+ void __init xen_relocate_p2m(void);
+ #endif
++void __init xen_do_remap_nonram(void);
++void __init xen_add_remap_nonram(phys_addr_t maddr, phys_addr_t paddr,
++				 unsigned long size);
+ 
+ void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
+ 				   const char *component);
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-introduce-generic-helper-checking-for-memory-map.patch b/queue-6.1/xen-introduce-generic-helper-checking-for-memory-map.patch
new file mode 100644
index 00000000000..8d51a175267
--- /dev/null
+++ b/queue-6.1/xen-introduce-generic-helper-checking-for-memory-map.patch
@@ -0,0 +1,138 @@
+From 698a7c44fb0ebb8d738d7feff9751817beac08c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2024 14:11:06 +0200
+Subject: xen: introduce generic helper checking for memory map conflicts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit ba88829706e2c5b7238638fc2b0713edf596495e ]
+
+When booting as a Xen PV dom0 the memory layout of the dom0 is
+modified to match that of the host, as this requires less changes in
+the kernel for supporting Xen.
+
+There are some cases, though, which are problematic, as it is the Xen
+hypervisor selecting the kernel's load address plus some other data,
+which might conflict with the host's memory map.
+
+These conflicts are detected at boot time and result in a boot error.
+In order to support handling at least some of these conflicts in
+future, introduce a generic helper function which will later gain the
+ability to adapt the memory layout when possible.
+
+Add the missing check for the xen_start_info area.
+
+Note that possible p2m map and initrd memory conflicts are handled
+already by copying the data to memory areas not conflicting with the
+memory map. The initial stack allocated by Xen doesn't need to be
+checked, as early boot code is switching to the statically allocated
+initial kernel stack. Initial page tables and the kernel itself will
+be handled later.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Stable-dep-of: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/mmu_pv.c  |  5 +----
+ arch/x86/xen/setup.c   | 34 ++++++++++++++++++++++++++++------
+ arch/x86/xen/xen-ops.h |  3 ++-
+ 3 files changed, 31 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index ee29fb558f2e6..4f7cde57a40fd 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -2010,10 +2010,7 @@ void __init xen_reserve_special_pages(void)
+ 
+ void __init xen_pt_check_e820(void)
+ {
+-	if (xen_is_e820_reserved(xen_pt_base, xen_pt_size)) {
+-		xen_raw_console_write("Xen hypervisor allocated page table memory conflicts with E820 map\n");
+-		BUG();
+-	}
++	xen_chk_is_e820_usable(xen_pt_base, xen_pt_size, "page table");
+ }
+ 
+ static unsigned char dummy_mapping[PAGE_SIZE] __page_aligned_bss;
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index f0bb5e350990d..96fb245d901b3 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -608,7 +608,7 @@ static void __init xen_ignore_unusable(void)
+ 	}
+ }
+ 
+-bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size)
++static bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size)
+ {
+ 	struct e820_entry *entry;
+ 	unsigned mapcnt;
+@@ -665,6 +665,23 @@ phys_addr_t __init xen_find_free_area(phys_addr_t size)
+ 	return 0;
+ }
+ 
++/*
++ * Check for an area in physical memory to be usable for non-movable purposes.
++ * An area is considered to usable if the used E820 map lists it to be RAM.
++ * In case the area is not usable, crash the system with an error message.
++ */
++void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
++				   const char *component)
++{
++	if (!xen_is_e820_reserved(start, size))
++		return;
++
++	xen_raw_console_write("Xen hypervisor allocated ");
++	xen_raw_console_write(component);
++	xen_raw_console_write(" memory conflicts with E820 map\n");
++	BUG();
++}
++
+ /*
+  * Like memcpy, but with physical addresses for dest and src.
+  */
+@@ -853,11 +870,16 @@ char * __init xen_memory_setup(void)
+ 	 * Failing now is better than running into weird problems later due
+ 	 * to relocating (and even reusing) pages with kernel text or data.
