From ec83c1bf7de4a4223cfc6ff919b214b88695d4f8 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sun, 12 Oct 2025 10:36:09 -0400
Subject: [PATCH] Remove EOLed 6.16

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...e-int-instead-of-u32-to-store-error-.patch |  60 ---
 ...correct-ndr_desc-being-reportedin-de.patch |  38 --
 ...dle-fix-memory-leak-when-register-cp.patch |  41 --
 queue-6.16/acpica-apply-acpi_nonstring.patch  |  63 ---
 ...st-possible-resource-descriptor-inde.patch |  42 --
 ...-int-type-to-store-negative-error-co.patch |  56 ---
 ...-bottom-softirqs-as-part-of-spin_loc.patch |  80 ----
 ...-copy_thread-pass-clone_flags-as-u64.patch | 413 ------------------
 ...arm-at91-pm-fix-mckx-restore-routine.patch |  56 ---
 ...35x-cm-t335-remove-unused-mcasp-num-.patch |  43 --
 ...dts-renesas-porter-fix-can-pin-group.patch |  36 --
 ...m32mp151c-plyaqm-use-correct-dai-for.patch |  42 --
 ...am335x-baltos-fix-ti-en-ck32k-xtal-p.patch |  42 --
 ...omap3-devkit8000-lcd-fix-ti-keep-vre.patch |  41 --
 ...ner-a527-cubie-a5e-add-ethernet-phy-.patch |  41 --
 ...ner-t527-avaota-a1-add-ethernet-phy-.patch |  41 --
 ...ner-t527-avaota-a1-hook-up-external-.patch |  48 --
 ...t8103-j457-fix-pcie-ethernet-iommu-m.patch |  65 ---
 ...kontron-fix-gpio-for-panel-regulator.patch |  50 ---
 ...mx93-kontron-fix-usb-port-assignment.patch |  62 ---
 ...correct-the-lpuart7-and-lpuart8-srci.patch |  47 --
 ...ek-mt6331-fix-pmic-regulators-rtc-ke.patch |  68 ---
 ...ek-mt6795-xperia-m5-fix-mmc0-latch-c.patch |  40 --
 ...ek-mt8186-tentacruel-fix-touchscreen.patch |  70 ---
 ...ek-mt8195-remove-suspend-breaking-re.patch |  50 ---
 ...ek-mt8395-kontron-i1200-fix-mt6360-r.patch | 105 -----
 ...ek-mt8516-pumpkin-fix-machine-compat.patch |  39 --
 ...s-rzg2lc-smarc-disable-can-fd-channe.patch |  43 --
 ...s-sparrow-hawk-invert-microsd-voltag.patch |  42 --
 ...s-sparrow-hawk-set-vddq18_25_avb-vol.patch |  45 --
 ...j742s2-mcu-wakeup-override-firmware-.patch |  65 ---
 ...t_es8316-fix-invalid-quirk-input-map.patch |  68 ---
 ..._rt5640-fix-invalid-quirk-input-mapp.patch |  53 ---
 ..._rt5651-fix-invalid-quirk-input-mapp.patch |  76 ----
 ...-sdw-bpt-set-persistent_buffer-false.patch |  42 --
 ...dw-prevent-jump-to-null-add_sidecar-.patch |  41 --
 ...ject-state_in_sysfs-before-deleting-.patch |  63 ---
 ...-access-race-during-throttle-policy-.patch | 171 --------
 ...-throtl_data-leak-during-disk-releas.patch |  62 ---
 ...-store-blk_stack_limits-return-value.patch |  48 --
 ...nc-fix-using-random-address-for-big-.patch |  57 ---
 ...th-iso-don-t-leak-skb-in-iso_cont-rx.patch |  38 --
 ...so-fix-possible-uaf-on-iso_conn_free.patch |  40 --
 ...ooth-iso-free-rx_skb-if-not-consumed.patch |  35 --
 ...ix-not-exposing-debug-uuid-on-mgmt_o.patch |  48 --
 ...-offload-feature-setup-on-active-bac.patch |  95 ----
 ...pf_jit_binary_pack_finalize-in-bpf_j.patch |  41 --
 ...cted_attach_type-for-tailcall-compat.patch |  93 ----
 ...itly-check-accesses-to-bpf_sock_addr.patch |  75 ----
 queue-6.16/bpf-mark-kfuncs-as-__noclone.patch |  56 ---
 ...-reject-negative-offsets-for-alu-ops.patch |  61 ---
 ...te_disable-in-kprobe_multi_link_prog.patch |  59 ---
 ...pf-selftests-fix-test_tcpnotify_user.patch | 139 ------
 .../bpf-tidy-verifier-bug-message.patch       |  60 ---
 ...y-hit-error-from-extent_writepage_io.patch |  70 ---
 ...ivers-tegra186-avoid-64-bit-division.patch |  47 --
 ...ers-timer-tegra186-avoid-64-bit-divi.patch |  47 --
 ...opriately-disable-programming-clocks.patch | 363 ---------------
 ...propriately-disable-trace-bus-clocks.patch | 281 ------------
 ...enable-programming-clock-duplicately.patch |  65 ---
 queue-6.16/coresight-catu-support-atclk.patch |  93 ----
 ...conditionally-access-register-trcext.patch |  91 ----
 .../coresight-etm4x-support-atclk.patch       | 106 -----
 ...correct-handling-for-return-value-of.patch |  39 --
 ...dentation-error-in-cscfg_remove_owne.patch |  40 --
 ...ht-fix-missing-include-for-field_get.patch |  77 ----
 ...egister-perf-symlink-for-sinks-with-.patch |  45 --
 queue-6.16/coresight-tmc-support-atclk.patch  | 111 -----
 ...ix-the-logic-to-setup-the-element-si.patch |  54 ---
 ...t-trbe-add-isb-after-trblimitr-write.patch |  41 --
 ...rbe-prevent-overflow-in-perf_idx2off.patch |  37 --
 ...eturn-null-pointer-for-allocation-fa.patch |  60 ---
 ...ount-for-malformed-dt-in-scmi_dev_us.patch |  61 ---
 ...-fix-device-and-of-node-leaks-at-pro.patch |  58 ---
 ...re-to-enable-isolated-partition-when.patch |  77 ----
 ...-check-the-sva-module-status-while-e.patch | 366 ----------------
 ...-qm-check-whether-the-input-function.patch |  42 --
 ...-qm-request-reserved-interrupt-for-v.patch | 113 -----
 ...-qm-set-null-to-qm-debug.qm_diff_reg.patch |  38 --
 ...-re-enable-address-prefetch-after-de.patch | 200 ---------
 ...-zip-remove-unnecessary-validation-f.patch |  67 ---
 ...dd-missing-check-after-sg_nents_for_.patch |  45 --
 ...-call-strscpy-with-correct-size-argu.patch |  42 --
 ...ror-on-corrupted-metadata-in-start_r.patch |  51 ---
 ...a_async_tx_descriptor-tx_submit-docu.patch |  44 --
 ...r-fix-malformed-code-block-directive.patch |  38 --
 ...ace-historgram-design-separate-sched.patch |  44 --
 ...e-fix-double-free-in-register_one_no.patch |  56 ---
 ...e-handle-error-properly-in-register_.patch |  56 ---
 ...add-null-pointer-checks-in-dc_stream.patch | 103 -----
 ...-display-remove-redundant-semicolons.patch |  34 --
 ...t-si_upload_smc_data-register-progra.patch |  57 ---
 ...le-mclk-switching-with-non-dc-at-120.patch |  48 --
 ...le-sclk-switching-on-oland-with-high.patch |  99 -----
 ...m-disable-ulv-even-if-unsupported-v3.patch |  53 ---
 ...drm-amd-pm-fix-si_upload_smc_data-v3.patch | 106 -----
 ...-zero-vblank-time-as-too-short-in-si.patch |  53 ---
 ...allocating-extra-dwords-for-rings-v2.patch | 100 -----
 ...peg-v4.0.3-poison-irq-call-trace-on-.patch |  58 ---
 ...cn-v4.0.3-poison-irq-call-trace-on-s.patch |  57 ---
 ...-power-up-uvd-3-for-fw-validation-v2.patch |  89 ----
 ...rror-code-sign-for-einval-in-svm_ioc.patch |  36 --
 ...ridge-cdns-dsi-fix-the-_atomic_check.patch |  48 --
 .../drm-bridge-it6505-select-regmap_i2c.patch |  39 --
 ...t-validate-sspp-when-it-is-not-ready.patch | 106 -----
 ...m-msm-dpu-fix-incorrect-type-for-ret.patch |  40 --
 ...add-disable-to-100ms-for-mnb601ls1-4.patch |  52 ---
 ...tek-nt35560-fix-invalid-return-value.patch |  42 --
 ..._cs-clean-up-of-dead-code-in-r600_cs.patch |  60 ---
 ...op-changes-on-non-primary-planes-in-.patch |  71 ---
 ...or-prefixes-add-undocumented-vendor-.patch | 238 ----------
 .../dts-arm-amlogic-fix-pwm-node-for-c3.patch |  37 --
 ...dimm-enumeration-on-a-disabled-memor.patch |  78 ----
 ...condition-in-__allow_reserved_blocks.patch |  45 --
 ...d-overflow-while-left-shift-operatio.patch |  36 --
 ...gate-overhead-of-f2fs_zero_post_eof_.patch | 138 ------
 ...cate-first-page-in-error-path-of-f2f.patch |  83 ----
 ...te-map-m_next_extent-correctly-in-f2.patch |  56 ---
 ...-data-after-eof-for-compressed-file-.patch | 138 ------
 ...ro-sized-extent-for-precache-extents.patch |  97 ----
 ...e-the-return-value-of-mnt_ns_from_de.patch | 117 -----
 ...dd-fl_reclaim-to-show_fl_flags-macro.patch |  37 --
 ...i-mark-virtio-ready-before-registeri.patch |  64 ---
 ...re-meson-sm-fix-compile-test-default.patch |  39 --
 ...3-fix-integer-overflow-in-run_unpack.patch |  87 ----
 ...index-allocation-if-bitmap-is-empty-.patch |  58 ---
 ...-memory-alloc-free-in-mlx5ctl_fw_rpc.patch |  45 --
 ...alidate_in_progress-flag-clearing-in.patch |  37 --
 ...hidraw-tighten-ioctl-command-parsing.patch | 310 -------------
 ...fix-steelseries_srws1-handling-in-st.patch |  47 --
 ...teelseries-refactor-probe-and-remove.patch | 322 --------------
 ...mas-without-shareable-locks-in-huget.patch |  81 ----
 ...-separate-methods-of-fan-setting-com.patch | 102 -----
 ...x-division-by-zero-in-ks_sa_rng_init.patch |  47 --
 ...wrng-nomadik-add-arm_amba-dependency.patch |  44 --
 ...dd-disabling-clocks-when-probe-fails.patch |  39 --
 ...-fix-clock-issue-when-pm-is-disabled.patch |  68 ---
 ...-potential-incorrect-use-of-i2c_mast.patch |  86 ----
 ...ck-sda-instead-of-scl-after-bus-rese.patch |  48 --
 ...able-sda-glitch-fix-to-avoid-restart.patch |  72 ---
 ...ure-bus-release-check-runs-when-wait.patch |  53 ---
 ...sure-sda-is-released-after-bus-reset.patch | 101 -----
 ...ove-stop-function-to-avoid-bus-error.patch |  87 ----
 ...c-master-svc-recycle-unused-ibi-slot.patch |  39 --
 ...c-use-manual-response-for-ibi-events.patch |  96 ----
 ...ix-sa_local_svc_timeout_ms-read-race.patch |  61 ---
 ...hed-free-function-for-dma_alloc_cohe.patch |  50 ---
 ...riptor-ready-check-barrier-in-splitq.patch |  56 ---
 ...x-handling-of-negative-channel-scale.patch | 121 -----
 ...x-offset-handling-in-iio_convert_raw.patch |  42 --
 ...sock_net-in-ping_get_port-and-ping_l.patch |  83 ----
 ...reserve_mtime-should-depend-on-blk_d.patch |  39 --
 ...revent-use-of-uninitialized-variable.patch |  69 ---
 ...fs-fix-legacy-mode-page-table-dump-l.patch |  79 ----
 ...low-dirty-tracking-if-incoherent-pag.patch |  52 ---
 ...ter-iommufd-mock-devices-with-fwspec.patch | 129 ------
 ..._ftp-unregister-during-netns-cleanup.patch |  63 ---
 ...read_once-write_once-for-ipvs-enable.patch | 223 ----------
 ...ng-objtree-prefix-to-powerpc-crtsavr.patch |  47 --
 ...ix-basic-constraints-ca-flag-parsing.patch |  85 ----
 ...gcs-correctly-check-return-value-whe.patch |  40 --
 ...qcom-flash-update-torch-current-clam.patch | 141 ------
 ...-use-correct-address-for-memory-prog.patch |  64 ---
 ...nction-return-instead-of-variable-as.patch |  40 --
 ...pf-export-bpf_object__prepare-symbol.patch |  38 --
 ...-when-st-prefix_ops-and-ops-from-dif.patch | 121 -----
 queue-6.16/libbpf-fix-reuse-of-devmap.patch   |  53 ---
 ...ig_lsm-can-depend-on-config_security.patch |  39 --
 ...c-vd55g1-fix-duster-register-address.patch |  39 --
 ...54n1cb0c-fix-memleak-in-rj54n1_probe.patch |  47 --
 ...st-delta-avoid-excessive-stack-usage.patch |  92 ----
 ...edia-zoran-remove-zoran_fh-structure.patch |  63 ---
 ...77705_charger-move-active-discharge-.patch |  57 ---
 ...up-the-core-driver-as-an-interrupt-c.patch |  93 ----
 ...incorrect-cmd-field-being-reported-i.patch |  38 --
 ...loc_by_count-to-return-0-when-counts.patch |  49 ---
 ...iable-shadowing-in-mmc_route_rpmb_fr.patch |  56 ---
 ...l-fix-error-handling-path-in-atmel_n.patch |  50 ---
 .../nbd-restrict-sockets-to-tcp-and-udp.patch |  54 ---
 ...andle-copy_thresh-allocation-failure.patch |  56 ---
 ...-in-ena_get_rxfh_key_size-when-rss-h.patch |  61 ---
 ...obing-error-message-typo-for-the-ene.patch |  38 --
 ...lize-sw-pir-and-cir-based-hw-pir-and.patch |  76 ----
 ...nfig-set-command-must-provide-a-repl.patch |  49 ---
 ...mlx5-fw-reset-add-reset-timeout-work.patch |  97 ----
 ...oc-fix-reclaim-race-during-command-i.patch |  57 ---
 ...lling-for-command-response-if-interf.patch |  53 ---
 ...isruptive-netif_wake_queue-in-rtl815.patch |  69 ---
 ...remove-unused-htable_bits-in-macro-a.patch |  68 ---
 ...ntrack-do-not-skip-entries-in-proc-n.patch |  49 ---
 ...ink-reset-nlh-pointer-during-batch-r.patch |  51 ---
 ...h-key-size-when-rss-is-not-supported.patch |  41 --
 ...channel-max_resp_sz-verification-che.patch |  50 ---
 ...-description-of-the-cache_size-modul.patch |  56 ---
 ...nvme-auth-update-bi_directional-flag.patch |  43 --
 ...ly-permitted-commands-for-secure-con.patch |  42 --
 ...-lsop-put-work-to-nvmet_fc_ls_req_op.patch | 107 -----
 ...l-done-callback-even-when-remote-por.patch |  53 ---
 ...-double-free-in-user_cluster_connect.patch |  44 --
 queue-6.16/octeontx2-pf-fix-bitmap-leak.patch |  43 --
 queue-6.16/octeontx2-vf-fix-bitmap-leak.patch |  43 --
 ...y-moving-do_once-to-separate-section.patch |  91 ----
 ...pci_acpi_preserve_config-memory-leak.patch |  52 ---
 ...fix-incorrect-error-message-in-probe.patch |  42 --
 ...double-cleanup-on-devm_add_action_or.patch |  66 ---
 ...alization-settings-for-8.0-gt-s-and-.patch | 183 --------
 ...d-missing-1ms-delay-after-pwr-reset-.patch |  65 ---
 ...ssure-reset-occurs-before-dbi-access.patch |  56 ---
 ...x-inverted-break-condition-in-phy-in.patch |  54 ---
 ...vm_kcalloc-argument-order-for-port-p.patch |  43 --
 ...-duplicate-pll-disable-in-pex_ep_eve.patch |  53 ---
 ...spe-prevent-overflow-in-perf_idx2off.patch |  37 --
 ...ix-ia32_pmc_x_cfg_b-msrs-access-erro.patch |  92 ----
 ...-use-early_initcall-to-hook-bts_init.patch |  48 --
 ...eng-combphy-enable-u3-otg-port-for-r.patch |  69 ---
 ...le_noaudit-when-determining-net-sysc.patch |  53 ---
 ...l-meson-gxl-add-missing-i2c_d-pinmux.patch |  67 ---
 ...rzg2l-fix-invalid-unsigned-return-in.patch |  49 ---
 ...use-int-type-to-store-negative-error.patch |  42 --
 ...ci-fix-potential-error-pointer-deref.patch |  40 --
 ...-rockchip-dfi-double-count-on-rk3588.patch |  88 ----
 ...ear-power.must_resume-in-noirq-suspe.patch |  67 ---
 ...015-fix-a-alignment-coding-style-iss.patch |  37 --
 ...ly-copy-kernel-pgd-entries-into-all-.patch |  64 ---
 ...ve-left-over-instruction-and-comment.patch |  71 ---
 ...nsure-ftrace-record-ops-are-always-s.patch |  60 ---
 ...s-correctly-iterate-over-stubs-in-se.patch |  43 --
 ...in-pps_register_cdev-when-register-d.patch | 115 -----
 ...ptp-add-a-upper-bound-on-max_vclocks.patch |  58 ---
 ...-t-drop-runtime-pm-reference-in-.fre.patch |  49 ---
 ...-corner-case-in-clock-divisor-calcul.patch |  53 ---
 ...-various-off-by-one-errors-in-duty-c.patch | 279 ------------
 ...ke-code-comment-in-.free-more-useful.patch |  40 --
 ...lean-up-unused-header-file-inclusion.patch |  57 ---
 ...it-destroy-cm-id-timeout-error-messa.patch |  44 --
 ...e-mac-of-next-hop-device-without-arp.patch |  53 ---
 ...-estimate-max_qp_wr-to-reflect-wqe-c.patch | 115 -----
 ...port-loopback-forcing-for-mpv-device.patch | 117 -----
 ...xe-fix-race-in-do_task-when-draining.patch |  62 ---
 ...ways-report-immediate-post-sq-errors.patch |  85 ----
 ...perfluous-check-for-config-in-__regm.patch |  37 --
 ...se-int-type-to-store-negative-error-.patch |  46 --
 ...om-pas-shutdown-lite-adsp-dtb-on-x1e.patch |  86 ----
 ...q6v5-avoid-disabling-handover-irq-tw.patch |  49 ---
 ...q6v5_mss-support-loading-mbn-file-on.patch |  57 ---
 ...-update-and-set-xon-xoff-upon-mtu-se.patch | 114 -----
 ...avoid-stop-endpoint-retry-loop-if-th.patch |  71 ---
 ...xtend-struct-ops-return-values-prope.patch | 139 ------
 ...m_smd-fix-fallback-to-qcom-ipc-parse.patch |  45 --
 ...umask-mark-cpumaskvar-as-transparent.patch |  38 --
 ...ack-tail-call-counter-for-bpf_pseudo.patch |  77 ----
 ...ack-tail-call-counter-for-bpf_tramp_.patch |  52 ---
 ...-crash-in-transport-port-remove-by-u.patch |  90 ----
 ...s-fix-dma_alloc_coherent-error-check.patch |  63 ---
 ...array-index-out-of-of-bounds-on-rmmo.patch |  79 ----
 ...pm80xx-restore-support-for-expanders.patch |  59 ---
 ...dif-fix-incorrect-sign-of-error-code.patch |  47 --
 ...-incorrect-sign-of-error-code-in-qla.patch |  39 --
 ...-incorrect-sign-of-error-code-in-sta.patch |  46 --
 ...x-data-race-in-cpu-latency-pm-qos-re.patch | 130 ------
 ...ce-with-wait_killable_recv-if-the-tr.patch |  78 ----
 ...-install-uapi-headers-to-the-correct.patch |  52 ---
 ...check-fread-return-value-in-exec_tar.patch |  48 --
 ...py-test_kmods-when-installing-selfte.patch |  40 --
 ...x-count-write-in-testapp_xdp_metadat.patch |  61 ---
 ...-make-test_pids-backwards-compatible.patch |  82 ----
 ...ex-fix-some-futex_numa_mpol-subtests.patch |  70 ---
 ...est_harness-add-harness-selftest.exp.patch |  46 --
 ...-va_high_addr_switch.sh-failure-on-x.patch | 101 -----
 ...selftests-nolibc-fix-expect_nz-macro.patch |  42 --
 ...ix-wunitialized-in-powerpc-vdso_call.patch |  79 ----
 ...dso_test_abi-correctly-skip-whole-te.patch |  62 ---
 ...og-skip-ping-loop-if-wdiof_keepalive.patch |  67 ---
 ...-max310x-add-error-checking-in-probe.patch |  36 --
 queue-6.16/series                             | 332 --------------
 ...-crypto-buffers-in-non-linear-memory.patch | 169 -------
 ...-ird-ord-negotiation-with-the-client.patch | 192 --------
 ...xpand-the-smp_call_function_many-ker.patch |  52 ---
 ...-svs-fix-device-leaks-on-mt8183-prob.patch |  79 ----
 ...-svs-fix-device-leaks-on-mt8192-prob.patch |  67 ---
 ...c-unconditionally-clear-_trigger-bit.patch |  50 ---
 ...te-exception-reporting-in-copy_-from.patch |  87 ----
 ...eption-reporting-in-copy_-from.patch-12084 | 111 -----
 ...eption-reporting-in-copy_-from.patch-20082 |  67 ---
 ...ception-reporting-in-copy_-from.patch-8584 | 112 -----
 ...te-exception-reporting-in-copy_to_us.patch |  43 --
 ...ode-when-spi-device-has-too-many-chi.patch |  36 --
 ...-preempt_disable-enable-in-srcu_gp_s.patch |  52 ---
 ...close-to-only-send-rst-when-required.patch |  60 ---
 ...rs-qcom-lmh-add-missing-irq-includes.patch |  41 --
 ...rivers-qcom-make-lmh-select-qcom_scm.patch |  40 --
 ...device-to-detached-state-in-tick_shu.patch | 105 -----
 ...e-time_t-robust-if-__kernel_old_time.patch |  51 ---
 ...ools-ynl-fix-undefined-variable-name.patch |  48 --
 ...n-t-block-input-queue-by-waiting-msc.patch |  82 ----
 ...s-uprobe_warn-should-use-passed-task.patch |  40 --
 ...gfs-correctly-set-use_os_string-at-b.patch |  58 ---
 ...-hcd-fix-error-pointer-dereference-i.patch |  39 --
 ...d-access-eud_mode_manager2-through-s.patch | 143 ------
 ...y-twl6030-fix-incorrect-type-for-ret.patch |  41 --
 ...vent-suspending-virtually-attached-d.patch |  74 ----
 ...__kernel_old_timeval-forward-declara.patch |  42 --
 ...ate-time-data-behind-config_generic_.patch |  59 ---
 ...o-pds-replace-bitmap_free-with-vfree.patch |  43 --
 ...-fix-copy_to_iter-return-value-check.patch |  53 ---
 ...vringh-modify-the-return-value-check.patch |  50 ---
 ...c_wdt-do-not-try-to-write-into-const.patch |  80 ----
 ..._wdt-reload-the-watchdog-timer-when-.patch |  49 ---
 ...d-unnecessary-wait-for-service-ready.patch |  93 ----
 ...fallback-for-invalid-channel-number-.patch |  88 ----
 ...hal_phyrx_common_user_info-handling-.patch | 103 -----
 ...x-overflow-warning-on-num_pwr_levels.patch |  89 ----
 ...peer-lookup-in-ath12k_dp_mon_rx_deli.patch |  79 ----
 ...2k-fix-the-fetching-of-combined-rssi.patch |  92 ----
 ...12k-fix-wrong-logging-id-used-for-ce.patch |  53 ---
 ...x-width-unit-in-cfg80211_radio_chand.patch |  37 --
 ...wlwifi-remove-redundant-header-files.patch |  36 --
 ...x-rx-packet-handling-when-pubsta-inf.patch |  87 ----
 ...tential-memory-leak-in-mt76_wmac_pro.patch |  40 --
 ...76-mt7915-fix-mt7981-pre-calibration.patch | 132 ------
 ...96-convert-mt7996_wed_rro_addr-to-le.patch |  95 ----
 ...6-fix-mt7996_mcu_bss_mld_tlv-routine.patch | 215 ---------
 ...-fix-mt7996_mcu_sta_ba-wcid-configur.patch |  96 ----
 ...-fix-rx-packets-configuration-for-pr.patch |  46 --
 ...-fix-tx-queues-initialization-for-se.patch |  63 ---
 ...-remove-redundant-per-phy-mac80211-c.patch | 275 ------------
 ...-use-proper-link_id-in-link_sta_rc_u.patch | 105 -----
 ...nd-world-regulatory-domain-to-driver.patch |  44 --
 ...-rtwdev-mutex-before-setting-the-led.patch |  67 ---
 ...ed-brightness_set_blocking-for-pci-t.patch | 111 -----
 ...-circular-locking-dependency-in-ser_.patch | 149 -------
 ...fix-leak-in-rtw89_core_send_nullfunc.patch |  39 --
 ...dso-fix-output-operand-size-of-rdpid.patch |  59 ---
 333 files changed, 24529 deletions(-)
 delete mode 100644 queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
 delete mode 100644 queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
 delete mode 100644 queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch
 delete mode 100644 queue-6.16/acpica-apply-acpi_nonstring.patch
 delete mode 100644 queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch
 delete mode 100644 queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch
 delete mode 100644 queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
 delete mode 100644 queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch
 delete mode 100644 queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch
 delete mode 100644 queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
 delete mode 100644 queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch
 delete mode 100644 queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
 delete mode 100644 queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
 delete mode 100644 queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
 delete mode 100644 queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
 delete mode 100644 queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
 delete mode 100644 queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
 delete mode 100644 queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
 delete mode 100644 queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
 delete mode 100644 queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
 delete mode 100644 queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
 delete mode 100644 queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
 delete mode 100644 queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
 delete mode 100644 queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
 delete mode 100644 queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
 delete mode 100644 queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
 delete mode 100644 queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
 delete mode 100644 queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
 delete mode 100644 queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
 delete mode 100644 queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
 delete mode 100644 queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
 delete mode 100644 queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
 delete mode 100644 queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch
 delete mode 100644 queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
 delete mode 100644 queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch
 delete mode 100644 queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch
 delete mode 100644 queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
 delete mode 100644 queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
 delete mode 100644 queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch
 delete mode 100644 queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
 delete mode 100644 queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
 delete mode 100644 queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
 delete mode 100644 queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch
 delete mode 100644 queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
 delete mode 100644 queue-6.16/bpf-mark-kfuncs-as-__noclone.patch
 delete mode 100644 queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch
 delete mode 100644 queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
 delete mode 100644 queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch
 delete mode 100644 queue-6.16/bpf-tidy-verifier-bug-message.patch
 delete mode 100644 queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch
 delete mode 100644 queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch
 delete mode 100644 queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
 delete mode 100644 queue-6.16/coresight-appropriately-disable-programming-clocks.patch
 delete mode 100644 queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch
 delete mode 100644 queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch
 delete mode 100644 queue-6.16/coresight-catu-support-atclk.patch
 delete mode 100644 queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch
 delete mode 100644 queue-6.16/coresight-etm4x-support-atclk.patch
 delete mode 100644 queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch
 delete mode 100644 queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch
 delete mode 100644 queue-6.16/coresight-fix-missing-include-for-field_get.patch
 delete mode 100644 queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch
 delete mode 100644 queue-6.16/coresight-tmc-support-atclk.patch
 delete mode 100644 queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
 delete mode 100644 queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch
 delete mode 100644 queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch
 delete mode 100644 queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch
 delete mode 100644 queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
 delete mode 100644 queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
 delete mode 100644 queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch
 delete mode 100644 queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
 delete mode 100644 queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch
 delete mode 100644 queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
 delete mode 100644 queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
 delete mode 100644 queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
 delete mode 100644 queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch
 delete mode 100644 queue-6.16/documentation-trace-historgram-design-separate-sched.patch
 delete mode 100644 queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch
 delete mode 100644 queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch
 delete mode 100644 queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
 delete mode 100644 queue-6.16/drm-amd-display-remove-redundant-semicolons.patch
 delete mode 100644 queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
 delete mode 100644 queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
 delete mode 100644 queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
 delete mode 100644 queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
 delete mode 100644 queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch
 delete mode 100644 queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
 delete mode 100644 queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
 delete mode 100644 queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
 delete mode 100644 queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
 delete mode 100644 queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
 delete mode 100644 queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
 delete mode 100644 queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
 delete mode 100644 queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch
 delete mode 100644 queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
 delete mode 100644 queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch
 delete mode 100644 queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
 delete mode 100644 queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch
 delete mode 100644 queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
 delete mode 100644 queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
 delete mode 100644 queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
 delete mode 100644 queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch
 delete mode 100644 queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
 delete mode 100644 queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch
 delete mode 100644 queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
 delete mode 100644 queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
 delete mode 100644 queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
 delete mode 100644 queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
 delete mode 100644 queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
 delete mode 100644 queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch
 delete mode 100644 queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
 delete mode 100644 queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
 delete mode 100644 queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
 delete mode 100644 queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch
 delete mode 100644 queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
 delete mode 100644 queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
 delete mode 100644 queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
 delete mode 100644 queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
 delete mode 100644 queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch
 delete mode 100644 queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
 delete mode 100644 queue-6.16/hid-steelseries-refactor-probe-and-remove.patch
 delete mode 100644 queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
 delete mode 100644 queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
 delete mode 100644 queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
 delete mode 100644 queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch
 delete mode 100644 queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch
 delete mode 100644 queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
 delete mode 100644 queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
 delete mode 100644 queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
 delete mode 100644 queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
 delete mode 100644 queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
 delete mode 100644 queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
 delete mode 100644 queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
 delete mode 100644 queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch
 delete mode 100644 queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch
 delete mode 100644 queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
 delete mode 100644 queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
 delete mode 100644 queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
 delete mode 100644 queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch
 delete mode 100644 queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
 delete mode 100644 queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
 delete mode 100644 queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
 delete mode 100644 queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch
 delete mode 100644 queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
 delete mode 100644 queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
 delete mode 100644 queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch
 delete mode 100644 queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
 delete mode 100644 queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch
 delete mode 100644 queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
 delete mode 100644 queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
 delete mode 100644 queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch
 delete mode 100644 queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch
 delete mode 100644 queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
 delete mode 100644 queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch
 delete mode 100644 queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch
 delete mode 100644 queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
 delete mode 100644 queue-6.16/libbpf-fix-reuse-of-devmap.patch
 delete mode 100644 queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch
 delete mode 100644 queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch
 delete mode 100644 queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
 delete mode 100644 queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch
 delete mode 100644 queue-6.16/media-zoran-remove-zoran_fh-structure.patch
 delete mode 100644 queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch
 delete mode 100644 queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
 delete mode 100644 queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
 delete mode 100644 queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
 delete mode 100644 queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
 delete mode 100644 queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
 delete mode 100644 queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch
 delete mode 100644 queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch
 delete mode 100644 queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
 delete mode 100644 queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch
 delete mode 100644 queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
 delete mode 100644 queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
 delete mode 100644 queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch
 delete mode 100644 queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
 delete mode 100644 queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch
 delete mode 100644 queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
 delete mode 100644 queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
 delete mode 100644 queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
 delete mode 100644 queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
 delete mode 100644 queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
 delete mode 100644 queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
 delete mode 100644 queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch
 delete mode 100644 queue-6.16/nvme-auth-update-bi_directional-flag.patch
 delete mode 100644 queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch
 delete mode 100644 queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
 delete mode 100644 queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch
 delete mode 100644 queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch
 delete mode 100644 queue-6.16/octeontx2-pf-fix-bitmap-leak.patch
 delete mode 100644 queue-6.16/octeontx2-vf-fix-bitmap-leak.patch
 delete mode 100644 queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch
 delete mode 100644 queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
 delete mode 100644 queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch
 delete mode 100644 queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
 delete mode 100644 queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
 delete mode 100644 queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
 delete mode 100644 queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
 delete mode 100644 queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
 delete mode 100644 queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
 delete mode 100644 queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
 delete mode 100644 queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
 delete mode 100644 queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
 delete mode 100644 queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
 delete mode 100644 queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
 delete mode 100644 queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
 delete mode 100644 queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
 delete mode 100644 queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
 delete mode 100644 queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch
 delete mode 100644 queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
 delete mode 100644 queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
 delete mode 100644 queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
 delete mode 100644 queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
 delete mode 100644 queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
 delete mode 100644 queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch
 delete mode 100644 queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
 delete mode 100644 queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
 delete mode 100644 queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch
 delete mode 100644 queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch
 delete mode 100644 queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
 delete mode 100644 queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
 delete mode 100644 queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
 delete mode 100644 queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
 delete mode 100644 queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch
 delete mode 100644 queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
 delete mode 100644 queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
 delete mode 100644 queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
 delete mode 100644 queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
 delete mode 100644 queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch
 delete mode 100644 queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch
 delete mode 100644 queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch
 delete mode 100644 queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch
 delete mode 100644 queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
 delete mode 100644 queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
 delete mode 100644 queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
 delete mode 100644 queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
 delete mode 100644 queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
 delete mode 100644 queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
 delete mode 100644 queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
 delete mode 100644 queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch
 delete mode 100644 queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
 delete mode 100644 queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
 delete mode 100644 queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
 delete mode 100644 queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch
 delete mode 100644 queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
 delete mode 100644 queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch
 delete mode 100644 queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
 delete mode 100644 queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
 delete mode 100644 queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
 delete mode 100644 queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
 delete mode 100644 queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
 delete mode 100644 queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch
 delete mode 100644 queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch
 delete mode 100644 queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch
 delete mode 100644 queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
 delete mode 100644 queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch
 delete mode 100644 queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch
 delete mode 100644 queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch
 delete mode 100644 queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
 delete mode 100644 queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch
 delete mode 100644 queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
 delete mode 100644 queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
 delete mode 100644 queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
 delete mode 100644 queue-6.16/serial-max310x-add-error-checking-in-probe.patch
 delete mode 100644 queue-6.16/series
 delete mode 100644 queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch
 delete mode 100644 queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch
 delete mode 100644 queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
 delete mode 100644 queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
 delete mode 100644 queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
 delete mode 100644 queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
 delete mode 100644 queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch
 delete mode 100644 queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084
 delete mode 100644 queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082
 delete mode 100644 queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584
 delete mode 100644 queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
 delete mode 100644 queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch
 delete mode 100644 queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
 delete mode 100644 queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
 delete mode 100644 queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
 delete mode 100644 queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
 delete mode 100644 queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch
 delete mode 100644 queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
 delete mode 100644 queue-6.16/tools-ynl-fix-undefined-variable-name.patch
 delete mode 100644 queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
 delete mode 100644 queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch
 delete mode 100644 queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
 delete mode 100644 queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
 delete mode 100644 queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
 delete mode 100644 queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch
 delete mode 100644 queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
 delete mode 100644 queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch
 delete mode 100644 queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch
 delete mode 100644 queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch
 delete mode 100644 queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch
 delete mode 100644 queue-6.16/vhost-vringh-modify-the-return-value-check.patch
 delete mode 100644 queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
 delete mode 100644 queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
 delete mode 100644 queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
 delete mode 100644 queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
 delete mode 100644 queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
 delete mode 100644 queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
 delete mode 100644 queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
 delete mode 100644 queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
 delete mode 100644 queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
 delete mode 100644 queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
 delete mode 100644 queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch
 delete mode 100644 queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
 delete mode 100644 queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
 delete mode 100644 queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
 delete mode 100644 queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
 delete mode 100644 queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
 delete mode 100644 queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
 delete mode 100644 queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
 delete mode 100644 queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
 delete mode 100644 queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch

diff --git a/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch b/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
deleted file mode 100644
index d56ac970a9..0000000000
--- a/queue-6.16/accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 26e5a0102eafd8515f8836d038658e4a1306ed5c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 11:39:17 +0800
-Subject: accel/amdxdna: Use int instead of u32 to store error codes
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ]
-
-Change the 'ret' variable from u32 to int to store -EINVAL.  Storing the
-negative error codes in unsigned type, doesn't cause an issue at runtime
-but it's ugly as pants.
-
-Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may
-trigger a GCC warning when the -Wsign-conversion flag is enabled.
-
-Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
-Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
-Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/accel/amdxdna/aie2_ctx.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
-index e04549f64d69e..842cf1f0aa1be 100644
---- a/drivers/accel/amdxdna/aie2_ctx.c
-+++ b/drivers/accel/amdxdna/aie2_ctx.c
-@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size)
- {
- 	struct amdxdna_sched_job *job = handle;
- 	struct amdxdna_gem_obj *cmd_abo;
--	u32 ret = 0;
-+	int ret = 0;
- 	u32 status;
- 
- 	cmd_abo = job->cmd_bo;
-@@ -222,7 +222,7 @@ static int
- aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size)
- {
- 	struct amdxdna_sched_job *job = handle;
--	u32 ret = 0;
-+	int ret = 0;
- 	u32 status;
- 
- 	if (unlikely(!data))
-@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size)
- 	u32 fail_cmd_status;
- 	u32 fail_cmd_idx;
- 	u32 cmd_status;
--	u32 ret = 0;
-+	int ret = 0;
- 
- 	cmd_abo = job->cmd_bo;
- 	if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) {
--- 
-2.51.0
-
diff --git a/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch b/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
deleted file mode 100644
index 0074223e6c..0000000000
--- a/queue-6.16/acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From e23e2ecdbad769c07b99656570daaf0d689d745d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 12:45:18 +0100
-Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
-
-From: Colin Ian King <colin.i.king@gmail.com>
-
-[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
-
-There appears to be a cut-n-paste error with the incorrect field
-ndr_desc->numa_node being reported for the target node. Fix this by
-using ndr_desc->target_node instead.
-
-Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
-Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
-Reviewed-by: Ira Weiny <ira.weiny@intel.com>
-Signed-off-by: Ira Weiny <ira.weiny@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/acpi/nfit/core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
-index ae035b93da087..3eb56b77cb6d9 100644
---- a/drivers/acpi/nfit/core.c
-+++ b/drivers/acpi/nfit/core.c
-@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
- 	if (ndr_desc->target_node == NUMA_NO_NODE) {
- 		ndr_desc->target_node = phys_to_target_node(spa->address);
- 		dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
--			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
-+			NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
- 	}
- 
- 	/*
--- 
-2.51.0
-
diff --git a/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch b/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch
deleted file mode 100644
index 3e98805146..0000000000
--- a/queue-6.16/acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 593c49ce0932512d12f64858e203183fa1bfa5e4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Jul 2025 15:06:11 +0800
-Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
- failed
-
-From: Huisong Li <lihuisong@huawei.com>
-
-[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
-
-The cpuidle device's memory is leaked when cpuidle device registration
-fails in acpi_processor_power_init().  Free it as appropriate.
-
-Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
-Signed-off-by: Huisong Li <lihuisong@huawei.com>
-Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
-[ rjw: Changed the order of the new statements, added empty line after if () ]
-[ rjw: Changelog edits ]
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/acpi/processor_idle.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index 2c2dc559e0f8d..d0fc045a8d310 100644
---- a/drivers/acpi/processor_idle.c
-+++ b/drivers/acpi/processor_idle.c
-@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
- 		if (retval) {
- 			if (acpi_processor_registered == 0)
- 				cpuidle_unregister_driver(&acpi_idle_driver);
-+
-+			per_cpu(acpi_cpuidle_device, pr->id) = NULL;
-+			kfree(dev);
- 			return retval;
- 		}
- 		acpi_processor_registered++;
--- 
-2.51.0
-
diff --git a/queue-6.16/acpica-apply-acpi_nonstring.patch b/queue-6.16/acpica-apply-acpi_nonstring.patch
deleted file mode 100644
index e32119b6b5..0000000000
--- a/queue-6.16/acpica-apply-acpi_nonstring.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 50c5564fc569e31f1fb8d9823142cc62c2735123 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 21:55:35 +0200
-Subject: ACPICA: Apply ACPI_NONSTRING
-
-From: Ahmed Salem <x0rw3ll@gmail.com>
-
-[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ]
-
-Add ACPI_NONSTRING for destination char arrays without a terminating NUL
-character.
-
-This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
-where a few more destination arrays were missed.
-
-Link: https://github.com/acpica/acpica/commit/f359e5ed
-Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
-Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/acpi/actbl.h                                     | 2 +-
- tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
-index 243097a3da636..8a67d4ea6e3fe 100644
---- a/include/acpi/actbl.h
-+++ b/include/acpi/actbl.h
-@@ -73,7 +73,7 @@ struct acpi_table_header {
- 	char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING;	/* ASCII OEM identification */
- 	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING;	/* ASCII OEM table identification */
- 	u32 oem_revision;	/* OEM revision number */
--	char asl_compiler_id[ACPI_NAMESEG_SIZE];	/* ASCII ASL compiler vendor ID */
-+	char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;	/* ASCII ASL compiler vendor ID */
- 	u32 asl_compiler_revision;	/* ASL compiler version */
- };
- 
-diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
-index 9741e7503591c..de93067a5da32 100644
---- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
-+++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
-@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory)
- {
- 	void *table_dir;
- 	u32 instance;
--	char temp_name[ACPI_NAMESEG_SIZE];
-+	char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
- 	char *filename;
- 	acpi_status status = AE_OK;
- 
-@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname,
- {
- 	void *table_dir;
- 	u32 current_instance = 0;
--	char temp_name[ACPI_NAMESEG_SIZE];
-+	char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
- 	char table_filename[PATH_MAX];
- 	char *filename;
- 	acpi_status status;
--- 
-2.51.0
-
diff --git a/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch b/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch
deleted file mode 100644
index a25697d734..0000000000
--- a/queue-6.16/acpica-fix-largest-possible-resource-descriptor-inde.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 9c0b93aed4ff35ccbbd2ac767cbd5f8b441f0d10 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 22:03:16 +0200
-Subject: ACPICA: Fix largest possible resource descriptor index
-
-From: Dmitry Antipov <dmantipov@yandex.ru>
-
-[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
-
-ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
-used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
-
-Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
-clamped incorrectly and resulting value may issue an out-of-bounds
-access for 'acpi_gbl_resource_types' array. Compile tested only.