+ 	 */
+-	if (xen_is_e820_reserved(__pa_symbol(_text),
+-				 __pa_symbol(_end) - __pa_symbol(_text))) {
+-		xen_raw_console_write("Xen hypervisor allocated kernel memory conflicts with E820 map\n");
+-		BUG();
+-	}
++	xen_chk_is_e820_usable(__pa_symbol(_text),
++			       __pa_symbol(_end) - __pa_symbol(_text),
++			       "kernel");
++
++	/*
++	 * Check for a conflict of the xen_start_info memory with the target
++	 * E820 map.
++	 */
++	xen_chk_is_e820_usable(__pa(xen_start_info), sizeof(*xen_start_info),
++			       "xen_start_info");
+ 
+ 	/*
+ 	 * Check for a conflict of the hypervisor supplied page tables with
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index b2b2f4315b78d..35670a44ef4c5 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -44,7 +44,8 @@ void xen_mm_unpin_all(void);
+ void __init xen_relocate_p2m(void);
+ #endif
+ 
+-bool __init xen_is_e820_reserved(phys_addr_t start, phys_addr_t size);
++void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
++				   const char *component);
+ unsigned long __ref xen_chk_extra_mem(unsigned long pfn);
+ void __init xen_inv_extra_mem(void);
+ void __init xen_remap_memory(void);
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-move-max_pfn-in-xen_memory_setup-out-of-function.patch b/queue-6.1/xen-move-max_pfn-in-xen_memory_setup-out-of-function.patch
new file mode 100644
index 00000000000..953b72092e9
--- /dev/null
+++ b/queue-6.1/xen-move-max_pfn-in-xen_memory_setup-out-of-function.patch
@@ -0,0 +1,195 @@
+From bd83746529b2e5643edb183620b3e154f1cb17fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 10:24:41 +0200
+Subject: xen: move max_pfn in xen_memory_setup() out of function scope
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 43dc2a0f479b9cd30f6674986d7a40517e999d31 ]
+
+Instead of having max_pfn as a local variable of xen_memory_setup(),
+make it a static variable in setup.c instead. This avoids having to
+pass it to subfunctions, which will be needed in more cases in future.
+
+Rename it to ini_nr_pages, as the value denotes the currently usable
+number of memory pages as passed from the hypervisor at boot time.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Stable-dep-of: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/setup.c | 52 ++++++++++++++++++++++----------------------
+ 1 file changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 96fb245d901b3..af18bd7e0700d 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -46,6 +46,9 @@ unsigned long xen_released_pages;
+ /* E820 map used during setting up memory. */
+ static struct e820_table xen_e820_table __initdata;
+ 
++/* Number of initially usable memory pages. */
++static unsigned long ini_nr_pages __initdata;
++
+ /*
+  * Buffer used to remap identity mapped pages. We only need the virtual space.
+  * The physical page behind this address is remapped as needed to different
+@@ -253,7 +256,7 @@ static int __init xen_free_mfn(unsigned long mfn)
+  * as a fallback if the remapping fails.
+  */
+ static void __init xen_set_identity_and_release_chunk(unsigned long start_pfn,
+-			unsigned long end_pfn, unsigned long nr_pages)
++						      unsigned long end_pfn)
+ {
+ 	unsigned long pfn, end;
+ 	int ret;
+@@ -261,7 +264,7 @@ static void __init xen_set_identity_and_release_chunk(unsigned long start_pfn,
+ 	WARN_ON(start_pfn > end_pfn);
+ 
+ 	/* Release pages first. */
+-	end = min(end_pfn, nr_pages);
++	end = min(end_pfn, ini_nr_pages);
+ 	for (pfn = start_pfn; pfn < end; pfn++) {
+ 		unsigned long mfn = pfn_to_mfn(pfn);
+ 
+@@ -382,15 +385,14 @@ static void __init xen_do_set_identity_and_remap_chunk(
+  * to Xen and not remapped.
+  */
+ static unsigned long __init xen_set_identity_and_remap_chunk(
+-	unsigned long start_pfn, unsigned long end_pfn, unsigned long nr_pages,
+-	unsigned long remap_pfn)
++	unsigned long start_pfn, unsigned long end_pfn, unsigned long remap_pfn)
+ {
+ 	unsigned long pfn;
+ 	unsigned long i = 0;
+ 	unsigned long n = end_pfn - start_pfn;
+ 
+ 	if (remap_pfn == 0)
+-		remap_pfn = nr_pages;
++		remap_pfn = ini_nr_pages;
+ 
+ 	while (i < n) {
+ 		unsigned long cur_pfn = start_pfn + i;
+@@ -399,19 +401,19 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
+ 		unsigned long remap_range_size;
+ 
+ 		/* Do not remap pages beyond the current allocation */
+-		if (cur_pfn >= nr_pages) {
++		if (cur_pfn >= ini_nr_pages) {
+ 			/* Identity map remaining pages */
+ 			set_phys_range_identity(cur_pfn, cur_pfn + size);
+ 			break;
+ 		}
+-		if (cur_pfn + size > nr_pages)
+-			size = nr_pages - cur_pfn;
++		if (cur_pfn + size > ini_nr_pages)
++			size = ini_nr_pages - cur_pfn;
+ 
+ 		remap_range_size = xen_find_pfn_range(&remap_pfn);
+ 		if (!remap_range_size) {
+ 			pr_warn("Unable to find available pfn range, not remapping identity pages\n");
+ 			xen_set_identity_and_release_chunk(cur_pfn,
+-						cur_pfn + left, nr_pages);
++							   cur_pfn + left);
+ 			break;
+ 		}
+ 		/* Adjust size to fit in current e820 RAM region */
+@@ -438,18 +440,18 @@ static unsigned long __init xen_set_identity_and_remap_chunk(
+ }
+ 
+ static unsigned long __init xen_count_remap_pages(
+-	unsigned long start_pfn, unsigned long end_pfn, unsigned long nr_pages,
++	unsigned long start_pfn, unsigned long end_pfn,
+ 	unsigned long remap_pages)
+ {
+-	if (start_pfn >= nr_pages)
++	if (start_pfn >= ini_nr_pages)
+ 		return remap_pages;
+ 
+-	return remap_pages + min(end_pfn, nr_pages) - start_pfn;
++	return remap_pages + min(end_pfn, ini_nr_pages) - start_pfn;
+ }
+ 
+-static unsigned long __init xen_foreach_remap_area(unsigned long nr_pages,
++static unsigned long __init xen_foreach_remap_area(
+ 	unsigned long (*func)(unsigned long start_pfn, unsigned long end_pfn,
+-			      unsigned long nr_pages, unsigned long last_val))
++			      unsigned long last_val))
+ {
+ 	phys_addr_t start = 0;
+ 	unsigned long ret_val = 0;
+@@ -477,8 +479,7 @@ static unsigned long __init xen_foreach_remap_area(unsigned long nr_pages,
+ 				end_pfn = PFN_UP(entry->addr);
+ 
+ 			if (start_pfn < end_pfn)
+-				ret_val = func(start_pfn, end_pfn, nr_pages,
+-					       ret_val);
++				ret_val = func(start_pfn, end_pfn, ret_val);
+ 			start = end;
+ 		}
+ 	}
+@@ -741,7 +742,7 @@ static void __init xen_reserve_xen_mfnlist(void)
+  **/
+ char * __init xen_memory_setup(void)
+ {
+-	unsigned long max_pfn, pfn_s, n_pfns;
++	unsigned long pfn_s, n_pfns;
+ 	phys_addr_t mem_end, addr, size, chunk_size;
+ 	u32 type;
+ 	int rc;
+@@ -753,9 +754,8 @@ char * __init xen_memory_setup(void)
+ 	int op;
+ 
+ 	xen_parse_512gb();
+-	max_pfn = xen_get_pages_limit();
+-	max_pfn = min(max_pfn, xen_start_info->nr_pages);
+-	mem_end = PFN_PHYS(max_pfn);
++	ini_nr_pages = min(xen_get_pages_limit(), xen_start_info->nr_pages);
++	mem_end = PFN_PHYS(ini_nr_pages);
+ 
+ 	memmap.nr_entries = ARRAY_SIZE(xen_e820_table.entries);
+ 	set_xen_guest_handle(memmap.buffer, xen_e820_table.entries);
+@@ -799,10 +799,10 @@ char * __init xen_memory_setup(void)
+ 	max_pages = xen_get_max_pages();
+ 
+ 	/* How many extra pages do we need due to remapping? */
+-	max_pages += xen_foreach_remap_area(max_pfn, xen_count_remap_pages);
++	max_pages += xen_foreach_remap_area(xen_count_remap_pages);
+ 
+-	if (max_pages > max_pfn)
+-		extra_pages += max_pages - max_pfn;
++	if (max_pages > ini_nr_pages)
++		extra_pages += max_pages - ini_nr_pages;
+ 
+ 	/*
+ 	 * Clamp the amount of extra memory to a EXTRA_MEM_RATIO
+@@ -811,8 +811,8 @@ char * __init xen_memory_setup(void)
+ 	 * Make sure we have no memory above max_pages, as this area
+ 	 * isn't handled by the p2m management.