-
-Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
-Link: https://github.com/acpica/acpica/commit/cf00116c
-Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
-Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/acpi/acpica/aclocal.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
-index 0c41f0097e8d7..f98640086f4ef 100644
---- a/drivers/acpi/acpica/aclocal.h
-+++ b/drivers/acpi/acpica/aclocal.h
-@@ -1141,7 +1141,7 @@ struct acpi_port_info {
- #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION   0x91
- #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG     0x92
- #define ACPI_RESOURCE_NAME_CLOCK_INPUT          0x93
--#define ACPI_RESOURCE_NAME_LARGE_MAX            0x94
-+#define ACPI_RESOURCE_NAME_LARGE_MAX            0x93
- 
- /*****************************************************************************
-  *
--- 
-2.51.0
-
diff --git a/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch b/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch
deleted file mode 100644
index 8e2f22bb6f..0000000000
--- a/queue-6.16/alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 9872975a5204d7aeb1e0be40a8ac443a35c2d5de Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 16:13:10 +0800
-Subject: ALSA: lx_core: use int type to store negative error codes
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
-
-Change the 'ret' variable from u16 to int to store negative error codes or
-zero returned by lx_message_send_atomic().
-
-Storing the negative error codes in unsigned type, doesn't cause an issue
-at runtime but it's ugly as pants. Additionally, assigning negative error
-codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
-flag is enabled.
-
-No effect on runtime.
-
-Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/pci/lx6464es/lx_core.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
-index 9d95ecb299aed..a99acd1125e74 100644
---- a/sound/pci/lx6464es/lx_core.c
-+++ b/sound/pci/lx6464es/lx_core.c
-@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
- /* low-level dsp access */
- int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
- {
--	u16 ret;
-+	int ret;
- 
- 	mutex_lock(&chip->msg_lock);
- 
-@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
- 
- int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
- {
--	u16 ret = 0;
- 	u32 freq_raw = 0;
- 	u32 freq = 0;
- 	u32 frequency = 0;
-+	int ret;
- 
- 	mutex_lock(&chip->msg_lock);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch b/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
deleted file mode 100644
index 4c8c2d3d48..0000000000
--- a/queue-6.16/alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 73ebac0788971cc0080e32739a37dd478d986cd4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 17:28:51 +0200
-Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
- PREEMPT_RT
-
-From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-
-[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]
-
-snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
-via spin_lock_irq(). This also implicitly disables the handling of
-softirqs such as TIMER_SOFTIRQ.
-On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
-disable them. That means a timer can be invoked during spin_lock_irq()
-on the same CPU. Due to synchronisations reasons local_bh_disable() has
-a per-CPU lock named softirq_ctrl.lock which synchronizes individual
-softirq against each other.
-syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
-acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
-is a possible deadlock.
-
-The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
-would lead to too much synchronisation against individual threads on the
-system. To avoid the possible deadlock, softirqs must be manually
-disabled before the lock is acquired.
-
-Disable softirqs before the lock is acquired on PREEMPT_RT.
-
-Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com
-Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
-Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/core/pcm_native.c | 25 +++++++++++++++----------
- 1 file changed, 15 insertions(+), 10 deletions(-)
-
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index ecb71bf1859d4..1a9abf0342c20 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
- }
- 
- /* define group lock helpers */
--#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
-+#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
- static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
- { \
--	if (nonatomic) \
-+	if (nonatomic) { \
- 		mutex_ ## mutex_action(&group->mutex); \
--	else \
--		spin_ ## action(&group->lock); \
--}
--
--DEFINE_PCM_GROUP_LOCK(lock, lock);
--DEFINE_PCM_GROUP_LOCK(unlock, unlock);
--DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
--DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
-+	} else { \
-+		if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock)   \
-+			local_bh_disable();			\
-+		spin_ ## action(&group->lock);			\
-+		if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
-+			local_bh_enable();                      \
-+	}							\
-+}
-+
-+DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
-+DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
-+DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
-+DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
- 
- /**
-  * snd_pcm_stream_lock - Lock the PCM stream
--- 
-2.51.0
-
diff --git a/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch b/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch
deleted file mode 100644
index 6c77a1cff9..0000000000
--- a/queue-6.16/arch-copy_thread-pass-clone_flags-as-u64.patch
+++ /dev/null
@@ -1,413 +0,0 @@
-From fcec9ea33d8777bdb31fa36bd718219d782e685c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 1 Sep 2025 15:09:52 +0200
-Subject: arch: copy_thread: pass clone_flags as u64
-
-From: Simon Schuster <schuster.simon@siemens-energy.com>
-
-[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ]
-
-With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
-clone3") the effective bit width of clone_flags on all architectures was
-increased from 32-bit to 64-bit, with a new type of u64 for the flags.
-However, for most consumers of clone_flags the interface was not
-changed from the previous type of unsigned long.
-
-While this works fine as long as none of the new 64-bit flag bits
-(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
-undesirable in terms of the principle of least surprise.
-
-Thus, this commit fixes all relevant interfaces of the copy_thread
-function that is called from copy_process to consistently pass
-clone_flags as u64, so that no truncation to 32-bit integers occurs on
-32-bit architectures.
-
-Signed-off-by: Simon Schuster <schuster.simon@siemens-energy.com>
-Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com
-Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread")
-Acked-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
-Acked-by: Andreas Larsson <andreas@gaisler.com> # sparc
-Acked-by: David Hildenbrand <david@redhat.com>
-Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
-Reviewed-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/alpha/kernel/process.c      | 2 +-
- arch/arc/kernel/process.c        | 2 +-
- arch/arm/kernel/process.c        | 2 +-
- arch/arm64/kernel/process.c      | 2 +-
- arch/csky/kernel/process.c       | 2 +-
- arch/hexagon/kernel/process.c    | 2 +-
- arch/loongarch/kernel/process.c  | 2 +-
- arch/m68k/kernel/process.c       | 2 +-
- arch/microblaze/kernel/process.c | 2 +-
- arch/mips/kernel/process.c       | 2 +-
- arch/nios2/kernel/process.c      | 2 +-
- arch/openrisc/kernel/process.c   | 2 +-
- arch/parisc/kernel/process.c     | 2 +-
- arch/powerpc/kernel/process.c    | 2 +-
- arch/riscv/kernel/process.c      | 2 +-
- arch/s390/kernel/process.c       | 2 +-
- arch/sh/kernel/process_32.c      | 2 +-
- arch/sparc/kernel/process_32.c   | 2 +-
- arch/sparc/kernel/process_64.c   | 2 +-
- arch/um/kernel/process.c         | 2 +-
- arch/x86/include/asm/fpu/sched.h | 2 +-
- arch/x86/include/asm/shstk.h     | 4 ++--
- arch/x86/kernel/fpu/core.c       | 2 +-
- arch/x86/kernel/process.c        | 2 +-
- arch/x86/kernel/shstk.c          | 2 +-
- arch/xtensa/kernel/process.c     | 2 +-
- 26 files changed, 27 insertions(+), 27 deletions(-)
-
-diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
-index 582d96548385d..06522451f018f 100644
---- a/arch/alpha/kernel/process.c
-+++ b/arch/alpha/kernel/process.c
-@@ -231,7 +231,7 @@ flush_thread(void)
-  */
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	extern void ret_from_fork(void);
-diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
-index 186ceab661eb0..8166d09087130 100644
---- a/arch/arc/kernel/process.c
-+++ b/arch/arc/kernel/process.c
-@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void);
-  */
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *c_regs;        /* child's pt_regs */
-diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index e16ed102960cb..d7aa95225c70b 100644
---- a/arch/arm/kernel/process.c
-+++ b/arch/arm/kernel/process.c
-@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long stack_start = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *thread = task_thread_info(p);
-diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
-index 3e1baff5e88d9..01a20fb96b8c4 100644
---- a/arch/arm64/kernel/process.c
-+++ b/arch/arm64/kernel/process.c
-@@ -410,7 +410,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long stack_start = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *childregs = task_pt_regs(p);
-diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
-index 0c6e4b17fe00f..a7a90340042a5 100644
---- a/arch/csky/kernel/process.c
-+++ b/arch/csky/kernel/process.c
-@@ -32,7 +32,7 @@ void flush_thread(void){}
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct switch_stack *childstack;
-diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
-index 2a77bfd756945..15b4992bfa298 100644
---- a/arch/hexagon/kernel/process.c
-+++ b/arch/hexagon/kernel/process.c
-@@ -52,7 +52,7 @@ void arch_cpu_idle(void)
-  */
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *ti = task_thread_info(p);
-diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c
-index 3582f591bab28..efd9edf65603c 100644
---- a/arch/loongarch/kernel/process.c
-+++ b/arch/loongarch/kernel/process.c
-@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- 	unsigned long childksp;
- 	unsigned long tls = args->tls;
- 	unsigned long usp = args->stack;
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	struct pt_regs *childregs, *regs = current_pt_regs();
- 
- 	childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
-diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
-index fda7eac23f872..f5a07a70e9385 100644
---- a/arch/m68k/kernel/process.c
-+++ b/arch/m68k/kernel/process.c
-@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct fork_frame {
-diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
-index 56342e11442d2..6cbf642d7b801 100644
---- a/arch/microblaze/kernel/process.c
-+++ b/arch/microblaze/kernel/process.c
-@@ -54,7 +54,7 @@ void flush_thread(void)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *childregs = task_pt_regs(p);
-diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index 02aa6a04a21da..29191fa1801e2 100644
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
-  */
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *ti = task_thread_info(p);
-diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
-index f84021303f6a8..151404139085c 100644
---- a/arch/nios2/kernel/process.c
-+++ b/arch/nios2/kernel/process.c
-@@ -101,7 +101,7 @@ void flush_thread(void)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *childregs = task_pt_regs(p);
-diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
-index eef99fee2110c..73ffb9fa3118b 100644
---- a/arch/openrisc/kernel/process.c
-+++ b/arch/openrisc/kernel/process.c
-@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void);
- int
- copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *userregs;
-diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
-index ed93bd8c15453..e64ab5d2a40d6 100644
---- a/arch/parisc/kernel/process.c
-+++ b/arch/parisc/kernel/process.c
-@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init);
- int
- copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *cregs = &(p->thread.regs);
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 855e098865032..eb23966ac0a9f 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- 			f = ret_from_kernel_user_thread;
- 		} else {
- 			struct pt_regs *regs = current_pt_regs();
--			unsigned long clone_flags = args->flags;
-+			u64 clone_flags = args->flags;
- 			unsigned long usp = args->stack;
- 
- 			/* Copy registers */
-diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
-index a0a40889d79a5..31a392993cb45 100644
---- a/arch/riscv/kernel/process.c
-+++ b/arch/riscv/kernel/process.c
-@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *childregs = task_pt_regs(p);
-diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index 9637aee43c401..76a97283daaf7 100644
---- a/arch/s390/kernel/process.c
-+++ b/arch/s390/kernel/process.c
-@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long new_stackp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct fake_frame
-diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
-index 92b6649d49295..62f753a85b89c 100644
---- a/arch/sh/kernel/process_32.c
-+++ b/arch/sh/kernel/process_32.c
-@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void);
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *ti = task_thread_info(p);
-diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
-index 9c7c662cb5659..5a28c0e91bf15 100644
---- a/arch/sparc/kernel/process_32.c
-+++ b/arch/sparc/kernel/process_32.c
-@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void);
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long sp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *ti = task_thread_info(p);
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index 529adfecd58ca..25781923788a0 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs)
-  */
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long sp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct thread_info *t = task_thread_info(p);
-diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
-index 1be644de9e41e..9c9c66dc45f05 100644
---- a/arch/um/kernel/process.c
-+++ b/arch/um/kernel/process.c
-@@ -143,7 +143,7 @@ static void fork_handler(void)
- 
- int copy_thread(struct task_struct * p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long sp = args->stack;
- 	unsigned long tls = args->tls;
- 	void (*handler)(void);
-diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
-index c060549c6c940..89004f4ca208d 100644
---- a/arch/x86/include/asm/fpu/sched.h
-+++ b/arch/x86/include/asm/fpu/sched.h
-@@ -11,7 +11,7 @@
- 
- extern void save_fpregs_to_fpstate(struct fpu *fpu);
- extern void fpu__drop(struct task_struct *tsk);
--extern int  fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
-+extern int  fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
- 		      unsigned long shstk_addr);
- extern void fpu_flush_thread(void);
- 
-diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
-index ba6f2fe438488..0f50e01259430 100644
---- a/arch/x86/include/asm/shstk.h
-+++ b/arch/x86/include/asm/shstk.h
-@@ -16,7 +16,7 @@ struct thread_shstk {
- 
- long shstk_prctl(struct task_struct *task, int option, unsigned long arg2);
- void reset_thread_features(void);
--unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags,
-+unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags,
- 				       unsigned long stack_size);
- void shstk_free(struct task_struct *p);
- int setup_signal_shadow_stack(struct ksignal *ksig);
-@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option,
- 			       unsigned long arg2) { return -EINVAL; }
- static inline void reset_thread_features(void) {}
- static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p,
--						     unsigned long clone_flags,
-+						     u64 clone_flags,
- 						     unsigned long stack_size) { return 0; }
- static inline void shstk_free(struct task_struct *p) {}
- static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
-diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
-index ea138583dd92a..a8ff319408363 100644
---- a/arch/x86/kernel/fpu/core.c
-+++ b/arch/x86/kernel/fpu/core.c
-@@ -606,7 +606,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp)
- }
- 
- /* Clone current's FPU state on fork */
--int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
-+int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
- 	      unsigned long ssp)
- {
- 	/*
-diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index a838be04f8749..1e57bcc795f31 100644
---- a/arch/x86/kernel/process.c
-+++ b/arch/x86/kernel/process.c
-@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs,
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long sp = args->stack;
- 	unsigned long tls = args->tls;
- 	struct inactive_task_frame *frame;
-diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
-index 2ddf23387c7ef..5eba6c5a67757 100644
---- a/arch/x86/kernel/shstk.c
-+++ b/arch/x86/kernel/shstk.c
-@@ -191,7 +191,7 @@ void reset_thread_features(void)
- 	current->thread.features_locked = 0;
- }
- 
--unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags,
-+unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags,
- 				       unsigned long stack_size)
- {
- 	struct thread_shstk *shstk = &tsk->thread.shstk;
-diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
-index 7bd66677f7b6d..94d43f44be131 100644
---- a/arch/xtensa/kernel/process.c
-+++ b/arch/xtensa/kernel/process.c
-@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
- 
- int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
- {
--	unsigned long clone_flags = args->flags;
-+	u64 clone_flags = args->flags;
- 	unsigned long usp_thread_fn = args->stack;
- 	unsigned long tls = args->tls;
- 	struct pt_regs *childregs = task_pt_regs(p);
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch b/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch
deleted file mode 100644
index aa534be2b3..0000000000
--- a/queue-6.16/arm-at91-pm-fix-mckx-restore-routine.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 713193dffe656106e3efccf99432db2fa327b49a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Aug 2025 16:54:26 +0200
-Subject: ARM: at91: pm: fix MCKx restore routine
-
-From: Nicolas Ferre <nicolas.ferre@microchip.com>
-
-[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
-
-The at91_mckx_ps_restore() assembly function is responsible for setting
-back MCKx system bus clocks after exiting low power modes.
-
-Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
-to previously saved state.
-Tmp2 was used without the needed changes in CSS and DIV. Moreover the
-required bit 7, telling that MCR register's content is to be changed
-(CMD/write), was not set.
-
-Fix function comment to match tmp variables actually used.
-
-Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
-Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
-Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
-Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-[claudiu.beznea: s/sate/state in commit description]
-Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/mach-at91/pm_suspend.S | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
-index e23b868340965..7e6c94f8edeef 100644
---- a/arch/arm/mach-at91/pm_suspend.S
-+++ b/arch/arm/mach-at91/pm_suspend.S
-@@ -904,7 +904,7 @@ e_done:
- /**
-  * at91_mckx_ps_restore: restore MCKx settings
-  *
-- * Side effects: overwrites tmp1, tmp2
-+ * Side effects: overwrites tmp1, tmp2 and tmp3
-  */
- .macro at91_mckx_ps_restore
- #ifdef CONFIG_SOC_SAMA7
-@@ -980,7 +980,7 @@ r_ps:
- 	bic	tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
- 	orr	tmp3, tmp3, tmp1
- 	orr	tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
--	str	tmp2, [pmc, #AT91_PMC_MCR_V2]
-+	str	tmp3, [pmc, #AT91_PMC_MCR_V2]
- 
- 	wait_mckrdy tmp1
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch b/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
deleted file mode 100644
index 2858af0aa5..0000000000
--- a/queue-6.16/arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From a1b118129010ffc3dd36fefe58fb3dbfdf568723 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 30 Aug 2025 23:59:57 +0200
-Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
- property
-
-From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-
-[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
-
-The dtbs_check validation for am335x-cm-t335.dtb flags an error
-for an unevaluated 'num-serializer' property in the mcasp0 node.
-
-This property is obsolete; it is not defined in the davinci-mcasp-audio
-schema and is not used by the corresponding (or any) driver.
-
-Remove this unused property to fix the schema validation warning.
-
-Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
-Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
-index 06767ea164b59..ece7f7854f6aa 100644
---- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
-+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
-@@ -483,8 +483,6 @@ &mcasp1 {
- 
- 		op-mode = <0>;          /* MCASP_IIS_MODE */
- 		tdm-slots = <2>;
--		/* 16 serializers */
--		num-serializer = <16>;
- 		serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
- 			0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
- 		>;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch b/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch
deleted file mode 100644
index 6fcd286a5c..0000000000
--- a/queue-6.16/arm-dts-renesas-porter-fix-can-pin-group.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b87e7dda63bcf374ff1f41fc20fcbdef9134e267 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 27 Jun 2025 15:49:48 +0200
-Subject: ARM: dts: renesas: porter: Fix CAN pin group
-
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-
-[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
-
-According to the schematics, the CAN transceiver is connected to pins
-GP7_3 and GP7_4, which correspond to CAN0 data group B.
-
-Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
-index f518eadd8b9cd..81b3c5d74e9b3 100644
---- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
-+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
-@@ -289,7 +289,7 @@ vin0_pins: vin0 {
- 	};
- 
- 	can0_pins: can0 {
--		groups = "can0_data";
-+		groups = "can0_data_b";
- 		function = "can0";
- 	};
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch b/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
deleted file mode 100644
index fc161707b7..0000000000
--- a/queue-6.16/arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From d5a9bae0afe2562dd032cc1e4cdcb807cddc4591 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 31 Aug 2025 00:51:15 +0200
-Subject: ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property
-
-From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-
-[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ]
-
-The stm32-i2s binding inherits from the standard audio-graph-port
-schema for its 'port' subnode, audio-graph-port requires the use
-of the 'dai-format' property. The stm32mp151c-plyaqm dts file was
-using the non-standard name 'format'.
-
-Correct the property name to 'dai-format' to fix the dtbs_check
-validation error.
-
-Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree")
-Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com
-Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
-index 39a3211c61337..55fe916740d7c 100644
---- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
-+++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
-@@ -239,7 +239,7 @@ &i2s1 {
- 
- 	i2s1_port: port {
- 		i2s1_endpoint: endpoint {
--			format = "i2s";
-+			dai-format = "i2s";
- 			mclk-fs = <256>;
- 			remote-endpoint = <&codec_endpoint>;
- 		};
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch b/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
deleted file mode 100644
index 6987c8e0b0..0000000000
--- a/queue-6.16/arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 439e7f6e087bc271e8c561f4b9755f48c44b8d43 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 23 Aug 2025 00:25:30 +0200
-Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in
- DTS to use correct boolean syntax
-
-From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-
-[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
-
-The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
-schema, was incorrectly assigned a value (<1>) in the DTS file, causing
-a validation error: "size (4) error for type flag". The driver uses
-of_property_read_bool(), expecting a boolean. Remove the value to fix
-the dtbs_check error.
-
-Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
-Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
-Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
-index ae2e8dffbe049..ea47f9960c356 100644
---- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
-+++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
-@@ -269,7 +269,7 @@ &tps {
- 	vcc7-supply = <&vbat>;
- 	vccio-supply = <&vbat>;
- 
--	ti,en-ck32k-xtal = <1>;
-+	ti,en-ck32k-xtal;
- 
- 	regulators {
- 		vrtc_reg: regulator@0 {
--- 
-2.51.0
-
diff --git a/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch b/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
deleted file mode 100644
index d5553fe957..0000000000
--- a/queue-6.16/arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From b4394cdf3be82232ebfc7b101ff0cd984acf7101 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 23 Aug 2025 00:50:52 +0200
-Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on
- property to use correct boolean syntax in DTS
-
-From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-
-[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
-
-The ti,keep-vref-on property, defined as a boolean flag in the Device
-Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
-causing a validation error: "size (4) error for type flag". Remove
-the value to match the schema and ensure compatibility with the driver
-using device_property_read_bool(). This fixes the dtbs_check error.
-
-Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
-Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
-Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
-index a7f99ae0c1fe9..78c657429f641 100644
---- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
-+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
-@@ -65,7 +65,7 @@ ads7846@0 {
- 		ti,debounce-max = /bits/ 16 <10>;
- 		ti,debounce-tol = /bits/ 16 <5>;
- 		ti,debounce-rep = /bits/ 16 <1>;
--		ti,keep-vref-on = <1>;
-+		ti,keep-vref-on;
- 		ti,settle-delay-usec = /bits/ 16 <150>;
- 
- 		wakeup-source;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch b/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
deleted file mode 100644
index 3f026eb489..0000000000
--- a/queue-6.16/arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 409135b8398390f3d558d801f9049f66b35c2a14 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 02:10:55 +0800
-Subject: arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset
- setting
-
-From: Chen-Yu Tsai <wens@csie.org>
-
-[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ]
-
-The external Ethernet PHY has a reset pin that is connected to the SoC.
-It is missing from the original submission.
-
-Add it to complete the description.
-
-Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board")
-Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
-Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org
-Signed-off-by: Chen-Yu Tsai <wens@csie.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
-index 8bc0f2c72a247..c57ecc420aed4 100644
---- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
-+++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
-@@ -70,6 +70,9 @@ &mdio0 {
- 	ext_rgmii_phy: ethernet-phy@1 {
- 		compatible = "ethernet-phy-ieee802.3-c22";
- 		reg = <1>;
-+		reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
-+		reset-assert-us = <10000>;
-+		reset-deassert-us = <150000>;
- 	};
- };
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
deleted file mode 100644
index 2926d9fa02..0000000000
--- a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From ada242ed6c76fecfd00ed4dc0b6a4b997d0243eb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 02:10:57 +0800
-Subject: arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset
- setting
-
-From: Chen-Yu Tsai <wens@csie.org>
-
-[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ]
-
-The external Ethernet PHY has a reset pin that is connected to the SoC.
-It is missing from the original submission.
-
-Add it to complete the description.
-
-Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board")
-Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
-Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org
-Signed-off-by: Chen-Yu Tsai <wens@csie.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-index 142177c1f737f..9a2f29201d3ce 100644
---- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-@@ -80,6 +80,9 @@ &mdio0 {
- 	ext_rgmii_phy: ethernet-phy@1 {
- 		compatible = "ethernet-phy-ieee802.3-c22";
- 		reg = <1>;
-+		reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
-+		reset-assert-us = <10000>;
-+		reset-deassert-us = <150000>;
- 	};
- };
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch b/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
deleted file mode 100644
index 97a7af9101..0000000000
--- a/queue-6.16/arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 8ec63d7a907fa4f81d8ba7466ad2a5cf6ea0f55d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 13 Sep 2025 18:24:49 +0800
-Subject: arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal
-
-From: Chen-Yu Tsai <wens@csie.org>
-
-[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ]
-
-When the board was added, its external 32.768 KHz crystal was described
-but not hooked up correctly. This meant the device had to fall back to
-the SoC's internal oscillator or divide a 32 KHz clock from the main
-oscillator, neither of which are accurate for the RTC. As a result the
-RTC clock will drift badly.
-
-Hook the crystal up to the RTC block and request the correct clock rate.
-
-Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support")
-Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
-Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org
-Signed-off-by: Chen-Yu Tsai <wens@csie.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-index 9a2f29201d3ce..6a07281e11007 100644
---- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
-@@ -304,6 +304,14 @@ &r_pio {
- 	vcc-pm-supply = <&reg_aldo3>;
- };
- 
-+&rtc {
-+	clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
-+		 <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
-+	clock-names = "bus", "hosc", "ahb", "ext-osc32k";
-+	assigned-clocks = <&rtc CLK_OSC32K>;
-+	assigned-clock-rates = <32768>;
-+};
-+
- &uart0 {
- 	pinctrl-names = "default";
- 	pinctrl-0 = <&uart0_pb_pins>;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch b/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
deleted file mode 100644
index f30740e0e1..0000000000
--- a/queue-6.16/arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 73ce2d8475b06e998da3378f029d072c4ed49a3d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 23 Aug 2025 11:49:44 +0200
-Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
-
-From: Janne Grunau <j@jannau.net>
-
-[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
-
-PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
-and disabled. Linux' PCI subsystem assigns the ethernet nic from
-`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
-disabled port as iommu. The `pcie0_dart_1` instance is disabled and
-probably fused off (it is on the M2 Pro Mac mini which has a disabled
-PCIe port as well).
-Without iommu the ethernet nic is not expected work.
-Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
-subsystem's bus number.
-
-Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
-Reviewed-by: Neal Gompa <neal@gompa.dev>
-Reviewed-by: Sven Peter <sven@kernel.org>
-Signed-off-by: Janne Grunau <j@jannau.net>
-Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
-Signed-off-by: Sven Peter <sven@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
-index 152f95fd49a21..7089ccf3ce556 100644
---- a/arch/arm64/boot/dts/apple/t8103-j457.dts
-+++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
-@@ -21,6 +21,14 @@ aliases {
- 	};
- };
- 
-+/*
-+ * Adjust pcie0's iommu-map to account for the disabled port01.
-+ */
-+&pcie0 {
-+	iommu-map = <0x100 &pcie0_dart_0 1 1>,
-+			<0x200 &pcie0_dart_2 1 1>;
-+};
-+
- &bluetooth0 {
- 	brcm,board-type = "apple,santorini";
- };
-@@ -36,10 +44,10 @@ &wifi0 {
-  */
- 
- &port02 {
--	bus-range = <3 3>;
-+	bus-range = <2 2>;
- 	status = "okay";
- 	ethernet0: ethernet@0,0 {
--		reg = <0x30000 0x0 0x0 0x0 0x0>;
-+		reg = <0x20000 0x0 0x0 0x0 0x0>;
- 		/* To be filled by the loader */
- 		local-mac-address = [00 10 18 00 00 00];
- 	};
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch b/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
deleted file mode 100644
index 6464ac88de..0000000000
--- a/queue-6.16/arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 45e2b0f1d8c36150f7a80f25fd9f6054753be443 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Jul 2025 12:05:45 +0200
-Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator
-
-From: Annette Kobou <annette.kobou@kontron.de>
-
-[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]
-
-The regulator uses the wrong GPIO. Fix this.
-
-Signed-off-by: Annette Kobou <annette.kobou@kontron.de>
-Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
-Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
-Signed-off-by: Shawn Guo <shawnguo@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts    | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-index 89e97c604bd3e..9a9e5d0daf3ba 100644
---- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-@@ -33,7 +33,9 @@ pwm-beeper {
- 
- 	reg_vcc_panel: regulator-vcc-panel {
- 		compatible = "regulator-fixed";
--		gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
-+		pinctrl-names = "default";
-+		pinctrl-0 = <&pinctrl_reg_vcc_panel>;
-+		gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
- 		enable-active-high;
- 		regulator-max-microvolt = <3300000>;
- 		regulator-min-microvolt = <3300000>;
-@@ -161,3 +163,11 @@ &usdhc2 {
- 	vmmc-supply = <&reg_vdd_3v3>;
- 	status = "okay";
- };
-+
-+&iomuxc {
-+	pinctrl_reg_vcc_panel: regvccpanelgrp {
-+		fsl,pins = <
-+			MX93_PAD_GPIO_IO21__GPIO2_IO21		0x31e /* PWM_2 */
-+		>;
-+	};
-+};
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch b/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
deleted file mode 100644
index 9c4a769155..0000000000
--- a/queue-6.16/arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From e211c5924bc8b621566e228ea9ebab8e376cf139 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Jul 2025 12:05:46 +0200
-Subject: arm64: dts: imx93-kontron: Fix USB port assignment
-
-From: Frieder Schrempf <frieder.schrempf@kontron.de>
-
-[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]
-
-The assignment of the USB ports is wrong and needs to be swapped.
-The OTG (USB-C) port is on the first port and the host port with
-the onboard hub is on the second port.
-
-Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
-Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
-Signed-off-by: Shawn Guo <shawnguo@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../dts/freescale/imx93-kontron-bl-osm-s.dts  | 20 +++++++++----------
- 1 file changed, 10 insertions(+), 10 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
---- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
-@@ -137,6 +137,16 @@ &tpm6 {
- };
- 
- &usbotg1 {
-+	adp-disable;
-+	hnp-disable;
-+	srp-disable;
-+	disable-over-current;
-+	dr_mode = "otg";
-+	usb-role-switch;
-+	status = "okay";
-+};
-+
-+&usbotg2 {
- 	#address-cells = <1>;
- 	#size-cells = <0>;
- 	disable-over-current;
-@@ -149,16 +159,6 @@ usb1@1 {
- 	};
- };
- 
--&usbotg2 {
--	adp-disable;
--	hnp-disable;
--	srp-disable;
--	disable-over-current;
--	dr_mode = "otg";
--	usb-role-switch;
--	status = "okay";
--};
--
- &usdhc2 {
- 	vmmc-supply = <&reg_vdd_3v3>;
- 	status = "okay";
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch b/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
deleted file mode 100644
index 7b46e3c5e3..0000000000
--- a/queue-6.16/arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 9b163d2edac907b65ee89f39c0b25410692ba28d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 18 Aug 2025 09:25:31 +0800
-Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
-
-From: Joy Zou <joy.zou@nxp.com>
-
-[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]
-
-According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
-and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.
-
-Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
-Signed-off-by: Joy Zou <joy.zou@nxp.com>
-Signed-off-by: Peng Fan <peng.fan@nxp.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Signed-off-by: Shawn Guo <shawnguo@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
-index 5aecdd9b62ff6..29227e80facc1 100644
---- a/arch/arm64/boot/dts/freescale/imx95.dtsi
-+++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
-@@ -913,7 +913,7 @@ lpuart7: serial@42690000 {
- 				interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
- 				clocks = <&scmi_clk IMX95_CLK_LPUART7>;
- 				clock-names = "ipg";
--				dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
-+				dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
- 				dma-names = "rx", "tx";
- 				status = "disabled";
- 			};
-@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 {
- 				interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
- 				clocks = <&scmi_clk IMX95_CLK_LPUART8>;
- 				clock-names = "ipg";
--				dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
-+				dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
- 				dma-names = "rx", "tx";
- 				status = "disabled";
- 			};
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch b/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
deleted file mode 100644
index 0c661303d9..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 0d4fe1c0d62f0f84da2f8ccebeed59dfc7233f3a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 10:38:52 +0200
-Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node
- names
-
-From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-
-[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
-
-The node names for "pmic", "regulators", "rtc", and "keys" are
-dictated by the PMIC MFD binding: change those to adhere to it.
-
-Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
-Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Reviewed-by: Fei Shao <fshao@chromium.org>
-Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
-index d89858c73ab1b..243afbffa21fd 100644
---- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
-+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
-@@ -6,12 +6,12 @@
- #include <dt-bindings/input/input.h>
- 
- &pwrap {
--	pmic: mt6331 {
-+	pmic: pmic {
- 		compatible = "mediatek,mt6331";
- 		interrupt-controller;
- 		#interrupt-cells = <2>;
- 
--		mt6331regulator: mt6331regulator {
-+		mt6331regulator: regulators {
- 			compatible = "mediatek,mt6331-regulator";
- 
- 			mt6331_vdvfs11_reg: buck-vdvfs11 {
-@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
- 			};
- 
- 			mt6331_vdig18_reg: ldo-vdig18 {
--				regulator-name = "dvdd18_dig";
-+				regulator-name = "vdig18";
- 				regulator-min-microvolt = <1800000>;
- 				regulator-max-microvolt = <1800000>;
- 				regulator-ramp-delay = <0>;
-@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
- 			};
- 		};
- 
--		mt6331rtc: mt6331rtc {
-+		mt6331rtc: rtc {
- 			compatible = "mediatek,mt6331-rtc";
- 		};
- 
--		mt6331keys: mt6331keys {
-+		mt6331keys: keys {
- 			compatible = "mediatek,mt6331-keys";
- 			power {
- 				linux,keycodes = <KEY_POWER>;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch b/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
deleted file mode 100644
index 343029977d..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 9e10cc85ce75034ac61dfa2abc20de39e909ce61 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 10:38:56 +0200
-Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
-
-From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-
-[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
-
-Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
-actually used, the final value that gets written to the register
-field for DAT_LATCH_CK_SEL is just 0x4.
-
-This also fixes dtbs_check warnings.
-
-Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
-Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
-index 91de920c22457..03cc48321a3f4 100644
---- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
-+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
-@@ -212,7 +212,7 @@ proximity@48 {
- 
- &mmc0 {
- 	/* eMMC controller */
--	mediatek,latch-ck = <0x14>; /* hs400 */
-+	mediatek,latch-ck = <4>; /* hs400 */
- 	mediatek,hs200-cmd-int-delay = <1>;
- 	mediatek,hs400-cmd-int-delay = <1>;
- 	mediatek,hs400-ds-dly3 = <0x1a>;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch b/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
deleted file mode 100644
index 6f48f14286..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From db21125995c3fae8a0790a700688274fe2015e99 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 17:01:34 +0800
-Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
-
-From: Chen-Yu Tsai <wenst@chromium.org>
-
-[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]
-
-The touchscreen controller used with the original Krabby design is the
-Elan eKTH6918, which is in the same family as eKTH6915, but supporting
-a larger screen size with more sense lines.
-
-OTOH, the touchscreen controller that actually shipped on the Tentacruel
-devices is the Elan eKTH6A12NAY. A compatible string was added for it
-specifically because it has different power sequencing timings.
-
-Fix up the touchscreen nodes for both these. This also includes adding
-a previously missing reset line. Also add "no-reset-on-power-off" since
-the power is always on, and putting it in reset would consume more
-power.
-
-Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
-Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
-Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi   | 8 ++++----
- .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts  | 4 ++++
- 2 files changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
-index 7c971198fa956..72a2a2bff0a93 100644
---- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
-+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
-@@ -71,14 +71,14 @@ &i2c1 {
- 	i2c-scl-internal-delay-ns = <10000>;
- 
- 	touchscreen: touchscreen@10 {
--		compatible = "hid-over-i2c";
-+		compatible = "elan,ekth6915";
- 		reg = <0x10>;
- 		interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
- 		pinctrl-names = "default";
- 		pinctrl-0 = <&touchscreen_pins>;
--		post-power-on-delay-ms = <10>;
--		hid-descr-addr = <0x0001>;
--		vdd-supply = <&pp3300_s3>;
-+		reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
-+		vcc33-supply = <&pp3300_s3>;
-+		no-reset-on-power-off;
- 	};
- };
- 
-diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
-index 26d3451a5e47c..24d9ede63eaa2 100644
---- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
-+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
-@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
- 		CROS_STD_MAIN_KEYMAP
- 	>;
- };
-+
-+&touchscreen {
-+	compatible = "elan,ekth6a12nay";
-+};
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch b/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
deleted file mode 100644
index 8426d8205c..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 88245d7ba267411e7e5f44596c25eafdb902b76c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Jul 2025 17:59:59 +0800
-Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from
- pcie0
-
-From: Guoqing Jiang <guoqing.jiang@canonical.com>
-
-[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
-
-When test suspend resume with 6.8 based kernel, system can't resume
-and I got below error which can be also reproduced with 6.16 rc6+
-kernel.
-
-mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
-mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
-mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
-
-After investigation, looks pcie0 has the same problem as pcie1 as
-decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
-Remove suspend-breaking reset from pcie1").
-
-Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
-Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
-Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
-Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
-index dd065b1bf94a3..50cf014522082 100644
---- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
-+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
-@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 {
- 
- 			power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
- 
--			resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
--			reset-names = "mac";
--
- 			#interrupt-cells = <1>;
- 			interrupt-map-mask = <0 0 0 7>;
- 			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch b/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
deleted file mode 100644
index c9cffedf92..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 3e23a8c1a505430a587e8c65ce880771ba02b8ae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 10:39:13 +0200
-Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator
- nodes
-
-From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-
-[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]
-
-All of the MT6360 regulator nodes were wrong and would not probe
-because the regulator names are supposed to be lower case, but
-they are upper case in this devicetree.
-
-Change all nodes to be lower case to get working regulators.
-
-Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
-Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Reviewed-by: Fei Shao <fshao@chromium.org>
-Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts    | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
-index 4985b65925a9e..d16f545cbbb27 100644
---- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
-+++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
-@@ -352,7 +352,7 @@ regulator {
- 			LDO_VIN2-supply = <&vsys>;
- 			LDO_VIN3-supply = <&vsys>;
- 
--			mt6360_buck1: BUCK1 {
-+			mt6360_buck1: buck1 {
- 				regulator-name = "emi_vdd2";
- 				regulator-min-microvolt = <600000>;
- 				regulator-max-microvolt = <1800000>;
-@@ -362,7 +362,7 @@ MT6360_OPMODE_LP
- 				regulator-always-on;
- 			};
- 
--			mt6360_buck2: BUCK2 {
-+			mt6360_buck2: buck2 {
- 				regulator-name = "emi_vddq";
- 				regulator-min-microvolt = <300000>;
- 				regulator-max-microvolt = <1300000>;
-@@ -372,7 +372,7 @@ MT6360_OPMODE_LP
- 				regulator-always-on;
- 			};
- 
--			mt6360_ldo1: LDO1 {
-+			mt6360_ldo1: ldo1 {
- 				regulator-name = "mt6360_ldo1"; /* Test point */
- 				regulator-min-microvolt = <1200000>;
- 				regulator-max-microvolt = <3600000>;
-@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 {
- 							   MT6360_OPMODE_LP>;
- 			};
- 
--			mt6360_ldo2: LDO2 {
-+			mt6360_ldo2: ldo2 {
- 				regulator-name = "panel1_p1v8";
- 				regulator-min-microvolt = <1800000>;
- 				regulator-max-microvolt = <1800000>;
-@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 {
- 							   MT6360_OPMODE_LP>;
- 			};
- 
--			mt6360_ldo3: LDO3 {
-+			mt6360_ldo3: ldo3 {
- 				regulator-name = "vmc_pmu";
- 				regulator-min-microvolt = <1800000>;
- 				regulator-max-microvolt = <3300000>;
-@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 {
- 							   MT6360_OPMODE_LP>;
- 			};
- 
--			mt6360_ldo5: LDO5 {
-+			mt6360_ldo5: ldo5 {
- 				regulator-name = "vmch_pmu";
- 				regulator-min-microvolt = <3300000>;
- 				regulator-max-microvolt = <3300000>;
-@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 {
- 							   MT6360_OPMODE_LP>;
- 			};
- 
--			mt6360_ldo6: LDO6 {
-+			mt6360_ldo6: ldo6 {
- 				regulator-name = "mt6360_ldo6"; /* Test point */
- 				regulator-min-microvolt = <500000>;
- 				regulator-max-microvolt = <2100000>;
-@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 {
- 							   MT6360_OPMODE_LP>;
- 			};
- 
--			mt6360_ldo7: LDO7 {
-+			mt6360_ldo7: ldo7 {
- 				regulator-name = "emi_vmddr_en";
- 				regulator-min-microvolt = <1800000>;
- 				regulator-max-microvolt = <1800000>;
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch b/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
deleted file mode 100644
index a66ea6c0ed..0000000000
--- a/queue-6.16/arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From f77c47b71ab518444fca7af6af670e178592635c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 10:39:14 +0200
-Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
-
-From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-
-[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
-
-This devicetree contained only the SoC compatible but lacked the
-machine specific one: add a "mediatek,mt8516-pumpkin" compatible
-to the list to fix dtbs_check warnings.
-
-Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
-Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Reviewed-by: Fei Shao <fshao@chromium.org>
-Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
-index cce642c538128..3d3db33a64dc6 100644
---- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
-+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
-@@ -11,7 +11,7 @@
- 
- / {
- 	model = "Pumpkin MT8516";
--	compatible = "mediatek,mt8516";
-+	compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
- 
- 	memory@40000000 {
- 		device_type = "memory";
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch b/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
deleted file mode 100644
index b50ff847d0..0000000000
--- a/queue-6.16/arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 6df49391425ae1c653b69a8ac2c27a1f7f52d759 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 1 Aug 2025 13:19:53 +0100
-Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
-
-From: Biju Das <biju.das.jz@bp.renesas.com>
-
-[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
-
-On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
-are deleting a wrong and nonexistent node.  Fixing the wrong node would
-invoke a dtb warning message, as channel0 is a required property.
-Disable CAN-FD channel0 instead of deleting the node.
-
-Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
-Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
-index 345b779e4f601..f3d7eff0d2f2a 100644
---- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
-+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
-@@ -48,7 +48,10 @@ sound_card {
- #if (SW_SCIF_CAN || SW_RSPI_CAN)
- &canfd {
- 	pinctrl-0 = <&can1_pins>;
--	/delete-node/ channel@0;
-+
-+	channel0 {
-+		status = "disabled";
-+	};
- };
- #else
- &canfd {
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch b/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
deleted file mode 100644
index 9ebf69b9dd..0000000000
--- a/queue-6.16/arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From f2a628c26e02df0a853317a596dcacb55b501630 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Jul 2025 01:58:11 +0200
-Subject: arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on
- EVTB1
-
-From: Marek Vasut <marek.vasut+renesas@mailbox.org>
-
-[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ]
-
-Invert the polarity of microSD voltage selector on Retronix R-Car V4H
-Sparrow Hawk board. The voltage selector was not populated on prototype
-EVTA1 boards, and is implemented slightly different on EVTB1 boards. As
-the EVTA1 boards are from a limited run and generally not available,
-update the DT to make it compatible with EVTB1 microSD voltage selector.
-
-Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
-Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-index 6955eafd8d6ab..3155a201ecd1a 100644
---- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-@@ -178,7 +178,7 @@ vcc_sdhi: regulator-vcc-sdhi {
- 		regulator-max-microvolt = <3300000>;
- 		gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>;
- 		gpios-states = <1>;
--		states = <3300000 0>, <1800000 1>;
-+		states = <1800000 0>, <3300000 1>;
- 	};
- };
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch b/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
deleted file mode 100644
index cf24844852..0000000000
--- a/queue-6.16/arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From a2ce048af8aa4234cf005b232d9fc3dafe0d48b7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Aug 2025 21:28:04 +0200
-Subject: arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1
-
-From: Marek Vasut <marek.vasut+renesas@mailbox.org>
-
-[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ]
-
-The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply
-for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the
-change in IO voltage. Since the VDDQ18_25_AVB power rail is shared,
-all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to
-be configured the same way. As the EVTA1 boards are from a limited run
-and generally not available, update the DT to make it compatible with
-EVTB1 IO voltage settings.