+ 	 */
+-	maxmem_pages = EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM));
+-	extra_pages = min3(maxmem_pages, extra_pages, max_pages - max_pfn);
++	maxmem_pages = EXTRA_MEM_RATIO * min(ini_nr_pages, PFN_DOWN(MAXMEM));
++	extra_pages = min3(maxmem_pages, extra_pages, max_pages - ini_nr_pages);
+ 	i = 0;
+ 	addr = xen_e820_table.entries[0].addr;
+ 	size = xen_e820_table.entries[0].size;
+@@ -914,7 +914,7 @@ char * __init xen_memory_setup(void)
+ 	 * Set identity map on non-RAM pages and prepare remapping the
+ 	 * underlying RAM.
+ 	 */
+-	xen_foreach_remap_area(max_pfn, xen_set_identity_and_remap_chunk);
++	xen_foreach_remap_area(xen_set_identity_and_remap_chunk);
+ 
+ 	pr_info("Released %ld page(s)\n", xen_released_pages);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-swiotlb-add-alignment-check-for-dma-buffers.patch b/queue-6.1/xen-swiotlb-add-alignment-check-for-dma-buffers.patch
new file mode 100644
index 00000000000..e36524b954e
--- /dev/null
+++ b/queue-6.1/xen-swiotlb-add-alignment-check-for-dma-buffers.patch
@@ -0,0 +1,52 @@
+From 8f37585eaef4c04d2e9ef842ccfa4e5f13d4696a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 12:05:02 +0200
+Subject: xen/swiotlb: add alignment check for dma buffers
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 9f40ec84a7976d95c34e7cc070939deb103652b0 ]
+
+When checking a memory buffer to be consecutive in machine memory,
+the alignment needs to be checked, too. Failing to do so might result
+in DMA memory not being aligned according to its requested size,
+leading to error messages like:
+
+  4xxx 0000:2b:00.0: enabling device (0140 -> 0142)
+  4xxx 0000:2b:00.0: Ring address not aligned
+  4xxx 0000:2b:00.0: Failed to initialise service qat_crypto
+  4xxx 0000:2b:00.0: Resetting device qat_dev0
+  4xxx: probe of 0000:2b:00.0 failed with error -14
+
+Fixes: 9435cce87950 ("xen/swiotlb: Add support for 64KB page granularity")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/swiotlb-xen.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index 7290f2b402e2a..cf52964f057b3 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -78,9 +78,15 @@ static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
+ {
+ 	unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
+ 	unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
++	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
+ 
+ 	next_bfn = pfn_to_bfn(xen_pfn);
+ 
++	/* If buffer is physically aligned, ensure DMA alignment. */
++	if (IS_ALIGNED(p, algn) &&
++	    !IS_ALIGNED((phys_addr_t)next_bfn << XEN_PAGE_SHIFT, algn))
++		return 1;
++
+ 	for (i = 1; i < nr_pages; i++)
+ 		if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
+ 			return 1;
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-swiotlb-fix-allocated-size.patch b/queue-6.1/xen-swiotlb-fix-allocated-size.patch
new file mode 100644
index 00000000000..1615821c00a
--- /dev/null
+++ b/queue-6.1/xen-swiotlb-fix-allocated-size.patch
@@ -0,0 +1,49 @@
+From 79f157f58d32c7b61b2f5904b53c9cdfcaca7d37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2024 13:06:44 +0200
+Subject: xen/swiotlb: fix allocated size
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit c3dea3d54f4d399f8044547f0f1abdccbdfb0fee ]
+
+The allocated size in xen_swiotlb_alloc_coherent() and
+xen_swiotlb_free_coherent() is calculated wrong for the case of
+XEN_PAGE_SIZE not matching PAGE_SIZE. Fix that.
+
+Fixes: 7250f422da04 ("xen-swiotlb: use actually allocated size on check physical continuous")
+Reported-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/swiotlb-xen.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index cf52964f057b3..0451e6ebc21a3 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -146,7 +146,7 @@ xen_swiotlb_alloc_coherent(struct device *dev, size_t size,
+ 	void *ret;
+ 
+ 	/* Align the allocation to the Xen page size */
+-	size = 1UL << (order + XEN_PAGE_SHIFT);
++	size = ALIGN(size, XEN_PAGE_SIZE);
+ 
+ 	ret = (void *)__get_free_pages(flags, get_order(size));
+ 	if (!ret)
+@@ -178,7 +178,7 @@ xen_swiotlb_free_coherent(struct device *dev, size_t size, void *vaddr,
+ 	int order = get_order(size);
+ 
+ 	/* Convert the size to actually allocated. */
+-	size = 1UL << (order + XEN_PAGE_SHIFT);
++	size = ALIGN(size, XEN_PAGE_SIZE);
+ 
+ 	if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) ||
+ 	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size)))
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-tolerate-acpi-nvs-memory-overlapping-with-xen-al.patch b/queue-6.1/xen-tolerate-acpi-nvs-memory-overlapping-with-xen-al.patch
new file mode 100644
index 00000000000..379951f0727
--- /dev/null
+++ b/queue-6.1/xen-tolerate-acpi-nvs-memory-overlapping-with-xen-al.patch
@@ -0,0 +1,161 @@
+From e16e625df04ccb81431a921d954b174cd73b9388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2024 20:14:22 +0200
+Subject: xen: tolerate ACPI NVS memory overlapping with Xen allocated memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit be35d91c8880650404f3bf813573222dfb106935 ]
+
+In order to minimize required special handling for running as Xen PV
+dom0, the memory layout is modified to match that of the host. This
+requires to have only RAM at the locations where Xen allocated memory
+is living. Unfortunately there seem to be some machines, where ACPI
+NVS is located at 64 MB, resulting in a conflict with the loaded
+kernel or the initial page tables built by Xen.
+
+Avoid this conflict by swapping the ACPI NVS area in the memory map
+with unused RAM. This is possible via modification of the dom0 P2M map.
+Accesses to the ACPI NVS area are done either for saving and restoring
+it across suspend operations (this will work the same way as before),
+or by ACPI code when NVS memory is referenced from other ACPI tables.
+The latter case is handled by a Xen specific indirection of
+acpi_os_ioremap().
+
+While the E820 map can (and should) be modified right away, the P2M
+map can be updated only after memory allocation is working, as the P2M
+map might need to be extended.
+
+Fixes: 808fdb71936c ("xen: check for kernel memory conflicting with memory layout")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/setup.c | 92 +++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 91 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index af18bd7e0700d..69803e3b1a231 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -536,6 +536,8 @@ void __init xen_remap_memory(void)
+ 	set_pte_mfn(buf, mfn_save, PAGE_KERNEL);
+ 
+ 	pr_info("Remapped %ld page(s)\n", remapped);
++
++	xen_do_remap_nonram();
+ }
+ 
+ static unsigned long __init xen_get_pages_limit(void)
+@@ -666,14 +668,102 @@ phys_addr_t __init xen_find_free_area(phys_addr_t size)
+ 	return 0;
+ }
+ 
++/*
++ * Swap a non-RAM E820 map entry with RAM above ini_nr_pages.
++ * Note that the E820 map is modified accordingly, but the P2M map isn't yet.
++ * The adaption of the P2M must be deferred until page allocation is possible.