-
-Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
-Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-index 3155a201ecd1a..05ddd1c62ccdf 100644
---- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
-@@ -529,6 +529,10 @@ pins-mii {
- 			drive-strength = <21>;
- 		};
- 
-+		pins-vddq18-25-avb {
-+			pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0";
-+			power-source = <1800>;
-+		};
- 	};
- 
- 	/* Page 28 / CANFD_IF */
--- 
-2.51.0
-
diff --git a/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch b/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
deleted file mode 100644
index 527fa74c22..0000000000
--- a/queue-6.16/arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From c409787664eaf2381435bd89691329bc7b7e7432 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 23 Aug 2025 22:01:11 +0530
-Subject: arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU
- R5F cores
-
-From: Beleswar Padhi <b-padhi@ti.com>
-
-[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ]
-
-The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi
-for its MCU domain, but it does not override the firmware-name property
-for its R5F cores. This causes the wrong firmware binaries to be
-referenced.
-
-Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the
-firmware-name property with correct names for J742s2.
-
-Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family")
-Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
-Reviewed-by: Udit Kumar <u-kumar1@ti.com>
-Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com
-Signed-off-by: Nishanth Menon <nm@ti.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++
- arch/arm64/boot/dts/ti/k3-j742s2.dtsi           |  1 +
- 2 files changed, 18 insertions(+)
- create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
-
-diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
-new file mode 100644
-index 0000000000000..61db2348d6a47
---- /dev/null
-+++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
-@@ -0,0 +1,17 @@
-+// SPDX-License-Identifier: GPL-2.0-only OR MIT
-+/*
-+ * Device Tree Source for J742S2 SoC Family
-+ *
-+ * TRM: https://www.ti.com/lit/pdf/spruje3
-+ *
-+ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/
-+ *
-+ */
-+
-+&mcu_r5fss0_core0 {
-+	firmware-name = "j742s2-mcu-r5f0_0-fw";
-+};
-+
-+&mcu_r5fss0_core1 {
-+	firmware-name = "j742s2-mcu-r5f0_1-fw";
-+};
-diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
-index 7a72f82f56d68..d265df1abade1 100644
---- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
-+++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
-@@ -96,3 +96,4 @@ cpu3: cpu@3 {
- };
- 
- #include "k3-j742s2-main.dtsi"
-+#include "k3-j742s2-mcu-wakeup.dtsi"
--- 
-2.51.0
-
diff --git a/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch b/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
deleted file mode 100644
index e78cf66657..0000000000
--- a/queue-6.16/asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From b6d08893f4f9341435e236f7894290c7604dfc8b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 19:18:19 +0200
-Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
-
-From: Takashi Iwai <tiwai@suse.de>
-
-[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
-
-When an invalid value is passed via quirk option, currently
-bytcht_es8316 driver just ignores and leaves as is, which may lead to
-unepxected results like OOB access.
-
-This patch adds the sanity check and corrects the input mapping to the
-certain default value if an invalid value is passed.
-
-Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Message-ID: <20250902171826.27329-2-tiwai@suse.de>
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
-index 62594e7966ab0..b384d38654e65 100644
---- a/sound/soc/intel/boards/bytcht_es8316.c
-+++ b/sound/soc/intel/boards/bytcht_es8316.c
-@@ -47,7 +47,8 @@ enum {
- 	BYT_CHT_ES8316_INTMIC_IN2_MAP,
- };
- 
--#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & GENMASK(3, 0))
-+#define BYT_CHT_ES8316_MAP_MASK			GENMASK(3, 0)
-+#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & BYT_CHT_ES8316_MAP_MASK)
- #define BYT_CHT_ES8316_SSP0			BIT(16)
- #define BYT_CHT_ES8316_MONO_SPEAKER		BIT(17)
- #define BYT_CHT_ES8316_JD_INVERTED		BIT(18)
-@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
- 
- static void log_quirks(struct device *dev)
- {
--	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
-+	int map;
-+
-+	map = BYT_CHT_ES8316_MAP(quirk);
-+	switch (map) {
-+	case BYT_CHT_ES8316_INTMIC_IN1_MAP:
- 		dev_info(dev, "quirk IN1_MAP enabled");
--	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
-+		break;
-+	case BYT_CHT_ES8316_INTMIC_IN2_MAP:
- 		dev_info(dev, "quirk IN2_MAP enabled");
-+		break;
-+	default:
-+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
-+		quirk &= ~BYT_CHT_ES8316_MAP_MASK;
-+		quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
-+		break;
-+	}
-+
- 	if (quirk & BYT_CHT_ES8316_SSP0)
- 		dev_info(dev, "quirk SSP0 enabled");
- 	if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
--- 
-2.51.0
-
diff --git a/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch b/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
deleted file mode 100644
index 6a891e908a..0000000000
--- a/queue-6.16/asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 8099c9b9dfde84bb6dd9f447e2ae9efd807666b2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 19:18:20 +0200
-Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
-
-From: Takashi Iwai <tiwai@suse.de>
-
-[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
-
-When an invalid value is passed via quirk option, currently
-bytcr_rt5640 driver only shows an error message but leaves as is.
-This may lead to unepxected results like OOB access.
-
-This patch corrects the input mapping to the certain default value if
-an invalid value is passed.
-
-Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Message-ID: <20250902171826.27329-3-tiwai@suse.de>
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
-index 0f3b8f44e7011..bc846558480e4 100644
---- a/sound/soc/intel/boards/bytcr_rt5640.c
-+++ b/sound/soc/intel/boards/bytcr_rt5640.c
-@@ -68,7 +68,8 @@ enum {
- 	BYT_RT5640_OVCD_SF_1P5		= (RT5640_OVCD_SF_1P5 << 13),
- };
- 
--#define BYT_RT5640_MAP(quirk)		((quirk) &  GENMASK(3, 0))
-+#define BYT_RT5640_MAP_MASK		GENMASK(3, 0)
-+#define BYT_RT5640_MAP(quirk)		((quirk) & BYT_RT5640_MAP_MASK)
- #define BYT_RT5640_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
- #define BYT_RT5640_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
- #define BYT_RT5640_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
-@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
- 		dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
- 		break;
- 	default:
--		dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
-+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
-+		byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
-+		byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
- 		break;
- 	}
- 	if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
--- 
-2.51.0
-
diff --git a/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch b/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
deleted file mode 100644
index 5c154cadc1..0000000000
--- a/queue-6.16/asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From bda62e0d060f8f3c97e00538742371d6216b03a3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 19:18:21 +0200
-Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
-
-From: Takashi Iwai <tiwai@suse.de>
-
-[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
-
-When an invalid value is passed via quirk option, currently
-bytcr_rt5640 driver just ignores and leaves as is, which may lead to
-unepxected results like OOB access.
-
-This patch adds the sanity check and corrects the input mapping to the
-certain default value if an invalid value is passed.
-
-Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Message-ID: <20250902171826.27329-4-tiwai@suse.de>
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
- 1 file changed, 21 insertions(+), 5 deletions(-)
-
-diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
-index 67c62844ca2a9..604a35d380e9a 100644
---- a/sound/soc/intel/boards/bytcr_rt5651.c
-+++ b/sound/soc/intel/boards/bytcr_rt5651.c
-@@ -58,7 +58,8 @@ enum {
- 	BYT_RT5651_OVCD_SF_1P5	= (RT5651_OVCD_SF_1P5 << 13),
- };
- 
--#define BYT_RT5651_MAP(quirk)		((quirk) & GENMASK(3, 0))
-+#define BYT_RT5651_MAP_MASK		GENMASK(3, 0)
-+#define BYT_RT5651_MAP(quirk)		((quirk) & BYT_RT5651_MAP_MASK)
- #define BYT_RT5651_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
- #define BYT_RT5651_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
- #define BYT_RT5651_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
-@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
- 
- static void log_quirks(struct device *dev)
- {
--	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
-+	int map;
-+
-+	map = BYT_RT5651_MAP(byt_rt5651_quirk);
-+	switch (map) {
-+	case BYT_RT5651_DMIC_MAP:
- 		dev_info(dev, "quirk DMIC_MAP enabled");
--	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
-+		break;
-+	case BYT_RT5651_IN1_MAP:
- 		dev_info(dev, "quirk IN1_MAP enabled");
--	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
-+		break;
-+	case BYT_RT5651_IN2_MAP:
- 		dev_info(dev, "quirk IN2_MAP enabled");
--	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
-+		break;
-+	case BYT_RT5651_IN1_IN2_MAP:
- 		dev_info(dev, "quirk IN1_IN2_MAP enabled");
-+		break;
-+	default:
-+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
-+		byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
-+		byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
-+		break;
-+	}
-+
- 	if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
- 		dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
- 			 BYT_RT5651_JDSRC(byt_rt5651_quirk));
--- 
-2.51.0
-
diff --git a/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch b/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
deleted file mode 100644
index 69463a989a..0000000000
--- a/queue-6.16/asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From c7d12eaf58b306956e0c6a5104c93560f5fba63c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 10:48:53 +0800
-Subject: ASoC: Intel: hda-sdw-bpt: set persistent_buffer false
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Bard Liao <yung-chuan.liao@linux.intel.com>
-
-[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ]
-
-The persistent_buffer agreement is false when hda_cl_prepare() is
-called. We should use the same value when hda_cl_cleanup() is called.
-
-Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA")
-Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
-Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
-Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
-Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/sof/intel/hda-sdw-bpt.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c
-index 1327f1cad0bcd..ff5abccf0d88b 100644
---- a/sound/soc/sof/intel/hda-sdw-bpt.c
-+++ b/sound/soc/sof/intel/hda-sdw-bpt.c
-@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream
- 	u32 mask;
- 	int ret;
- 
--	ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream);
-+	ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream);
- 	if (ret < 0) {
- 		dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n",
- 			__func__);
--- 
-2.51.0
-
diff --git a/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch b/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
deleted file mode 100644
index 4ce0551403..0000000000
--- a/queue-6.16/asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From a94ee84af9a9fe6549598105f70fc2025a1870a7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 15:02:35 +0100
-Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
-
-From: Richard Fitzgerald <rf@opensource.cirrus.com>
-
-[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]
-
-In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
-is not NULL before calling it.
-
-The original code assumed that if include_sidecar is true, the codec
-on that link has an add_sidecar callback. But there could be other
-codecs on the same link that do not have an add_sidecar callback.
-
-Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
-Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
-Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/intel/boards/sof_sdw.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
-index c576ec5527f91..aed05b19ef5ae 100644
---- a/sound/soc/intel/boards/sof_sdw.c
-+++ b/sound/soc/intel/boards/sof_sdw.c
-@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
- 			(*codec_conf)++;
- 		}
- 
--		if (sof_end->include_sidecar) {
-+		if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
- 			ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
- 			if (ret)
- 				return ret;
--- 
-2.51.0
-
diff --git a/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch b/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
deleted file mode 100644
index 725a7964c3..0000000000
--- a/queue-6.16/blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 92f87fb1c59c5e9add3f6cd4f8e8a603371f0817 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 16:48:54 +0800
-Subject: blk-mq: check kobject state_in_sysfs before deleting in
- blk_mq_unregister_hctx
-
-From: Li Nan <linan122@huawei.com>
-
-[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
-
-In __blk_mq_update_nr_hw_queues() the return value of
-blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
-fails, later changing the number of hw_queues or removing disk will
-trigger the following warning:
-
-  kernfs: can not remove 'nr_tags', no directory
-  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
-  Call Trace:
-   remove_files.isra.1+0x38/0xb0
-   sysfs_remove_group+0x4d/0x100
-   sysfs_remove_groups+0x31/0x60
-   __kobject_del+0x23/0xf0
-   kobject_del+0x17/0x40
-   blk_mq_unregister_hctx+0x5d/0x80
-   blk_mq_sysfs_unregister_hctxs+0x94/0xd0
-   blk_mq_update_nr_hw_queues+0x124/0x760
-   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
-   nullb_device_submit_queues_store+0x92/0x120 [null_blk]
-
-kobjct_del() was called unconditionally even if sysfs creation failed.
-Fix it by checkig the kobject creation statusbefore deleting it.
-
-Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
-Signed-off-by: Li Nan <linan122@huawei.com>
-Reviewed-by: Yu Kuai <yukuai3@huawei.com>
-Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-mq-sysfs.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
-index 24656980f4431..5c399ac562eae 100644
---- a/block/blk-mq-sysfs.c
-+++ b/block/blk-mq-sysfs.c
-@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
- 		return;
- 
- 	hctx_for_each_ctx(hctx, ctx, i)
--		kobject_del(&ctx->kobj);
-+		if (ctx->kobj.state_in_sysfs)
-+			kobject_del(&ctx->kobj);
- 
--	kobject_del(&hctx->kobj);
-+	if (hctx->kobj.state_in_sysfs)
-+		kobject_del(&hctx->kobj);
- }
- 
- static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
--- 
-2.51.0
-
diff --git a/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch b/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch
deleted file mode 100644
index b2a0a4f750..0000000000
--- a/queue-6.16/blk-throttle-fix-access-race-during-throttle-policy-.patch
+++ /dev/null
@@ -1,171 +0,0 @@
-From b2d6bf4581c666580a27b909f7728d46606fb3da Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 18:24:11 +0800
-Subject: blk-throttle: fix access race during throttle policy activation
-
-From: Han Guangjiang <hanguangjiang@lixiang.com>
-
-[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ]
-
-On repeated cold boots we occasionally hit a NULL pointer crash in
-blk_should_throtl() when throttling is consulted before the throttle
-policy is fully enabled for the queue. Checking only q->td != NULL is
-insufficient during early initialization, so blkg_to_pd() for the
-throttle policy can still return NULL and blkg_to_tg() becomes NULL,
-which later gets dereferenced.
-
- Unable to handle kernel NULL pointer dereference
- at virtual address 0000000000000156
- ...
- pc : submit_bio_noacct+0x14c/0x4c8
- lr : submit_bio_noacct+0x48/0x4c8
- sp : ffff800087f0b690
- x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0
- x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70
- x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
- x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff
- x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff
- x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c
- x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60
- x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002
- x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500
- x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a
- Call trace:
-  submit_bio_noacct+0x14c/0x4c8
-  verity_map+0x178/0x2c8
-  __map_bio+0x228/0x250
-  dm_submit_bio+0x1c4/0x678
-  __submit_bio+0x170/0x230
-  submit_bio_noacct_nocheck+0x16c/0x388
-  submit_bio_noacct+0x16c/0x4c8
-  submit_bio+0xb4/0x210
-  f2fs_submit_read_bio+0x4c/0xf0
-  f2fs_mpage_readpages+0x3b0/0x5f0
-  f2fs_readahead+0x90/0xe8
-
-Tighten blk_throtl_activated() to also require that the throttle policy
-bit is set on the queue:
-
-  return q->td != NULL &&
-         test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
-
-This prevents blk_should_throtl() from accessing throttle group state
-until policy data has been attached to blkgs.
-
-Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration")
-Co-developed-by: Liang Jie <liangjie@lixiang.com>
-Signed-off-by: Liang Jie <liangjie@lixiang.com>
-Signed-off-by: Han Guangjiang <hanguangjiang@lixiang.com>
-Reviewed-by: Yu Kuai <yukuai3@huawei.com>
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-cgroup.c   |  6 ------
- block/blk-cgroup.h   |  6 ++++++
- block/blk-throttle.c |  6 +-----
- block/blk-throttle.h | 18 +++++++++++-------
- 4 files changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index 5936db7f8475b..754fdfcdfb4ff 100644
---- a/block/blk-cgroup.c
-+++ b/block/blk-cgroup.c
-@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void)
- 	return task_css(current, io_cgrp_id);
- }
- 
--static bool blkcg_policy_enabled(struct request_queue *q,
--				 const struct blkcg_policy *pol)
--{
--	return pol && test_bit(pol->plid, q->blkcg_pols);
--}
--
- static void blkg_free_workfn(struct work_struct *work)
- {
- 	struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
-diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
-index 81868ad86330c..83367086cb6ae 100644
---- a/block/blk-cgroup.h
-+++ b/block/blk-cgroup.h
-@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
- 		bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
- }
- 
-+static inline bool blkcg_policy_enabled(struct request_queue *q,
-+				const struct blkcg_policy *pol)
-+{
-+	return pol && test_bit(pol->plid, q->blkcg_pols);
-+}
-+
- void blk_cgroup_bio_start(struct bio *bio);
- void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta);
- #else	/* CONFIG_BLK_CGROUP */
-diff --git a/block/blk-throttle.c b/block/blk-throttle.c
-index 397b6a410f9e5..cfa1cd60d2c5f 100644
---- a/block/blk-throttle.c
-+++ b/block/blk-throttle.c
-@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk)
- 	INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
- 	throtl_service_queue_init(&td->service_queue);
- 
--	/*
--	 * Freeze queue before activating policy, to synchronize with IO path,
--	 * which is protected by 'q_usage_counter'.
--	 */
- 	memflags = blk_mq_freeze_queue(disk->queue);
- 	blk_mq_quiesce_queue(disk->queue);
- 
- 	q->td = td;
- 	td->queue = q;
- 
--	/* activate policy */
-+	/* activate policy, blk_throtl_activated() will return true */
- 	ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
- 	if (ret) {
- 		q->td = NULL;
-diff --git a/block/blk-throttle.h b/block/blk-throttle.h
-index 3b27755bfbff1..9d7a42c039a15 100644
---- a/block/blk-throttle.h
-+++ b/block/blk-throttle.h
-@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk);
- 
- static inline bool blk_throtl_activated(struct request_queue *q)
- {
--	return q->td != NULL;
-+	/*
-+	 * q->td guarantees that the blk-throttle module is already loaded,
-+	 * and the plid of blk-throttle is assigned.
-+	 * blkcg_policy_enabled() guarantees that the policy is activated
-+	 * in the request_queue.
-+	 */
-+	return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl);
- }
- 
- static inline bool blk_should_throtl(struct bio *bio)
-@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio)
- 	struct throtl_grp *tg;
- 	int rw = bio_data_dir(bio);
- 
--	/*
--	 * This is called under bio_queue_enter(), and it's synchronized with
--	 * the activation of blk-throtl, which is protected by
--	 * blk_mq_freeze_queue().
--	 */
- 	if (!blk_throtl_activated(bio->bi_bdev->bd_queue))
- 		return false;
- 
-@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio)
- 
- static inline bool blk_throtl_bio(struct bio *bio)
- {
--
-+	/*
-+	 * block throttling takes effect if the policy is activated
-+	 * in the bio's request_queue.
-+	 */
- 	if (!blk_should_throtl(bio))
- 		return false;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch b/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
deleted file mode 100644
index 961dfde26e..0000000000
--- a/queue-6.16/blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From decb72d096d07d2d390b9dddc8e4af34b0cefc5d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 15:55:39 +0800
-Subject: blk-throttle: fix throtl_data leak during disk release
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ]
-
-Tightening the throttle activation check in blk_throtl_activated() to
-require both q->td presence and policy bit set introduced a memory leak
-during disk release:
-
-blkg_destroy_all() clears the policy bit first during queue deactivation,
-causing subsequent blk_throtl_exit() to skip throtl_data cleanup when
-blk_throtl_activated() fails policy check.
-
-Idealy we should avoid modifying blk_throtl_exit() activation check because
-it's intuitive that blk-throtl start from blk_throtl_init() and end in
-blk_throtl_exit(). However, call blk_throtl_exit() before
-blkg_destroy_all() will make a long term deadlock problem easier to
-trigger[1], hence fix this problem by checking if q->td is NULL from
-blk_throtl_exit(), and remove policy deactivation as well since it's
-useless.
-
-[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t
-
-Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation")
-Reported-by: Yi Zhang <yi.zhang@redhat.com>
-Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-throttle.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/block/blk-throttle.c b/block/blk-throttle.c
-index cfa1cd60d2c5f..95bf175c2a135 100644
---- a/block/blk-throttle.c
-+++ b/block/blk-throttle.c
-@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk)
- {
- 	struct request_queue *q = disk->queue;
- 
--	if (!blk_throtl_activated(q))
-+	/*
-+	 * blkg_destroy_all() already deactivate throtl policy, just check and
-+	 * free throtl data.
-+	 */
-+	if (!q->td)
- 		return;
- 
- 	timer_delete_sync(&q->td->service_queue.pending_timer);
- 	throtl_shutdown_wq(q);
--	blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
- 	kfree(q->td);
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch b/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch
deleted file mode 100644
index 2354b4f128..0000000000
--- a/queue-6.16/block-use-int-to-store-blk_stack_limits-return-value.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 4e2f1a446647c50905372bc444c10d038a8f42e0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 21:09:30 +0800
-Subject: block: use int to store blk_stack_limits() return value
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
-
-Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
-as it needs to store negative value -1.
-
-Storing the negative error codes in unsigned type, or performing equality
-comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
-can be confusing.  Additionally, assigning negative error codes to unsigned
-type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
-
-No effect on runtime.
-
-Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Reviewed-by: John Garry <john.g.garry@oracle.com>
-Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
-Reviewed-by: Bart Van Assche <bvanassche@acm.org>
-Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-settings.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/block/blk-settings.c b/block/blk-settings.c
-index 44dabc636a592..12648d7d37177 100644
---- a/block/blk-settings.c
-+++ b/block/blk-settings.c
-@@ -697,7 +697,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
- int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
- 		     sector_t start)
- {
--	unsigned int top, bottom, alignment, ret = 0;
-+	unsigned int top, bottom, alignment;
-+	int ret = 0;
- 
- 	t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch b/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch
deleted file mode 100644
index 5cf483c97f..0000000000
--- a/queue-6.16/bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From d3925c8fe8b3f1340871bbf4b4fa30f9a148c457 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 12:30:05 -0400
-Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
- advertisements
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
-
-When creating an advertisement for BIG the address shall not be
-non-resolvable since in case of acting as BASS/Broadcast Assistant the
-address must be the same as the connection in order to use the PAST
-method and even when PAST/BASS are not in the picture a Periodic
-Advertisement can still be synchronized thus the same argument as to
-connectable advertisements still stand.
-
-Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bluetooth/hci_sync.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
-index 7ca544d7791f4..775a1bbdd0b15 100644
---- a/net/bluetooth/hci_sync.c
-+++ b/net/bluetooth/hci_sync.c
-@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
- {
- 	struct hci_cp_le_set_ext_adv_params cp;
- 	struct hci_rp_le_set_ext_adv_params rp;
--	bool connectable;
-+	bool connectable, require_privacy;
- 	u32 flags;
- 	bdaddr_t random_addr;
- 	u8 own_addr_type;
-@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
- 		return -EPERM;
- 
- 	/* Set require_privacy to true only when non-connectable
--	 * advertising is used. In that case it is fine to use a
--	 * non-resolvable private address.
-+	 * advertising is used and it is not periodic.
-+	 * In that case it is fine to use a non-resolvable private address.
- 	 */
--	err = hci_get_random_address(hdev, !connectable,
-+	require_privacy = !connectable && !(adv && adv->periodic);
-+
-+	err = hci_get_random_address(hdev, require_privacy,
- 				     adv_use_rpa(hdev, flags), adv,
- 				     &own_addr_type, &random_addr);
- 	if (err < 0)
--- 
-2.51.0
-
diff --git a/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch b/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
deleted file mode 100644
index 52e93c0e78..0000000000
--- a/queue-6.16/bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 944b744cf71891ba10b30a82e7b789b753759b43 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 21:11:22 +0300
-Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
-
-From: Pauli Virtanen <pav@iki.fi>
-
-[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
-
-For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
-skb is leaked.
-
-Free skb after copying its data.
-
-Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
-Signed-off-by: Pauli Virtanen <pav@iki.fi>
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bluetooth/iso.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
-index 72060c087d1b8..d675ad9ad1581 100644
---- a/net/bluetooth/iso.c
-+++ b/net/bluetooth/iso.c
-@@ -2390,7 +2390,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
- 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
- 					  skb->len);
- 		conn->rx_len -= skb->len;
--		return;
-+		break;
- 
- 	case ISO_END:
- 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
--- 
-2.51.0
-
diff --git a/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch b/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
deleted file mode 100644
index 2a5849978b..0000000000
--- a/queue-6.16/bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 98fc8e02dc5edb3fcf38f26e51e06f02776966ac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 16:27:51 -0400
-Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
-
-This attempt to fix similar issue to sco_conn_free where if the
-conn->sk is not set to NULL may lead to UAF on iso_conn_free.
-
-Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bluetooth/iso.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
-index c21566e1494a9..361d89c0ff533 100644
---- a/net/bluetooth/iso.c
-+++ b/net/bluetooth/iso.c
-@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk)
- 
- 	BT_DBG("sk %p state %d", sk, sk->sk_state);
- 
-+	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
-+	if (iso_pi(sk)->conn) {
-+		iso_conn_lock(iso_pi(sk)->conn);
-+		iso_pi(sk)->conn->sk = NULL;
-+		iso_conn_unlock(iso_pi(sk)->conn);
-+	}
-+
- 	/* Kill poor orphan */
- 	bt_sock_unlink(&iso_sk_list, sk);
- 	sock_set_flag(sk, SOCK_DEAD);
--- 
-2.51.0
-
diff --git a/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch b/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch
deleted file mode 100644
index 8131ae2696..0000000000
--- a/queue-6.16/bluetooth-iso-free-rx_skb-if-not-consumed.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 6b76560cb85d0d1803917c9c7c3549ace2c99903 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 21:11:21 +0300
-Subject: Bluetooth: ISO: free rx_skb if not consumed
-
-From: Pauli Virtanen <pav@iki.fi>
-
-[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]
-
-If iso_conn is freed when RX is incomplete, free any leftover skb piece.
-
-Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
-Signed-off-by: Pauli Virtanen <pav@iki.fi>
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bluetooth/iso.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
-index 361d89c0ff533..72060c087d1b8 100644
---- a/net/bluetooth/iso.c
-+++ b/net/bluetooth/iso.c
-@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
- 	/* Ensure no more work items will run since hci_conn has been dropped */
- 	disable_delayed_work_sync(&conn->timeout_work);
- 
-+	kfree_skb(conn->rx_skb);
-+
- 	kfree(conn);
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch b/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
deleted file mode 100644
index 81ab791798..0000000000
--- a/queue-6.16/bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From b6c4dc492af39f83a7938361d30ddbc56a5d112c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 08:50:12 -0400
-Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
- MGMT_OP_READ_EXP_FEATURES_INFO
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
-
-The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
-was not called with a specific index which breaks the likes of
-bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
-adapter is plugged, so instead of depending hdev not to be set just
-enable the UUID on any index like it was done with iso_sock_uuid.
-
-Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/bluetooth/mgmt.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
-index 225140fcb3d6c..a3d16eece0d23 100644
---- a/net/bluetooth/mgmt.c
-+++ b/net/bluetooth/mgmt.c
-@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
- 		return -ENOMEM;
- 
- #ifdef CONFIG_BT_FEATURE_DEBUG
--	if (!hdev) {
--		flags = bt_dbg_get() ? BIT(0) : 0;
-+	flags = bt_dbg_get() ? BIT(0) : 0;
- 
--		memcpy(rp->features[idx].uuid, debug_uuid, 16);
--		rp->features[idx].flags = cpu_to_le32(flags);
--		idx++;
--	}
-+	memcpy(rp->features[idx].uuid, debug_uuid, 16);
-+	rp->features[idx].flags = cpu_to_le32(flags);
-+	idx++;
- #endif
- 
- 	if (hdev && hci_dev_le_state_simultaneous(hdev)) {
--- 
-2.51.0
-
diff --git a/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch b/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
deleted file mode 100644
index f32a098367..0000000000
--- a/queue-6.16/bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From a31a6286cf75b7409e4af3b739c0023617d32042 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 02:33:03 +0000
-Subject: bonding: fix xfrm offload feature setup on active-backup mode
-
-From: Hangbin Liu <liuhangbin@gmail.com>
-
-[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
-
-The active-backup bonding mode supports XFRM ESP offload. However, when
-a bond is added using command like `ip link add bond0 type bond mode 1
-miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is
-disabled. This occurs because, in bond_newlink(), we change bond link
-first and register bond device later. So the XFRM feature update in
-bond_option_mode_set() is not called as the bond device is not yet
-registered, leading to the offload feature not being set successfully.
-
-To resolve this issue, we can modify the code order in bond_newlink() to
-ensure that the bond device is registered first before changing the bond
-link parameters. This change will allow the XFRM ESP offload feature to be
-correctly enabled.
-
-Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time")
-Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
-Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/bonding/bond_main.c    |  2 +-
- drivers/net/bonding/bond_netlink.c | 16 +++++++++-------
- include/net/bonding.h              |  1 +
- 3 files changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index e23195dd74776..0f87aefcec297 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -4394,7 +4394,7 @@ void bond_work_init_all(struct bonding *bond)
- 	INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
- }
- 
--static void bond_work_cancel_all(struct bonding *bond)
-+void bond_work_cancel_all(struct bonding *bond)
- {
- 	cancel_delayed_work_sync(&bond->mii_work);
- 	cancel_delayed_work_sync(&bond->arp_work);
-diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
-index ac5e402c34bc6..5024bd58c4fdd 100644
---- a/drivers/net/bonding/bond_netlink.c
-+++ b/drivers/net/bonding/bond_netlink.c
-@@ -568,20 +568,22 @@ static int bond_newlink(struct net_device *bond_dev,
- 			struct rtnl_newlink_params *params,
- 			struct netlink_ext_ack *extack)
- {
-+	struct bonding *bond = netdev_priv(bond_dev);
- 	struct nlattr **data = params->data;
- 	struct nlattr **tb = params->tb;
- 	int err;
- 
--	err = bond_changelink(bond_dev, tb, data, extack);
--	if (err < 0)
-+	err = register_netdevice(bond_dev);
-+	if (err)
- 		return err;
- 
--	err = register_netdevice(bond_dev);
--	if (!err) {
--		struct bonding *bond = netdev_priv(bond_dev);
-+	netif_carrier_off(bond_dev);
-+	bond_work_init_all(bond);
- 
--		netif_carrier_off(bond_dev);
--		bond_work_init_all(bond);
-+	err = bond_changelink(bond_dev, tb, data, extack);
-+	if (err) {
-+		bond_work_cancel_all(bond);
-+		unregister_netdevice(bond_dev);
- 	}
- 
- 	return err;
-diff --git a/include/net/bonding.h b/include/net/bonding.h
-index 95f67b308c19a..e9b7b283b1953 100644
---- a/include/net/bonding.h
-+++ b/include/net/bonding.h
-@@ -708,6 +708,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
- int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
- void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
- void bond_work_init_all(struct bonding *bond);
-+void bond_work_cancel_all(struct bonding *bond);
- 
- #ifdef CONFIG_PROC_FS
- void bond_create_proc_entry(struct bonding *bond);
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch b/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
deleted file mode 100644
index 1fceeaed17..0000000000
--- a/queue-6.16/bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From aab4dfc575e7a3130d0c29d1fcbb7197b81136bf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 23:26:53 +0000
-Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
-
-From: Hengqi Chen <hengqi.chen@gmail.com>
-
-[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]
-
-The current implementation seems incorrect and does NOT match the
-comment above, use bpf_jit_binary_pack_finalize() instead.
-
-Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
-Acked-by: Puranjay Mohan <puranjay@kernel.org>
-Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
-Acked-by: Song Liu <song@kernel.org>
-Acked-by: Puranjay Mohan <puranjay@kernel.org>
-Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/net/bpf_jit_comp.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
-index 58f838b310bc5..2e01a7fdb3fa9 100644
---- a/arch/arm64/net/bpf_jit_comp.c
-+++ b/arch/arm64/net/bpf_jit_comp.c
-@@ -2936,8 +2936,7 @@ void bpf_jit_free(struct bpf_prog *prog)
- 		 * before freeing it.
- 		 */
- 		if (jit_data) {
--			bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
--					   sizeof(jit_data->header->size));
-+			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
- 			kfree(jit_data);
- 		}
- 		hdr = bpf_jit_binary_pack_hdr(prog);
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch b/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch
deleted file mode 100644
index c5d87558b4..0000000000
--- a/queue-6.16/bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From c198a269c6821e71c40d17fb57db14eb25e2decc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Sep 2025 19:12:00 +0200
-Subject: bpf: Enforce expected_attach_type for tailcall compatibility
-
-From: Daniel Borkmann <daniel@iogearbox.net>
-
-[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
-
-Yinhao et al. recently reported:
-
-  Our fuzzer tool discovered an uninitialized pointer issue in the
-  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
-  This leads to a NULL pointer dereference when a BPF program attempts to
-  deference the txq member of struct xdp_buff object.
-
-The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
-entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
-neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
-of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
-to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
-egress_ifindex, and the latter is only allowed to be accessed under mentioned
-expected_attach_type. progB is then inserted into the tailcall which progA
-calls.
-
-The underlying issue goes beyond XDP though. Another example are programs
-of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
-as sock_addr_func_proto() have different logic depending on the programs'
-expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
-should not be allowed doing a tailcall into a program which calls bpf_bind()
-out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
-
-In short, specifying expected_attach_type allows to open up additional
-functionality or restrictions beyond what the basic bpf_prog_type enables.
-The use of tailcalls must not violate these constraints. Fix it by enforcing
-expected_attach_type in __bpf_prog_map_compatible().
-
-Note that we only enforce this for tailcall maps, but not for BPF devmaps or
-cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
-cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
-these situations are not prone to this issue.
-
-Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
-Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
-Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
-Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/bpf.h | 1 +
- kernel/bpf/core.c   | 5 +++++
- 2 files changed, 6 insertions(+)
-
-diff --git a/include/linux/bpf.h b/include/linux/bpf.h
-index bcae876a2a603..e8f4a6efb053d 100644
---- a/include/linux/bpf.h
-+++ b/include/linux/bpf.h
-@@ -285,6 +285,7 @@ struct bpf_map_owner {
- 	bool xdp_has_frags;
- 	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
- 	const struct btf_type *attach_func_proto;
-+	enum bpf_attach_type expected_attach_type;
- };
- 
- struct bpf_map {
-diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
-index 17e5cf18da1ef..b9015a8322174 100644
---- a/kernel/bpf/core.c
-+++ b/kernel/bpf/core.c
-@@ -2381,6 +2381,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
- 		map->owner->type  = prog_type;
- 		map->owner->jited = fp->jited;
- 		map->owner->xdp_has_frags = aux->xdp_has_frags;
-+		map->owner->expected_attach_type = fp->expected_attach_type;
- 		map->owner->attach_func_proto = aux->attach_func_proto;
- 		for_each_cgroup_storage_type(i) {
- 			map->owner->storage_cookie[i] =
-@@ -2392,6 +2393,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
- 		ret = map->owner->type  == prog_type &&
- 		      map->owner->jited == fp->jited &&
- 		      map->owner->xdp_has_frags == aux->xdp_has_frags;
-+		if (ret &&
-+		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
-+		    map->owner->expected_attach_type != fp->expected_attach_type)
-+			ret = false;
- 		for_each_cgroup_storage_type(i) {
- 			if (!ret)
- 				break;
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch b/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
deleted file mode 100644
index a997015a27..0000000000
--- a/queue-6.16/bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 3280f8d03541448ad679b64418ad3513c67e74df Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 10:08:00 +0200
-Subject: bpf: Explicitly check accesses to bpf_sock_addr
-
-From: Paul Chaignon <paul.chaignon@gmail.com>
-
-[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
-
-Syzkaller found a kernel warning on the following sock_addr program:
-
-    0: r0 = 0
-    1: r2 = *(u32 *)(r1 +60)
-    2: exit
-
-which triggers:
-
-    verifier bug: error during ctx access conversion (0)
-
-This is happening because offset 60 in bpf_sock_addr corresponds to an
-implicit padding of 4 bytes, right after msg_src_ip4. Access to this
-padding isn't rejected in sock_addr_is_valid_access and it thus later
-fails to convert the access.
-
-This patch fixes it by explicitly checking the various fields of
-bpf_sock_addr in sock_addr_is_valid_access.
-
-I checked the other ctx structures and is_valid_access functions and
-didn't find any other similar cases. Other cases of (properly handled)
-padding are covered in new tests in a subsequent patch.
-
-Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
-Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
-Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Acked-by: Eduard Zingerman <eddyz87@gmail.com>
-Acked-by: Daniel Borkmann <daniel@iogearbox.net>
-Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
-Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/filter.c | 16 ++++++++++------
- 1 file changed, 10 insertions(+), 6 deletions(-)
-
-diff --git a/net/core/filter.c b/net/core/filter.c
-index 2c3196dadd54a..11533ce08c6b3 100644
---- a/net/core/filter.c
-+++ b/net/core/filter.c
-@@ -9275,13 +9275,17 @@ static bool sock_addr_is_valid_access(int off, int size,
- 			return false;
- 		info->reg_type = PTR_TO_SOCKET;
- 		break;
--	default:
--		if (type == BPF_READ) {
--			if (size != size_default)
--				return false;
--		} else {
-+	case bpf_ctx_range(struct bpf_sock_addr, user_family):
-+	case bpf_ctx_range(struct bpf_sock_addr, family):
-+	case bpf_ctx_range(struct bpf_sock_addr, type):
-+	case bpf_ctx_range(struct bpf_sock_addr, protocol):
-+		if (type != BPF_READ)
- 			return false;
--		}
-+		if (size != size_default)
-+			return false;
-+		break;
-+	default:
-+		return false;
- 	}
- 
- 	return true;
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch b/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch
deleted file mode 100644
index 96760d798c..0000000000
--- a/queue-6.16/bpf-mark-kfuncs-as-__noclone.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 24ce4afc7cadceddbe59eab541996a3c39d23057 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 10:14:26 +0200
-Subject: bpf: Mark kfuncs as __noclone
-
-From: Andrea Righi <arighi@nvidia.com>
-
-[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]
-
-Some distributions (e.g., CachyOS) support building the kernel with -O3,
-but doing so may break kfuncs, resulting in their symbols not being
-properly exported.
-
-In fact, with gcc -O3, some kfuncs may be optimized away despite being
-annotated as noinline. This happens because gcc can still clone the
-function during IPA optimizations, e.g., by duplicating or inlining it
-into callers, and then dropping the standalone symbol. This breaks BTF
-ID resolution since resolve_btfids relies on the presence of a global
-symbol for each kfunc.
-
-Currently, this is not an issue for upstream, because we don't allow
-building the kernel with -O3, but it may be safer to address it anyway,
-to prevent potential issues in the future if compilers become more
-aggressive with optimizations.
-
-Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
-cloned and remain distinct, globally visible symbols, regardless of
-the optimization level.
-
-Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
-Acked-by: David Vernet <void@manifault.com>
-Acked-by: Yonghong Song <yonghong.song@linux.dev>
-Signed-off-by: Andrea Righi <arighi@nvidia.com>
-Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/btf.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/linux/btf.h b/include/linux/btf.h
-index b2983706292f7..de2bf13e71905 100644
---- a/include/linux/btf.h
-+++ b/include/linux/btf.h
-@@ -86,7 +86,7 @@
-  * as to avoid issues such as the compiler inlining or eliding either a static
-  * kfunc, or a global kfunc in an LTO build.
-  */
--#define __bpf_kfunc __used __retain noinline
-+#define __bpf_kfunc __used __retain __noclone noinline
- 
- #define __bpf_kfunc_start_defs()					       \
- 	__diag_push();							       \
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch b/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch
deleted file mode 100644
index d8ba7600b7..0000000000
--- a/queue-6.16/bpf-reject-negative-offsets-for-alu-ops.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 020c75d1162488593fb2edcf6bc5180ff154c813 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 Sep 2025 23:04:33 +0800
-Subject: bpf: Reject negative offsets for ALU ops
-
-From: Yazhou Tang <tangyazhou518@outlook.com>
-
-[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
-
-When verifying BPF programs, the check_alu_op() function validates
-instructions with ALU operations. The 'offset' field in these
-instructions is a signed 16-bit integer.
-
-The existing check 'insn->off > 1' was intended to ensure the offset is
-either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
-signed, this check incorrectly accepts all negative values (e.g., -1).
-
-This commit tightens the validation by changing the condition to
-'(insn->off != 0 && insn->off != 1)'. This ensures that any value
-other than the explicitly permitted 0 and 1 is rejected, hardening the
-verifier against malformed BPF programs.
-
-Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
-Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
-Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
-Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
-Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
-Acked-by: Yonghong Song <yonghong.song@linux.dev>
-Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
-Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/verifier.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index a6338936085ae..48b3765456553 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -15521,7 +15521,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
- 	} else {	/* all other ALU ops: and, sub, xor, add, ... */
- 
- 		if (BPF_SRC(insn->code) == BPF_X) {
--			if (insn->imm != 0 || insn->off > 1 ||
-+			if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
- 			    (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
- 				verbose(env, "BPF_ALU uses reserved fields\n");
- 				return -EINVAL;
-@@ -15531,7 +15531,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
- 			if (err)
- 				return err;
- 		} else {
--			if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
-+			if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
- 			    (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
- 				verbose(env, "BPF_ALU uses reserved fields\n");
- 				return -EINVAL;
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch b/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
deleted file mode 100644
index 00ec0904b5..0000000000
--- a/queue-6.16/bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 3eec35b2d1cf2a0c978728246211201d5868f6b3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 14 Aug 2025 20:14:29 +0800
-Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
-
-From: Tao Chen <chen.dylane@linux.dev>
-
-[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
-
-Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
-called all the way from graph tracer, which disables preemption in
-function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
-need to use migrate_disable. As a result, some overhead may will be reduced.
-And add cant_sleep check for __this_cpu_inc_return.
-
-Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
-Signed-off-by: Tao Chen <chen.dylane@linux.dev>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/trace/bpf_trace.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
-index 132c8be6f635c..60e89f56dec3f 100644
---- a/kernel/trace/bpf_trace.c
-+++ b/kernel/trace/bpf_trace.c
-@@ -2703,20 +2703,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
- 	struct pt_regs *regs;
- 	int err;
- 
-+	/*
-+	 * graph tracer framework ensures we won't migrate, so there is no need
-+	 * to use migrate_disable for bpf_prog_run again. The check here just for
-+	 * __this_cpu_inc_return.
-+	 */
-+	cant_sleep();
-+
- 	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
- 		bpf_prog_inc_misses_counter(link->link.prog);
- 		err = 1;
- 		goto out;
- 	}
- 
--	migrate_disable();
- 	rcu_read_lock();
- 	regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr());
- 	old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
- 	err = bpf_prog_run(link->link.prog, regs);
- 	bpf_reset_run_ctx(old_run_ctx);
- 	rcu_read_unlock();
--	migrate_enable();
- 
-  out:
- 	__this_cpu_dec(bpf_prog_active);
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch b/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch
deleted file mode 100644
index 9accc764c9..0000000000
--- a/queue-6.16/bpf-selftests-fix-test_tcpnotify_user.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From ef4d8037927f36260b36df8570f884e6cfffb5db Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 15 Aug 2025 12:12:14 +0000
-Subject: bpf/selftests: Fix test_tcpnotify_user
-
-From: Matt Bobrowski <mattbobrowski@google.com>
-
-[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
-
-Based on a bisect, it appears that commit 7ee988770326 ("timers:
-Implement the hierarchical pull model") has somehow inadvertently
-broken BPF selftest test_tcpnotify_user. The error that is being
-generated by this test is as follows:
-
-	FAILED: Wrong stats Expected 10 calls, got 8
-
-It looks like the change allows timer functions to be run on CPUs
-different from the one they are armed on. The test had pinned itself
-to CPU 0, and in the past the retransmit attempts also occurred on CPU
-0. The test had set the max_entries attribute for
-BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
-bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
-likely to be in range. With the change to allow timers to run on other
-CPUs, the current CPU tasked with performing the retransmit might be
-bumped and in turn fall out of range, as the event will be filtered
-out via __bpf_perf_event_output() using:
-
-    if (unlikely(index >= array->map.max_entries))
-            return -E2BIG;
-
-A possible change would be to explicitly set the max_entries attribute
-for perf_event_map in test_tcpnotify_kern.c to a value that's at least
-as large as the number of CPUs. As it turns out however, if the field
-is left unset, then the libbpf will determine the number of CPUs available
-on the underlying system and update the max_entries attribute accordingly
-in map_set_def_max_entries().