++ */
++static void __init xen_e820_swap_entry_with_ram(struct e820_entry *swap_entry)
++{
++	struct e820_entry *entry;
++	unsigned int mapcnt;
++	phys_addr_t mem_end = PFN_PHYS(ini_nr_pages);
++	phys_addr_t swap_addr, swap_size, entry_end;
++
++	swap_addr = PAGE_ALIGN_DOWN(swap_entry->addr);
++	swap_size = PAGE_ALIGN(swap_entry->addr - swap_addr + swap_entry->size);
++	entry = xen_e820_table.entries;
++
++	for (mapcnt = 0; mapcnt < xen_e820_table.nr_entries; mapcnt++) {
++		entry_end = entry->addr + entry->size;
++		if (entry->type == E820_TYPE_RAM && entry->size >= swap_size &&
++		    entry_end - swap_size >= mem_end) {
++			/* Reduce RAM entry by needed space (whole pages). */
++			entry->size -= swap_size;
++
++			/* Add new entry at the end of E820 map. */
++			entry = xen_e820_table.entries +
++				xen_e820_table.nr_entries;
++			xen_e820_table.nr_entries++;
++
++			/* Fill new entry (keep size and page offset). */
++			entry->type = swap_entry->type;
++			entry->addr = entry_end - swap_size +
++				      swap_addr - swap_entry->addr;
++			entry->size = swap_entry->size;
++
++			/* Convert old entry to RAM, align to pages. */
++			swap_entry->type = E820_TYPE_RAM;
++			swap_entry->addr = swap_addr;
++			swap_entry->size = swap_size;
++
++			/* Remember PFN<->MFN relation for P2M update. */
++			xen_add_remap_nonram(swap_addr, entry_end - swap_size,
++					     swap_size);
++
++			/* Order E820 table and merge entries. */
++			e820__update_table(&xen_e820_table);
++
++			return;
++		}
++
++		entry++;
++	}
++
++	xen_raw_console_write("No suitable area found for required E820 entry remapping action\n");
++	BUG();
++}
++
++/*
++ * Look for non-RAM memory types in a specific guest physical area and move
++ * those away if possible (ACPI NVS only for now).
++ */
++static void __init xen_e820_resolve_conflicts(phys_addr_t start,
++					      phys_addr_t size)
++{
++	struct e820_entry *entry;
++	unsigned int mapcnt;
++	phys_addr_t end;
++
++	if (!size)
++		return;
++
++	end = start + size;
++	entry = xen_e820_table.entries;
++
++	for (mapcnt = 0; mapcnt < xen_e820_table.nr_entries; mapcnt++) {
++		if (entry->addr >= end)
++			return;
++
++		if (entry->addr + entry->size > start &&
++		    entry->type == E820_TYPE_NVS)
++			xen_e820_swap_entry_with_ram(entry);
++
++		entry++;
++	}
++}
++
+ /*
+  * Check for an area in physical memory to be usable for non-movable purposes.
+- * An area is considered to usable if the used E820 map lists it to be RAM.
++ * An area is considered to usable if the used E820 map lists it to be RAM or
++ * some other type which can be moved to higher PFNs while keeping the MFNs.
+  * In case the area is not usable, crash the system with an error message.
+  */
+ void __init xen_chk_is_e820_usable(phys_addr_t start, phys_addr_t size,
+ 				   const char *component)
+ {
++	xen_e820_resolve_conflicts(start, size);
++
+ 	if (!xen_is_e820_reserved(start, size))
+ 		return;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-use-correct-end-address-of-kernel-for-conflict-c.patch b/queue-6.1/xen-use-correct-end-address-of-kernel-for-conflict-c.patch
new file mode 100644
index 00000000000..498b956aab7
--- /dev/null
+++ b/queue-6.1/xen-use-correct-end-address-of-kernel-for-conflict-c.patch
@@ -0,0 +1,51 @@
+From ec7cf4f5c1c4b853f4a5c7d25dde152586e1a7c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Aug 2024 08:01:22 +0200
+Subject: xen: use correct end address of kernel for conflict checking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit fac1bceeeb04886fc2ee952672e6e6c85ce41dca ]
+
+When running as a Xen PV dom0 the kernel is loaded by the hypervisor
+using a different memory map than that of the host. In order to
+minimize the required changes in the kernel, the kernel adapts its
+memory map to that of the host. In order to do that it is checking
+for conflicts of its load address with the host memory map.