-
-A further problem with the test is that it has a thread that continues
-running up until the program exits. The main thread cleans up some
-LIBBPF data structures, while the other thread continues to use them,
-which inevitably will trigger a SIGSEGV. This can be dealt with by
-telling the thread to run for as long as necessary and doing a
-pthread_join on it before exiting the program.
-
-Finally, I don't think binding the process to CPU 0 is meaningful for
-this test any more, so get rid of that.
-
-Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
-Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
-Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
-Acked-by: Stanislav Fomichev <sdf@fomichev.me>
-Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../selftests/bpf/progs/test_tcpnotify_kern.c |  1 -
- .../selftests/bpf/test_tcpnotify_user.c       | 20 +++++++++----------
- 2 files changed, 10 insertions(+), 11 deletions(-)
-
-diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
-index 540181c115a85..ef00d38b0a8d2 100644
---- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
-+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
-@@ -23,7 +23,6 @@ struct {
- 
- struct {
- 	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
--	__uint(max_entries, 2);
- 	__type(key, int);
- 	__type(value, __u32);
- } perf_event_map SEC(".maps");
-diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
-index 595194453ff8f..35b4893ccdf8a 100644
---- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
-+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
-@@ -15,20 +15,18 @@
- #include <bpf/libbpf.h>
- #include <sys/ioctl.h>
- #include <linux/rtnetlink.h>
--#include <signal.h>
- #include <linux/perf_event.h>
--#include <linux/err.h>
- 
--#include "bpf_util.h"
- #include "cgroup_helpers.h"
- 
- #include "test_tcpnotify.h"
--#include "trace_helpers.h"
- #include "testing_helpers.h"
- 
- #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
- 
- pthread_t tid;
-+static bool exit_thread;
-+
- int rx_callbacks;
- 
- static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
-@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
- {
- 	int err;
- 
--	while (1) {
-+	while (!exit_thread) {
- 		err = perf_buffer__poll(pb, 100);
- 		if (err < 0 && err != -EINTR) {
- 			printf("failed perf_buffer__poll: %d\n", err);
-@@ -78,15 +76,10 @@ int main(int argc, char **argv)
- 	int error = EXIT_FAILURE;
- 	struct bpf_object *obj;
- 	char test_script[80];
--	cpu_set_t cpuset;
- 	__u32 key = 0;
- 
- 	libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
- 
--	CPU_ZERO(&cpuset);
--	CPU_SET(0, &cpuset);
--	pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
--
- 	cg_fd = cgroup_setup_and_join(cg_path);
- 	if (cg_fd < 0)
- 		goto err;
-@@ -151,6 +144,13 @@ int main(int argc, char **argv)
- 
- 	sleep(10);
- 
-+	exit_thread = true;
-+	int ret = pthread_join(tid, NULL);
-+	if (ret) {
-+		printf("FAILED: pthread_join\n");
-+		goto err;
-+	}
-+
- 	if (verify_result(&g)) {
- 		printf("FAILED: Wrong stats Expected %d calls, got %d\n",
- 			g.ncalls, rx_callbacks);
--- 
-2.51.0
-
diff --git a/queue-6.16/bpf-tidy-verifier-bug-message.patch b/queue-6.16/bpf-tidy-verifier-bug-message.patch
deleted file mode 100644
index 2c88648895..0000000000
--- a/queue-6.16/bpf-tidy-verifier-bug-message.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 9bf89434aae0c7b45b0f4383b635a0dde76200ac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 20:58:20 +0200
-Subject: bpf: Tidy verifier bug message
-
-From: Paul Chaignon <paul.chaignon@gmail.com>
-
-[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ]
-
-Yonghong noticed that error messages for potential verifier bugs often
-have a '(1)' at the end. This is happening because verifier_bug_if(cond,
-env, fmt, args...) prints "(" #cond ")\n" as part of the message and
-verifier_bug() is defined as:
-
-  #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
-
-Hence, verifier_bug() always ends up displaying '(1)'. This small patch
-fixes it by having verifier_bug_if conditionally call verifier_bug
-instead of the other way around.
-
-Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs")
-Reported-by: Yonghong Song <yonghong.song@linux.dev>
-Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Tested-by: Eduard Zingerman <eddyz87@gmail.com>
-Acked-by: Yonghong Song <yonghong.song@linux.dev>
-Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/bpf_verifier.h | 12 +++++++-----
- 1 file changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
-index 256274acb1d86..e824d091ad2b0 100644
---- a/include/linux/bpf_verifier.h
-+++ b/include/linux/bpf_verifier.h
-@@ -846,13 +846,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
- #define verifier_bug_if(cond, env, fmt, args...)						\
- 	({											\
- 		bool __cond = (cond);								\
--		if (unlikely(__cond)) {								\
--			BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args);		\
--			bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args);	\
--		}										\
-+		if (unlikely(__cond))								\
-+			verifier_bug(env, fmt " (" #cond ")", ##args);				\
- 		(__cond);									\
- 	})
--#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
-+#define verifier_bug(env, fmt, args...)								\
-+	({											\
-+		BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args);				\
-+		bpf_log(&env->log, "verifier bug: " fmt "\n", ##args);				\
-+	})
- 
- static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env)
- {
--- 
-2.51.0
-
diff --git a/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch b/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch
deleted file mode 100644
index 3f52b608d4..0000000000
--- a/queue-6.16/btrfs-return-any-hit-error-from-extent_writepage_io.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From b671c0817fec5f7295f7ff928589f1014a266b46 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 08:40:45 +0930
-Subject: btrfs: return any hit error from extent_writepage_io()
-
-From: Qu Wenruo <wqu@suse.com>
-
-[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]
-
-Since the support of bs < ps support, extent_writepage_io() will submit
-multiple blocks inside the folio.
-
-But if we hit error submitting one sector, but the next sector can still
-be submitted successfully, the function extent_writepage_io() will still
-return 0.
-
-This will make btrfs to silently ignore the error without setting error
-flag for the filemap.
-
-Fix it by recording the first error hit, and always return that value.
-
-Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
-Reviewed-by: Daniel Vacek <neelx@suse.com>
-Signed-off-by: Qu Wenruo <wqu@suse.com>
-Signed-off-by: David Sterba <dsterba@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/btrfs/extent_io.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index b843db855f402..40ec2e0a14c9f 100644
---- a/fs/btrfs/extent_io.c
-+++ b/fs/btrfs/extent_io.c
-@@ -1622,7 +1622,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
- 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
- 	unsigned long range_bitmap = 0;
- 	bool submitted_io = false;
--	bool error = false;
-+	int found_error = 0;
- 	const u64 folio_start = folio_pos(folio);
- 	const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio);
- 	u64 cur;
-@@ -1682,7 +1682,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
- 			 */
- 			btrfs_mark_ordered_io_finished(inode, folio, cur,
- 						       fs_info->sectorsize, false);
--			error = true;
-+			if (!found_error)
-+				found_error = ret;
- 			continue;
- 		}
- 		submitted_io = true;
-@@ -1699,11 +1700,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
- 	 * If we hit any error, the corresponding sector will have its dirty
- 	 * flag cleared and writeback finished, thus no need to handle the error case.
- 	 */
--	if (!submitted_io && !error) {
-+	if (!submitted_io && !found_error) {
- 		btrfs_folio_set_writeback(fs_info, folio, start, len);
- 		btrfs_folio_clear_writeback(fs_info, folio, start, len);
- 	}
--	return ret;
-+	return found_error;
- }
- 
- /*
--- 
-2.51.0
-
diff --git a/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch b/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch
deleted file mode 100644
index 430f57d2c9..0000000000
--- a/queue-6.16/clocksource-drivers-tegra186-avoid-64-bit-division.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 264f0a08cec5552d555d96f524d1816f3469cce6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 20 Jun 2025 13:19:35 +0200
-Subject: clocksource/drivers/tegra186: Avoid 64-bit division
-
-From: Arnd Bergmann <arnd@arndb.de>
-
-[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ]
-
-The newly added function causes a build failure on 32-bit targets with
-older compiler version such as gcc-10:
-
-arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft':
-timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod'
-
-The calculation can trivially be changed to avoid the division entirely,
-as USEC_PER_SEC is a multiple of 5. Change both such calculation for
-consistency, even though gcc apparently managed to optimize the other one
-properly already.
-
-[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ]
-
-Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-tegra186.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
-index 7b506de654386..47bdb1e320af9 100644
---- a/drivers/clocksource/timer-tegra186.c
-+++ b/drivers/clocksource/timer-tegra186.c
-@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt)
- 	tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR);
- 
- 	/* configure timer (system reset happens on the fifth expiration) */
--	value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) |
-+	value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) |
- 		TMRCR_PERIODIC | TMRCR_ENABLE;
- 	tmr_writel(wdt->tmr, value, TMRCR);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch b/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
deleted file mode 100644
index 4441eaa73e..0000000000
--- a/queue-6.16/clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From b7a4ae2f9ca2850f01bed1b1b4b6692f44e4253b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 14 Jun 2025 10:55:55 -0700
-Subject: clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ]
-
-Building the driver on xtensa fails with
-
-tensa-linux-ld: drivers/clocksource/timer-tegra186.o:
-	in function `tegra186_timer_remove':
-timer-tegra186.c:(.text+0x350):
-	undefined reference to `__udivdi3'
-
-Avoid the problem by rearranging the offending code to avoid the 64-bit
-divide operation.
-
-Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
-Cc: Pohsun Su <pohsuns@nvidia.com>
-Cc: Robert Lin <robelin@nvidia.com>
-Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-tegra186.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
-index e5394f98a02e6..7b506de654386 100644
---- a/drivers/clocksource/timer-tegra186.c
-+++ b/drivers/clocksource/timer-tegra186.c
-@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd)
- 	 * counter value to the time of the counter expirations that
- 	 * remain.
- 	 */
--	timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration);
-+	timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration);
- 
- 	/*
- 	 * Convert the current counter value to seconds,
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-appropriately-disable-programming-clocks.patch b/queue-6.16/coresight-appropriately-disable-programming-clocks.patch
deleted file mode 100644
index a783fd3d79..0000000000
--- a/queue-6.16/coresight-appropriately-disable-programming-clocks.patch
+++ /dev/null
@@ -1,363 +0,0 @@
-From f22c0c167019dec23469f07e06de773d99b073b5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:40 +0100
-Subject: coresight: Appropriately disable programming clocks
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ]
-
-Some CoreSight components have programming clocks (pclk) and are enabled
-using clk_get() and clk_prepare_enable().  However, in many cases, these
-clocks are not disabled when modules exit and only released by clk_put().
-
-To fix the issue, this commit refactors programming clock by replacing
-clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled()
-for enabling APB clock. If the "apb_pclk" clock is not found, a NULL
-pointer is returned, and the function proceeds to attempt enabling the
-"apb" clock.
-
-Since ACPI platforms rely on firmware to manage clocks, returning a NULL
-pointer in this case leaves clock management to the firmware rather than
-the driver. This effectively avoids a clock imbalance issue during
-module removal - where the clock could be disabled twice: once during
-the ACPI runtime suspend and again during the devm resource release.
-
-Callers are updated to reuse the returned error value.
-
-With the change, programming clocks are managed as resources in driver
-model layer, allowing clock cleanup to be handled automatically.  As a
-result, manual cleanup operations are no longer needed and are removed
-from the Coresight drivers.
-
-Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-catu.c  |  9 ++------
- .../hwtracing/coresight/coresight-cpu-debug.c |  6 +----
- .../hwtracing/coresight/coresight-ctcu-core.c | 10 ++-------
- .../coresight/coresight-etm4x-core.c          |  9 ++------
- .../hwtracing/coresight/coresight-funnel.c    |  6 +----
- .../coresight/coresight-replicator.c          |  6 +----
- drivers/hwtracing/coresight/coresight-stm.c   |  4 +---
- .../hwtracing/coresight/coresight-tmc-core.c  |  4 +---
- drivers/hwtracing/coresight/coresight-tpiu.c  |  4 +---
- include/linux/coresight.h                     | 22 ++++++++-----------
- 10 files changed, 21 insertions(+), 59 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
-index af2a55f0c907c..4c345ff2cff14 100644
---- a/drivers/hwtracing/coresight/coresight-catu.c
-+++ b/drivers/hwtracing/coresight/coresight-catu.c
-@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	pm_runtime_get_noresume(&pdev->dev);
- 	pm_runtime_set_active(&pdev->dev);
-@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev)
- 	dev_set_drvdata(&pdev->dev, drvdata);
- 	ret = __catu_probe(&pdev->dev, res);
- 	pm_runtime_put(&pdev->dev);
--	if (ret) {
-+	if (ret)
- 		pm_runtime_disable(&pdev->dev);
--		if (!IS_ERR_OR_NULL(drvdata->pclk))
--			clk_put(drvdata->pclk);
--	}
- 
- 	return ret;
- }
-@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev)
- 
- 	__catu_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_PM
-diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
-index a871d997330b0..e39dfb886688e 100644
---- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
-+++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
-@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	dev_set_drvdata(&pdev->dev, drvdata);
- 	pm_runtime_get_noresume(&pdev->dev);
-@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev)
- 	if (ret) {
- 		pm_runtime_put_noidle(&pdev->dev);
- 		pm_runtime_disable(&pdev->dev);
--		if (!IS_ERR_OR_NULL(drvdata->pclk))
--			clk_put(drvdata->pclk);
- 	}
- 	return ret;
- }
-@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev)
- 
- 	__debug_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_ACPI
-diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c
-index c6bafc96db963..de279efe34058 100644
---- a/drivers/hwtracing/coresight/coresight-ctcu-core.c
-+++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c
-@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev)
- 
- 	drvdata->apb_clk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->apb_clk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->apb_clk);
- 
- 	cfgs = of_device_get_match_data(dev);
- 	if (cfgs) {
-@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev)
- 	desc.access = CSDEV_ACCESS_IOMEM(base);
- 
- 	drvdata->csdev = coresight_register(&desc);
--	if (IS_ERR(drvdata->csdev)) {
--		if (!IS_ERR_OR_NULL(drvdata->apb_clk))
--			clk_put(drvdata->apb_clk);
--
-+	if (IS_ERR(drvdata->csdev))
- 		return PTR_ERR(drvdata->csdev);
--	}
- 
- 	return 0;
- }
-@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev)
- 
- 	ctcu_remove(pdev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->apb_clk))
--		clk_put(drvdata->apb_clk);
- }
- 
- #ifdef CONFIG_PM
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-index 81f20a167e001..4b98a7bf4cb73 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
-+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	if (res) {
- 		drvdata->base = devm_ioremap_resource(&pdev->dev, res);
--		if (IS_ERR(drvdata->base)) {
--			clk_put(drvdata->pclk);
-+		if (IS_ERR(drvdata->base))
- 			return PTR_ERR(drvdata->base);
--		}
- 	}
- 
- 	dev_set_drvdata(&pdev->dev, drvdata);
-@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev)
- 	if (drvdata)
- 		etm4_remove_dev(drvdata);
- 	pm_runtime_disable(&pdev->dev);
--
--	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- static const struct amba_id etm4_ids[] = {
-diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
-index b1922dbe9292b..36fc4e991458c 100644
---- a/drivers/hwtracing/coresight/coresight-funnel.c
-+++ b/drivers/hwtracing/coresight/coresight-funnel.c
-@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	/*
- 	 * Map the device base for dynamic-funnel, which has been
-@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res)
- out_disable_clk:
- 	if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
- 		clk_disable_unprepare(drvdata->atclk);
--	if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_disable_unprepare(drvdata->pclk);
- 	return ret;
- }
- 
-@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev)
- 
- 	funnel_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- static const struct of_device_id funnel_match[] = {
-diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
-index 06efd2b01a0f7..6dd24eb10a94b 100644
---- a/drivers/hwtracing/coresight/coresight-replicator.c
-+++ b/drivers/hwtracing/coresight/coresight-replicator.c
-@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	/*
- 	 * Map the device base for dynamic-replicator, which has been
-@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
- out_disable_clk:
- 	if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
- 		clk_disable_unprepare(drvdata->atclk);
--	if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_disable_unprepare(drvdata->pclk);
- 	return ret;
- }
- 
-@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev)
- 
- 	replicator_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_PM
-diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
-index e45c6c7204b44..88ee453b28154 100644
---- a/drivers/hwtracing/coresight/coresight-stm.c
-+++ b/drivers/hwtracing/coresight/coresight-stm.c
-@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 	dev_set_drvdata(dev, drvdata);
- 
- 	base = devm_ioremap_resource(dev, res);
-@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev)
- 
- 	__stm_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_ACPI
-diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
-index 0b5e7635a084d..e867198b03e82 100644
---- a/drivers/hwtracing/coresight/coresight-tmc-core.c
-+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
-@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 
- 	dev_set_drvdata(&pdev->dev, drvdata);
- 	pm_runtime_get_noresume(&pdev->dev);
-@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev)
- 
- 	__tmc_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_PM
-diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
-index 3e01592884280..b2559c6fac6d2 100644
---- a/drivers/hwtracing/coresight/coresight-tpiu.c
-+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
-@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
--		return -ENODEV;
-+		return PTR_ERR(drvdata->pclk);
- 	dev_set_drvdata(dev, drvdata);
- 
- 	/* Validity for the resource is already checked by the AMBA core */
-@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev)
- 
- 	__tpiu_remove(&pdev->dev);
- 	pm_runtime_disable(&pdev->dev);
--	if (!IS_ERR_OR_NULL(drvdata->pclk))
--		clk_put(drvdata->pclk);
- }
- 
- #ifdef CONFIG_ACPI
-diff --git a/include/linux/coresight.h b/include/linux/coresight.h
-index 4ac65c68bbf44..1e652e1578419 100644
---- a/include/linux/coresight.h
-+++ b/include/linux/coresight.h
-@@ -6,6 +6,7 @@
- #ifndef _LINUX_CORESIGHT_H
- #define _LINUX_CORESIGHT_H
- 
-+#include <linux/acpi.h>
- #include <linux/amba/bus.h>
- #include <linux/clk.h>
- #include <linux/device.h>
-@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base)
-  * Returns:
-  *
-  * clk   - Clock is found and enabled
-- * NULL  - clock is not found
-+ * NULL  - Clock is controlled by firmware (ACPI device only)
-  * ERROR - Clock is found but failed to enable
-  */
- static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
- {
- 	struct clk *pclk;
--	int ret;
- 
--	pclk = clk_get(dev, "apb_pclk");
--	if (IS_ERR(pclk)) {
--		pclk = clk_get(dev, "apb");
--		if (IS_ERR(pclk))
--			return NULL;
--	}
-+	/* Firmware controls clocks for an ACPI device. */
-+	if (has_acpi_companion(dev))
-+		return NULL;
-+
-+	pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
-+	if (!pclk)
-+		pclk = devm_clk_get_optional_enabled(dev, "apb");
- 
--	ret = clk_prepare_enable(pclk);
--	if (ret) {
--		clk_put(pclk);
--		return ERR_PTR(ret);
--	}
- 	return pclk;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch b/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch
deleted file mode 100644
index 57d3b9f2e6..0000000000
--- a/queue-6.16/coresight-appropriately-disable-trace-bus-clocks.patch
+++ /dev/null
@@ -1,281 +0,0 @@
-From 0dcd0ffe1b7392820aeca3c4c0d8c5b40faad624 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:41 +0100
-Subject: coresight: Appropriately disable trace bus clocks
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ]
-
-Some CoreSight components have trace bus clocks 'atclk' and are enabled
-using clk_prepare_enable().  These clocks are not disabled when modules
-exit.
-
-As atclk is optional, use devm_clk_get_optional_enabled() to manage it.
-The benefit is the driver model layer can automatically disable and
-release clocks.
-
-Check the returned value with IS_ERR() to detect errors but leave the
-NULL pointer case if the clock is not found.  And remove the error
-handling codes which are no longer needed.
-
-Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk")
-Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-etb10.c | 10 +++---
- .../coresight/coresight-etm3x-core.c          |  9 ++---
- .../hwtracing/coresight/coresight-funnel.c    | 36 ++++++-------------
- .../coresight/coresight-replicator.c          | 34 ++++++------------
- drivers/hwtracing/coresight/coresight-stm.c   |  9 ++---
- drivers/hwtracing/coresight/coresight-tpiu.c  | 10 ++----
- 6 files changed, 34 insertions(+), 74 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
-index d5efb085b30d3..8e81b41eb2226 100644
---- a/drivers/hwtracing/coresight/coresight-etb10.c
-+++ b/drivers/hwtracing/coresight/coresight-etb10.c
-@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id)
- 	if (!drvdata)
- 		return -ENOMEM;
- 
--	drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
-+
- 	dev_set_drvdata(dev, drvdata);
- 
- 	/* validity for the resource is already checked by the AMBA core */
-diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
-index 1c6204e144221..baba2245b1dfb 100644
---- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
-+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
-@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
- 
- 	spin_lock_init(&drvdata->spinlock);
- 
--	drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
- 
- 	drvdata->cpu = coresight_get_cpu(dev);
- 	if (drvdata->cpu < 0)
-diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
-index 36fc4e991458c..b044a4125310b 100644
---- a/drivers/hwtracing/coresight/coresight-funnel.c
-+++ b/drivers/hwtracing/coresight/coresight-funnel.c
-@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel);
- 
- static int funnel_probe(struct device *dev, struct resource *res)
- {
--	int ret;
- 	void __iomem *base;
- 	struct coresight_platform_data *pdata = NULL;
- 	struct funnel_drvdata *drvdata;
-@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
- 	if (!drvdata)
- 		return -ENOMEM;
- 
--	drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
-@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res)
- 	 */
- 	if (res) {
- 		base = devm_ioremap_resource(dev, res);
--		if (IS_ERR(base)) {
--			ret = PTR_ERR(base);
--			goto out_disable_clk;
--		}
-+		if (IS_ERR(base))
-+			return PTR_ERR(base);
- 		drvdata->base = base;
- 		desc.groups = coresight_funnel_groups;
- 		desc.access = CSDEV_ACCESS_IOMEM(base);
-@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
- 	dev_set_drvdata(dev, drvdata);
- 
- 	pdata = coresight_get_platform_data(dev);
--	if (IS_ERR(pdata)) {
--		ret = PTR_ERR(pdata);
--		goto out_disable_clk;
--	}
-+	if (IS_ERR(pdata))
-+		return PTR_ERR(pdata);
-+
- 	dev->platform_data = pdata;
- 
- 	raw_spin_lock_init(&drvdata->spinlock);
-@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res)
- 	desc.pdata = pdata;
- 	desc.dev = dev;
- 	drvdata->csdev = coresight_register(&desc);
--	if (IS_ERR(drvdata->csdev)) {
--		ret = PTR_ERR(drvdata->csdev);
--		goto out_disable_clk;
--	}
-+	if (IS_ERR(drvdata->csdev))
-+		return PTR_ERR(drvdata->csdev);
- 
--	ret = 0;
--
--out_disable_clk:
--	if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
--		clk_disable_unprepare(drvdata->atclk);
--	return ret;
-+	return 0;
- }
- 
- static int funnel_remove(struct device *dev)
-diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
-index 6dd24eb10a94b..9e8bd36e7a9a2 100644
---- a/drivers/hwtracing/coresight/coresight-replicator.c
-+++ b/drivers/hwtracing/coresight/coresight-replicator.c
-@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = {
- 
- static int replicator_probe(struct device *dev, struct resource *res)
- {
--	int ret = 0;
- 	struct coresight_platform_data *pdata = NULL;
- 	struct replicator_drvdata *drvdata;
- 	struct coresight_desc desc = { 0 };
-@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res)
- 	if (!drvdata)
- 		return -ENOMEM;
- 
--	drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
-@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
- 	 */
- 	if (res) {
- 		base = devm_ioremap_resource(dev, res);
--		if (IS_ERR(base)) {
--			ret = PTR_ERR(base);
--			goto out_disable_clk;
--		}
-+		if (IS_ERR(base))
-+			return PTR_ERR(base);
- 		drvdata->base = base;
- 		desc.groups = replicator_groups;
- 		desc.access = CSDEV_ACCESS_IOMEM(base);
-@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
- 	dev_set_drvdata(dev, drvdata);
- 
- 	pdata = coresight_get_platform_data(dev);
--	if (IS_ERR(pdata)) {
--		ret = PTR_ERR(pdata);
--		goto out_disable_clk;
--	}
-+	if (IS_ERR(pdata))
-+		return PTR_ERR(pdata);
- 	dev->platform_data = pdata;
- 
- 	raw_spin_lock_init(&drvdata->spinlock);
-@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res)
- 	desc.dev = dev;
- 
- 	drvdata->csdev = coresight_register(&desc);
--	if (IS_ERR(drvdata->csdev)) {
--		ret = PTR_ERR(drvdata->csdev);
--		goto out_disable_clk;
--	}
-+	if (IS_ERR(drvdata->csdev))
-+		return PTR_ERR(drvdata->csdev);
- 
- 	replicator_reset(drvdata);
--
--out_disable_clk:
--	if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
--		clk_disable_unprepare(drvdata->atclk);
--	return ret;
-+	return 0;
- }
- 
- static int replicator_remove(struct device *dev)
-diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
-index 88ee453b28154..57fbe3ad0fb20 100644
---- a/drivers/hwtracing/coresight/coresight-stm.c
-+++ b/drivers/hwtracing/coresight/coresight-stm.c
-@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res)
- 	if (!drvdata)
- 		return -ENOMEM;
- 
--	drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
-diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
-index b2559c6fac6d2..8d6179c83e5d3 100644
---- a/drivers/hwtracing/coresight/coresight-tpiu.c
-+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
-@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = {
- 
- static int __tpiu_probe(struct device *dev, struct resource *res)
- {
--	int ret;
- 	void __iomem *base;
- 	struct coresight_platform_data *pdata = NULL;
- 	struct tpiu_drvdata *drvdata;
-@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
- 
- 	spin_lock_init(&drvdata->spinlock);
- 
--	drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
--	if (!IS_ERR(drvdata->atclk)) {
--		ret = clk_prepare_enable(drvdata->atclk);
--		if (ret)
--			return ret;
--	}
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
- 
- 	drvdata->pclk = coresight_get_enable_apb_pclk(dev);
- 	if (IS_ERR(drvdata->pclk))
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch b/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch
deleted file mode 100644
index 5dcf9372db..0000000000
--- a/queue-6.16/coresight-avoid-enable-programming-clock-duplicately.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 20525270cadf81e404a6c3f6b872ed71abd6a2f5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:42 +0100
-Subject: coresight: Avoid enable programming clock duplicately
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ]
-
-The programming clock is enabled by AMBA bus driver before a dynamic
-probe. As a result, a CoreSight driver may redundantly enable the same
-clock.
-
-To avoid this, add a check for device type and skip enabling the
-programming clock for AMBA devices. The returned NULL pointer will be
-tolerated by the drivers.
-
-Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
-Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/coresight.h | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/include/linux/coresight.h b/include/linux/coresight.h
-index 1e652e1578419..bb49080ec8f96 100644
---- a/include/linux/coresight.h
-+++ b/include/linux/coresight.h
-@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base)
-  * Returns:
-  *
-  * clk   - Clock is found and enabled
-- * NULL  - Clock is controlled by firmware (ACPI device only)
-+ * NULL  - Clock is controlled by firmware (ACPI device only) or when managed
-+ *	   by the AMBA bus driver instead
-  * ERROR - Clock is found but failed to enable
-  */
- static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
- {
--	struct clk *pclk;
-+	struct clk *pclk = NULL;
- 
- 	/* Firmware controls clocks for an ACPI device. */
- 	if (has_acpi_companion(dev))
- 		return NULL;
- 
--	pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
--	if (!pclk)
--		pclk = devm_clk_get_optional_enabled(dev, "apb");
-+	if (!dev_is_amba(dev)) {
-+		pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
-+		if (!pclk)
-+			pclk = devm_clk_get_optional_enabled(dev, "apb");
-+	}
- 
- 	return pclk;
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-catu-support-atclk.patch b/queue-6.16/coresight-catu-support-atclk.patch
deleted file mode 100644
index fc5a07d53d..0000000000
--- a/queue-6.16/coresight-catu-support-atclk.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 08af03eaac810667dd2fdbfbc4da2b49469232f5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:38 +0100
-Subject: coresight: catu: Support atclk
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]
-
-The atclk is an optional clock for the CoreSight CATU, but the driver
-misses to initialize it.
-
-This change enables atclk in probe of the CATU driver, and dynamically
-control the clock during suspend and resume.
-
-The checks for driver data and clocks in suspend and resume are not
-needed, remove them.  Add error handling in the resume function.
-
-Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
-Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
- drivers/hwtracing/coresight/coresight-catu.h |  1 +
- 2 files changed, 18 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
-index 5058432233da1..af2a55f0c907c 100644
---- a/drivers/hwtracing/coresight/coresight-catu.c
-+++ b/drivers/hwtracing/coresight/coresight-catu.c
-@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
- 	struct coresight_platform_data *pdata = NULL;
- 	void __iomem *base;
- 
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
-+
- 	catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
- 	if (!catu_desc.name)
- 		return -ENOMEM;
-@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
- {
- 	struct catu_drvdata *drvdata = dev_get_drvdata(dev);
- 
--	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_disable_unprepare(drvdata->pclk);
-+	clk_disable_unprepare(drvdata->atclk);
-+	clk_disable_unprepare(drvdata->pclk);
-+
- 	return 0;
- }
- 
- static int catu_runtime_resume(struct device *dev)
- {
- 	struct catu_drvdata *drvdata = dev_get_drvdata(dev);
-+	int ret;
- 
--	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_prepare_enable(drvdata->pclk);
--	return 0;
-+	ret = clk_prepare_enable(drvdata->pclk);
-+	if (ret)
-+		return ret;
-+
-+	ret = clk_prepare_enable(drvdata->atclk);
-+	if (ret)
-+		clk_disable_unprepare(drvdata->pclk);
-+
-+	return ret;
- }
- #endif
- 
-diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
-index 755776cd19c5b..6e6b7aac206dc 100644
---- a/drivers/hwtracing/coresight/coresight-catu.h
-+++ b/drivers/hwtracing/coresight/coresight-catu.h
-@@ -62,6 +62,7 @@
- 
- struct catu_drvdata {
- 	struct clk *pclk;
-+	struct clk *atclk;
- 	void __iomem *base;
- 	struct coresight_device *csdev;
- 	int irq;
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch b/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch
deleted file mode 100644
index 217f0b2d98..0000000000
--- a/queue-6.16/coresight-etm4x-conditionally-access-register-trcext.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 67b7702cb9904b701acf991b4c442f39e61e5826 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 01:24:45 -0700
-Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
-
-From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
-
-[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
-
-The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
-To avoid invalid accesses, introduce a check on numextinsel
-(derived from TRCIDR5[11:9]) before reading or writing to this register.
-
-Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
-Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
-Reviewed-by: James Clark <james.clark@linaro.org>
-Reviewed-by: Mike Leach <mike.leach@linaro.org>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
- drivers/hwtracing/coresight/coresight-etm4x.h      |  2 ++
- 2 files changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-index cbea200489c8f..b4f1834a1af1e 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
-+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
- 		etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
- 		etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
- 	}
--	etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
-+	if (drvdata->numextinsel)
-+		etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
- 	for (i = 0; i < drvdata->nr_cntr; i++) {
- 		etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
- 		etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
-@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info)
- 	etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
- 	/* NUMEXTIN, bits[8:0] number of external inputs implemented */
- 	drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
-+	drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
- 	/* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
- 	drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
- 	/* ATBTRIG, bit[22] implementation can support ATB triggers? */
-@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
- 		state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
- 		state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
- 	}
--	state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
-+
-+	if (drvdata->numextinsel)
-+		state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
- 
- 	for (i = 0; i < drvdata->nr_cntr; i++) {
- 		state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
-@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
- 		etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
- 		etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
- 	}
--	etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
-+	if (drvdata->numextinsel)
-+		etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
- 
- 	for (i = 0; i < drvdata->nr_cntr; i++) {
- 		etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
-index ac649515054d9..823914fefa90a 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x.h
-+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
-@@ -162,6 +162,7 @@
- #define TRCIDR4_NUMVMIDC_MASK			GENMASK(31, 28)
- 
- #define TRCIDR5_NUMEXTIN_MASK			GENMASK(8, 0)
-+#define TRCIDR5_NUMEXTINSEL_MASK               GENMASK(11, 9)
- #define TRCIDR5_TRACEIDSIZE_MASK		GENMASK(21, 16)
- #define TRCIDR5_ATBTRIG				BIT(22)
- #define TRCIDR5_LPOVERRIDE			BIT(23)
-@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
- 	u8				nr_cntr;
- 	u8				nr_ext_inp;
- 	u8				numcidc;
-+	u8				numextinsel;
- 	u8				numvmidc;
- 	u8				nrseqstate;
- 	u8				nr_event;
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-etm4x-support-atclk.patch b/queue-6.16/coresight-etm4x-support-atclk.patch
deleted file mode 100644
index 1cdc7f2983..0000000000
--- a/queue-6.16/coresight-etm4x-support-atclk.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From c530e16abcd268e0a2e10a44cb9bbb657da3d0c8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:39 +0100
-Subject: coresight: etm4x: Support atclk
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
-
-The atclk is an optional clock for the CoreSight ETMv4, but the driver
-misses to initialize it.
-
-This change enables atclk in probe of the ETMv4 driver, and dynamically
-control the clock during suspend and resume.
-
-No need to check the driver data and clock pointer in the runtime
-suspend and resume, so remove checks.  And add error handling in the
-resume function.
-
-Add a minor fix to the comment format when adding the atclk field.
-
-Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
-Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../coresight/coresight-etm4x-core.c          | 20 ++++++++++++++-----
- drivers/hwtracing/coresight/coresight-etm4x.h |  4 +++-
- 2 files changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-index b4f1834a1af1e..81f20a167e001 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
-+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev)
- 	if (WARN_ON(!drvdata))
- 		return -ENOMEM;
- 
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
-+
- 	if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
- 		pm_save_enable = coresight_loses_context_with_cpu(dev) ?
- 			       PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
-@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev)
- {
- 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
- 
--	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
--		clk_disable_unprepare(drvdata->pclk);
-+	clk_disable_unprepare(drvdata->atclk);
-+	clk_disable_unprepare(drvdata->pclk);
- 
- 	return 0;
- }
-@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev)
- static int etm4_runtime_resume(struct device *dev)
- {
- 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
-+	int ret;
-+
-+	ret = clk_prepare_enable(drvdata->pclk);
-+	if (ret)
-+		return ret;
- 
--	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
--		clk_prepare_enable(drvdata->pclk);
-+	ret = clk_prepare_enable(drvdata->atclk);
-+	if (ret)
-+		clk_disable_unprepare(drvdata->pclk);
- 
--	return 0;
-+	return ret;
- }
- #endif
- 
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
-index 823914fefa90a..13ec9ecef46f5 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x.h
-+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
-@@ -920,7 +920,8 @@ struct etmv4_save_state {
- 
- /**
-  * struct etm4_drvdata - specifics associated to an ETM component
-- * @pclk        APB clock if present, otherwise NULL
-+ * @pclk:       APB clock if present, otherwise NULL
-+ * @atclk:      Optional clock for the core parts of the ETMv4.
-  * @base:       Memory mapped base address for this component.
-  * @csdev:      Component vitals needed by the framework.
-  * @spinlock:   Only one at a time pls.
-@@ -989,6 +990,7 @@ struct etmv4_save_state {
-  */
- struct etmv4_drvdata {
- 	struct clk			*pclk;
-+	struct clk			*atclk;
- 	void __iomem			*base;
- 	struct coresight_device		*csdev;
- 	raw_spinlock_t			spinlock;
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch b/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch
deleted file mode 100644
index d7753ea448..0000000000
--- a/queue-6.16/coresight-fix-incorrect-handling-for-return-value-of.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 8d2d40924113a0320fd0149fdf6abd56c71710b0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 8 Sep 2025 20:20:22 +0800
-Subject: coresight: Fix incorrect handling for return value of devm_kzalloc
-
-From: Lin Yujun <linyujun809@h-partners.com>
-
-[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]
-
-The return value of devm_kzalloc could be an null pointer,
-use "!desc.pdata" to fix incorrect handling return value
-of devm_kzalloc.
-
-Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
-Signed-off-by: Lin Yujun <linyujun809@h-partners.com>
-Reviewed-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
-index 3dd2e1b4809dc..43643d2c5bdd0 100644
---- a/drivers/hwtracing/coresight/coresight-trbe.c
-+++ b/drivers/hwtracing/coresight/coresight-trbe.c
-@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
- 	 * into the device for that purpose.
- 	 */
- 	desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
--	if (IS_ERR(desc.pdata))
-+	if (!desc.pdata)
- 		goto cpu_clear;
- 
- 	desc.type = CORESIGHT_DEV_TYPE_SINK;
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch b/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch
deleted file mode 100644
index c33cde0deb..0000000000
--- a/queue-6.16/coresight-fix-indentation-error-in-cscfg_remove_owne.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 9a7c9606be1ac38293b5eeaff6536957995da309 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 Jun 2025 11:30:25 +0100
-Subject: coresight: fix indentation error in
- cscfg_remove_owned_csdev_configs()
-
-From: Yeoreum Yun <yeoreum.yun@arm.com>
-
-[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ]
-
-Fix wrong indentation in cscfg_remove_owned_csdev_configs()
-
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/
-Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev")
-Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Reviewed-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-syscfg.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
-index 83dad24e0116d..6836b05986e80 100644
---- a/drivers/hwtracing/coresight/coresight-syscfg.c
-+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
-@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi
- 	if (list_empty(&csdev->config_csdev_list))
- 		return;
- 
--  guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
-+	guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
- 
- 	list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) {
- 		if (config_csdev->config_desc->load_owner == load_owner)
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-fix-missing-include-for-field_get.patch b/queue-6.16/coresight-fix-missing-include-for-field_get.patch
deleted file mode 100644
index 15841afa5a..0000000000
--- a/queue-6.16/coresight-fix-missing-include-for-field_get.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 6c9a601db68ed3ea1c68a1706f5674b279574f7b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Jul 2025 10:55:27 +0100
-Subject: coresight: Fix missing include for FIELD_GET
-
-From: James Clark <james.clark@linaro.org>
-
-[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ]
-
-Include the header for FIELD_GET which is only sometimes transitively
-included on some configs and kernel releases.
-
-Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
-Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/
-Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits")
-Signed-off-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-core.c        | 1 +
- drivers/hwtracing/coresight/coresight-etm4x-core.c  | 1 +
- drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 +
- drivers/hwtracing/coresight/ultrasoc-smb.h          | 1 +
- 4 files changed, 4 insertions(+)
-
-diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
-index fa758cc218275..c2db94f2ab237 100644
---- a/drivers/hwtracing/coresight/coresight-core.c
-+++ b/drivers/hwtracing/coresight/coresight-core.c
-@@ -3,6 +3,7 @@
-  * Copyright (c) 2012, The Linux Foundation. All rights reserved.
-  */
- 
-+#include <linux/bitfield.h>
- #include <linux/build_bug.h>
- #include <linux/kernel.h>
- #include <linux/init.h>
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-index 42e5d37403add..cbea200489c8f 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
-+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-@@ -4,6 +4,7 @@
-  */
- 
- #include <linux/acpi.h>
-+#include <linux/bitfield.h>
- #include <linux/bitops.h>
- #include <linux/kernel.h>
- #include <linux/kvm_host.h>
-diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
-index ab251865b893d..e9eeea6240d55 100644
---- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
-+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
-@@ -4,6 +4,7 @@
-  * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
-  */
- 
-+#include <linux/bitfield.h>
- #include <linux/coresight.h>
- #include <linux/pid_namespace.h>
- #include <linux/pm_runtime.h>
-diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h
-index c4c111275627b..323f0ccb6878c 100644
---- a/drivers/hwtracing/coresight/ultrasoc-smb.h
-+++ b/drivers/hwtracing/coresight/ultrasoc-smb.h
-@@ -7,6 +7,7 @@
- #ifndef _ULTRASOC_SMB_H
- #define _ULTRASOC_SMB_H
- 
-+#include <linux/bitfield.h>
- #include <linux/miscdevice.h>
- #include <linux/spinlock.h>
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch b/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch
deleted file mode 100644
index 862a2d0688..0000000000
--- a/queue-6.16/coresight-only-register-perf-symlink-for-sinks-with-.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From c12c33020f31d8fadb7e4cf5b217fa7eae4e15ac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 Jun 2025 18:26:19 +0800
-Subject: coresight: Only register perf symlink for sinks with alloc_buffer
-
-From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
-
-[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
-
-Ensure that etm_perf_add_symlink_sink() is only called for devices
-that implement the alloc_buffer operation. This prevents invalid
-symlink creation for dummy sinks that do not implement alloc_buffer.
-
-Without this check, perf may attempt to use a dummy sink that lacks
-alloc_buffer operationsu to initialise perf's ring buffer, leading
-to runtime failures.
-
-Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
-Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-core.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
-index c2db94f2ab237..1accd7cbd54bf 100644
---- a/drivers/hwtracing/coresight/coresight-core.c
-+++ b/drivers/hwtracing/coresight/coresight-core.c
-@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
- 		goto out_unlock;
- 	}
- 
--	if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
--	    csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
-+	if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
-+	     csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
-+	    sink_ops(csdev)->alloc_buffer) {
- 		ret = etm_perf_add_symlink_sink(csdev);
- 
- 		if (ret) {
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-tmc-support-atclk.patch b/queue-6.16/coresight-tmc-support-atclk.patch
deleted file mode 100644
index 2741f19ec8..0000000000
--- a/queue-6.16/coresight-tmc-support-atclk.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 47c03bf665153fdbe3a4a980ce63cbe0d3cf7b02 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 13:23:37 +0100
-Subject: coresight: tmc: Support atclk
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]
-
-The atclk is an optional clock for the CoreSight TMC, but the driver
-misses to initialize it.  In most cases, TMC shares the atclk clock with
-other CoreSight components.  Since these components enable the clock
-before the TMC device is initialized, the TMC continues properly,
-which is why we don’t observe any lockup issues.
-
-This change enables atclk in probe of the TMC driver.  Given the clock
-is optional, it is possible to return NULL if the clock does not exist.
-IS_ERR() is tolerant for this case.
-
-Dynamically disable and enable atclk during suspend and resume.  The
-clock pointers will never be error values if the driver has successfully
-probed, and the case of a NULL pointer case will be handled by the clock
-core layer.  The driver data is always valid after probe. Therefore,
-remove the related checks.  Also in the resume flow adds error handling.
-
-Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
-Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Tested-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../hwtracing/coresight/coresight-tmc-core.c  | 22 ++++++++++++++-----
- drivers/hwtracing/coresight/coresight-tmc.h   |  2 ++
- 2 files changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
-index 88afb16bb6bec..0b5e7635a084d 100644
---- a/drivers/hwtracing/coresight/coresight-tmc-core.c
-+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
-@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
- 	struct coresight_desc desc = { 0 };
- 	struct coresight_dev_list *dev_list = NULL;
- 
-+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
-+	if (IS_ERR(drvdata->atclk))
-+		return PTR_ERR(drvdata->atclk);
-+
- 	ret = -ENOMEM;
- 
- 	/* Validity for the resource is already checked by the AMBA core */
-@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev)
- {
- 	struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
- 
--	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_disable_unprepare(drvdata->pclk);
-+	clk_disable_unprepare(drvdata->atclk);
-+	clk_disable_unprepare(drvdata->pclk);
-+
- 	return 0;
- }
- 
- static int tmc_runtime_resume(struct device *dev)
- {
- 	struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
-+	int ret;
- 
--	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
--		clk_prepare_enable(drvdata->pclk);
--	return 0;
-+	ret = clk_prepare_enable(drvdata->pclk);
-+	if (ret)
-+		return ret;
-+
-+	ret = clk_prepare_enable(drvdata->atclk);
-+	if (ret)
-+		clk_disable_unprepare(drvdata->pclk);
-+
-+	return ret;
- }
- #endif
- 
-diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
-index 6541a27a018e6..cbb4ba4391585 100644
---- a/drivers/hwtracing/coresight/coresight-tmc.h
-+++ b/drivers/hwtracing/coresight/coresight-tmc.h
-@@ -210,6 +210,7 @@ struct tmc_resrv_buf {
- 
- /**
-  * struct tmc_drvdata - specifics associated to an TMC component
-+ * @atclk:	optional clock for the core parts of the TMC.
-  * @pclk:	APB clock if present, otherwise NULL
-  * @base:	memory mapped base address for this component.
-  * @csdev:	component vitals needed by the framework.
-@@ -244,6 +245,7 @@ struct tmc_resrv_buf {
-  *		 Used by ETR/ETF.
-  */
- struct tmc_drvdata {
-+	struct clk		*atclk;
- 	struct clk		*pclk;
- 	void __iomem		*base;
- 	struct coresight_device	*csdev;
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch b/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
deleted file mode 100644
index 144e938cb5..0000000000
--- a/queue-6.16/coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 1a902c3b480ae7c5a3be856c3917001351cf3f18 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 6 Sep 2025 07:53:04 +0800
-Subject: coresight: tpda: fix the logic to setup the element size
-
-From: Jie Gan <jie.gan@oss.qualcomm.com>
-
-[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]
-
-Some TPDM devices support both CMB and DSB datasets, requiring
-the system to enable the port with both corresponding element sizes.
-
-Currently, the logic treats tpdm_read_element_size as successful if
-the CMB element size is retrieved correctly, regardless of whether
-the DSB element size is obtained. This behavior causes issues
-when parsing data from TPDM devices that depend on both element sizes.
-
-To address this, the function should explicitly fail if the DSB
-element size cannot be read correctly.
-
-Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
-Reviewed-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
-index 0633f04beb240..333b3cb236859 100644
---- a/drivers/hwtracing/coresight/coresight-tpda.c
-+++ b/drivers/hwtracing/coresight/coresight-tpda.c
-@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
- 	if (tpdm_data->dsb) {
- 		rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
- 				"qcom,dsb-element-bits", &drvdata->dsb_esize);
-+		if (rc)
-+			goto out;
- 	}
- 
- 	if (tpdm_data->cmb) {
-@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
- 				"qcom,cmb-element-bits", &drvdata->cmb_esize);
- 	}
- 
-+out:
- 	if (rc)
- 		dev_warn_once(&csdev->dev,
- 			"Failed to read TPDM Element size: %d\n", rc);
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch b/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch
deleted file mode 100644
index 601103b495..0000000000
--- a/queue-6.16/coresight-trbe-add-isb-after-trblimitr-write.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 20743beaee4e3272a6bc17140cec9fdc53ba2df2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 9 Jun 2025 11:19:05 +0100
-Subject: coresight: trbe: Add ISB after TRBLIMITR write
-
-From: James Clark <james.clark@linaro.org>
-
-[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ]
-
-DEN0154 states that hardware will be allowed to ignore writes to TRB*
-registers while the trace buffer is enabled. Add an ISB to ensure that
-it's disabled before clearing the other registers.
-
-This is purely defensive because it's expected that arm_trbe_disable()
-would be called before teardown which has the required ISB.
-
-Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call")
-Signed-off-by: James Clark <james.clark@linaro.org>
-Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-trbe.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
-index 8f426f94e32a1..f78c9b9dc0087 100644
---- a/drivers/hwtracing/coresight/coresight-trbe.c
-+++ b/drivers/hwtracing/coresight/coresight-trbe.c
-@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata)
- static void trbe_reset_local(struct trbe_cpudata *cpudata)
- {
- 	write_sysreg_s(0, SYS_TRBLIMITR_EL1);
-+	isb();
- 	trbe_drain_buffer();
- 	write_sysreg_s(0, SYS_TRBPTR_EL1);
- 	write_sysreg_s(0, SYS_TRBBASER_EL1);
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch b/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch
deleted file mode 100644
index 319dc31911..0000000000
--- a/queue-6.16/coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 07309267ba1f574119a3a693871c940f5a951bcd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 18:41:38 +0100
-Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
-
-Cast nr_pages to unsigned long to avoid overflow when handling large
-AUX buffer sizes (>= 2 GiB).
-
-Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Will Deacon <will@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
-index 8267dd1a2130d..8f426f94e32a1 100644
---- a/drivers/hwtracing/coresight/coresight-trbe.c
-+++ b/drivers/hwtracing/coresight/coresight-trbe.c
-@@ -23,7 +23,8 @@
- #include "coresight-self-hosted-trace.h"
- #include "coresight-trbe.h"
- 
--#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
-+#define PERF_IDX2OFF(idx, buf) \
-+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
- 
- /*
-  * A padding packet that will help the user space tools
--- 
-2.51.0
-
diff --git a/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch b/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch
deleted file mode 100644
index c8963ed374..0000000000
--- a/queue-6.16/coresight-trbe-return-null-pointer-for-allocation-fa.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 6fb2315b34bfae66edc60821c18cedf626accec2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Sep 2025 15:13:52 +0100
-Subject: coresight: trbe: Return NULL pointer for allocation failures
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
-
-When the TRBE driver fails to allocate a buffer, it currently returns
-the error code "-ENOMEM". However, the caller etm_setup_aux() only
-checks for a NULL pointer, so it misses the error. As a result, the
-driver continues and eventually causes a kernel panic.
-
-Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
-allocation failures. This allows that the callers can properly handle
-the failure.
-
-Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
-Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Reviewed-by: James Clark <james.clark@linaro.org>
-Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
-Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
-index f78c9b9dc0087..3dd2e1b4809dc 100644
---- a/drivers/hwtracing/coresight/coresight-trbe.c
-+++ b/drivers/hwtracing/coresight/coresight-trbe.c
-@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
- 
- 	buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
- 	if (!buf)
--		return ERR_PTR(-ENOMEM);
-+		return NULL;
- 
- 	pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
- 	if (!pglist) {
- 		kfree(buf);
--		return ERR_PTR(-ENOMEM);
-+		return NULL;
- 	}
- 
- 	for (i = 0; i < nr_pages; i++)
-@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
- 	if (!buf->trbe_base) {
- 		kfree(pglist);
- 		kfree(buf);
--		return ERR_PTR(-ENOMEM);
-+		return NULL;
- 	}
- 	buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
- 	buf->trbe_write = buf->trbe_base;
--- 
-2.51.0
-
diff --git a/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch b/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
deleted file mode 100644
index 03d825a57b..0000000000
--- a/queue-6.16/cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 3afa6de133b3aa596de54a40cd775d317133a108 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 18 Aug 2025 08:50:48 -0700
-Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
-
-From: Florian Fainelli <florian.fainelli@broadcom.com>
-
-[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
-
-Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
-a result, not all deployed systems have a Device Tree entry where SCMI
-protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
-CPU Device Tree node(s) referencing protocol 0x13 as their clock
-provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
-firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
-
-For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
-to continue, and in the event of not having done an early return, we key
-off the documented compatible string and give them a pass to continue to
-use scmi-cpufreq.
-
-Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
-Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
-Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
-Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
-index ef078426bfd51..38c165d526d14 100644
---- a/drivers/cpufreq/scmi-cpufreq.c
-+++ b/drivers/cpufreq/scmi-cpufreq.c
-@@ -15,6 +15,7 @@
- #include <linux/energy_model.h>
- #include <linux/export.h>
- #include <linux/module.h>
-+#include <linux/of.h>
- #include <linux/pm_opp.h>
- #include <linux/pm_qos.h>
- #include <linux/slab.h>
-@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
- 			return true;
- 	}
- 
-+	/*
-+	 * Older Broadcom STB chips had a "clocks" property for CPU node(s)
-+	 * that did not match the SCMI performance protocol node, if we got
-+	 * there, it means we had such an older Device Tree, therefore return
-+	 * true to preserve backwards compatibility.
-+	 */
-+	if (of_machine_is_compatible("brcm,brcmstb"))
-+		return true;
-+
- 	return false;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch b/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
deleted file mode 100644
index c1847bed11..0000000000
--- a/queue-6.16/cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 3ec92c313a1d3fee4e397bb23e87c6771a2d0ae4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 8 Sep 2025 17:22:12 +0200
-Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
-
-From: Johan Hovold <johan@kernel.org>
-
-[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
-
-Make sure to drop the reference to the saw device taken by
-of_find_device_by_node() after retrieving its driver data during
-probe().
-
-Also drop the reference to the CPU node sooner to avoid leaking it in
-case there is no saw node or device.
-
-Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
-index 5f386761b1562..f60a4cf536423 100644
---- a/drivers/cpuidle/cpuidle-qcom-spm.c
-+++ b/drivers/cpuidle/cpuidle-qcom-spm.c
-@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
- 		return -ENODEV;
- 
- 	saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
-+	of_node_put(cpu_node);
- 	if (!saw_node)
- 		return -ENODEV;
- 
- 	pdev = of_find_device_by_node(saw_node);
- 	of_node_put(saw_node);
--	of_node_put(cpu_node);
- 	if (!pdev)
- 		return -ENODEV;
- 
- 	data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
--	if (!data)
-+	if (!data) {
-+		put_device(&pdev->dev);
- 		return -ENOMEM;
-+	}
- 
- 	data->spm = dev_get_drvdata(&pdev->dev);
-+	put_device(&pdev->dev);
- 	if (!data->spm)
- 		return -EINVAL;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch b/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch
deleted file mode 100644
index 6d7f899714..0000000000
--- a/queue-6.16/cpuset-fix-failure-to-enable-isolated-partition-when.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 9a90f37fbf162324e12134e501e439b413f34cad Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 01:12:26 +0000
-Subject: cpuset: fix failure to enable isolated partition when containing
- isolcpus
-
-From: Chen Ridong <chenridong@huawei.com>
-
-[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ]
-
-The 'isolcpus' parameter specified at boot time can be assigned to an
-isolated partition. While it is valid put the 'isolcpus' in an isolated
-partition, attempting to change a member cpuset to an isolated partition
-will fail if the cpuset contains any 'isolcpus'.
-
-For example, the system boots with 'isolcpus=9', and the following
-configuration works correctly:
-
-  # cd /sys/fs/cgroup/
-  # mkdir test
-  # echo 1 > test/cpuset.cpus
-  # echo isolated > test/cpuset.cpus.partition
-  # cat test/cpuset.cpus.partition
-  isolated
-  # echo 9 > test/cpuset.cpus
-  # cat test/cpuset.cpus.partition
-  isolated
-  # cat test/cpuset.cpus
-  9
-
-However, the following steps to convert a member cpuset to an isolated
-partition will fail:
-
-  # cd /sys/fs/cgroup/
-  # mkdir test
-  # echo 9 > test/cpuset.cpus
-  # echo isolated > test/cpuset.cpus.partition
-  # cat test/cpuset.cpus.partition
-  isolated invalid (partition config conflicts with housekeeping setup)
-
-The issue occurs because the new partition state (new_prs) is used for
-validation against housekeeping constraints before it has been properly
-updated. To resolve this, move the assignment of new_prs before the
-housekeeping validation check when enabling a root partition.
-
-Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup")
-Signed-off-by: Chen Ridong <chenridong@huawei.com>
-Reviewed-by: Waiman Long <longman@redhat.com>
-Signed-off-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/cgroup/cpuset.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
-index f9d7799c5c947..9e1fc18549059 100644
---- a/kernel/cgroup/cpuset.c
-+++ b/kernel/cgroup/cpuset.c
-@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
- 		xcpus = tmp->delmask;
- 		if (compute_effective_exclusive_cpumask(cs, xcpus, NULL))
- 			WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus));
-+		new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
- 
- 		/*
- 		 * Enabling partition root is not allowed if its
-@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
- 
- 		deleting = true;
- 		subparts_delta++;
--		new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
- 	} else if (cmd == partcmd_disable) {
- 		/*
- 		 * May need to add cpus back to parent's effective_cpus
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch b/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch
deleted file mode 100644
index e4abacf055..0000000000
--- a/queue-6.16/crypto-hisilicon-check-the-sva-module-status-while-e.patch
+++ /dev/null
@@ -1,366 +0,0 @@
-From f91dbbd9af48c04447a7e984c5de77a16838601a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 09:38:06 +0800
-Subject: crypto: hisilicon - check the sva module status while enabling or
- disabling address prefetch
-
-From: Weili Qian <qianweili@huawei.com>
-
-[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ]
-
-After enabling address prefetch, check the sva module status. If all
-previous prefetch requests from the sva module are not completed, then
-disable the address prefetch to ensure normal execution of new task
-operations. After disabling address prefetch, check if all requests
-from the sva module have been completed.
-
-Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching")
-Signed-off-by: Weili Qian <qianweili@huawei.com>
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++----
- drivers/crypto/hisilicon/sec2/sec_main.c  | 48 +++++++++++++-
- drivers/crypto/hisilicon/zip/zip_main.c   | 79 +++++++++++++++++++----
- 3 files changed, 164 insertions(+), 26 deletions(-)
-
-diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
-index 34f84978180f0..7b60e89015bdf 100644
---- a/drivers/crypto/hisilicon/hpre/hpre_main.c
-+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
-@@ -78,6 +78,11 @@
- #define HPRE_PREFETCH_ENABLE		(~(BIT(0) | BIT(30)))
- #define HPRE_PREFETCH_DISABLE		BIT(30)
- #define HPRE_SVA_DISABLE_READY		(BIT(4) | BIT(8))
-+#define HPRE_SVA_PREFTCH_DFX4		0x301144
-+#define HPRE_WAIT_SVA_READY		500000
-+#define HPRE_READ_SVA_STATUS_TIMES	3
-+#define HPRE_WAIT_US_MIN		10
-+#define HPRE_WAIT_US_MAX		20
- 
- /* clock gate */
- #define HPRE_CLKGATE_CTL		0x301a10
-@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type)
- 	return NULL;
- }
- 
-+static int hpre_wait_sva_ready(struct hisi_qm *qm)
-+{
-+	u32 val, try_times = 0;
-+	u8 count = 0;
-+
-+	/*
-+	 * Read the register value every 10-20us. If the value is 0 for three
-+	 * consecutive times, the SVA module is ready.
-+	 */
-+	do {
-+		val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4);
-+		if (val)
-+			count = 0;
-+		else if (++count == HPRE_READ_SVA_STATUS_TIMES)
-+			break;
-+
-+		usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX);
-+	} while (++try_times < HPRE_WAIT_SVA_READY);
-+
-+	if (try_times == HPRE_WAIT_SVA_READY) {
-+		pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
-+		return -ETIMEDOUT;
-+	}
-+
-+	return 0;
-+}
-+
- static void hpre_config_pasid(struct hisi_qm *qm)
- {
- 	u32 val1, val2;
-@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm)
- 	writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE);
- }
- 
--static void hpre_open_sva_prefetch(struct hisi_qm *qm)
-+static void hpre_close_sva_prefetch(struct hisi_qm *qm)
- {
- 	u32 val;
- 	int ret;
-@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm)
- 	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- 		return;
- 
--	/* Enable prefetch */
- 	val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
--	val &= HPRE_PREFETCH_ENABLE;
-+	val |= HPRE_PREFETCH_DISABLE;
- 	writel(val, qm->io_base + HPRE_PREFETCH_CFG);
- 
--	ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
--					 val, !(val & HPRE_PREFETCH_DISABLE),
-+	ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
-+					 val, !(val & HPRE_SVA_DISABLE_READY),
- 					 HPRE_REG_RD_INTVRL_US,
- 					 HPRE_REG_RD_TMOUT_US);
- 	if (ret)
--		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+
-+	(void)hpre_wait_sva_ready(qm);
- }
- 
--static void hpre_close_sva_prefetch(struct hisi_qm *qm)
-+static void hpre_open_sva_prefetch(struct hisi_qm *qm)
- {
- 	u32 val;
- 	int ret;
-@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm)
- 	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- 		return;
- 
-+	/* Enable prefetch */
- 	val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
--	val |= HPRE_PREFETCH_DISABLE;
-+	val &= HPRE_PREFETCH_ENABLE;
- 	writel(val, qm->io_base + HPRE_PREFETCH_CFG);
- 
--	ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
--					 val, !(val & HPRE_SVA_DISABLE_READY),
-+	ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
-+					 val, !(val & HPRE_PREFETCH_DISABLE),
- 					 HPRE_REG_RD_INTVRL_US,
- 					 HPRE_REG_RD_TMOUT_US);
-+	if (ret) {
-+		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+		hpre_close_sva_prefetch(qm);
-+		return;
-+	}
-+
-+	ret = hpre_wait_sva_ready(qm);
- 	if (ret)
--		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+		hpre_close_sva_prefetch(qm);
- }
- 
- static void hpre_enable_clock_gate(struct hisi_qm *qm)
-diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
-index ddb20f380b546..348f1f52956dc 100644
---- a/drivers/crypto/hisilicon/sec2/sec_main.c
-+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
-@@ -93,6 +93,16 @@
- #define SEC_PREFETCH_ENABLE		(~(BIT(0) | BIT(1) | BIT(11)))
- #define SEC_PREFETCH_DISABLE		BIT(1)
- #define SEC_SVA_DISABLE_READY		(BIT(7) | BIT(11))
-+#define SEC_SVA_PREFETCH_INFO		0x301ED4
-+#define SEC_SVA_STALL_NUM		GENMASK(23, 8)
-+#define SEC_SVA_PREFETCH_NUM		GENMASK(2, 0)
-+#define SEC_WAIT_SVA_READY		500000
-+#define SEC_READ_SVA_STATUS_TIMES	3
-+#define SEC_WAIT_US_MIN			10
-+#define SEC_WAIT_US_MAX			20
-+#define SEC_WAIT_QP_US_MIN		1000
-+#define SEC_WAIT_QP_US_MAX		2000
-+#define SEC_MAX_WAIT_TIMES		2000
- 
- #define SEC_DELAY_10_US			10
- #define SEC_POLL_TIMEOUT_US		1000
-@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm)
- 	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
- }
- 
-+static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
-+{
-+	u32 val, try_times = 0;
-+	u8 count = 0;
-+
-+	/*
-+	 * Read the register value every 10-20us. If the value is 0 for three
-+	 * consecutive times, the SVA module is ready.
-+	 */
-+	do {
-+		val = readl(qm->io_base + offset);
-+		if (val & mask)
-+			count = 0;
-+		else if (++count == SEC_READ_SVA_STATUS_TIMES)
-+			break;
-+
-+		usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX);
-+	} while (++try_times < SEC_WAIT_SVA_READY);
-+
-+	if (try_times == SEC_WAIT_SVA_READY) {
-+		pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
-+		return -ETIMEDOUT;
-+	}
-+
-+	return 0;
-+}
-+
- static void sec_close_sva_prefetch(struct hisi_qm *qm)
- {
- 	u32 val;
-@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm)
- 					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
- 	if (ret)
- 		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+
-+	(void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM);
- }
- 
- static void sec_open_sva_prefetch(struct hisi_qm *qm)
-@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm)
- 	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
- 					 val, !(val & SEC_PREFETCH_DISABLE),
- 					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
--	if (ret)
-+	if (ret) {
- 		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+		sec_close_sva_prefetch(qm);
-+		return;
-+	}
-+
-+	ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM);
-+	if (ret)
-+		sec_close_sva_prefetch(qm);
- }
- 
- static void sec_engine_sva_config(struct hisi_qm *qm)
-diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
-index 480fa590664a8..341c4564e21aa 100644
---- a/drivers/crypto/hisilicon/zip/zip_main.c
-+++ b/drivers/crypto/hisilicon/zip/zip_main.c
-@@ -95,10 +95,16 @@
- #define HZIP_PREFETCH_ENABLE		(~(BIT(26) | BIT(17) | BIT(0)))
- #define HZIP_SVA_PREFETCH_DISABLE	BIT(26)
- #define HZIP_SVA_DISABLE_READY		(BIT(26) | BIT(30))
-+#define HZIP_SVA_PREFETCH_NUM		GENMASK(18, 16)
-+#define HZIP_SVA_STALL_NUM		GENMASK(15, 0)
- #define HZIP_SHAPER_RATE_COMPRESS	750
- #define HZIP_SHAPER_RATE_DECOMPRESS	140
--#define HZIP_DELAY_1_US		1
--#define HZIP_POLL_TIMEOUT_US	1000
-+#define HZIP_DELAY_1_US			1
-+#define HZIP_POLL_TIMEOUT_US		1000
-+#define HZIP_WAIT_SVA_READY		500000
-+#define HZIP_READ_SVA_STATUS_TIMES	3
-+#define HZIP_WAIT_US_MIN		10
-+#define HZIP_WAIT_US_MAX		20
- 
- /* clock gating */
- #define HZIP_PEH_CFG_AUTO_GATE		0x3011A8
-@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm)
- 	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
- }
- 
--static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
-+static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
-+{
-+	u32 val, try_times = 0;
-+	u8 count = 0;
-+
-+	/*
-+	 * Read the register value every 10-20us. If the value is 0 for three
-+	 * consecutive times, the SVA module is ready.
-+	 */
-+	do {
-+		val = readl(qm->io_base + offset);
-+		if (val & mask)
-+			count = 0;
-+		else if (++count == HZIP_READ_SVA_STATUS_TIMES)
-+			break;
-+
-+		usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX);
-+	} while (++try_times < HZIP_WAIT_SVA_READY);
-+
-+	if (try_times == HZIP_WAIT_SVA_READY) {
-+		pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
-+		return -ETIMEDOUT;
-+	}
-+
-+	return 0;
-+}
-+
-+static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
- {
- 	u32 val;
- 	int ret;
-@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
- 	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- 		return;
- 
--	/* Enable prefetch */
- 	val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
--	val &= HZIP_PREFETCH_ENABLE;
-+	val |= HZIP_SVA_PREFETCH_DISABLE;
- 	writel(val, qm->io_base + HZIP_PREFETCH_CFG);
- 
--	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
--					 val, !(val & HZIP_SVA_PREFETCH_DISABLE),
-+	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
-+					 val, !(val & HZIP_SVA_DISABLE_READY),
- 					 HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
- 	if (ret)
--		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+
-+	(void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM);
- }
- 
--static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
-+static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
- {
- 	u32 val;
- 	int ret;
-@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
- 	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
- 		return;
- 
-+	/* Enable prefetch */
- 	val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
--	val |= HZIP_SVA_PREFETCH_DISABLE;
-+	val &= HZIP_PREFETCH_ENABLE;
- 	writel(val, qm->io_base + HZIP_PREFETCH_CFG);
- 
--	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
--					 val, !(val & HZIP_SVA_DISABLE_READY),
-+	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
-+					 val, !(val & HZIP_SVA_PREFETCH_DISABLE),
- 					 HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
-+	if (ret) {
-+		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+		hisi_zip_close_sva_prefetch(qm);
-+		return;
-+	}
-+
-+	ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM);
- 	if (ret)
--		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+		hisi_zip_close_sva_prefetch(qm);
- }
- 
- static void hisi_zip_enable_clock_gate(struct hisi_qm *qm)
-@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
- 	void __iomem *base = qm->io_base;
- 	u32 dcomp_bm, comp_bm;
- 	u32 zip_core_en;
-+	int ret;
- 
- 	/* qm user domain */
- 	writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1);
-@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
- 	hisi_zip_set_high_perf(qm);
- 	hisi_zip_enable_clock_gate(qm);
- 
--	return hisi_dae_set_user_domain(qm);
-+	ret = hisi_dae_set_user_domain(qm);
-+	if (ret)
-+		goto close_sva_prefetch;
-+
-+	return 0;
-+
-+close_sva_prefetch:
-+	hisi_zip_close_sva_prefetch(qm);
-+	return ret;
- }
- 
- static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable)
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch b/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch
deleted file mode 100644
index 51fcdbc0b7..0000000000
--- a/queue-6.16/crypto-hisilicon-qm-check-whether-the-input-function.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 34143e1dd1528ff8c990d72418999d44e9773070 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 09:38:07 +0800
-Subject: crypto: hisilicon/qm - check whether the input function and PF are on
- the same device
-
-From: Zhushuai Yin <yinzhushuai@huawei.com>
-
-[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
-
-Function rate limiting is set through physical function driver.
-Users configure by providing function information and rate limit values.
-Before configuration, it is necessary to check whether the
-provided function and PF belong to the same device.
-
-Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
-Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/qm.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
-index 2b7b4b2033de4..56d80fc943bee 100644
---- a/drivers/crypto/hisilicon/qm.c
-+++ b/drivers/crypto/hisilicon/qm.c
-@@ -3827,6 +3827,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
- 	}
- 
- 	pdev = container_of(dev, struct pci_dev, dev);
-+	if (pci_physfn(pdev) != qm->pdev) {
-+		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
-+		return -EINVAL;
-+	}
- 
- 	*fun_index = pdev->devfn;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch b/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
deleted file mode 100644
index 1a808220af..0000000000
--- a/queue-6.16/crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 3be5fe6c71604a53996d8868964fdbf4a8227a88 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 09:38:08 +0800
-Subject: crypto: hisilicon/qm - request reserved interrupt for virtual
- function
-
-From: Weili Qian <qianweili@huawei.com>
-
-[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ]
-
-The device interrupt vector 3 is an error interrupt for
-physical function and a reserved interrupt for virtual function.
-However, the driver has not registered the reserved interrupt for
-virtual function. When allocating interrupts, the number of interrupts
-is allocated based on powers of two, which includes this interrupt.
-When the system enables GICv4 and the virtual function passthrough
-to the virtual machine, releasing the interrupt in the driver
-triggers a warning.
-
-The WARNING report is:
-WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4
-
-Therefore, register a reserved interrupt for VF and set the
-IRQF_NO_AUTOEN flag to avoid that warning.
-
-Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
-Signed-off-by: Weili Qian <qianweili@huawei.com>
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------
- 1 file changed, 32 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
-index 56d80fc943bee..4f97806f6241b 100644
---- a/drivers/crypto/hisilicon/qm.c
-+++ b/drivers/crypto/hisilicon/qm.c
-@@ -4733,6 +4733,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev)
- }
- EXPORT_SYMBOL_GPL(hisi_qm_reset_done);
- 
-+static irqreturn_t qm_rsvd_irq(int irq, void *data)
-+{
-+	struct hisi_qm *qm = data;
-+
-+	dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n");
-+
-+	return IRQ_HANDLED;
-+}
-+
- static irqreturn_t qm_abnormal_irq(int irq, void *data)
- {
- 	struct hisi_qm *qm = data;
-@@ -5016,7 +5025,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
- 	struct pci_dev *pdev = qm->pdev;
- 	u32 irq_vector, val;
- 
--	if (qm->fun_type == QM_HW_VF)
-+	if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3)
- 		return;
- 
- 	val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
-@@ -5033,17 +5042,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
- 	u32 irq_vector, val;
- 	int ret;
- 
--	if (qm->fun_type == QM_HW_VF)
--		return 0;
--
- 	val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
- 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
- 		return 0;
--
- 	irq_vector = val & QM_IRQ_VECTOR_MASK;
-+
-+	/* For VF, this is a reserved interrupt in V3 version. */
-+	if (qm->fun_type == QM_HW_VF) {
-+		if (qm->ver < QM_HW_V3)
-+			return 0;
-+
-+		ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq,
-+				  IRQF_NO_AUTOEN, qm->dev_name, qm);
-+		if (ret) {
-+			dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret);
-+			return ret;
-+		}
-+		return 0;
-+	}
-+
- 	ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm);
- 	if (ret)
--		dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret);
-+		dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret);
- 
- 	return ret;
- }
-@@ -5409,6 +5429,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm)
- 	pci_set_master(pdev);
- 
- 	num_vec = qm_get_irq_num(qm);
-+	if (!num_vec) {
-+		dev_err(dev, "Device irq num is zero!\n");
-+		ret = -EINVAL;
-+		goto err_get_pci_res;
-+	}
-+	num_vec = roundup_pow_of_two(num_vec);
- 	ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI);
- 	if (ret < 0) {
- 		dev_err(dev, "Failed to enable MSI vectors!\n");
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch b/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
deleted file mode 100644
index e1cdbdc10c..0000000000
--- a/queue-6.16/crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8bf2673e9d899b8be6d9d60150277a840d1fdd35 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 13 Sep 2025 18:57:54 +0800
-Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
-
-From: Chenghai Huang <huangchenghai2@huawei.com>
-
-[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
-
-When the initialization of qm->debug.acc_diff_reg fails,
-the probe process does not exit. However, after qm->debug.qm_diff_regs is
-freed, it is not set to NULL. This can lead to a double free when the
-remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
-should be set to NULL after it is freed.
-
-Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/debugfs.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
-index 45e130b901eb5..17eb236e9ee4d 100644
---- a/drivers/crypto/hisilicon/debugfs.c
-+++ b/drivers/crypto/hisilicon/debugfs.c
-@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
- 		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
- 		ret = PTR_ERR(qm->debug.acc_diff_regs);
- 		qm->debug.acc_diff_regs = NULL;
-+		qm->debug.qm_diff_regs = NULL;
- 		return ret;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch b/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch
deleted file mode 100644
index 2704114429..0000000000
--- a/queue-6.16/crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-From d491e8033750daf3b9bd6daa7b63703561385703 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 09:38:05 +0800
-Subject: crypto: hisilicon - re-enable address prefetch after device resuming
-
-From: Chenghai Huang <huangchenghai2@huawei.com>
-
-[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
-
-When the device resumes from a suspended state, it will revert to its
-initial state and requires re-enabling. Currently, the address prefetch
-function is not re-enabled after device resuming. Move the address prefetch
-enable to the initialization process. In this way, the address prefetch
-can be enabled when the device resumes by calling the initialization
-process.
-
-Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/hpre/hpre_main.c |  3 +-
- drivers/crypto/hisilicon/qm.c             |  3 -
- drivers/crypto/hisilicon/sec2/sec_main.c  | 80 +++++++++++------------
- drivers/crypto/hisilicon/zip/zip_main.c   |  5 +-
- 4 files changed, 43 insertions(+), 48 deletions(-)
-
-diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
-index f5b47e5ff48a4..34f84978180f0 100644
---- a/drivers/crypto/hisilicon/hpre/hpre_main.c
-+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
-@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
- 
- 	/* Config data buffer pasid needed by Kunpeng 920 */
- 	hpre_config_pasid(qm);
-+	hpre_open_sva_prefetch(qm);
- 
- 	hpre_enable_clock_gate(qm);
- 
-@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
- 	if (ret)
- 		return ret;
- 
--	hpre_open_sva_prefetch(qm);
--
- 	hisi_qm_dev_err_init(qm);
- 	ret = hpre_show_last_regs_init(qm);
- 	if (ret)
-diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
-index 7c41f9593d039..2b7b4b2033de4 100644
---- a/drivers/crypto/hisilicon/qm.c
-+++ b/drivers/crypto/hisilicon/qm.c
-@@ -4448,9 +4448,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
- {
- 	u32 value;
- 
--	if (qm->err_ini->open_sva_prefetch)
--		qm->err_ini->open_sva_prefetch(qm);
--
- 	if (qm->ver >= QM_HW_V3)
- 		return;
- 
-diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
-index 72cf48d1f3ab8..ddb20f380b546 100644
---- a/drivers/crypto/hisilicon/sec2/sec_main.c
-+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
-@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm)
- 	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
- }
- 
-+static void sec_close_sva_prefetch(struct hisi_qm *qm)
-+{
-+	u32 val;
-+	int ret;
-+
-+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-+		return;
-+
-+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-+	val |= SEC_PREFETCH_DISABLE;
-+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-+
-+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
-+					 val, !(val & SEC_SVA_DISABLE_READY),
-+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-+	if (ret)
-+		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+}
-+
-+static void sec_open_sva_prefetch(struct hisi_qm *qm)
-+{
-+	u32 val;
-+	int ret;
-+
-+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-+		return;
-+
-+	/* Enable prefetch */
-+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-+	val &= SEC_PREFETCH_ENABLE;
-+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-+
-+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
-+					 val, !(val & SEC_PREFETCH_DISABLE),
-+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-+	if (ret)
-+		pci_err(qm->pdev, "failed to open sva prefetch\n");
-+}
-+
- static void sec_engine_sva_config(struct hisi_qm *qm)
- {
- 	u32 reg;
-@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
- 		writel_relaxed(reg, qm->io_base +
- 				SEC_INTERFACE_USER_CTRL1_REG);
- 	}
--}
--
--static void sec_open_sva_prefetch(struct hisi_qm *qm)
--{
--	u32 val;
--	int ret;
--
--	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
--		return;
--
--	/* Enable prefetch */
--	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
--	val &= SEC_PREFETCH_ENABLE;
--	writel(val, qm->io_base + SEC_PREFETCH_CFG);
--
--	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
--					 val, !(val & SEC_PREFETCH_DISABLE),
--					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
--	if (ret)
--		pci_err(qm->pdev, "failed to open sva prefetch\n");
--}
--
--static void sec_close_sva_prefetch(struct hisi_qm *qm)
--{
--	u32 val;
--	int ret;
--
--	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
--		return;
--
--	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
--	val |= SEC_PREFETCH_DISABLE;
--	writel(val, qm->io_base + SEC_PREFETCH_CFG);
--
--	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
--					 val, !(val & SEC_SVA_DISABLE_READY),
--					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
--	if (ret)
--		pci_err(qm->pdev, "failed to close sva prefetch\n");
-+	sec_open_sva_prefetch(qm);
- }
- 
- static void sec_enable_clock_gate(struct hisi_qm *qm)
-@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
- 	if (ret)
- 		return ret;
- 
--	sec_open_sva_prefetch(qm);
- 	hisi_qm_dev_err_init(qm);
- 	sec_debug_regs_clear(qm);
- 	ret = sec_show_last_regs_init(qm);
-diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
-index fb7b19927dd32..480fa590664a8 100644
---- a/drivers/crypto/hisilicon/zip/zip_main.c
-+++ b/drivers/crypto/hisilicon/zip/zip_main.c
-@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
- 		writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
- 		writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
- 	}
-+	hisi_zip_open_sva_prefetch(qm);
- 
- 	/* let's open all compression/decompression cores */
- 
-@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
- 	       CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
- 	       FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
- 
-+	hisi_zip_set_high_perf(qm);
- 	hisi_zip_enable_clock_gate(qm);
- 
- 	return hisi_dae_set_user_domain(qm);
-@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
- 	if (ret)
- 		return ret;
- 
--	hisi_zip_set_high_perf(qm);
--
--	hisi_zip_open_sva_prefetch(qm);
- 	hisi_qm_dev_err_init(qm);
- 	hisi_zip_debug_regs_clear(qm);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch b/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
deleted file mode 100644
index c34bfff201..0000000000
--- a/queue-6.16/crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From b3e79420f39b4e5ae75ba5a09c79453aa7f895a0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 09:38:04 +0800
-Subject: crypto: hisilicon/zip - remove unnecessary validation for
- high-performance mode configurations
-
-From: Chenghai Huang <huangchenghai2@huawei.com>
-
-[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
-
-When configuring the high-performance mode register, there is no
-need to verify whether the register has been successfully
-enabled, as there is no possibility of a write failure for this
-register.
-
-Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
-Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
- 1 file changed, 2 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
-index d8ba23b7cc7dd..fb7b19927dd32 100644
---- a/drivers/crypto/hisilicon/zip/zip_main.c
-+++ b/drivers/crypto/hisilicon/zip/zip_main.c
-@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
- 	return false;
- }
- 
--static int hisi_zip_set_high_perf(struct hisi_qm *qm)
-+static void hisi_zip_set_high_perf(struct hisi_qm *qm)
- {
- 	u32 val;
--	int ret;
- 
- 	val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
- 	if (perf_mode == HZIP_HIGH_COMP_PERF)
-@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
- 
- 	/* Set perf mode */
- 	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
--	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
--					 val, val == perf_mode, HZIP_DELAY_1_US,
--					 HZIP_POLL_TIMEOUT_US);
--	if (ret)
--		pci_err(qm->pdev, "failed to set perf mode\n");
--
--	return ret;
- }
- 
- static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
-@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
- 	if (ret)
- 		return ret;
- 
--	ret = hisi_zip_set_high_perf(qm);
--	if (ret)
--		return ret;
-+	hisi_zip_set_high_perf(qm);
- 
- 	hisi_zip_open_sva_prefetch(qm);
- 	hisi_qm_dev_err_init(qm);
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch b/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch
deleted file mode 100644
index 9119874460..0000000000
--- a/queue-6.16/crypto-keembay-add-missing-check-after-sg_nents_for_.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 117e481df8d43017446133478cca12f38de23749 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Jul 2025 14:03:30 +0200
-Subject: crypto: keembay - Add missing check after sg_nents_for_len()
-
-From: Thomas Fourier <fourier.thomas@gmail.com>
-
-[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
-
-sg_nents_for_len() returns an int which is negative in case of error.
-
-Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
-Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
-index 8f9e21ced0fe1..48281d8822603 100644
---- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
-+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
-@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
- 	struct device *dev = rctx->hcu_dev->dev;
- 	unsigned int remainder = 0;
- 	unsigned int total;
--	size_t nents;
-+	int nents;
- 	size_t count;
- 	int rc;
- 	int i;
-@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
- 	/* Determine the number of scatter gather list entries to process. */
- 	nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
- 
-+	if (nents < 0)
-+		return nents;
-+
- 	/* If there are entries to process, map them. */
- 	if (nents) {
- 		rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
--- 
-2.51.0
-
diff --git a/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch b/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
deleted file mode 100644
index 0bd5c3fe45..0000000000
--- a/queue-6.16/crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 09d4f409fd6d302971b34a3b54c0803ad76a28fd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 11:24:57 +0200
-Subject: crypto: octeontx2 - Call strscpy() with correct size argument
-
-From: Thorsten Blum <thorsten.blum@linux.dev>
-
-[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]
-
-In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
-of the source string rather than the size of the destination buffer.
-
-This is fine as long as the destination buffer is larger than the source
-string, but we should still use the destination buffer size instead to
-call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
-we can safely omit the size argument and let strscpy() infer it using
-sizeof().
-
-Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
-Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
-index cc47e361089a0..ebdf4efa09d4d 100644
---- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
-+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
-@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
- 		return -EINVAL;
- 	}
- 	err_msg = "Invalid engine group format";
--	strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
-+	strscpy(tmp_buf, ctx->val.vstr);
- 	start = tmp_buf;
- 
- 	has_se = has_ie = has_ae = false;
--- 
-2.51.0
-
diff --git a/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch b/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
deleted file mode 100644
index 02974fa5b6..0000000000
--- a/queue-6.16/dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 30216dd0c690f0a837200ef09c9a7e62eb5ebe69 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 23:22:38 +0300
-Subject: dm vdo: return error on corrupted metadata in start_restoring_volume
- functions
-
-From: Ivan Abramov <i.abramov@mt-integration.ru>
-
-[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]
-
-The return values of VDO_ASSERT calls that validate metadata are not acted
-upon.
-
-Return UDS_CORRUPT_DATA in case of an error.
-
-Found by Linux Verification Center (linuxtesting.org) with SVACE.
-
-Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
-Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
-Reviewed-by: Matthew Sakai <msakai@redhat.com>
-Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
-index 12f954a0c5325..afb062e1f1fb4 100644
---- a/drivers/md/dm-vdo/indexer/volume-index.c
-+++ b/drivers/md/dm-vdo/indexer/volume-index.c
-@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
- 				    "%zu bytes decoded of %zu expected", offset,
- 				    sizeof(buffer));
- 		if (result != VDO_SUCCESS)
--			result = UDS_CORRUPT_DATA;
-+			return UDS_CORRUPT_DATA;
- 
- 		if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
- 			return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
-@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
- 				    "%zu bytes decoded of %zu expected", offset,
- 				    sizeof(buffer));
- 		if (result != VDO_SUCCESS)
--			result = UDS_CORRUPT_DATA;
-+			return UDS_CORRUPT_DATA;
- 
- 		if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
- 			return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
--- 
-2.51.0
-
diff --git a/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch b/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
deleted file mode 100644
index 7c04fc738d..0000000000
--- a/queue-6.16/dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 48a2afd08c53a727913eb18a8b6b004d094f7fd6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 11:07:38 -0500
-Subject: dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation
-
-From: Nathan Lynch <nathan.lynch@amd.com>
-
-[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ]
-
-Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc
-warnings") inserted new documentation for @desc_free in the middle of
-@tx_submit's description.
-
-Put @tx_submit's description back together, matching the indentation
-style of the rest of the documentation for dma_async_tx_descriptor.
-
-Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings")
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
-Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/dmaengine.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
-index bb146c5ac3e4c..51e1e357892a0 100644
---- a/include/linux/dmaengine.h
-+++ b/include/linux/dmaengine.h
-@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops {
-  * @phys: physical address of the descriptor
-  * @chan: target channel for this operation
-  * @tx_submit: accept the descriptor, assign ordered cookie and mark the
-+ *	descriptor pending. To be pushed on .issue_pending() call
-  * @desc_free: driver's callback function to free a resusable descriptor
-  *	after completion
-- * descriptor pending. To be pushed on .issue_pending() call
-  * @callback: routine to call after this operation is complete
-  * @callback_result: error result from a DMA transaction
-  * @callback_param: general parameter to pass to the callback routine
--- 
-2.51.0
-
diff --git a/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch b/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch
deleted file mode 100644
index 362c243817..0000000000
--- a/queue-6.16/docs-iio-ad3552r-fix-malformed-code-block-directive.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From a7c29bbbde01bab45b827b6cf5dde74136b73369 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 18 Aug 2025 16:44:23 +0200
-Subject: docs: iio: ad3552r: Fix malformed code-block directive
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ]
-
-Missing required double dot and line break.
-
-Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver")
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Reviewed-by: David Lechner <dlechner@baylibre.com>
-Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- Documentation/iio/ad3552r.rst | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst
-index f5d59e4e86c7e..4274e35f503d9 100644
---- a/Documentation/iio/ad3552r.rst
-+++ b/Documentation/iio/ad3552r.rst
-@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``.