+
+Unfortunately the tested memory range does not include the .brk
+area, which might result in crashes or memory corruption when this
+area does conflict with the memory map of the host.
+
+Fix the test by using the _end label instead of __bss_stop.
+
+Fixes: 808fdb71936c ("xen: check for kernel memory conflicting with memory layout")
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 8db26f10fb1d9..46a2cb782ab7d 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -853,7 +853,7 @@ char * __init xen_memory_setup(void)
+ 	 * to relocating (and even reusing) pages with kernel text or data.
+ 	 */
+ 	if (xen_is_e820_reserved(__pa_symbol(_text),
+-			__pa_symbol(__bss_stop) - __pa_symbol(_text))) {
++				 __pa_symbol(_end) - __pa_symbol(_text))) {
+ 		xen_raw_console_write("Xen hypervisor allocated kernel memory conflicts with E820 map\n");
+ 		BUG();
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/xz-cleanup-crc32-edits-from-2018.patch b/queue-6.1/xz-cleanup-crc32-edits-from-2018.patch
new file mode 100644
index 00000000000..ebbc43e0ec7
--- /dev/null
+++ b/queue-6.1/xz-cleanup-crc32-edits-from-2018.patch
@@ -0,0 +1,78 @@
+From 1000f74b966bfe59b0344e7e9a2e90007e04905d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jul 2024 16:36:24 +0300
+Subject: xz: cleanup CRC32 edits from 2018
+
+From: Lasse Collin <lasse.collin@tukaani.org>
+
+[ Upstream commit 2ee96abef214550d9e92f5143ee3ac1fd1323e67 ]
+
+In 2018, a dependency on <linux/crc32poly.h> was added to avoid
+duplicating the same constant in multiple files.  Two months later it was
+found to be a bad idea and the definition of CRC32_POLY_LE macro was moved
+into xz_private.h to avoid including <linux/crc32poly.h>.
+
+xz_private.h is a wrong place for it too.  Revert back to the upstream
+version which has the poly in xz_crc32_init() in xz_crc32.c.
+
+Link: https://lkml.kernel.org/r/20240721133633.47721-10-lasse.collin@tukaani.org
+Fixes: faa16bc404d7 ("lib: Use existing define with polynomial")
+Fixes: 242cdad873a7 ("lib/xz: Put CRC32_POLY_LE in xz_private.h")
+Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
+Reviewed-by: Sam James <sam@gentoo.org>
+Tested-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Joel Stanley <joel@jms.id.au>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Emil Renner Berthing <emil.renner.berthing@canonical.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Jubin Zhong <zhongjubin@huawei.com>
+Cc: Jules Maselbas <jmaselbas@zdiv.net>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Rui Li <me@lirui.org>
+Cc: Simon Glass <sjg@chromium.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/xz/xz_crc32.c   | 2 +-
+ lib/xz/xz_private.h | 4 ----
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/lib/xz/xz_crc32.c b/lib/xz/xz_crc32.c
+index 88a2c35e1b597..5627b00fca296 100644
+--- a/lib/xz/xz_crc32.c
++++ b/lib/xz/xz_crc32.c
+@@ -29,7 +29,7 @@ STATIC_RW_DATA uint32_t xz_crc32_table[256];
+ 
+ XZ_EXTERN void xz_crc32_init(void)
+ {
+-	const uint32_t poly = CRC32_POLY_LE;
++	const uint32_t poly = 0xEDB88320;
+ 
+ 	uint32_t i;
+ 	uint32_t j;
+diff --git a/lib/xz/xz_private.h b/lib/xz/xz_private.h
+index bf1e94ec7873c..d9fd49b45fd75 100644
+--- a/lib/xz/xz_private.h
++++ b/lib/xz/xz_private.h
+@@ -105,10 +105,6 @@
+ #	endif
+ #endif
+ 
+-#ifndef CRC32_POLY_LE
+-#define CRC32_POLY_LE 0xedb88320
+-#endif
+-
+ /*
+  * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used
+  * before calling xz_dec_lzma2_run().
+-- 
+2.43.0
+
-- 
2.47.3