- Usage examples
- --------------
- 
--. code-block:: bash
-+.. code-block:: bash
-+
- 	root:/sys/bus/iio/devices/iio:device0# cat data_source
- 	normal
- 	root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source
--- 
-2.51.0
-
diff --git a/queue-6.16/documentation-trace-historgram-design-separate-sched.patch b/queue-6.16/documentation-trace-historgram-design-separate-sched.patch
deleted file mode 100644
index b320f6f301..0000000000
--- a/queue-6.16/documentation-trace-historgram-design-separate-sched.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 25222334ab4dd34266235a80c81aee8a3d663e45 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 12:42:01 +0700
-Subject: Documentation: trace: historgram-design: Separate sched_waking
- histogram section heading and the following diagram
-
-From: Bagas Sanjaya <bagasdotme@gmail.com>
-
-[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
-
-Section heading for sched_waking histogram is shown as normal paragraph
-instead due to codeblock marker for the following diagram being in the
-same line as the section underline. Separate them.
-
-Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
-Reviewed-by: Tom Zanussi <zanussi@kernel.org>
-Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
-Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
-Signed-off-by: Jonathan Corbet <corbet@lwn.net>
-Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- Documentation/trace/histogram-design.rst | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
-index 5765eb3e9efa7..a30f4bed11b4e 100644
---- a/Documentation/trace/histogram-design.rst
-+++ b/Documentation/trace/histogram-design.rst
-@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
- trigger above.
- 
- sched_waking histogram
------------------------::
-+----------------------
-+
-+.. code-block::
- 
-   +------------------+
-   | hist_data        |<-------------------------------------------------------+
--- 
-2.51.0
-
diff --git a/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch b/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch
deleted file mode 100644
index 9c8653c4ca..0000000000
--- a/queue-6.16/drivers-base-node-fix-double-free-in-register_one_no.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 8dca7cd8cf20f46eefacd2c95ece62025f497d00 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 11:11:44 +0530
-Subject: drivers/base/node: fix double free in register_one_node()
-
-From: Donet Tom <donettom@linux.ibm.com>
-
-[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
-
-When device_register() fails in register_node(), it calls
-put_device(&node->dev).  This triggers node_device_release(), which calls
-kfree(to_node(dev)), thereby freeing the entire node structure.
-
-As a result, when register_node() returns an error, the node memory has
-already been freed.  Calling kfree(node) again in register_one_node()
-leads to a double free.
-
-This patch removes the redundant kfree(node) from register_one_node() to
-prevent the double free.
-
-Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
-Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
-Signed-off-by: Donet Tom <donettom@linux.ibm.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Acked-by: Oscar Salvador <osalvador@suse.de>
-Cc: Alison Schofield <alison.schofield@intel.com>
-Cc: Chris Mason <clm@meta.com>
-Cc: Danilo Krummrich <dakr@kernel.org>
-Cc: Dave Jiang <dave.jiang@intel.com>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
-Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
-Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
-Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
-Cc: Zi Yan <ziy@nvidia.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/node.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/base/node.c b/drivers/base/node.c
-index 340525155e993..715ae053dc8a1 100644
---- a/drivers/base/node.c
-+++ b/drivers/base/node.c
-@@ -892,7 +892,6 @@ int __register_one_node(int nid)
- 	error = register_node(node_devices[nid], nid);
- 	if (error) {
- 		node_devices[nid] = NULL;
--		kfree(node);
- 		return error;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch b/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch
deleted file mode 100644
index e6383e025c..0000000000
--- a/queue-6.16/drivers-base-node-handle-error-properly-in-register_.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 56bac4571fbabd311519e712a9de7a0f5baae56e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 22 Aug 2025 14:18:45 +0530
-Subject: drivers/base/node: handle error properly in register_one_node()
-
-From: Donet Tom <donettom@linux.ibm.com>
-
-[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
-
-If register_node() returns an error, it is not handled correctly.
-The function will proceed further and try to register CPUs under the
-node, which is not correct.
-
-So, in this patch, if register_node() returns an error, we return
-immediately from the function.
-
-Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
-Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
-Signed-off-by: Donet Tom <donettom@linux.ibm.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Cc: Alison Schofield <alison.schofield@intel.com>
-Cc: Danilo Krummrich <dakr@kernel.org>
-Cc: Dave Jiang <dave.jiang@intel.com>
-Cc: Donet Tom <donettom@linux.ibm.com>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
-Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
-Cc: Oscar Salvador <osalvador@suse.de>
-Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
-Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
-Cc: Zi Yan <ziy@nvidia.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/node.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/base/node.c b/drivers/base/node.c
-index c19094481630d..340525155e993 100644
---- a/drivers/base/node.c
-+++ b/drivers/base/node.c
-@@ -890,6 +890,11 @@ int __register_one_node(int nid)
- 	node_devices[nid] = node;
- 
- 	error = register_node(node_devices[nid], nid);
-+	if (error) {
-+		node_devices[nid] = NULL;
-+		kfree(node);
-+		return error;
-+	}
- 
- 	/* link cpu under this node */
- 	for_each_present_cpu(cpu) {
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch b/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
deleted file mode 100644
index 948aacafed..0000000000
--- a/queue-6.16/drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From cad1ff1c1b318cc181099adcac371e513b1f9cce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 12:14:01 +0530
-Subject: drm/amd/display: Add NULL pointer checks in dc_stream cursor
- attribute functions
-
-From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
-
-[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ]
-
-The function dc_stream_set_cursor_attributes() currently dereferences
-the `stream` pointer and nested members `stream->ctx->dc->current_state`
-without checking for NULL.
-
-All callers of these functions, such as in
-`dcn30_apply_idle_power_optimizations()` and
-`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
-before calling these functions.
-
-Fixes below:
-drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
-error: we previously assumed 'stream' could be null (see line 334)
-
-drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
-    327 bool dc_stream_program_cursor_attributes(
-    328         struct dc_stream_state *stream,
-    329         const struct dc_cursor_attributes *attributes)
-    330 {
-    331         struct dc  *dc;
-    332         bool reset_idle_optimizations = false;
-    333
-    334         dc = stream ? stream->ctx->dc : NULL;
-                     ^^^^^^
-The old code assumed stream could be NULL.
-
-    335
---> 336         if (dc_stream_set_cursor_attributes(stream, attributes)) {
-                                                    ^^^^^^
-The refactor added an unchecked dereference.
-
-drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
-   313  bool dc_stream_set_cursor_attributes(
-   314          struct dc_stream_state *stream,
-   315          const struct dc_cursor_attributes *attributes)
-   316  {
-   317          bool result = false;
-   318
-   319          if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
-                                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
-This function used to check for if stream as NULL and return false at
-the start. Probably we should add that back.
-
-Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic")
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Cc: Alex Hung <alex.hung@amd.com>
-Cc: Alvin Lee <alvin.lee2@amd.com>
-Cc: Ray Wu <ray.wu@amd.com>
-Cc: Dillon Varone <dillon.varone@amd.com>
-Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
-Cc: Roman Li <roman.li@amd.com>
-Cc: ChiaHsuan Chung <chiahsuan.chung@amd.com>
-Cc: Harry Wentland <harry.wentland@amd.com>
-Cc: Daniel Wheeler <daniel.wheeler@amd.com>
-Cc: Tom Chung <chiahsuan.chung@amd.com>
-Cc: Wenjing Liu <wenjing.liu@amd.com>
-Cc: Jun Lei <Jun.Lei@amd.com>
-Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
-Reviewed-by: Dillon Varone <Dillon.varone@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
-index b883fb24fa127..2a68d470d093a 100644
---- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
-+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
-@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes(
- {
- 	bool result = false;
- 
-+	if (!stream)
-+		return false;
-+
- 	if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
- 		stream->cursor_attributes = *attributes;
- 		result = true;
-@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes(
- 	struct dc  *dc;
- 	bool reset_idle_optimizations = false;
- 
--	dc = stream ? stream->ctx->dc : NULL;
-+	if (!stream)
-+		return false;
-+
-+	dc = stream->ctx->dc;
- 
- 	if (dc_stream_set_cursor_attributes(stream, attributes)) {
- 		dc_z10_restore(dc);
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch b/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch
deleted file mode 100644
index edce727f35..0000000000
--- a/queue-6.16/drm-amd-display-remove-redundant-semicolons.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 110db373f83a4974b141fc49e439b04453006bbe Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 15:50:14 +0800
-Subject: drm/amd/display: Remove redundant semicolons
-
-From: Liao Yuanhong <liaoyuanhong@vivo.com>
-
-[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
-
-Remove unnecessary semicolons.
-
-Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
-Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c    | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
-index 9ba6cb67655f4..6c75aa82327ac 100644
---- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
-+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
-@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
- 	if (dual_plane) {
- 		unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
- 				num_pipes, pipe_idx);
--		;
- 		if (src->sw_mode == dm_sw_linear)
- 			ASSERT(p1_pte_row_height_linear >= 8);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch b/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
deleted file mode 100644
index a658408b8d..0000000000
--- a/queue-6.16/drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 1967bfbc817e3f91e0a88cff887ee88c595a3da7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:07 +0200
-Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
-
-Based on some comments in dm_pp_display_configuration
-above the crtc_index and line_time fields, these values
-are programmed to the SMC to work around an SMC hang
-when it switches MCLK.
-
-According to Alex, the Windows driver programs them to:
-mclk_change_block_cp_min = 200 / line_time
-mclk_change_block_cp_max = 100 / line_time
-Let's use the same for the sake of consistency.
-
-Previously we used the watermark values, but it seemed buggy
-as the code was mixing up low/high and A/B watermarks, and
-was not saving a low watermark value on DCE 6, so
-mclk_change_block_cp_max would be always zero previously.
-
-Split this change off from the previous si_upload_smc_data
-to make it easier to bisect, in case it causes any issues.
-
-Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-index a0cdf6e2d788e..223f59bbf49de 100644
---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
- 		crtc_index = amdgpu_crtc->crtc_id;
- 
- 		if (amdgpu_crtc->line_time) {
--			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
--			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
-+			mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
-+			mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
- 		}
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch b/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
deleted file mode 100644
index 5db526eccf..0000000000
--- a/queue-6.16/drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 5bf981e500519d78a5598495268a493d522c7729 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:09 +0200
-Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
-
-According to pp_pm_compute_clocks the non-DC display code
-has "issues with mclk switching with refresh rates over 120 hz".
-The workaround is to disable MCLK switching in this case.
-
-Do the same for legacy DPM.
-
-Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
-index 42efe838fa85c..2d2d2d5e67634 100644
---- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
-+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
-@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
- 					(amdgpu_crtc->v_border * 2));
- 
- 				vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
-+
-+				/* we have issues with mclk switching with
-+				 * refresh rates over 120 hz on the non-DC code.
-+				 */
-+				if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
-+					vblank_time_us = 0;
-+
- 				break;
- 			}
- 		}
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch b/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
deleted file mode 100644
index 46322d1220..0000000000
--- a/queue-6.16/drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 506b9151ac71caf81b1d00e241792beedd07fa84 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:10 +0200
-Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
- (v3)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
-
-Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
-switching on Oland when two 4K 60Hz monitors are connected")
-
-This is an ad-hoc DPM fix, necessary because we don't have
-proper bandwidth calculation for DCE 6.
-
-We define "high pixelclock" for SI as higher than necessary
-for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
-this category.
-
-When two high pixel clock displays are connected to Oland,
-additionally disable shader clock switching, which results in
-a higher voltage, thereby addressing some visible flickering.
-
-v2:
-Add more comments.
-v3:
-Split into two commits for easier review.
-
-Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-index d70104bdaa998..80d79a7f8edf1 100644
---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
- {
- 	struct  si_ps *ps = si_get_ps(rps);
- 	struct amdgpu_clock_and_voltage_limits *max_limits;
-+	struct amdgpu_connector *conn;
- 	bool disable_mclk_switching = false;
- 	bool disable_sclk_switching = false;
- 	u32 mclk, sclk;
- 	u16 vddc, vddci, min_vce_voltage = 0;
- 	u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
- 	u32 max_sclk = 0, max_mclk = 0;
-+	u32 high_pixelclock_count = 0;
- 	int i;
- 
- 	if (adev->asic_type == CHIP_HAINAN) {
-@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
- 		}
- 	}
- 
-+	/* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
-+	 * For example, 4K 60Hz and 1080p 144Hz fall into this category.
-+	 * Find number of such displays connected.
-+	 */
-+	for (i = 0; i < adev->mode_info.num_crtc; i++) {
-+		if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
-+			!adev->mode_info.crtcs[i]->enabled)
-+			continue;
-+
-+		conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
-+
-+		if (conn->pixelclock_for_modeset > 297000)
-+			high_pixelclock_count++;
-+	}
-+
-+	/* These are some ad-hoc fixes to some issues observed with SI GPUs.
-+	 * They are necessary because we don't have something like dce_calcs
-+	 * for these GPUs to calculate bandwidth requirements.
-+	 */
-+	if (high_pixelclock_count) {
-+		/* On Oland, we observe some flickering when two 4K 60Hz
-+		 * displays are connected, possibly because voltage is too low.
-+		 * Raise the voltage by requiring a higher SCLK.
-+		 * (Voltage cannot be adjusted independently without also SCLK.)
-+		 */
-+		if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
-+			disable_sclk_switching = true;
-+	}
-+
- 	if (rps->vce_active) {
- 		rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
- 		rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch b/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
deleted file mode 100644
index 47bf664c57..0000000000
--- a/queue-6.16/drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 933186d17d426895d9177d78936b0b391ccc3ac0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:04 +0200
-Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
-
-Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
-is unsupported, to make sure it is properly turned off.
-
-v3:
-Simplify si_disable_ulv further.
-Always check the return value of amdgpu_si_send_msg_to_smc.
-
-Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
- 1 file changed, 3 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-index 4c0e976004ba4..50da1eed8ddf0 100644
---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
- 
- static int si_disable_ulv(struct amdgpu_device *adev)
- {
--	struct si_power_info *si_pi = si_get_pi(adev);
--	struct si_ulv_param *ulv = &si_pi->ulv;
-+	PPSMC_Result r;
- 
--	if (ulv->supported)
--		return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
--			0 : -EINVAL;
--
--	return 0;
-+	r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
-+	return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
- }
- 
- static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch b/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch
deleted file mode 100644
index 2a09d6ca39..0000000000
--- a/queue-6.16/drm-amd-pm-fix-si_upload_smc_data-v3.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From d647b1605a6cfcfdf0a250fea64040517ca53578 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:06 +0200
-Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
-
-The si_upload_smc_data function uses si_write_smc_soft_register
-to set some register values in the SMC, and expects the result
-to be PPSMC_Result_OK which is 1.
-
-The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
-checking the result of a command sent to the SMC.
-However, the si_write_smc_soft_register actually doesn't send
-any commands to the SMC and returns zero on success,
-so this check was incorrect.
-
-Fix that by not checking the return value, just like other
-calls to si_write_smc_soft_register.
-
-v3:
-Additionally, when no display is plugged in, there is no need
-to restrict MCLK switching, so program the registers to zero.
-
-Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
- 1 file changed, 24 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-index 50da1eed8ddf0..a0cdf6e2d788e 100644
---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
- {
- 	struct amdgpu_crtc *amdgpu_crtc = NULL;
- 	int i;
--
--	if (adev->pm.dpm.new_active_crtc_count == 0)
--		return 0;
-+	u32 crtc_index = 0;
-+	u32 mclk_change_block_cp_min = 0;
-+	u32 mclk_change_block_cp_max = 0;
- 
- 	for (i = 0; i < adev->mode_info.num_crtc; i++) {
- 		if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
-@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
- 		}
- 	}
- 
--	if (amdgpu_crtc == NULL)
--		return 0;
-+	/* When a display is plugged in, program these so that the SMC
-+	 * performs MCLK switching when it doesn't cause flickering.
-+	 * When no display is plugged in, there is no need to restrict
-+	 * MCLK switching, so program them to zero.
-+	 */
-+	if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
-+		crtc_index = amdgpu_crtc->crtc_id;
- 
--	if (amdgpu_crtc->line_time <= 0)
--		return 0;
-+		if (amdgpu_crtc->line_time) {
-+			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
-+			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
-+		}
-+	}
- 
--	if (si_write_smc_soft_register(adev,
--				       SI_SMC_SOFT_REGISTER_crtc_index,
--				       amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
--		return 0;
-+	si_write_smc_soft_register(adev,
-+		SI_SMC_SOFT_REGISTER_crtc_index,
-+		crtc_index);
- 
--	if (si_write_smc_soft_register(adev,
--				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
--				       amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
--		return 0;
-+	si_write_smc_soft_register(adev,
-+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
-+		mclk_change_block_cp_min);
- 
--	if (si_write_smc_soft_register(adev,
--				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
--				       amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
--		return 0;
-+	si_write_smc_soft_register(adev,
-+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
-+		mclk_change_block_cp_max);
- 
- 	return 0;
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch b/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
deleted file mode 100644
index af4b5b5996..0000000000
--- a/queue-6.16/drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 50121b0e4d99ea1c9aee11ba5af9833602536827 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:08 +0200
-Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
-
-Some parts of the code base expect that MCLK switching is turned
-off when the vblank time is set to zero.
-
-According to pp_pm_compute_clocks the non-DC code has issues
-with MCLK switching with refresh rates over 120 Hz.
-
-v3:
-Add code comment to explain this better.
-Add an if statement instead of changing the switch_limit.
-
-Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-index 223f59bbf49de..d70104bdaa998 100644
---- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
-@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle)
- 	/* we never hit the non-gddr5 limit so disable it */
- 	u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
- 
--	if (vblank_time < switch_limit)
-+	/* Consider zero vblank time too short and disable MCLK switching.
-+	 * Note that the vblank time is set to maximum when no displays are attached,
-+	 * so we'll still enable MCLK switching in that case.
-+	 */
-+	if (vblank_time == 0)
-+		return true;
-+	else if (vblank_time < switch_limit)
- 		return true;
- 	else
- 		return false;
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch b/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
deleted file mode 100644
index bd91e3b4d6..0000000000
--- a/queue-6.16/drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 90467f5e9879dde46570c7ff49599aa08fe6fe6f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 16:49:35 +0200
-Subject: drm/amdgpu: Fix allocating extra dwords for rings (v2)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ]
-
-Rename extra_dw to extra_bytes and document what it's for.
-
-The value is already used as if it were bytes in vcn_v4_0.c
-and in amdgpu_ring_init. Just adjust the dword count in
-jpeg_v1_0.c so that it becomes a byte count.
-
-v2:
-Rename extra_dw to extra_bytes as discussed during review.
-
-Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring")
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Reviewed-by: Christian König <christian.koenig@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c |  3 ++-
- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++-
- drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c   |  2 +-
- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c    |  2 +-
- 4 files changed, 16 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
-index a0b7ac7486dc5..5693830c0c364 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
-@@ -335,7 +335,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
- 
- 	/* Allocate ring buffer */
- 	if (ring->ring_obj == NULL) {
--		r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE,
-+		r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes,
-+					    PAGE_SIZE,
- 					    AMDGPU_GEM_DOMAIN_GTT,
- 					    &ring->ring_obj,
- 					    &ring->gpu_addr,
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
-index e1f25218943a4..0fc4a2ed88e26 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
-@@ -202,7 +202,18 @@ struct amdgpu_ring_funcs {
- 	bool			support_64bit_ptrs;
- 	bool			no_user_fence;
- 	bool			secure_submission_supported;
--	unsigned		extra_dw;
-+
-+	/**
-+	 * @extra_bytes:
-+	 *
-+	 * Optional extra space in bytes that is added to the ring size
-+	 * when allocating the BO that holds the contents of the ring.
-+	 * This space isn't used for command submission to the ring,
-+	 * but is just there to satisfy some hardware requirements or
-+	 * implement workarounds. It's up to the implementation of each
-+	 * specific ring to initialize this space.
-+	 */
-+	unsigned		extra_bytes;
- 
- 	/* ring read/write ptr handling */
- 	u64 (*get_rptr)(struct amdgpu_ring *ring);
-diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
-index 9e428e669ada6..b5bb7f4d607c1 100644
---- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
-@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = {
- 	.nop = PACKET0(0x81ff, 0),
- 	.support_64bit_ptrs = false,
- 	.no_user_fence = true,
--	.extra_dw = 64,
-+	.extra_bytes = 256,
- 	.get_rptr = jpeg_v1_0_decode_ring_get_rptr,
- 	.get_wptr = jpeg_v1_0_decode_ring_get_wptr,
- 	.set_wptr = jpeg_v1_0_decode_ring_set_wptr,
-diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
-index e77f2df1beb77..c4e15ea1e66ed 100644
---- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
-@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = {
- 	.type = AMDGPU_RING_TYPE_VCN_ENC,
- 	.align_mask = 0x3f,
- 	.nop = VCN_ENC_CMD_NO_OP,
--	.extra_dw = sizeof(struct amdgpu_vcn_rb_metadata),
-+	.extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata),
- 	.get_rptr = vcn_v4_0_unified_ring_get_rptr,
- 	.get_wptr = vcn_v4_0_unified_ring_get_wptr,
- 	.set_wptr = vcn_v4_0_unified_ring_set_wptr,
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch b/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
deleted file mode 100644
index 673801dd1c..0000000000
--- a/queue-6.16/drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 3779309fbe9017b6af7c6d191a315705c660bf40 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 14:28:26 +0800
-Subject: drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest
-
-From: Xiang Liu <xiang.liu@amd.com>
-
-[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ]
-
-Sriov guest side doesn't init ras feature hence the poison irq shouldn't
-be put during hw fini.
-
-[25209.467154] Call Trace:
-[25209.467156]  <TASK>
-[25209.467158]  ? srso_alias_return_thunk+0x5/0x7f
-[25209.467162]  ? show_trace_log_lvl+0x28e/0x2ea
-[25209.467166]  ? show_trace_log_lvl+0x28e/0x2ea
-[25209.467171]  ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
-[25209.467300]  ? show_regs.part.0+0x23/0x29
-[25209.467303]  ? show_regs.cold+0x8/0xd
-[25209.467304]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.467403]  ? __warn+0x8c/0x100
-[25209.467407]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.467503]  ? report_bug+0xa4/0xd0
-[25209.467508]  ? handle_bug+0x39/0x90
-[25209.467511]  ? exc_invalid_op+0x19/0x70
-[25209.467513]  ? asm_exc_invalid_op+0x1b/0x20
-[25209.467518]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.467613]  ? amdgpu_irq_put+0x5f/0xc0 [amdgpu]
-[25209.467709]  jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
-[25209.467805]  amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
-[25209.467971]  amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
-
-Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq")
-Signed-off-by: Xiang Liu <xiang.liu@amd.com>
-Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
-index 90d773dbe337c..21a35c83982e6 100644
---- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
-+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
-@@ -446,7 +446,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
- 			ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE);
- 	}
- 
--	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG))
-+	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev))
- 		amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0);
- 
- 	return ret;
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch b/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
deleted file mode 100644
index 8e26c8ea02..0000000000
--- a/queue-6.16/drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 4bd9c9b36ef11bad7193a0bd0123f69ff5553cde Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 14:54:50 +0800
-Subject: drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest
-
-From: Xiang Liu <xiang.liu@amd.com>
-
-[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ]
-
-Sriov guest side doesn't init ras feature hence the poison irq shouldn't
-be put during hw fini.
-
-[25209.468816] Call Trace:
-[25209.468817]  <TASK>
-[25209.468818]  ? srso_alias_return_thunk+0x5/0x7f
-[25209.468820]  ? show_trace_log_lvl+0x28e/0x2ea
-[25209.468822]  ? show_trace_log_lvl+0x28e/0x2ea
-[25209.468825]  ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
-[25209.468936]  ? show_regs.part.0+0x23/0x29
-[25209.468939]  ? show_regs.cold+0x8/0xd
-[25209.468940]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.469038]  ? __warn+0x8c/0x100
-[25209.469040]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.469135]  ? report_bug+0xa4/0xd0
-[25209.469138]  ? handle_bug+0x39/0x90
-[25209.469140]  ? exc_invalid_op+0x19/0x70
-[25209.469142]  ? asm_exc_invalid_op+0x1b/0x20
-[25209.469146]  ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
-[25209.469241]  vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
-[25209.469343]  amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
-[25209.469511]  amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
-
-Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq")
-Signed-off-by: Xiang Liu <xiang.liu@amd.com>
-Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
-index faba11166efb6..802520d82a438 100644
---- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
-+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
-@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
- 			vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
- 	}
- 
--	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
-+	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
- 		amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
- 
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch b/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
deleted file mode 100644
index 946d318fad..0000000000
--- a/queue-6.16/drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From d7c0ed210a9cd930ac10e31a2295abdb78621167 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Aug 2025 17:11:03 +0200
-Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Timur Kristóf <timur.kristof@gmail.com>
-
-[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
-
-Unlike later versions, UVD 3 has firmware validation.
-For this to work, the UVD should be powered up correctly.
-
-When DPM is enabled and the display clock is off,
-the SMU may choose a power state which doesn't power
-the UVD, which can result in failure to initialize UVD.
-
-v2:
-Add code comments to explain about the UVD power state
-and how UVD clock is turned on/off.
-
-Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
-Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
- 1 file changed, 25 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
-index 5dbaebb592b30..2e79a3afc7748 100644
---- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
-+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
-@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
-  *
-  * @ip_block: Pointer to the amdgpu_ip_block for this hw instance.
-  *
-- * Initialize the hardware, boot up the VCPU and do some testing
-+ * Initialize the hardware, boot up the VCPU and do some testing.
-+ *
-+ * On SI, the UVD is meant to be used in a specific power state,
-+ * or alternatively the driver can manually enable its clock.
-+ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
-+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
-+ * for the SMU and afterwards enables the UVD clock.
-+ * This is automatically done by amdgpu_uvd_ring_begin_use when work
-+ * is submitted to the UVD ring. Here, we have to call it manually
-+ * in order to power up UVD before firmware validation.
-+ *
-+ * Note that we must not disable the UVD clock here, as that would
-+ * cause the ring test to fail. However, UVD is powered off
-+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
-+ * the UVD idle work handler which will disable the UVD clock when
-+ * all fences are signalled.
-  */
- static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
- {
-@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
- 	int r;
- 
- 	uvd_v3_1_mc_resume(adev);
-+	uvd_v3_1_enable_mgcg(adev, true);
-+
-+	/* Make sure UVD is powered during FW validation.
-+	 * It's going to be automatically powered off after the ring test.
-+	 */
-+	if (adev->pm.dpm_enabled)
-+		amdgpu_dpm_enable_uvd(adev, true);
-+	else
-+		amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
- 
- 	r = uvd_v3_1_fw_validate(adev);
- 	if (r) {
-@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
- 		return r;
- 	}
- 
--	uvd_v3_1_enable_mgcg(adev, true);
--	amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
--
- 	uvd_v3_1_start(adev);
- 
- 	r = amdgpu_ring_test_helper(ring);
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch b/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
deleted file mode 100644
index e411db9be7..0000000000
--- a/queue-6.16/drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From a32ea2590f26b192121338a590d73551b281ed6a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Sep 2025 20:36:46 +0800
-Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
-
-Use negative error code -EINVAL instead of positive EINVAL in the default
-case of svm_ioctl() to conform to Linux kernel error code conventions.
-
-Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
-index a0f22ea6d15af..3d8b20828c068 100644
---- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
-+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
-@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
- 		r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
- 		break;
- 	default:
--		r = EINVAL;
-+		r = -EINVAL;
- 		break;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch b/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
deleted file mode 100644
index 4c03c6e2d2..0000000000
--- a/queue-6.16/drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 03f158ba5f36cae43af37fb674de6eddc1b32101 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 23 Jul 2025 13:05:07 +0300
-Subject: drm/bridge: cdns-dsi: Fix the _atomic_check()
-
-From: Aradhya Bhatia <aradhya.bhatia@linux.dev>
-
-[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ]
-
-Use the "adjusted_mode" for the dsi configuration check, as that is the
-more appropriate display_mode for validation, and later bridge enable.
-
-Also, fix the mode_valid_check parameter from false to true, as the dsi
-configuration check is taking place during the check-phase, and the
-crtc_* mode values are not expected to be populated yet.
-
-Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()")
-Signed-off-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
-Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
-Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
-Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
-Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com
-Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
-index b022dd6e6b6e9..1c3fefce5fd28 100644
---- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
-+++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
-@@ -989,10 +989,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge,
- 	struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge);
- 	struct cdns_dsi *dsi = input_to_dsi(input);
- 	struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state);
--	const struct drm_display_mode *mode = &crtc_state->mode;
-+	const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
- 	struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg;
- 
--	return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false);
-+	return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true);
- }
- 
- static struct drm_bridge_state *
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch b/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch
deleted file mode 100644
index d8815946f0..0000000000
--- a/queue-6.16/drm-bridge-it6505-select-regmap_i2c.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 9da4b65a09d72475c416589e34f952cfc7cd1eae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 10 Jun 2025 16:58:25 -0700
-Subject: drm/bridge: it6505: select REGMAP_I2C
-
-From: Chia-I Wu <olvaffe@gmail.com>
-
-[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
-
-Fix
-
-  aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
-  ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
-
-Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
-Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
-Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
-Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
-Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
-index b9e0ca85226a6..a6d6e62071a0e 100644
---- a/drivers/gpu/drm/bridge/Kconfig
-+++ b/drivers/gpu/drm/bridge/Kconfig
-@@ -122,6 +122,7 @@ config DRM_ITE_IT6505
- 	select EXTCON
- 	select CRYPTO
- 	select CRYPTO_HASH
-+	select REGMAP_I2C
- 	help
- 	  ITE IT6505 DisplayPort bridge chip driver.
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch b/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
deleted file mode 100644
index 92901827ab..0000000000
--- a/queue-6.16/drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 778f97f903a8ee142d7d809edc72ddc8bbb4de03 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Aug 2025 09:30:55 +0800
-Subject: drm/msm: Do not validate SSPP when it is not ready
-
-From: Jun Nie <jun.nie@linaro.org>
-
-[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ]
-
-Current code will validate current plane and previous plane to
-confirm they can share a SSPP with multi-rect mode. The SSPP
-is already allocated for previous plane, while current plane
-is not associated with any SSPP yet. Null pointer is referenced
-when validating the SSPP of current plane. Skip SSPP validation
-for current plane.
-
-Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
-Mem abort info:
-  ESR = 0x0000000096000004
-  EC = 0x25: DABT (current EL), IL = 32 bits
-  SET = 0, FnV = 0
-  EA = 0, S1PTW = 0
-  FSC = 0x04: level 0 translation fault
-Data abort info:
-  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
-  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
-  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
-user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
-[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
-Internal error: Oops: 0000000096000004 [#1]  SMP
-Modules linked in:
-CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S                  6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
-Tainted: [S]=CPU_OUT_OF_SPEC
-Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
-pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
-pc : dpu_plane_is_multirect_capable+0x68/0x90
-lr : dpu_assign_plane_resources+0x288/0x410
-sp : ffff800093dcb770
-x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
-x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
-x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
-x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
-x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
-x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
-x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
-x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
-x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
-x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
-Call trace:
- dpu_plane_is_multirect_capable+0x68/0x90 (P)
- dpu_crtc_atomic_check+0x5bc/0x650
- drm_atomic_helper_check_planes+0x13c/0x220
- drm_atomic_helper_check+0x58/0xb8
- msm_atomic_check+0xd8/0xf0
- drm_atomic_check_only+0x4a8/0x968
- drm_atomic_commit+0x50/0xd8
- drm_atomic_helper_update_plane+0x140/0x188
- __setplane_atomic+0xfc/0x148
- drm_mode_setplane+0x164/0x378
- drm_ioctl_kernel+0xc0/0x140
- drm_ioctl+0x20c/0x500
- __arm64_sys_ioctl+0xbc/0xf8
- invoke_syscall+0x50/0x120
- el0_svc_common.constprop.0+0x48/0xf8
- do_el0_svc+0x28/0x40
- el0_svc+0x30/0xd0
- el0t_64_sync_handler+0x144/0x168
- el0t_64_sync+0x198/0x1a0
-Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
----[ end trace 0000000000000000 ]---
-
-Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
-Signed-off-by: Jun Nie <jun.nie@linaro.org>
-Patchwork: https://patchwork.freedesktop.org/patch/669224/
-Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
-index d059ed1e4b707..eba8adb660568 100644
---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
-+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
-@@ -929,6 +929,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
- 	if (MSM_FORMAT_IS_YUV(fmt))
- 		return false;
- 
-+	if (!sspp)
-+		return true;
-+
- 	if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
- 	    !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
- 		return false;
-@@ -1035,6 +1038,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate,
- 	    prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
- 		return false;
- 
-+	/* Do not validate SSPP of current plane when it is not ready */
- 	if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
- 	    !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt))
- 		return false;
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch b/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch
deleted file mode 100644
index 7536465cfd..0000000000
--- a/queue-6.16/drm-msm-dpu-fix-incorrect-type-for-ret.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 85425bcf101ba593e2b24ea0a02d2578ece4de65 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 17:20:45 +0800
-Subject: drm/msm/dpu: fix incorrect type for ret
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
-
-Change 'ret' from unsigned long to int, as storing negative error codes
-in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
-errors.
-
-Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Patchwork: https://patchwork.freedesktop.org/patch/671100/
-Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
-index 849fea580a4ca..5ea7745f9c78e 100644
---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
-+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
-@@ -448,7 +448,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
- static int dpu_encoder_phys_wb_wait_for_commit_done(
- 		struct dpu_encoder_phys *phys_enc)
- {
--	unsigned long ret;
-+	int ret;
- 	struct dpu_encoder_wait_info wait_info;
- 	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch b/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
deleted file mode 100644
index 5afe3719e0..0000000000
--- a/queue-6.16/drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 8bd2233663aeaf91b0cd09d9ef5c0183f0dc7282 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 21 Jul 2025 14:16:27 +0800
-Subject: drm/panel-edp: Add disable to 100ms for MNB601LS1-4
-
-From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
-
-[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ]
-
-For the MNB601LS1-4 panel, the T9+T10 timing does not meet the
-requirements of the specification, so disable is set to 100ms.
-
-Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4")
-Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
-Reviewed-by: Douglas Anderson <dianders@chromium.org>
-Signed-off-by: Douglas Anderson <dianders@chromium.org>
-Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
-index 90e8c154a9788..bfb09352a4acb 100644
---- a/drivers/gpu/drm/panel/panel-edp.c
-+++ b/drivers/gpu/drm/panel/panel-edp.c
-@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = {
- 	.powered_on_to_enable = 335,
- };
- 
-+static const struct panel_delay delay_200_500_e50_d100 = {
-+	.hpd_absent = 200,
-+	.unprepare = 500,
-+	.enable = 50,
-+	.disable = 100,
-+};
-+
- #define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \
- { \
- 	.ident = { \
-@@ -1979,7 +1986,7 @@ static const struct edp_panel_entry edp_panels[] = {
- 
- 	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
- 	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
--	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"),
-+	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"),
- 	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"),
- 	EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"),
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch b/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch
deleted file mode 100644
index c6bd86a2a8..0000000000
--- a/queue-6.16/drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 90d4044b87619663945cdf4fc5acac4a00c098c4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 30 Jul 2025 21:23:41 -0600
-Subject: drm/panel: novatek-nt35560: Fix invalid return value
-
-From: Brigham Campbell <me@brighamcampbell.com>
-
-[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
-
-Fix bug in nt35560_set_brightness() which causes the function to
-erroneously report an error. mipi_dsi_dcs_write() returns either a
-negative value when an error occurred or a positive number of bytes
-written when no error occurred. The buggy code reports an error under
-either condition.
-
-Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
-Reviewed-by: Douglas Anderson <dianders@chromium.org>
-Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
-Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
-index 5bbea734123bc..ee04c55175bb8 100644
---- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
-+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
-@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
- 		par = 0x00;
- 		ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
- 					 &par, 1);
--		if (ret) {
-+		if (ret < 0) {
- 			dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
- 			return ret;
- 		}
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch b/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
deleted file mode 100644
index 8baf238376..0000000000
--- a/queue-6.16/drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From f8952adbd5442449721fb7b5bbec3d81928ac095 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 14:51:25 +0530
-Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Brahmajit Das <listout@listout.xyz>
-
-[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
-
-GCC 16 enables -Werror=unused-but-set-variable= which results in build
-error with the following message.
-
-drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
-drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
- 1411 |         unsigned offset, i, level;
-      |                             ^~~~~
-cc1: all warnings being treated as errors
-make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
-
-level although is set, but in never used in the function
-r600_texture_size. Thus resulting in dead code and this error getting
-triggered.
-
-Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
-Acked-by: Christian König <christian.koenig@amd.com>
-Signed-off-by: Brahmajit Das <listout@listout.xyz>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
-index ac77d1246b945..811265648a582 100644
---- a/drivers/gpu/drm/radeon/r600_cs.c
-+++ b/drivers/gpu/drm/radeon/r600_cs.c
-@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
- 			      unsigned block_align, unsigned height_align, unsigned base_align,
- 			      unsigned *l0_size, unsigned *mipmap_size)
- {
--	unsigned offset, i, level;
-+	unsigned offset, i;
- 	unsigned width, height, depth, size;
- 	unsigned blocksize;
- 	unsigned nbx, nby;
-@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
- 	w0 = r600_mip_minify(w0, 0);
- 	h0 = r600_mip_minify(h0, 0);
- 	d0 = r600_mip_minify(d0, 0);
--	for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
-+	for (i = 0, offset = 0; i < nlevels; i++) {
- 		width = r600_mip_minify(w0, i);
- 		nbx = r600_fmt_get_nblocksx(format, width);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch b/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
deleted file mode 100644
index f1d956d1a4..0000000000
--- a/queue-6.16/drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From af2c1ae73dfa758c3e1b955aabee90a3b3a0e210 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 22 Aug 2025 17:28:49 +0200
-Subject: drm: re-allow no-op changes on non-primary planes in async flips
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Xaver Hugl <xaver.hugl@kde.org>
-
-[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ]
-
-Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to
-async flip") unintentionally disallowed no-op changes on non-primary
-planes that the driver doesn't allow async flips on. This broke async
-flips for compositors that disable the cursor plane in every async
-atomic commit. To fix that, change drm_atomic_set_property to again
-only run atomic_async_check if the plane would actually be changed by
-the atomic commit.
-
-Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip")
-Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263
-Signed-off-by: Xaver Hugl <xaver.hugl@kde.org>
-Reviewed-by: André Almeida <andrealmeid@igalia.com>
-Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org
-[andrealmeid: fix checkpatch warning]
-Signed-off-by: André Almeida <andrealmeid@igalia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++-----------
- 1 file changed, 12 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
-index c2726af6698e7..317303cf5b8c2 100644
---- a/drivers/gpu/drm/drm_atomic_uapi.c
-+++ b/drivers/gpu/drm/drm_atomic_uapi.c
-@@ -1077,19 +1077,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
- 		}
- 
- 		if (async_flip) {
--			/* check if the prop does a nop change */
--			if ((prop != config->prop_fb_id &&
--			     prop != config->prop_in_fence_fd &&
--			     prop != config->prop_fb_damage_clips)) {
--				ret = drm_atomic_plane_get_property(plane, plane_state,
--								    prop, &old_val);
--				ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
--			}
-+			/* no-op changes are always allowed */
-+			ret = drm_atomic_plane_get_property(plane, plane_state,
-+							    prop, &old_val);
-+			ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
- 
--			/* ask the driver if this non-primary plane is supported */
--			if (plane->type != DRM_PLANE_TYPE_PRIMARY) {
--				ret = -EINVAL;
-+			/* fail everything that isn't no-op or a pure flip */
-+			if (ret && prop != config->prop_fb_id &&
-+			    prop != config->prop_in_fence_fd &&
-+			    prop != config->prop_fb_damage_clips) {
-+				break;
-+			}
- 
-+			if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) {
-+				/* ask the driver if this non-primary plane is supported */
- 				if (plane_funcs && plane_funcs->atomic_async_check)
- 					ret = plane_funcs->atomic_async_check(plane, state, true);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch b/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
deleted file mode 100644
index 71d097a670..0000000000
--- a/queue-6.16/dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
+++ /dev/null
@@ -1,238 +0,0 @@
-From dccdcf62edc6e5f33829730b9ee20668a843bcb5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 17:21:33 -0500
-Subject: dt-bindings: vendor-prefixes: Add undocumented vendor prefixes
-
-From: Rob Herring (Arm) <robh@kernel.org>
-
-[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ]
-
-Add various vendor prefixes which are in use in compatible strings
-already. These were found by modifying vendor-prefixes.yaml into a
-schema to check compatible strings.
-
-The added prefixes doesn't include various duplicate prefixes in use
-such as "lge".
-
-Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org
-Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../devicetree/bindings/vendor-prefixes.yaml  | 50 +++++++++++++++++++
- 1 file changed, 50 insertions(+)
-
-diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
-index 5d2a7a8d3ac6c..75ccab226182c 100644
---- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
-+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
-@@ -85,6 +85,8 @@ patternProperties:
-     description: Allegro DVT
-   "^allegromicro,.*":
-     description: Allegro MicroSystems, Inc.
-+  "^alliedtelesis,.*":
-+    description: Allied Telesis, Inc.
-   "^alliedvision,.*":
-     description: Allied Vision Technologies GmbH
-   "^allo,.*":
-@@ -224,6 +226,8 @@ patternProperties:
-     description: Bitmain Technologies
-   "^blaize,.*":
-     description: Blaize, Inc.
-+  "^bluegiga,.*":
-+    description: Bluegiga Technologies Ltd.
-   "^blutek,.*":
-     description: BluTek Power
-   "^boe,.*":
-@@ -242,6 +246,8 @@ patternProperties:
-     description: Bticino International
-   "^buffalo,.*":
-     description: Buffalo, Inc.
-+  "^buglabs,.*":
-+    description: Bug Labs, Inc.
-   "^bur,.*":
-     description: B&R Industrial Automation GmbH
-   "^bytedance,.*":
-@@ -318,6 +324,8 @@ patternProperties:
-     description: Conexant Systems, Inc.
-   "^colorfly,.*":
-     description: Colorful GRP, Shenzhen Xueyushi Technology Ltd.
-+  "^compal,.*":
-+    description: Compal Electronics, Inc.
-   "^compulab,.*":
-     description: CompuLab Ltd.
-   "^comvetia,.*":
-@@ -346,6 +354,8 @@ patternProperties:
-     description: Guangzhou China Star Optoelectronics Technology Co., Ltd
-   "^csq,.*":
-     description: Shenzen Chuangsiqi Technology Co.,Ltd.
-+  "^csr,.*":
-+    description: Cambridge Silicon Radio
-   "^ctera,.*":
-     description: CTERA Networks Intl.
-   "^ctu,.*":
-@@ -446,6 +456,8 @@ patternProperties:
-     description: Emtop Embedded Solutions
-   "^eeti,.*":
-     description: eGalax_eMPIA Technology Inc
-+  "^egnite,.*":
-+    description: egnite GmbH
-   "^einfochips,.*":
-     description: Einfochips
-   "^eink,.*":
-@@ -476,8 +488,12 @@ patternProperties:
-     description: Empire Electronix
-   "^emtrion,.*":
-     description: emtrion GmbH
-+  "^enbw,.*":
-+    description: Energie Baden-Württemberg AG
-   "^enclustra,.*":
-     description: Enclustra GmbH
-+  "^endian,.*":
-+    description: Endian SRL
-   "^endless,.*":
-     description: Endless Mobile, Inc.
-   "^ene,.*":
-@@ -543,6 +559,8 @@ patternProperties:
-     description: FocalTech Systems Co.,Ltd
-   "^forlinx,.*":
-     description: Baoding Forlinx Embedded Technology Co., Ltd.
-+  "^foxlink,.*":
-+    description: Foxlink Group
-   "^freebox,.*":
-     description: Freebox SAS
-   "^freecom,.*":
-@@ -631,6 +649,10 @@ patternProperties:
-     description: Haoyu Microelectronic Co. Ltd.
-   "^hardkernel,.*":
-     description: Hardkernel Co., Ltd
-+  "^hce,.*":
-+    description: HCE Engineering SRL
-+  "^headacoustics,.*":
-+    description: HEAD acoustics
-   "^hechuang,.*":
-     description: Shenzhen Hechuang Intelligent Co.
-   "^hideep,.*":
-@@ -712,6 +734,8 @@ patternProperties:
-     description: Shenzhen INANBO Electronic Technology Co., Ltd.
-   "^incircuit,.*":
-     description: In-Circuit GmbH
-+  "^incostartec,.*":
-+    description: INCOstartec GmbH
-   "^indiedroid,.*":
-     description: Indiedroid
-   "^inet-tek,.*":
-@@ -916,6 +940,8 @@ patternProperties:
-     description: Maxim Integrated Products
-   "^maxlinear,.*":
-     description: MaxLinear Inc.
-+  "^maxtor,.*":
-+    description: Maxtor Corporation
-   "^mbvl,.*":
-     description: Mobiveil Inc.
-   "^mcube,.*":
-@@ -1077,6 +1103,8 @@ patternProperties:
-     description: Nordic Semiconductor
-   "^nothing,.*":
-     description: Nothing Technology Limited
-+  "^novatech,.*":
-+    description: NovaTech Automation
-   "^novatek,.*":
-     description: Novatek
-   "^novtech,.*":
-@@ -1172,6 +1200,8 @@ patternProperties:
-     description: Pervasive Displays, Inc.
-   "^phicomm,.*":
-     description: PHICOMM Co., Ltd.
-+  "^phontech,.*":
-+    description: Phontech
-   "^phytec,.*":
-     description: PHYTEC Messtechnik GmbH
-   "^picochip,.*":
-@@ -1256,6 +1286,8 @@ patternProperties:
-     description: Ramtron International
-   "^raspberrypi,.*":
-     description: Raspberry Pi Foundation
-+  "^raumfeld,.*":
-+    description: Raumfeld GmbH
-   "^raydium,.*":
-     description: Raydium Semiconductor Corp.
-   "^rda,.*":
-@@ -1294,6 +1326,8 @@ patternProperties:
-     description: ROHM Semiconductor Co., Ltd
-   "^ronbo,.*":
-     description: Ronbo Electronics
-+  "^ronetix,.*":
-+    description: Ronetix GmbH
-   "^roofull,.*":
-     description: Shenzhen Roofull Technology Co, Ltd
-   "^roseapplepi,.*":
-@@ -1318,8 +1352,12 @@ patternProperties:
-     description: Schindler
-   "^schneider,.*":
-     description: Schneider Electric
-+  "^schulercontrol,.*":
-+    description: Schuler Group
-   "^sciosense,.*":
-     description: ScioSense B.V.
-+  "^sdmc,.*":
-+    description: SDMC Technology Co., Ltd
-   "^seagate,.*":
-     description: Seagate Technology PLC
-   "^seeed,.*":
-@@ -1358,6 +1396,8 @@ patternProperties:
-     description: Si-En Technology Ltd.
-   "^si-linux,.*":
-     description: Silicon Linux Corporation
-+  "^sielaff,.*":
-+    description: Sielaff GmbH & Co.
-   "^siemens,.*":
-     description: Siemens AG
-   "^sifive,.*":
-@@ -1426,6 +1466,8 @@ patternProperties:
-     description: SolidRun
-   "^solomon,.*":
-     description: Solomon Systech Limited
-+  "^somfy,.*":
-+    description: Somfy Systems Inc.
-   "^sony,.*":
-     description: Sony Corporation
-   "^sophgo,.*":
-@@ -1496,6 +1538,8 @@ patternProperties:
-   "^synopsys,.*":
-     description: Synopsys, Inc. (deprecated, use snps)
-     deprecated: true
-+  "^taos,.*":
-+    description: Texas Advanced Optoelectronic Solutions Inc.
-   "^tbs,.*":
-     description: TBS Technologies
-   "^tbs-biometrics,.*":
-@@ -1526,6 +1570,8 @@ patternProperties:
-     description: Teltonika Networks
-   "^tempo,.*":
-     description: Tempo Semiconductor
-+  "^tenda,.*":
-+    description: Shenzhen Tenda Technology Co., Ltd.
-   "^terasic,.*":
-     description: Terasic Inc.
-   "^tesla,.*":
-@@ -1629,6 +1675,8 @@ patternProperties:
-     description: V3 Semiconductor
-   "^vaisala,.*":
-     description: Vaisala
-+  "^valve,.*":
-+    description: Valve Corporation
-   "^vamrs,.*":
-     description: Vamrs Ltd.
-   "^variscite,.*":
-@@ -1729,6 +1777,8 @@ patternProperties:
-     description: Extreme Engineering Solutions (X-ES)
-   "^xiaomi,.*":
-     description: Xiaomi Technology Co., Ltd.
-+  "^xicor,.*":
-+    description: Xicor Inc.
-   "^xillybus,.*":
-     description: Xillybus Ltd.
-   "^xingbangda,.*":
--- 
-2.51.0
-
diff --git a/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch b/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch
deleted file mode 100644
index 814c323a4f..0000000000
--- a/queue-6.16/dts-arm-amlogic-fix-pwm-node-for-c3.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 6559927821dc1cb64b8ce513fabf7675da621d92 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 17 Jul 2025 17:29:54 +0800
-Subject: dts: arm: amlogic: fix pwm node for c3
-
-From: Xianwei Zhao <xianwei.zhao@amlogic.com>
-
-[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ]
-
-Fix reg address for c3 pwm node.
-
-Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM")
-Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
-Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
-Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
-index cb9ea3ca6ee0f..71b2b3b547f7c 100644
---- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
-+++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
-@@ -792,7 +792,7 @@ spicc1: spi@52000 {
- 			pwm_mn: pwm@54000 {
- 				compatible = "amlogic,c3-pwm",
- 					     "amlogic,meson-s4-pwm";
--				reg = <0x0 54000 0x0 0x24>;
-+				reg = <0x0 0x54000 0x0 0x24>;
- 				clocks = <&clkc_periphs CLKID_PWM_M>,
- 					 <&clkc_periphs CLKID_PWM_N>;
- 				#pwm-cells = <3>;
--- 
-2.51.0
-
diff --git a/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch b/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
deleted file mode 100644
index 8e58339f2f..0000000000
--- a/queue-6.16/edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From bbcf563699d6f39f8c2070d2e13f5c2d6cbca16f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Aug 2025 14:57:07 +0800
-Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
-
-From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
-
-[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
-
-When loading the i10nm_edac driver on some Intel Granite Rapids servers,
-a call trace may appear as follows:
-
-  UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
-  shift exponent -66 is negative
-  ...
-  __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
-  skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
-  i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
-  skx_register_mci+0x159/0x220 [skx_edac_common]
-  i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
-  ...
-
-This occurs because some BIOS may disable a memory controller if there
-aren't any memory DIMMs populated on this memory controller. The DIMMMTR
-register of this disabled memory controller contains the invalid value
-~0, resulting in the call trace above.
-
-Fix this call trace by skipping DIMM enumeration on a disabled memory
-controller.
-
-Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
-Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
-Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
-Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
-Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
-Signed-off-by: Tony Luck <tony.luck@intel.com>
-Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
-Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/edac/i10nm_base.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
-index a3fca2567752e..ac9afcf461d71 100644
---- a/drivers/edac/i10nm_base.c
-+++ b/drivers/edac/i10nm_base.c
-@@ -1047,6 +1047,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
- 	return !!GET_BITFIELD(mcmtr, 2, 2);
- }
- 
-+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
-+{
-+	u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
-+
-+	edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
-+
-+	return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
-+}
-+
- static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
- 				 struct res_config *cfg)
- {
-@@ -1060,6 +1069,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
- 		if (!imc->mbase)
- 			continue;
- 
-+		if (i10nm_channel_disabled(imc, i)) {
-+			edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
-+			continue;
-+		}
-+
- 		ndimms = 0;
- 
- 		if (res_cfg->type != GNR)
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch b/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch
deleted file mode 100644
index 46956d22f3..0000000000
--- a/queue-6.16/f2fs-fix-condition-in-__allow_reserved_blocks.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From ba314a3864382b600d8e3ee0a16025d35d653b30 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 14:03:38 +0800
-Subject: f2fs: fix condition in __allow_reserved_blocks()
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
-
-If reserve_root mount option is not assigned, __allow_reserved_blocks()
-will return false, it's not correct, fix it.
-
-Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/f2fs.h | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
-index e084b96f11090..ec9a1d334ddaf 100644
---- a/fs/f2fs/f2fs.h
-+++ b/fs/f2fs/f2fs.h
-@@ -2358,8 +2358,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
- {
- 	if (!inode)
- 		return true;
--	if (!test_opt(sbi, RESERVE_ROOT))
--		return false;
- 	if (IS_NOQUOTA(inode))
- 		return true;
- 	if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
-@@ -2380,7 +2378,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
- 	avail_user_block_count = sbi->user_block_count -
- 					sbi->current_reserved_blocks;
- 
--	if (!__allow_reserved_blocks(sbi, inode, cap))
-+	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
- 		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
- 
- 	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch b/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
deleted file mode 100644
index b51e0fbd64..0000000000
--- a/queue-6.16/f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 89acc9b33a6df06ccafce93da2b1374d3ddc216e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 5 Aug 2025 14:29:10 +0800
-Subject: f2fs: fix to avoid overflow while left shift operation
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ]
-
-Should cast type of folio->index from pgoff_t to loff_t to avoid overflow
-while left shift operation.
-
-Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/compress.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
-index 8cbb8038bc72f..e6ec77d6903be 100644
---- a/fs/f2fs/compress.c
-+++ b/fs/f2fs/compress.c
-@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
- 
- 		for (i = cluster_size - 1; i >= 0; i--) {
- 			struct folio *folio = page_folio(rpages[i]);
--			loff_t start = folio->index << PAGE_SHIFT;
-+			loff_t start = (loff_t)folio->index << PAGE_SHIFT;
- 
- 			if (from <= start) {
- 				folio_zero_segment(folio, 0, folio_size(folio));
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch b/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
deleted file mode 100644
index cc4a189897..0000000000
--- a/queue-6.16/f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From b68ad98844ad0c05ea48f16d7d4b3ac4491c5ad9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 10:47:09 +0800
-Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
-
-f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
-and page lookup, change as below to mitigate its overhead:
-- check new_size before grabbing invalidate_lock
-- lookup and invalidate pages only in range of [old_size, new_size]
-
-Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
- 1 file changed, 19 insertions(+), 20 deletions(-)
-
-diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
-index 0b4868b2370d0..e203ec4d06ae2 100644
---- a/fs/f2fs/file.c
-+++ b/fs/f2fs/file.c
-@@ -35,15 +35,23 @@
- #include <trace/events/f2fs.h>
- #include <uapi/linux/f2fs.h>
- 
--static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
-+static void f2fs_zero_post_eof_page(struct inode *inode,
-+					loff_t new_size, bool lock)
- {
- 	loff_t old_size = i_size_read(inode);
- 
- 	if (old_size >= new_size)
- 		return;
- 
-+	if (mapping_empty(inode->i_mapping))
-+		return;
-+
-+	if (lock)
-+		filemap_invalidate_lock(inode->i_mapping);
- 	/* zero or drop pages only in range of [old_size, new_size] */
--	truncate_pagecache(inode, old_size);
-+	truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
-+	if (lock)
-+		filemap_invalidate_unlock(inode->i_mapping);
- }
- 
- static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
-@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
- 
- 	f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
- 
--	filemap_invalidate_lock(inode->i_mapping);
--	f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
--	filemap_invalidate_unlock(inode->i_mapping);
-+	f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
- 
- 	file_update_time(vmf->vma->vm_file);
- 	filemap_invalidate_lock_shared(inode->i_mapping);
-@@ -1134,7 +1140,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
- 		filemap_invalidate_lock(inode->i_mapping);
- 
- 		if (attr->ia_size > old_size)
--			f2fs_zero_post_eof_page(inode, attr->ia_size);
-+			f2fs_zero_post_eof_page(inode, attr->ia_size, false);
- 		truncate_setsize(inode, attr->ia_size);
- 
- 		if (attr->ia_size <= old_size)
-@@ -1253,9 +1259,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
- 	if (ret)
- 		return ret;
- 
--	filemap_invalidate_lock(inode->i_mapping);
--	f2fs_zero_post_eof_page(inode, offset + len);
--	filemap_invalidate_unlock(inode->i_mapping);
-+	f2fs_zero_post_eof_page(inode, offset + len, true);
- 
- 	pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
- 	pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
-@@ -1540,7 +1544,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
- 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
- 	filemap_invalidate_lock(inode->i_mapping);
- 
--	f2fs_zero_post_eof_page(inode, offset + len);
-+	f2fs_zero_post_eof_page(inode, offset + len, false);
- 
- 	f2fs_lock_op(sbi);
- 	f2fs_drop_extent_tree(inode);
-@@ -1663,9 +1667,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
- 	if (ret)
- 		return ret;
- 
--	filemap_invalidate_lock(mapping);
--	f2fs_zero_post_eof_page(inode, offset + len);
--	filemap_invalidate_unlock(mapping);
-+	f2fs_zero_post_eof_page(inode, offset + len, true);
- 
- 	pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
- 	pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
-@@ -1799,7 +1801,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
- 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
- 	filemap_invalidate_lock(mapping);
- 
--	f2fs_zero_post_eof_page(inode, offset + len);
-+	f2fs_zero_post_eof_page(inode, offset + len, false);
- 	truncate_pagecache(inode, offset);
- 
- 	while (!ret && idx > pg_start) {
-@@ -1857,9 +1859,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
- 	if (err)
- 		return err;
- 
--	filemap_invalidate_lock(inode->i_mapping);
--	f2fs_zero_post_eof_page(inode, offset + len);
--	filemap_invalidate_unlock(inode->i_mapping);
-+	f2fs_zero_post_eof_page(inode, offset + len, true);
- 
- 	f2fs_balance_fs(sbi, true);
- 
-@@ -4903,9 +4903,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
- 	if (err)
- 		return err;
- 
--	filemap_invalidate_lock(inode->i_mapping);
--	f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
--	filemap_invalidate_unlock(inode->i_mapping);
-+	f2fs_zero_post_eof_page(inode,
-+		iocb->ki_pos + iov_iter_count(from), true);
- 	return count;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch b/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
deleted file mode 100644
index 738589e84e..0000000000
--- a/queue-6.16/f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 570efeea38efa76180a0cd9c30e86b9af68ef45c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 10 Sep 2025 16:40:24 +0800
-Subject: f2fs: fix to truncate first page in error path of f2fs_truncate()
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
-
-syzbot reports a bug as below:
-
-loop0: detected capacity change from 0 to 40427
-F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
-F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
-F2FS-fs (loop0): invalid crc value
-F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
-------------[ cut here ]------------
-kernel BUG at fs/inode.c:753!
-RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
-Call Trace:
- <TASK>
- evict+0x504/0x9c0 fs/inode.c:810
- f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
- get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
- vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
- do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
- do_mount fs/namespace.c:4136 [inline]
- __do_sys_mount fs/namespace.c:4347 [inline]
- __se_sys_mount+0x317/0x410 fs/namespace.c:4324
- do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
- do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
- entry_SYSCALL_64_after_hwframe+0x77/0x7f
-
-During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
-all page cache before destorying inode, that is because in below path, we
-will create page #0 in cache, but missed to drop it in error path, let's fix
-it.
-
-- evict
- - f2fs_evict_inode
-  - f2fs_truncate
-   - f2fs_convert_inline_inode
-    - f2fs_grab_cache_folio
-    : create page #0 in cache
-    - f2fs_convert_inline_folio
-    : sanity check failed, return -EFSCORRUPTED
-  - clear_inode detects that inode->i_data.nrpages is not zero
-
-Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
-Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
-Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/file.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
-index bb3fd6a8416fd..0b4868b2370d0 100644
---- a/fs/f2fs/file.c
-+++ b/fs/f2fs/file.c
-@@ -900,8 +900,16 @@ int f2fs_truncate(struct inode *inode)
- 	/* we should check inline_data size */
- 	if (!f2fs_may_inline_data(inode)) {
- 		err = f2fs_convert_inline_inode(inode);
--		if (err)
-+		if (err) {
-+			/*
-+			 * Always truncate page #0 to avoid page cache
-+			 * leak in evict() path.
-+			 */
-+			truncate_inode_pages_range(inode->i_mapping,
-+					F2FS_BLK_TO_BYTES(0),
-+					F2FS_BLK_END_BYTES(0));
- 			return err;
-+		}
- 	}
- 
- 	err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch b/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
deleted file mode 100644
index ca951c8db3..0000000000
--- a/queue-6.16/f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From f336a37e1999cc5516e82e5e9d0ac82ccd0b3ab2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 16:12:50 +0800
-Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
-
-Script to reproduce:
-mkfs.f2fs -O extra_attr,compression /dev/vdb -f
-mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
-cd /mnt/f2fs
-f2fs_io write 1 0 1024 rand dsync testfile
-xfs_io testfile -c "fsync"
-f2fs_io write 1 0 512 rand dsync testfile
-xfs_io testfile -c "fsync"
-cd /
-umount /mnt/f2fs
-mount /dev/vdb /mnt/f2fs
-f2fs_io precache_extents /mnt/f2fs/testfile
-umount /mnt/f2fs
-
-Tracepoint output:
-f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
-f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
-f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
-
-During precache_extents, there is off-by-one issue, we should update
-map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
-valid and not contiguous to previous extent.
-
-Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/data.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
-index 53b64f4ff2d74..6ff650f425113 100644
---- a/fs/f2fs/data.c
-+++ b/fs/f2fs/data.c
-@@ -1785,7 +1785,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
- 				map->m_len - ofs);
- 		}
- 		if (map->m_next_extent)
--			*map->m_next_extent = pgofs + 1;
-+			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
- 	}
- 	f2fs_put_dnode(&dn);
- unlock_out:
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch b/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
deleted file mode 100644
index bb784cbae2..0000000000
--- a/queue-6.16/f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From 5b1b28ac280a6a29610c6561bffa9b94b3a3680f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Aug 2025 14:11:06 +0800
-Subject: f2fs: fix to zero data after EOF for compressed file correctly
-
-From: Chao Yu <chao@kernel.org>
-
-[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ]
-
-generic/091 may fail, then it bisects to the bad commit ba8dac350faf
-("f2fs: fix to zero post-eof page").
-
-What will cause generic/091 to fail is something like below Testcase #1:
-1. write 16k as compressed blocks
-2. truncate to 12k
-3. truncate to 20k
-4. verify data in range of [12k, 16k], however data is not zero as
-expected
-
-Script of Testcase #1
-mkfs.f2fs -f -O extra_attr,compression /dev/vdb
-mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
-dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
-dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
-sync
-truncate -s $((12*1024)) /mnt/f2fs/file
-truncate -s $((20*1024)) /mnt/f2fs/file
-dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
-od /mnt/f2fs/data
-umount /mnt/f2fs
-
-Analisys:
-in step 2), we will redirty all data pages from #0 to #3 in compressed
-cluster, and zero page #3,
-in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop
-all page cache post eof, includeing dirtied page #3,
-in step 4) when we read data from page #3, it will decompressed cluster
-and extra random data to page #3, finally, we hit the non-zeroed data
-post eof.
-
-However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just
-let the issue be reproduced easily, w/o the commit, it can reproduce this
-bug w/ below Testcase #2:
-1. write 16k as compressed blocks
-2. truncate to 8k
-3. truncate to 12k
-4. truncate to 20k
-5. verify data in range of [12k, 16k], however data is not zero as
-expected
-
-Script of Testcase #2
-mkfs.f2fs -f -O extra_attr,compression /dev/vdb
-mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
-dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
-dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
-sync
-truncate -s $((8*1024)) /mnt/f2fs/file
-truncate -s $((12*1024)) /mnt/f2fs/file
-truncate -s $((20*1024)) /mnt/f2fs/file
-echo 3 > /proc/sys/vm/drop_caches
-dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
-od /mnt/f2fs/data
-umount /mnt/f2fs
-
-Anlysis:
-in step 2), we will redirty all data pages from #0 to #3 in compressed
-cluster, and zero page #2 and #3,
-in step 3), we will truncate page #3 in page cache,
-in step 4), expand file size,
-in step 5), hit random data post eof w/ the same reason in Testcase #1.
-
-Root Cause:
-In f2fs_truncate_partial_cluster(), after we truncate partial data block
-on compressed cluster, all pages in cluster including the one post eof
-will be dirtied, after another tuncation, dirty page post eof will be
-dropped, however on-disk compressed cluster is still valid, it may
-include non-zero data post eof, result in exposing previous non-zero data
-post eof while reading.
-
-Fix:
-In f2fs_truncate_partial_cluster(), let change as below to fix:
-- call filemap_write_and_wait_range() to flush dirty page
-- call truncate_pagecache() to drop pages or zero partial page post eof
-- call f2fs_do_truncate_blocks() to truncate non-compress cluster to
-  last valid block
-
-Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
-Reported-by: Jan Prusakowski <jprusakowski@google.com>
-Signed-off-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/compress.c | 23 ++++++++++++++++-------
- 1 file changed, 16 insertions(+), 7 deletions(-)
-
-diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
-index e6ec77d6903be..67cac17cc7dc7 100644
---- a/fs/f2fs/compress.c
-+++ b/fs/f2fs/compress.c
-@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
- 		for (i = cluster_size - 1; i >= 0; i--) {
- 			struct folio *folio = page_folio(rpages[i]);
- 			loff_t start = (loff_t)folio->index << PAGE_SHIFT;
-+			loff_t offset = from > start ? from - start : 0;
- 
--			if (from <= start) {
--				folio_zero_segment(folio, 0, folio_size(folio));
--			} else {
--				folio_zero_segment(folio, from - start,
--						folio_size(folio));
-+			folio_zero_segment(folio, offset, folio_size(folio));
-+
-+			if (from >= start)
- 				break;
--			}
- 		}
- 
- 		f2fs_compress_write_end(inode, fsdata, start_idx, true);
-+
-+		err = filemap_write_and_wait_range(inode->i_mapping,
-+				round_down(from, cluster_size << PAGE_SHIFT),
-+				LLONG_MAX);
-+		if (err)
-+			return err;
-+
-+		truncate_pagecache(inode, from);
-+
-+		err = f2fs_do_truncate_blocks(inode,
-+				round_up(from, PAGE_SIZE), lock);
- 	}
--	return 0;
-+	return err;
- }
- 
- static int f2fs_write_compressed_pages(struct compress_ctx *cc,
--- 
-2.51.0
-
diff --git a/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch b/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch
deleted file mode 100644
index 3f2562ab6b..0000000000
--- a/queue-6.16/f2fs-fix-zero-sized-extent-for-precache-extents.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 84f80526261c2b87aba8f431018320bed9a60933 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 10:36:21 +0800
-Subject: f2fs: fix zero-sized extent for precache extents
-
-From: wangzijie <wangzijie1@honor.com>
-
-[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
-
-Script to reproduce:
-f2fs_io write 1 0 1881 rand dsync testfile
-f2fs_io fallocate 0 7708672 4096 testfile
-f2fs_io write 1 1881 1 rand buffered testfile
-fsync testfile
-umount
-mount
-f2fs_io precache_extents testfile
-
-When the data layout is something like this:
-dnode1:                     dnode2:
-[0]      A                  [0]    NEW_ADDR
-[1]      A+1                [1]    0x0
-...
-[1016]   A+1016
-[1017]   B (B!=A+1017)      [1017] 0x0
-
-During precache_extents, we map the last block(valid blkaddr) in dnode1:
-map->m_flags |= F2FS_MAP_MAPPED;
-map->m_pblk = blkaddr(valid blkaddr);
-map->m_len = 1;
-then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
-map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
-
-map->m_len = 1
-ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
-ei.fofs = start_pgofs = 1882
-ei.len = map->m_len - ofs = 1 - 1 = 0
-
-Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
-A,B,C is valid blkaddr
-case1:
-dnode1:                     dnode2:
-[0]      A                  [0]    NEW_ADDR
-[1]      A+1                [1]    0x0
-...                         ....
-[1016]   A+1016
-[1017]   B (B!=A+1017)      [1017] 0x0
-
-case2:
-dnode1:                     dnode2:
-[0]      A                  [0]    C (C!=B+1)
-[1]      A+1                [1]    C+1
-...                         ....
-[1016]   A+1016
-[1017]   B (B!=A+1017)      [1017] 0x0
-
-case3:
-dnode1:                     dnode2:
-[0]      A                  [0]    C (C!=B+2)
-[1]      A+1                [1]    C+1
-...                         ....
-[1015]   A+1015
-[1016]   B (B!=A+1016)
-[1017]   B+1                [1017] 0x0
-
-[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
-
-Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
-Signed-off-by: wangzijie <wangzijie1@honor.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/f2fs/data.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
-index 6ff650f425113..9c35a0fb79e73 100644
---- a/fs/f2fs/data.c
-+++ b/fs/f2fs/data.c
-@@ -1780,9 +1780,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
- 		if (map->m_flags & F2FS_MAP_MAPPED) {
- 			unsigned int ofs = start_pgofs - map->m_lblk;
- 
--			f2fs_update_read_extent_cache_range(&dn,
--				start_pgofs, map->m_pblk + ofs,
--				map->m_len - ofs);
-+			if (map->m_len > ofs)
-+				f2fs_update_read_extent_cache_range(&dn,
-+					start_pgofs, map->m_pblk + ofs,
-+					map->m_len - ofs);
- 		}
- 		if (map->m_next_extent)
- 			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
--- 
-2.51.0
-
diff --git a/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch b/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
deleted file mode 100644
index a933b9e2a2..0000000000
--- a/queue-6.16/fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 3418198bdcbee8bb983958e480194a35e62b2cf7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Sep 2025 16:09:13 +0200
-Subject: fanotify: Validate the return value of mnt_ns_from_dentry() before
- dereferencing
-
-From: Anderson Nascimento <anderson@allelesecurity.com>
-
-[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ]
-
-The function do_fanotify_mark() does not validate if
-mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.
-This causes a NULL pointer dereference in do_fanotify_mark() if the
-path is not a mount namespace object.
-
-Fix this by checking mnt_ns_from_dentry()'s return value before
-dereferencing it.
-
-Before the patch
-
-$ gcc fanotify_nullptr.c -o fanotify_nullptr
-$ mkdir A
-$ ./fanotify_nullptr
-Fanotify fd: 3
-fanotify_mark: Operation not permitted
-$ unshare -Urm
-Fanotify fd: 3
-Killed
-
-int main(void){
-    int ffd;
-    ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);
-    if(ffd < 0){
-        perror("fanotify_init");
-        exit(EXIT_FAILURE);
-    }
-
-    printf("Fanotify fd: %d\n",ffd);
-
-    if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,
-FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){
-        perror("fanotify_mark");
-        exit(EXIT_FAILURE);
-    }
-
-return 0;
-}
-
-After the patch
-
-$ gcc fanotify_nullptr.c -o fanotify_nullptr
-$ mkdir A
-$ ./fanotify_nullptr
-Fanotify fd: 3
-fanotify_mark: Operation not permitted
-$ unshare -Urm
-Fanotify fd: 3
-fanotify_mark: Invalid argument
-
-[   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038
-[   25.695006] #PF: supervisor read access in kernel mode
-[   25.695012] #PF: error_code(0x0000) - not-present page
-[   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0
-[   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI
-[   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not
-tainted 6.17.0-rc4 #1 PREEMPT(lazy)
-[   25.695040] Hardware name: VMware, Inc. VMware Virtual
-Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
-[   25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950
-[   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54
-24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b
-5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28
-85 c9
-[   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203
-[   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220
-[   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180
-[   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000
-[   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7
-[   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0
-[   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)
-knlGS:0000000000000000
-[   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0
-[   25.695201] Call Trace:
-[   25.695209]  <TASK>
-[   25.695215]  __x64_sys_fanotify_mark+0x1f/0x30
-[   25.695222]  do_syscall_64+0x82/0x2c0
-...
-
-Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns")
-Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com
-Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
-Reviewed-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Jan Kara <jack@suse.cz>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/notify/fanotify/fanotify_user.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
-index b192ee068a7ac..561339b4cf752 100644
---- a/fs/notify/fanotify/fanotify_user.c
-+++ b/fs/notify/fanotify/fanotify_user.c
-@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
- 		user_ns = path.mnt->mnt_sb->s_user_ns;
- 		obj = path.mnt->mnt_sb;
- 	} else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) {
-+		ret = -EINVAL;
- 		mntns = mnt_ns_from_dentry(path.dentry);
-+		if (!mntns)
-+			goto path_put_and_out;
- 		user_ns = mntns->user_ns;
- 		obj = mntns;
- 	}
--- 
-2.51.0
-
diff --git a/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch b/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
deleted file mode 100644
index bf47c78b27..0000000000
--- a/queue-6.16/filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 3a3191e60fec286dc8cba60908adb968e3f67bfc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 3 Sep 2025 11:23:33 -0400
-Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
-
-From: Jeff Layton <jlayton@kernel.org>
-
-[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
-
-Show the FL_RECLAIM flag symbolically in tracepoints.
-
-Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
-Signed-off-by: Jeff Layton <jlayton@kernel.org>
-Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/trace/events/filelock.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
-index b8d1e00a7982c..2dfeb158e848a 100644
---- a/include/trace/events/filelock.h
-+++ b/include/trace/events/filelock.h
-@@ -27,7 +27,8 @@
- 		{ FL_SLEEP,		"FL_SLEEP" },			\
- 		{ FL_DOWNGRADE_PENDING,	"FL_DOWNGRADE_PENDING" },	\
- 		{ FL_UNLOCK_PENDING,	"FL_UNLOCK_PENDING" },		\
--		{ FL_OFDLCK,		"FL_OFDLCK" })
-+		{ FL_OFDLCK,		"FL_OFDLCK" },			\
-+		{ FL_RECLAIM,		"FL_RECLAIM"})
- 
- #define show_fl_type(val)				\
- 	__print_symbolic(val,				\
--- 
-2.51.0
-
diff --git a/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch b/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
deleted file mode 100644
index c1a2fd21b8..0000000000
--- a/queue-6.16/firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 64598ab1445d9666c76a8441c49e0ef463ea7183 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 15:53:43 +0800
-Subject: firmware: arm_scmi: Mark VirtIO ready before registering
- scmi_virtio_driver
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Junnan Wu <junnan01.wu@samsung.com>
-
-[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]
-
-After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
-standalone driver”), the VirtIO transport probes independently. During
-scmi_virtio_probe, scmi_probe() is called, which intune invokes
-scmi_protocol_acquire() that sends a message over the virtqueue and
-waits for a reply.
-
-Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
-virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
-Initialization):
-  |  The driver MUST NOT send any buffer available notifications to the
-  |  device before setting DRIVER_OK.
-
-Some type-1 hypervisors block available-buffer notifications until the
-driver is marked OK. In such cases, scmi_vio_probe stalls in
-scmi_wait_for_reply(), and the probe never completes.
-
-Resolve this by setting DRIVER_OK immediately after the device-specific
-setup, so scmi_probe() can safely send notifications.
-
-Note after splitting the transports into modules, the probe sequence
-changed a bit. We can no longer rely on virtio_device_ready() being
-called by the core in virtio_dev_probe(), because scmi_vio_probe()
-doesn’t complete until the core SCMI stack runs scmi_probe(), which
-immediately issues the initial BASE protocol exchanges.
-
-Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
-Signed-off-by: Junnan Wu <junnan01.wu@samsung.com>
-Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com>
-Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
-index cb934db9b2b4a..326c4a93e44b9 100644
---- a/drivers/firmware/arm_scmi/transports/virtio.c
-+++ b/drivers/firmware/arm_scmi/transports/virtio.c
-@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
- 	/* Ensure initialized scmi_vdev is visible */
- 	smp_store_mb(scmi_vdev, vdev);
- 
-+	/* Set device ready */
-+	virtio_device_ready(vdev);
-+
- 	ret = platform_driver_register(&scmi_virtio_driver);
- 	if (ret) {
- 		vdev->priv = NULL;
--- 
-2.51.0
-
diff --git a/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch b/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch
deleted file mode 100644
index 629fa6c73e..0000000000
--- a/queue-6.16/firmware-firmware-meson-sm-fix-compile-test-default.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From e20a7cc336cba44d9db1ff738ea2f7e87eb08ac2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 25 Jul 2025 09:54:29 +0200
-Subject: firmware: firmware: meson-sm: fix compile-test default
-
-From: Johan Hovold <johan@kernel.org>
-
-[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
-
-Enabling compile testing should not enable every individual driver (we
-have "allyesconfig" for that).
-
-Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
-Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
-Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/firmware/meson/Kconfig | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
-index f2fdd37566482..179f5d46d8ddf 100644
---- a/drivers/firmware/meson/Kconfig
-+++ b/drivers/firmware/meson/Kconfig
-@@ -5,7 +5,7 @@
- config MESON_SM
- 	tristate "Amlogic Secure Monitor driver"
- 	depends on ARCH_MESON || COMPILE_TEST
--	default y
-+	default ARCH_MESON
- 	depends on ARM64_4K_PAGES
- 	help
- 	  Say y here to enable the Amlogic secure monitor driver
--- 
-2.51.0
-
diff --git a/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch b/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
deleted file mode 100644
index 5a3a335007..0000000000
--- a/queue-6.16/fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From d787afb975964a61469676b00948ad6e6416af83 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 Aug 2025 13:08:55 +0300
-Subject: fs: ntfs3: Fix integer overflow in run_unpack()
-
-From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
-
-[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
-
-The MFT record relative to the file being opened contains its runlist,
-an array containing information about the file's location on the physical
-disk. Analysis of all Call Stack paths showed that the values of the
-runlist array, from which LCNs are calculated, are not validated before
-run_unpack function.
-
-The run_unpack function decodes the compressed runlist data format
-from MFT attributes (for example, $DATA), converting them into a runs_tree
-structure, which describes the mapping of virtual clusters (VCN) to
-logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
-deleting files from MFT records - in this case, the RUN_DEALLOCATE
-command is sent to the run_unpack input, and the function logic
-provides that all data transferred to the runlist about file or
-directory is deleted without creating a runs_tree structure.
-
-Substituting the runlist in the $DATA attribute of the MFT record for an
-arbitrary file can lead either to access to arbitrary data on the disk
-bypassing access checks to them (since the inode access check
-occurs above) or to destruction of arbitrary data on the disk.
-
-Add overflow check for addition operation.
-
-Found by Linux Verification Center (linuxtesting.org) with SVACE.
-
-Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
-Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
-Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ntfs3/run.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
-index 6e86d66197ef2..88550085f7457 100644
---- a/fs/ntfs3/run.c
-+++ b/fs/ntfs3/run.c
-@@ -9,6 +9,7 @@
- #include <linux/blkdev.h>
- #include <linux/fs.h>
- #include <linux/log2.h>
-+#include <linux/overflow.h>
- 
- #include "debug.h"
- #include "ntfs.h"
-@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
- 
- 			if (!dlcn)
- 				return -EINVAL;
--			lcn = prev_lcn + dlcn;
-+
-+			if (check_add_overflow(prev_lcn, dlcn, &lcn))
-+				return -EINVAL;
- 			prev_lcn = lcn;
- 		} else {
- 			/* The size of 'dlcn' can't be > 8. */
- 			return -EINVAL;
- 		}
- 
--		next_vcn = vcn64 + len;
-+		if (check_add_overflow(vcn64, len, &next_vcn))
-+			return -EINVAL;
-+
- 		/* Check boundary. */
- 		if (next_vcn > evcn + 1)
- 			return -EINVAL;
-@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
- 			return -EINVAL;
- 
- 		run_buf += size_size + offset_size;
--		vcn64 += len;
-+		if (check_add_overflow(vcn64, len, &vcn64))
-+			return -EINVAL;
- 
- #ifndef CONFIG_NTFS3_64BIT_CLUSTER
- 		if (vcn64 > 0x100000000ull)
--- 
-2.51.0
-
diff --git a/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch b/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
deleted file mode 100644
index 67367267bc..0000000000
--- a/queue-6.16/fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From dde216c045efb536e31eca4e4e478163b14c3eb6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Jul 2025 10:40:16 -0700
-Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks
- exist
-
-From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
-
-[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
-
-Index allocation requires at least one bit in the $BITMAP attribute to
-track usage of index entries. If the bitmap is empty while index blocks
-are already present, this reflects on-disk corruption.
-
-syzbot triggered this condition using a malformed NTFS image. During a
-rename() operation involving a long filename (which spans multiple
-index entries), the empty bitmap allowed the name to be added without
-valid tracking. Subsequent deletion of the original entry failed with
--ENOENT, due to unexpected index state.
-
-Reject such cases by verifying that the bitmap is not empty when index
-blocks exist.
-
-Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
-Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
-Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
-Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
-Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
-Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ntfs3/index.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
-index 1bf2a6593dec6..6d1bf890929d9 100644
---- a/fs/ntfs3/index.c
-+++ b/fs/ntfs3/index.c
-@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
- 			bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
- 		}
- 
-+		/*
-+		 * Index blocks exist, but $BITMAP has zero valid bits.
-+		 * This implies an on-disk corruption and must be rejected.
-+		 */
-+		if (in->name == I30_NAME &&
-+		    unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
-+			err = -EINVAL;
-+			goto out1;
-+		}
-+
- 		bit = bmp_size << 3;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch b/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
deleted file mode 100644
index 998e330f54..0000000000
--- a/queue-6.16/fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From f1df31eec09bd93f6d2cabf0188d98a8066b80fc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 16 Aug 2025 11:49:54 +0530
-Subject: fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
-
-From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
-
-[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ]
-
-Use kvfree() to free memory allocated by kvzalloc() instead of kfree().
-Avoid potential memory management issue considering kvzalloc() can
-internally choose to use either kmalloc() or vmalloc() based on memory
-request and current system memory state. Hence, use more appropriate
-kvfree() which automatically determines correct free method to avoid
-potential hard to debug memory issues.  Fix this issue discovered by
-running spatch static analysis tool using coccinelle script -
-scripts/coccinelle/api/kfree_mismatch.cocci
-
-Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw")
-Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in
-Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Reviewed-by: Alison Schofield <alison.schofield@intel.com>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/fwctl/mlx5/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c
-index f93aa0cecdb97..4b379f695eb73 100644
---- a/drivers/fwctl/mlx5/main.c
-+++ b/drivers/fwctl/mlx5/main.c
-@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope,
- 	 */
- 	if (ret && ret != -EREMOTEIO) {
- 		if (rpc_out != rpc_in)
--			kfree(rpc_out);
-+			kvfree(rpc_out);
- 		return ERR_PTR(ret);
- 	}
- 	return rpc_out;
--- 
-2.51.0
-
diff --git a/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch b/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
deleted file mode 100644
index dc55e24425..0000000000
--- a/queue-6.16/gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 947e194027abac7ed01c82a5f44301721032db21 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 2 Aug 2025 23:57:24 +0200
-Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
-
-From: Andreas Gruenbacher <agruenba@redhat.com>
-
-[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
-
-Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
-added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
-flag a second time after it has already been cleared.  Fix that.
-
-Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
-Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
-Reviewed-by: Andrew Price <anprice@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/gfs2/glock.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
-index ea96113edbe31..5f44486479d69 100644
---- a/fs/gfs2/glock.c
-+++ b/fs/gfs2/glock.c
-@@ -807,8 +807,6 @@ __acquires(&gl->gl_lockref.lock)
- 			clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
- 			gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
- 			return;
--		} else {
--			clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
- 		}
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch b/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch
deleted file mode 100644
index 2665d3c361..0000000000
--- a/queue-6.16/hid-hidraw-tighten-ioctl-command-parsing.patch
+++ /dev/null
@@ -1,310 +0,0 @@
-From 82ff4e2791518d34de1a79975daa41dbcf74efc8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 18:58:51 +0200
-Subject: HID: hidraw: tighten ioctl command parsing
-
-From: Benjamin Tissoires <bentiss@kernel.org>
-
-[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]
-
-The handling for variable-length ioctl commands in hidraw_ioctl() is
-rather complex and the check for the data direction is incomplete.
-
-Simplify this code by factoring out the various ioctls grouped by dir
-and size, and using a switch() statement with the size masked out, to
-ensure the rest of the command is correctly matched.
-
-Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
-Reported-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
-Signed-off-by: Jiri Kosina <jkosina@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hid/hidraw.c        | 224 ++++++++++++++++++++----------------
- include/uapi/linux/hidraw.h |   2 +
- 2 files changed, 124 insertions(+), 102 deletions(-)
-
-diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
-index c887f48756f4b..bbd6f23bce789 100644
---- a/drivers/hid/hidraw.c
-+++ b/drivers/hid/hidraw.c
-@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
- 	return 0;
- }
- 
--static long hidraw_ioctl(struct file *file, unsigned int cmd,
--							unsigned long arg)
-+static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
-+				    void __user *arg)
- {
--	struct inode *inode = file_inode(file);
--	unsigned int minor = iminor(inode);
--	long ret = 0;
--	struct hidraw *dev;
--	struct hidraw_list *list = file->private_data;
--	void __user *user_arg = (void __user*) arg;
--
--	down_read(&minors_rwsem);
--	dev = hidraw_table[minor];
--	if (!dev || !dev->exist || hidraw_is_revoked(list)) {
--		ret = -ENODEV;
--		goto out;
--	}
-+	struct hid_device *hid = dev->hid;
- 
- 	switch (cmd) {
- 		case HIDIOCGRDESCSIZE:
--			if (put_user(dev->hid->rsize, (int __user *)arg))
--				ret = -EFAULT;
-+			if (put_user(hid->rsize, (int __user *)arg))
-+				return -EFAULT;
- 			break;
- 
- 		case HIDIOCGRDESC:
-@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
- 				__u32 len;
- 
- 				if (get_user(len, (int __user *)arg))
--					ret = -EFAULT;
--				else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
--					ret = -EINVAL;
--				else if (copy_to_user(user_arg + offsetof(
--					struct hidraw_report_descriptor,
--					value[0]),
--					dev->hid->rdesc,
--					min(dev->hid->rsize, len)))
--					ret = -EFAULT;
-+					return -EFAULT;
-+
-+				if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
-+					return -EINVAL;
-+
-+				if (copy_to_user(arg + offsetof(
-+				    struct hidraw_report_descriptor,
-+				    value[0]),
-+				    hid->rdesc,
-+				    min(hid->rsize, len)))
-+					return -EFAULT;
-+
- 				break;
- 			}
- 		case HIDIOCGRAWINFO:
- 			{
- 				struct hidraw_devinfo dinfo;
- 
--				dinfo.bustype = dev->hid->bus;
--				dinfo.vendor = dev->hid->vendor;
--				dinfo.product = dev->hid->product;
--				if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
--					ret = -EFAULT;
-+				dinfo.bustype = hid->bus;
-+				dinfo.vendor = hid->vendor;
-+				dinfo.product = hid->product;
-+				if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
-+					return -EFAULT;
- 				break;
- 			}
- 		case HIDIOCREVOKE:
- 			{
--				if (user_arg)
--					ret = -EINVAL;
--				else
--					ret = hidraw_revoke(list);
--				break;
-+				struct hidraw_list *list = file->private_data;
-+
-+				if (arg)
-+					return -EINVAL;
-+
-+				return hidraw_revoke(list);
- 			}
- 		default:
--			{
--				struct hid_device *hid = dev->hid;
--				if (_IOC_TYPE(cmd) != 'H') {
--					ret = -EINVAL;
--					break;
--				}
-+			/*
-+			 * None of the above ioctls can return -EAGAIN, so
-+			 * use it as a marker that we need to check variable
-+			 * length ioctls.
-+			 */
-+			return -EAGAIN;
-+	}
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
--					break;
--				}
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
--					break;
--				}
-+	return 0;
-+}
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
--					break;
--				}
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
--					break;
--				}
-+static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
-+					  void __user *user_arg)
-+{
-+	int len = _IOC_SIZE(cmd);
-+
-+	switch (cmd & ~IOCSIZE_MASK) {
-+	case HIDIOCSFEATURE(0):
-+		return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
-+	case HIDIOCGFEATURE(0):
-+		return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
-+	case HIDIOCSINPUT(0):
-+		return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
-+	case HIDIOCGINPUT(0):
-+		return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
-+	case HIDIOCSOUTPUT(0):
-+		return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
-+	case HIDIOCGOUTPUT(0):
-+		return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
-+	}
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
--					break;
--				}
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
--					int len = _IOC_SIZE(cmd);
--					ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
--					break;
--				}
-+	return -EINVAL;
-+}
- 
--				/* Begin Read-only ioctls. */
--				if (_IOC_DIR(cmd) != _IOC_READ) {
--					ret = -EINVAL;
--					break;
--				}
-+static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
-+					  void __user *user_arg)
-+{
-+	struct hid_device *hid = dev->hid;
-+	int len = _IOC_SIZE(cmd);
-+	int field_len;
-+
-+	switch (cmd & ~IOCSIZE_MASK) {
-+	case HIDIOCGRAWNAME(0):
-+		field_len = strlen(hid->name) + 1;
-+		if (len > field_len)
-+			len = field_len;
-+		return copy_to_user(user_arg, hid->name, len) ?  -EFAULT : len;
-+	case HIDIOCGRAWPHYS(0):
-+		field_len = strlen(hid->phys) + 1;
-+		if (len > field_len)
-+			len = field_len;
-+		return copy_to_user(user_arg, hid->phys, len) ?  -EFAULT : len;
-+	case HIDIOCGRAWUNIQ(0):
-+		field_len = strlen(hid->uniq) + 1;
-+		if (len > field_len)
-+			len = field_len;
-+		return copy_to_user(user_arg, hid->uniq, len) ?  -EFAULT : len;
-+	}
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
--					int len = strlen(hid->name) + 1;
--					if (len > _IOC_SIZE(cmd))
--						len = _IOC_SIZE(cmd);
--					ret = copy_to_user(user_arg, hid->name, len) ?
--						-EFAULT : len;
--					break;
--				}
-+	return -EINVAL;
-+}
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
--					int len = strlen(hid->phys) + 1;
--					if (len > _IOC_SIZE(cmd))
--						len = _IOC_SIZE(cmd);
--					ret = copy_to_user(user_arg, hid->phys, len) ?
--						-EFAULT : len;
--					break;
--				}
-+static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-+{
-+	struct inode *inode = file_inode(file);
-+	unsigned int minor = iminor(inode);
-+	struct hidraw *dev;
-+	struct hidraw_list *list = file->private_data;
-+	void __user *user_arg = (void __user *)arg;
-+	int ret;
- 
--				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
--					int len = strlen(hid->uniq) + 1;
--					if (len > _IOC_SIZE(cmd))
--						len = _IOC_SIZE(cmd);
--					ret = copy_to_user(user_arg, hid->uniq, len) ?
--						-EFAULT : len;
--					break;
--				}
--			}
-+	down_read(&minors_rwsem);
-+	dev = hidraw_table[minor];
-+	if (!dev || !dev->exist || hidraw_is_revoked(list)) {
-+		ret = -ENODEV;
-+		goto out;
-+	}
-+
-+	if (_IOC_TYPE(cmd) != 'H') {
-+		ret = -EINVAL;
-+		goto out;
-+	}
- 
-+	if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
- 		ret = -ENOTTY;
-+		goto out;
- 	}
-+
-+	ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
-+	if (ret != -EAGAIN)
-+		goto out;
-+
-+	switch (_IOC_DIR(cmd)) {
-+	case (_IOC_READ | _IOC_WRITE):
-+		ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
-+		break;
-+	case _IOC_READ:
-+		ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
-+		break;
-+	default:
-+		/* Any other IOC_DIR is wrong */
-+		ret = -EINVAL;
-+	}
-+
- out:
- 	up_read(&minors_rwsem);
- 	return ret;
-diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
-index d5ee269864e07..ebd701b3c18d9 100644
---- a/include/uapi/linux/hidraw.h
-+++ b/include/uapi/linux/hidraw.h
-@@ -48,6 +48,8 @@ struct hidraw_devinfo {
- #define HIDIOCGOUTPUT(len)    _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
- #define HIDIOCREVOKE	      _IOW('H', 0x0D, int) /* Revoke device access */
- 
-+#define HIDIOCTL_LAST		_IOC_NR(HIDIOCREVOKE)
-+
- #define HIDRAW_FIRST_MINOR 0
- #define HIDRAW_MAX_DEVICES 64
- /* number of reports to buffer */
--- 
-2.51.0
-
diff --git a/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch b/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
deleted file mode 100644
index aaca240c76..0000000000
--- a/queue-6.16/hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 6fa21740fb65709ab70f5825dca70f1acdd56a2d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 16:27:35 +0200
-Subject: HID: steelseries: Fix STEELSERIES_SRWS1 handling in
- steelseries_remove()
-
-From: Jiri Kosina <jkosina@suse.com>
-
-[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ]
-
-srws1_remove label can be only reached only if LEDS subsystem is enabled. To
-avoid putting horryfing ifdef second time around the label, just perform
-the cleanup and exit immediately directly.
-
-Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()")
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/
-Signed-off-by: Jiri Kosina <jkosina@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hid/hid-steelseries.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
-index 8af98d67959e0..f98435631aa18 100644
---- a/drivers/hid/hid-steelseries.c
-+++ b/drivers/hid/hid-steelseries.c
-@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev)
- 	if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
- #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
-     (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
--		goto srws1_remove;
-+		hid_hw_stop(hdev);
- #endif
- 		return;
- 	}
-@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev)
- 	cancel_delayed_work_sync(&sd->battery_work);
- 
- 	hid_hw_close(hdev);
--srws1_remove:
- 	hid_hw_stop(hdev);
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch b/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch
deleted file mode 100644
index 7e673bd5a4..0000000000
--- a/queue-6.16/hid-steelseries-refactor-probe-and-remove.patch
+++ /dev/null
@@ -1,322 +0,0 @@
-From 64bbc2de738bea00929848c08339da34531af790 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 17 Jul 2025 20:26:43 +0900
-Subject: HID: steelseries: refactor probe() and remove()
-
-From: Jeongjun Park <aha310510@gmail.com>
-
-[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ]
-
-steelseries_srws1_probe() still does not use devm_kzalloc() and
-devm_led_classdev_register(), so there is a lot of code to safely manage
-heap, which reduces readability and may cause memory leaks due to minor
-patch mistakes in the future.
-
-Therefore, it should be changed to use devm_kzalloc() and
-devm_led_classdev_register() to easily and safely manage heap.
-
-Also, the current steelseries driver mainly checks sd->quriks to determine
-which product a specific HID device is, which is not the correct way.
-
-remove(), unlike probe(), does not receive struct hid_device_id as an
-argument, so it must check hdev unconditionally to know which product
-it is.
-
-However, since struct steelseries_device and struct steelseries_srws1_data
-have different structures, if SRWS1 is removed in remove(), converts
-hdev->dev, which is initialized to struct steelseries_srws1_data,
-to struct steelseries_device and uses it. This causes various
-memory-related bugs as completely unexpected values exist in member
-variables of the structure.
-
-Therefore, in order to modify probe() and remove() to work properly,
-Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be
-modified to check hdev->product when determining HID device product.
-
-Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox")
-Signed-off-by: Jeongjun Park <aha310510@gmail.com>
-Signed-off-by: Jiri Kosina <jkosina@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hid/hid-ids.h         |   2 +
- drivers/hid/hid-quirks.c      |   2 +
- drivers/hid/hid-steelseries.c | 109 ++++++++++++----------------------
- 3 files changed, 43 insertions(+), 70 deletions(-)
-
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index a752c667fbcaa..dde20386def17 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -1293,6 +1293,8 @@
- 
- #define USB_VENDOR_ID_STEELSERIES	0x1038
- #define USB_DEVICE_ID_STEELSERIES_SRWS1	0x1410
-+#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1  0x12b6
-+#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9  0x12c2
- 
- #define USB_VENDOR_ID_SUN		0x0430
- #define USB_DEVICE_ID_RARITAN_KVM_DONGLE	0xcdab
-diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
-index 416160cfde77b..ccffd08cd8840 100644
---- a/drivers/hid/hid-quirks.c
-+++ b/drivers/hid/hid-quirks.c
-@@ -694,6 +694,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
- #endif
- #if IS_ENABLED(CONFIG_HID_STEELSERIES)
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
-+	{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) },
-+	{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) },
- #endif
- #if IS_ENABLED(CONFIG_HID_SUNPLUS)
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
-diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
-index d4bd7848b8c66..8af98d67959e0 100644
---- a/drivers/hid/hid-steelseries.c
-+++ b/drivers/hid/hid-steelseries.c
-@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
- {
- 	int ret, i;
- 	struct led_classdev *led;
-+	struct steelseries_srws1_data *drv_data;
- 	size_t name_sz;
- 	char *name;
- 
--	struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL);
--
-+	drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
- 	if (drv_data == NULL) {
- 		hid_err(hdev, "can't alloc SRW-S1 memory\n");
- 		return -ENOMEM;
-@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
- 	ret = hid_parse(hdev);
- 	if (ret) {
- 		hid_err(hdev, "parse failed\n");
--		goto err_free;
-+		goto err;
- 	}
- 
- 	if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
- 		ret = -ENODEV;
--		goto err_free;
-+		goto err;
- 	}
- 
- 	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
- 	if (ret) {
- 		hid_err(hdev, "hw start failed\n");
--		goto err_free;
-+		goto err;
- 	}
- 
- 	/* register led subsystem */
-@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
- 	name_sz = strlen(hdev->uniq) + 16;
- 
- 	/* 'ALL', for setting all LEDs simultaneously */
--	led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
-+	led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
- 	if (!led) {
- 		hid_err(hdev, "can't allocate memory for LED ALL\n");
--		goto err_led;
-+		goto out;
- 	}
- 
- 	name = (void *)(&led[1]);
-@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
- 	led->brightness_set = steelseries_srws1_led_all_set_brightness;
- 
- 	drv_data->led[SRWS1_NUMBER_LEDS] = led;
--	ret = led_classdev_register(&hdev->dev, led);
--	if (ret)
--		goto err_led;
-+	ret = devm_led_classdev_register(&hdev->dev, led);
-+	if (ret) {
-+		hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS);
-+		goto out; /* let the driver continue without LEDs */
-+	}
- 
- 	/* Each individual LED */
- 	for (i = 0; i < SRWS1_NUMBER_LEDS; i++) {
--		led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
-+		led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
- 		if (!led) {
- 			hid_err(hdev, "can't allocate memory for LED %d\n", i);
--			goto err_led;
-+			break;
- 		}
- 
- 		name = (void *)(&led[1]);
-@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
- 		led->brightness_set = steelseries_srws1_led_set_brightness;
- 
- 		drv_data->led[i] = led;
--		ret = led_classdev_register(&hdev->dev, led);
-+		ret = devm_led_classdev_register(&hdev->dev, led);
- 
- 		if (ret) {
- 			hid_err(hdev, "failed to register LED %d. Aborting.\n", i);
--err_led:
--			/* Deregister all LEDs (if any) */
--			for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
--				led = drv_data->led[i];
--				drv_data->led[i] = NULL;
--				if (!led)
--					continue;
--				led_classdev_unregister(led);
--				kfree(led);
--			}
--			goto out;	/* but let the driver continue without LEDs */
-+			break;	/* but let the driver continue without LEDs */
- 		}
- 	}
- out:
- 	return 0;
--err_free:
--	kfree(drv_data);
-+err:
- 	return ret;
- }
--
--static void steelseries_srws1_remove(struct hid_device *hdev)
--{
--	int i;
--	struct led_classdev *led;
--
--	struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev);
--
--	if (drv_data) {
--		/* Deregister LEDs (if any) */
--		for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
--			led = drv_data->led[i];
--			drv_data->led[i] = NULL;
--			if (!led)
--				continue;
--			led_classdev_unregister(led);
--			kfree(led);
--		}
--
--	}
--
--	hid_hw_stop(hdev);
--	kfree(drv_data);
--}
- #endif
- 
- #define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS	3000
-@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev,
- 
- static void steelseries_headset_fetch_battery(struct hid_device *hdev)
- {
--	struct steelseries_device *sd = hid_get_drvdata(hdev);
- 	int ret = 0;
- 
--	if (sd->quirks & STEELSERIES_ARCTIS_1)
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1)
- 		ret = steelseries_headset_request_battery(hdev,
- 			arctis_1_battery_request, sizeof(arctis_1_battery_request));
--	else if (sd->quirks & STEELSERIES_ARCTIS_9)
-+	else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9)
- 		ret = steelseries_headset_request_battery(hdev,
- 			arctis_9_battery_request, sizeof(arctis_9_battery_request));
- 
-@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
- 	struct steelseries_device *sd;
- 	int ret;
- 
--	sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
--	if (!sd)
--		return -ENOMEM;
--	hid_set_drvdata(hdev, sd);
--	sd->hdev = hdev;
--	sd->quirks = id->driver_data;
--
--	if (sd->quirks & STEELSERIES_SRWS1) {
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
- #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
-     (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
- 		return steelseries_srws1_probe(hdev, id);
-@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
- #endif
- 	}
- 
-+	sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
-+	if (!sd)
-+		return -ENOMEM;
-+	hid_set_drvdata(hdev, sd);
-+	sd->hdev = hdev;
-+	sd->quirks = id->driver_data;
-+
- 	ret = hid_parse(hdev);
- 	if (ret)
- 		return ret;
-@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
- 
- static void steelseries_remove(struct hid_device *hdev)
- {
--	struct steelseries_device *sd = hid_get_drvdata(hdev);
-+	struct steelseries_device *sd;
- 	unsigned long flags;
- 
--	if (sd->quirks & STEELSERIES_SRWS1) {
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
- #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
-     (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
--		steelseries_srws1_remove(hdev);
-+		goto srws1_remove;
- #endif
- 		return;
- 	}
- 
-+	sd = hid_get_drvdata(hdev);
-+
- 	spin_lock_irqsave(&sd->lock, flags);
- 	sd->removed = true;
- 	spin_unlock_irqrestore(&sd->lock, flags);
-@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev)
- 	cancel_delayed_work_sync(&sd->battery_work);
- 
- 	hid_hw_close(hdev);
-+srws1_remove:
- 	hid_hw_stop(hdev);
- }
- 
-@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
- 	unsigned long flags;
- 
- 	/* Not a headset */
--	if (sd->quirks & STEELSERIES_SRWS1)
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1)
- 		return 0;
- 
--	if (sd->quirks & STEELSERIES_ARCTIS_1) {
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) {
- 		hid_dbg(sd->hdev,
- 			"Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf);
- 		if (size < ARCTIS_1_BATTERY_RESPONSE_LEN ||
-@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
- 		}
- 	}
- 
--	if (sd->quirks & STEELSERIES_ARCTIS_9) {
-+	if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) {
- 		hid_dbg(sd->hdev,
- 			"Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf);
- 		if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) {
-@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = {
- 	  .driver_data = STEELSERIES_SRWS1 },
- 
- 	{ /* SteelSeries Arctis 1 Wireless for XBox */
--	  HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6),
--	.driver_data = STEELSERIES_ARCTIS_1 },
-+	  HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1),
-+	  .driver_data = STEELSERIES_ARCTIS_1 },
- 
- 	{ /* SteelSeries Arctis 9 Wireless for XBox */
--	  HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2),
-+	  HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9),
- 	  .driver_data = STEELSERIES_ARCTIS_9 },
- 
- 	{ }
--- 
-2.51.0
-
diff --git a/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
deleted file mode 100644
index ceb7e1a88a..0000000000
--- a/queue-6.16/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 978c5aafad2b54f34a9626b261e8f2d09f68e43d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Sep 2025 09:02:54 +0530
-Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Deepanshu Kartikey <kartikey406@gmail.com>
-
-[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ]
-
-hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate
-operations.  As per the original design in commit 40549ba8f8e0 ("hugetlb:
-use new vma_lock for pmd sharing synchronization"), if the trylock fails
-or the VMA has no lock, it should skip that VMA.  Any remaining mapped
-pages are handled by remove_inode_hugepages() which is called after
-hugetlb_vmdelete_list() and uses proper lock ordering to guarantee
-unmapping success.
-
-Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs
-without shareable locks, the code proceeds to call unmap_hugepage_range().
-This causes assertion failures in huge_pmd_unshare() →
-hugetlb_vma_assert_locked() because no lock is actually held:
-
-  WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted
-  Call Trace:
-   hugetlb_vma_assert_locked+0x1dd/0x250
-   huge_pmd_unshare+0x2c8/0x540
-   __unmap_hugepage_range+0x6e3/0x1aa0
-   unmap_hugepage_range+0x32e/0x410
-   hugetlb_vmdelete_list+0x189/0x1f0
-
-Fix by using goto to ensure locks acquired by trylock are always released,
-even when skipping VMAs without shareable locks.
-
-Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com
-Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization")
-Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
-Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com
-Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7
-Suggested-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: David Hildenbrand <david@redhat.com>
-Cc: Muchun Song <muchun.song@linux.dev>
-Cc: Oscar Salvador <osalvador@suse.de>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/hugetlbfs/inode.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 6040e54082777..f56155a2969ee 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -493,6 +493,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
- 		if (!hugetlb_vma_trylock_write(vma))
- 			continue;
- 
-+		/*
-+		 * Skip VMAs without shareable locks. Per the design in commit
-+		 * 40549ba8f8e0, these will be handled by remove_inode_hugepages()
-+		 * called after this function with proper locking.
-+		 */
-+		if (!__vma_shareable_lock(vma))
-+			goto skip;
-+
- 		v_start = vma_offset_start(vma, start);
- 		v_end = vma_offset_end(vma, end);
- 
-@@ -503,6 +511,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
- 		 * vmas.  Therefore, lock is not held when calling
- 		 * unmap_hugepage_range for private vmas.
- 		 */
-+skip:
- 		hugetlb_vma_unlock_write(vma);
- 	}
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch b/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
deleted file mode 100644
index e5a54765fc..0000000000
--- a/queue-6.16/hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From e2861afcbbfd5af8679e5b4b2441810eb5e08192 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jan 2025 10:48:58 +0200
-Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
- different subsystems
-
-From: Vadim Pasternak <vadimp@nvidia.com>
-
-[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
-
-Distinct between fan speed setting request coming for hwmon and
-thermal subsystems.
-
-There are fields 'last_hwmon_state' and 'last_thermal_state' in the
-structure 'mlxreg_fan_pwm', which respectively store the cooling state
-set by the 'hwmon' and 'thermal' subsystem.
-The purpose is to make arbitration of fan speed setting. For example, if
-fan speed required to be not lower than some limit, such setting is to
-be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
-not set fan below this limit.
-
-Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
-cooling state to never be set to a lower value.
-
-Eliminate update of 'last_thermal_state', when request is coming from
-'hwmon' subsystem.
-
-Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
-Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
-Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
- 1 file changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
-index c25a54d5b39ad..0ba9195c9d713 100644
---- a/drivers/hwmon/mlxreg-fan.c
-+++ b/drivers/hwmon/mlxreg-fan.c
-@@ -113,8 +113,8 @@ struct mlxreg_fan {
- 	int divider;
- };
- 
--static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
--				    unsigned long state);
-+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-+				     unsigned long state, bool thermal);
- 
- static int
- mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
-@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
- 				 * last thermal state.
- 				 */
- 				if (pwm->last_hwmon_state >= pwm->last_thermal_state)
--					return mlxreg_fan_set_cur_state(pwm->cdev,
--									pwm->last_hwmon_state);
-+					return _mlxreg_fan_set_cur_state(pwm->cdev,
-+									 pwm->last_hwmon_state,
-+									 false);
- 				return 0;
- 			}
- 			return regmap_write(fan->regmap, pwm->reg, val);
-@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
- 	return 0;
- }
- 
--static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
--				    unsigned long state)
--
-+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-+				     unsigned long state, bool thermal)
- {
- 	struct mlxreg_fan_pwm *pwm = cdev->devdata;
- 	struct mlxreg_fan *fan = pwm->fan;
-@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
- 		return -EINVAL;
- 
- 	/* Save thermal state. */
--	pwm->last_thermal_state = state;
-+	if (thermal)
-+		pwm->last_thermal_state = state;
- 
- 	state = max_t(unsigned long, state, pwm->last_hwmon_state);
- 	err = regmap_write(fan->regmap, pwm->reg,
-@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
- 	return 0;
- }
- 
-+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-+				    unsigned long state)
-+
-+{
-+	return _mlxreg_fan_set_cur_state(cdev, state, true);
-+}
-+
- static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
- 	.get_max_state	= mlxreg_fan_get_max_state,
- 	.get_cur_state	= mlxreg_fan_get_cur_state,
--- 
-2.51.0
-
diff --git a/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch b/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
deleted file mode 100644
index 7c40ec01c3..0000000000
--- a/queue-6.16/hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 7f67106eeee0b7e6bdef1d75498548ba91b2ca33 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 08:20:02 -0500
-Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
-
-From: Nishanth Menon <nm@ti.com>
-
-[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
-
-Fix division by zero in ks_sa_rng_init caused by missing clock
-pointer initialization. The clk_get_rate() call is performed on
-an uninitialized clk pointer, resulting in division by zero when
-calculating delay values.
-
-Add clock initialization code before using the clock.
-
-Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
-Signed-off-by: Nishanth Menon <nm@ti.com>
-
- drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
-
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/char/hw_random/ks-sa-rng.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
-index d8fd8a3544828..9e408144a10c1 100644
---- a/drivers/char/hw_random/ks-sa-rng.c
-+++ b/drivers/char/hw_random/ks-sa-rng.c
-@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
- 	if (IS_ERR(ks_sa_rng->regmap_cfg))
- 		return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n");
- 
-+	ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
-+	if (IS_ERR(ks_sa_rng->clk))
-+		return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
-+
- 	pm_runtime_enable(dev);
- 	ret = pm_runtime_resume_and_get(dev);
- 	if (ret < 0) {
--- 
-2.51.0
-
diff --git a/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch b/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch
deleted file mode 100644
index 920684591c..0000000000
--- a/queue-6.16/hwrng-nomadik-add-arm_amba-dependency.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 164ec5d0472e3efd858fe3dea0599d5aa1176a4d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 29 Jul 2025 17:28:00 +0200
-Subject: hwrng: nomadik - add ARM_AMBA dependency
-
-From: Arnd Bergmann <arnd@arndb.de>
-
-[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
-
-Compile-testing this driver is only possible when the AMBA bus driver is
-available in the kernel:
-
-x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
-nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
-x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
-nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
-x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
-
-The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
-specified for the COMPILE_TEST case.
-
-Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/char/hw_random/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
-index c858278434475..7826fd7c4603f 100644
---- a/drivers/char/hw_random/Kconfig
-+++ b/drivers/char/hw_random/Kconfig
-@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG
- config HW_RANDOM_NOMADIK
- 	tristate "ST-Ericsson Nomadik Random Number Generator support"
- 	depends on ARCH_NOMADIK || COMPILE_TEST
-+	depends on ARM_AMBA
- 	default HW_RANDOM
- 	help
- 	  This driver provides kernel-side support for the Random Number
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch b/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch
deleted file mode 100644
index 3fe3194e32..0000000000
--- a/queue-6.16/i2c-designware-add-disabling-clocks-when-probe-fails.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 88d3fbdfb59e0800ed8af87ee5741752f5adcef0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 13:22:11 +0900
-Subject: i2c: designware: Add disabling clocks when probe fails
-
-From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
-
-[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
-
-After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
-called. However, this function doesn't disable clocks and the clock-enable
-count keeps increasing. Should disable these clocks explicitly.
-
-Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
-Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
-Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
-Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
-Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
-index 128b8cd7924e0..006c312cf7c82 100644
---- a/drivers/i2c/busses/i2c-designware-platdrv.c
-+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
-@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
- 
- exit_probe:
- 	dw_i2c_plat_pm_cleanup(dev);
-+	i2c_dw_prepare_clk(dev, false);
- exit_reset:
- 	reset_control_assert(dev->rst);
- 	return ret;
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch b/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
deleted file mode 100644
index db2332d472..0000000000
--- a/queue-6.16/i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 693a57b0d4c8d101304732bb3760f9c8e44f5e23 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 13:22:10 +0900
-Subject: i2c: designware: Fix clock issue when PM is disabled
-
-From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
-
-[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
-
-When the driver is removed, the clocks are first enabled by
-calling pm_runtime_get_sync(), and then disabled with
-pm_runtime_put_sync().
-
-If CONFIG_PM=y, clocks for this controller are disabled when it's in
-the idle state. So the clocks are properly disabled when the driver
-exits.
-
-Othewise, the clocks are always enabled and the PM functions have
-no effect. Therefore, the driver exits without disabling the clocks.
-
-    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
-    18
-    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
-    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
-    20
-    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
-    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
-    20
-
-To ensure that the clocks can be disabled correctly even without
-CONFIG_PM=y, should add the following fixes:
-
-- Replace with pm_runtime_put_noidle(), which only decrements the runtime
-  PM usage count.
-- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
-
-Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
-Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
-Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
-Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
-Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
-Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
-index c1262df02cdb2..128b8cd7924e0 100644
---- a/drivers/i2c/busses/i2c-designware-platdrv.c
-+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
-@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
- 	i2c_dw_disable(dev);
- 
- 	pm_runtime_dont_use_autosuspend(device);
--	pm_runtime_put_sync(device);
-+	pm_runtime_put_noidle(device);
- 	dw_i2c_plat_pm_cleanup(dev);
- 
-+	i2c_dw_prepare_clk(dev, false);
-+
- 	i2c_dw_remove_lock_support(dev);
- 
- 	reset_control_assert(dev->rst);
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch b/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
deleted file mode 100644
index c6a311b9d2..0000000000
--- a/queue-6.16/i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 3f32f73b19ff00212c2625b2fe4d9a2d0de1bc1c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 6 Sep 2025 16:24:06 +0800
-Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Leilk.Liu <leilk.liu@mediatek.com>
-
-[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
-
-The old IC does not support the I2C_MASTER_WRRD (write-then-read)
-function, but the current code’s handling of i2c->auto_restart may
-potentially lead to entering the I2C_MASTER_WRRD software flow,
-resulting in unexpected bugs.
-
-Instead of repurposing the auto_restart flag, add a separate flag
-to signal I2C_MASTER_WRRD operations.
-
-Also fix handling of msgs. If the operation (i2c->op) is
-I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
-For all other operations, msgs is simply incremented by 1.
-
-Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
-Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
-Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
-Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
- 1 file changed, 10 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
-index ab456c3717db1..dee40704825cb 100644
---- a/drivers/i2c/busses/i2c-mt65xx.c
-+++ b/drivers/i2c/busses/i2c-mt65xx.c
-@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
- {
- 	int ret;
- 	int left_num = num;
-+	bool write_then_read_en = false;
- 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
- 
- 	ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
-@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
- 		if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
- 		    msgs[0].addr == msgs[1].addr) {
- 			i2c->auto_restart = 0;
-+			write_then_read_en = true;
- 		}
- 	}
- 
-@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
- 		else
- 			i2c->op = I2C_MASTER_WR;
- 
--		if (!i2c->auto_restart) {
--			if (num > 1) {
--				/* combined two messages into one transaction */
--				i2c->op = I2C_MASTER_WRRD;
--				left_num--;
--			}
-+		if (write_then_read_en) {
-+			/* combined two messages into one transaction */
-+			i2c->op = I2C_MASTER_WRRD;
-+			left_num--;
- 		}
- 
- 		/* always use DMA mode. */
-@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
- 		if (ret < 0)
- 			goto err_exit;
- 
--		msgs++;
-+		if (i2c->op == I2C_MASTER_WRRD)
-+			msgs += 2;
-+		else
-+			msgs++;
- 	}
- 	/* the return value is number of executed messages */
- 	ret = num;
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch b/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
deleted file mode 100644
index 89dd7b91bf..0000000000
--- a/queue-6.16/i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 241cdb6ca57e9cdd5d4f171d96f16c6082455bcc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 10:02:28 +0800
-Subject: i2c: spacemit: check SDA instead of SCL after bus reset
-
-From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-
-[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ]
-
-After calling spacemit_i2c_conditionally_reset_bus(),
-the controller should ensure that the SDA line is release
-before proceeding.
-
-Previously, the driver checked the SCL line instead,
-which does not guarantee that the bus is truly idle.
-
-This patch changes the check to verify SDA. This ensures
-proper bus recovery and avoids potential communication errors
-after a conditional reset.
-
-Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
-Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
-Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-k1.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
-index 9bf9f01aa68bd..848dfaf634f63 100644
---- a/drivers/i2c/busses/i2c-k1.c
-+++ b/drivers/i2c/busses/i2c-k1.c
-@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
- 	spacemit_i2c_reset(i2c);
- 	usleep_range(10, 20);
- 
--	/* check scl status again */
-+	/* check sda again here */
- 	status = readl(i2c->base + SPACEMIT_IBMR);
--	if (!(status & SPACEMIT_BMR_SCL))
-+	if (!(status & SPACEMIT_BMR_SDA))
- 		dev_warn_ratelimited(i2c->dev, "unit reset failed\n");
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch b/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
deleted file mode 100644
index 65b93a6291..0000000000
--- a/queue-6.16/i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 6434cd9a09d8122d00e969815d7bdb779bb11435 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 10:02:27 +0800
-Subject: i2c: spacemit: disable SDA glitch fix to avoid restart delay
-
-From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-
-[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ]
-
-The K1 I2C controller has an SDA glitch fix that introduces a small
-delay on restart signals. While this feature can suppress glitches
-on SDA when SCL = 0, it also delays the restart signal, which may
-cause unexpected behavior in some transfers.
-
-The glitch itself does not affect normal I2C operation, because
-the I2C specification allows SDA to change while SCL is low.
-
-To ensure correct transmission for every message, we disable the
-SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during
-initialization.
-
-This guarantees that restarts are issued promptly without
-unintended delays.
-
-Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
-Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
-Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-k1.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
-index 84f132d0504dc..9bf9f01aa68bd 100644
---- a/drivers/i2c/busses/i2c-k1.c
-+++ b/drivers/i2c/busses/i2c-k1.c
-@@ -14,6 +14,7 @@
- #define SPACEMIT_ICR		 0x0		/* Control register */
- #define SPACEMIT_ISR		 0x4		/* Status register */
- #define SPACEMIT_IDBR		 0xc		/* Data buffer register */
-+#define SPACEMIT_IRCR		 0x18		/* Reset cycle counter */
- #define SPACEMIT_IBMR		 0x1c		/* Bus monitor register */
- 
- /* SPACEMIT_ICR register fields */
-@@ -76,6 +77,8 @@
- 					SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \
- 					SPACEMIT_SR_ALD)
- 
-+#define SPACEMIT_RCR_SDA_GLITCH_NOFIX		BIT(7)		/* bypass the SDA glitch fix */
-+
- /* SPACEMIT_IBMR register fields */
- #define SPACEMIT_BMR_SDA         BIT(0)		/* SDA line level */
- #define SPACEMIT_BMR_SCL         BIT(1)		/* SCL line level */
-@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
- 	val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE;
- 
- 	writel(val, i2c->base + SPACEMIT_ICR);
-+
-+	/*
-+	 * The glitch fix in the K1 I2C controller introduces a delay
-+	 * on restart signals, so we disable the fix here.
-+	 */
-+	val = readl(i2c->base + SPACEMIT_IRCR);
-+	val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
-+	writel(val, i2c->base + SPACEMIT_IRCR);
- }
- 
- static inline void
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch b/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
deleted file mode 100644
index 34474dd0ae..0000000000
--- a/queue-6.16/i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From a9504ddff65b28092759f2ceef747fb1aa8a8124 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 10:02:25 +0800
-Subject: i2c: spacemit: ensure bus release check runs when wait_bus_idle()
- fails
-
-From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-
-[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ]
-
-spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative
-error code on failure.
-
-Since 'ret' can never be positive, the final 'else' branch was
-unreachable, and spacemit_i2c_check_bus_release() was never called.
-
-This commit guarantees we attempt to release the bus whenever waiting for
-an idle bus fails.
-
-Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
-Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
-Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-k1.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
-index b68a21fff0b56..ee08811f4087c 100644
---- a/drivers/i2c/busses/i2c-k1.c
-+++ b/drivers/i2c/busses/i2c-k1.c
-@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in
- 	spacemit_i2c_enable(i2c);
- 
- 	ret = spacemit_i2c_wait_bus_idle(i2c);
--	if (!ret)
-+	if (!ret) {
- 		ret = spacemit_i2c_xfer_msg(i2c);
--	else if (ret < 0)
--		dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
--	else
-+		if (ret < 0)
-+			dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
-+	} else {
- 		spacemit_i2c_check_bus_release(i2c);
-+	}
- 
- 	spacemit_i2c_disable(i2c);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch b/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
deleted file mode 100644
index c40646f91b..0000000000
--- a/queue-6.16/i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 8019d189f37ebe3667b9f9850603a007c6f07c99 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 10:02:29 +0800
-Subject: i2c: spacemit: ensure SDA is released after bus reset
-
-From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-
-[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ]
-
-After performing a conditional bus reset, the controller must ensure
-that the SDA line is actually released.
-
-Previously, the reset routine only performed a single check,
-which could leave the bus in a locked state in some situations.
-
-This patch introduces a loop that toggles the reset cycle and issues
-a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking
-SDA after each attempt. If SDA is released before the maximum count,
-the function returns early. Otherwise, a warning is emitted.
-
-This change improves bus recovery reliability.
-
-Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
-Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
-index 848dfaf634f63..6b918770e612e 100644
---- a/drivers/i2c/busses/i2c-k1.c
-+++ b/drivers/i2c/busses/i2c-k1.c
-@@ -3,6 +3,7 @@
-  * Copyright (C) 2024-2025 Troy Mitchell <troymitchell988@gmail.com>
-  */
- 
-+#include <linux/bitfield.h>
-  #include <linux/clk.h>
-  #include <linux/i2c.h>
-  #include <linux/iopoll.h>
-@@ -26,7 +27,8 @@
- #define SPACEMIT_CR_MODE_FAST    BIT(8)		/* bus mode (master operation) */
- /* Bit 9 is reserved */
- #define SPACEMIT_CR_UR           BIT(10)	/* unit reset */
--/* Bits 11-12 are reserved */
-+#define SPACEMIT_CR_RSTREQ	 BIT(11)	/* i2c bus reset request */
-+/* Bit 12 is reserved */
- #define SPACEMIT_CR_SCLE         BIT(13)	/* master clock enable */
- #define SPACEMIT_CR_IUE          BIT(14)	/* unit enable */
- /* Bits 15-17 are reserved */
-@@ -78,6 +80,8 @@
- 					SPACEMIT_SR_ALD)
- 
- #define SPACEMIT_RCR_SDA_GLITCH_NOFIX		BIT(7)		/* bypass the SDA glitch fix */
-+/* the cycles of SCL during bus reset */
-+#define SPACEMIT_RCR_FIELD_RST_CYC		GENMASK(3, 0)
- 
- /* SPACEMIT_IBMR register fields */
- #define SPACEMIT_BMR_SDA         BIT(0)		/* SDA line level */
-@@ -91,6 +95,8 @@
- 
- #define SPACEMIT_SR_ERR	(SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD)
- 
-+#define SPACEMIT_BUS_RESET_CLK_CNT_MAX		9
-+
- enum spacemit_i2c_state {
- 	SPACEMIT_STATE_IDLE,
- 	SPACEMIT_STATE_START,
-@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c)
- static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
- {
- 	u32 status;
-+	u8 clk_cnt;
- 
- 	/* if bus is locked, reset unit. 0: locked */
- 	status = readl(i2c->base + SPACEMIT_IBMR);
-@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
- 	spacemit_i2c_reset(i2c);
- 	usleep_range(10, 20);
- 
-+	for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) {
-+		status = readl(i2c->base + SPACEMIT_IBMR);
-+		if (status & SPACEMIT_BMR_SDA)
-+			return;
-+
-+		/* There's nothing left to save here, we are about to exit */
-+		writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1),
-+		       i2c->base + SPACEMIT_IRCR);
-+		writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR);
-+		usleep_range(20, 30);
-+	}
-+
- 	/* check sda again here */
- 	status = readl(i2c->base + SPACEMIT_IBMR);
- 	if (!(status & SPACEMIT_BMR_SDA))
--- 
-2.51.0
-
diff --git a/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch b/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
deleted file mode 100644
index 6022943432..0000000000
--- a/queue-6.16/i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 87a63dc5dd845d27ff9c8ae26bfc475ed787b433 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 10:02:26 +0800
-Subject: i2c: spacemit: remove stop function to avoid bus error
-
-From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-
-[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ]
-
-Previously, STOP handling was split into two separate steps:
-  1) clear TB/STOP/START/ACK bits
-  2) issue STOP by calling spacemit_i2c_stop()
-
-This left a small window where the control register was updated
-twice, which can confuse the controller. While this race has not
-been observed with interrupt-driven transfers, it reliably causes
-bus errors in PIO mode.
-
-Inline the STOP sequence into the IRQ handler and ensure that
-control register bits are updated atomically in a single writel().
-
-Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
-Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
-Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
-Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-k1.c | 26 +++++++-------------------
- 1 file changed, 7 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
-index ee08811f4087c..84f132d0504dc 100644
---- a/drivers/i2c/busses/i2c-k1.c
-+++ b/drivers/i2c/busses/i2c-k1.c
-@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c)
- 	writel(val, i2c->base + SPACEMIT_ICR);
- }
- 
--static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c)
--{
--	u32 val;
--
--	val = readl(i2c->base + SPACEMIT_ICR);
--	val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
--
--	if (i2c->read)
--		val |= SPACEMIT_CR_ACKNAK;
--
--	writel(val, i2c->base + SPACEMIT_ICR);
--}
--
- static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c)
- {
- 	unsigned long time_left;
-@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
- 
- 	val = readl(i2c->base + SPACEMIT_ICR);
- 	val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START);
--	writel(val, i2c->base + SPACEMIT_ICR);
- 
- 	switch (i2c->state) {
- 	case SPACEMIT_STATE_START:
-@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
- 	}
- 
- 	if (i2c->state != SPACEMIT_STATE_IDLE) {
-+		val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE;
-+
- 		if (spacemit_i2c_is_last_msg(i2c)) {
- 			/* trigger next byte with stop */
--			spacemit_i2c_stop(i2c);
--		} else {
--			/* trigger next byte */
--			val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
--			writel(val, i2c->base + SPACEMIT_ICR);
-+			val |= SPACEMIT_CR_STOP;
-+
-+			if (i2c->read)
-+				val |= SPACEMIT_CR_ACKNAK;
- 		}
-+		writel(val, i2c->base + SPACEMIT_ICR);
- 	}
- 
- err_out:
--- 
-2.51.0
-
diff --git a/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch b/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch
deleted file mode 100644
index c6a1332360..0000000000
--- a/queue-6.16/i3c-master-svc-recycle-unused-ibi-slot.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From be9f96bf6241871e935e5b34c0bfaa7e000a09ab Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 09:23:09 +0800
-Subject: i3c: master: svc: Recycle unused IBI slot
-
-From: Stanley Chu <stanley.chuys@gmail.com>
-
-[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
-
-In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
-to store the IBI payload. However, when an error condition is encountered,
-the function returns without recycling the IBI slot, resulting in an IBI
-slot leak.
-
-Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
-Signed-off-by: Stanley Chu <yschu@nuvoton.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/svc-i3c-master.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
-index fc2829c22c647..93632194ffcca 100644
---- a/drivers/i3c/master/svc-i3c-master.c
-+++ b/drivers/i3c/master/svc-i3c-master.c
-@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
- 						SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
- 	if (ret) {
- 		dev_err(master->dev, "Timeout when polling for COMPLETE\n");
-+		i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
- 		return ret;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch b/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch
deleted file mode 100644
index f3276899a6..0000000000
--- a/queue-6.16/i3c-master-svc-use-manual-response-for-ibi-events.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From b1390fdad74d203413ce6dd3d74b464b163a241c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 09:23:08 +0800
-Subject: i3c: master: svc: Use manual response for IBI events
-
-From: Stanley Chu <yschu@nuvoton.com>
-
-[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
-
-Driver wants to nack the IBI request when the target is not in the
-known address list. In below code, svc_i3c_master_nack_ibi() will
-cause undefined behavior when using AUTOIBI with auto response rule,
-because hw always auto ack the IBI request.
-
-    switch (ibitype) {
-    case SVC_I3C_MSTATUS_IBITYPE_IBI:
-            dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
-            if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
-                    svc_i3c_master_nack_ibi(master);
-            ...
-            break;
-
-AutoIBI has another issue that the controller doesn't quit AutoIBI state
-after IBIWON polling timeout when there is a SDA glitch(high->low->high).
-1. SDA high->low: raising an interrupt to execute IBI ISR
-2. SDA low->high
-3. Driver writes an AutoIBI request
-4. AutoIBI process does not start because SDA is not low
-5. IBIWON polling times out
-6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
-
-Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
-
-Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
-Signed-off-by: Stanley Chu <yschu@nuvoton.com>
-Reviewed-by: Frank Li <Frank.Li@nxp.com>
-Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
- 1 file changed, 25 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
-index ece5633538958..fc2829c22c647 100644
---- a/drivers/i3c/master/svc-i3c-master.c
-+++ b/drivers/i3c/master/svc-i3c-master.c
-@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
- 	 */
- 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
- 
--	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
--	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
--	       SVC_I3C_MCTRL_IBIRESP_AUTO,
-+	/*
-+	 * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
-+	 * instend of using AUTO_IBI.
-+	 *
-+	 * Using AutoIBI request may cause controller to remain in AutoIBI state when
-+	 * there is a glitch on SDA line (high->low->high).
-+	 * 1. SDA high->low, raising an interrupt to execute IBI isr.
-+	 * 2. SDA low->high.
-+	 * 3. IBI isr writes an AutoIBI request.
-+	 * 4. The controller will not start AutoIBI process because SDA is not low.
-+	 * 5. IBIWON polling times out.
-+	 * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
-+	 */
-+	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
-+	       SVC_I3C_MCTRL_TYPE_I3C |
-+	       SVC_I3C_MCTRL_IBIRESP_MANUAL |
-+	       SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
-+	       SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
- 	       master->regs + SVC_I3C_MCTRL);
- 
- 	/* Wait for IBIWON, should take approximately 100us */
-@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
- 	switch (ibitype) {
- 	case SVC_I3C_MSTATUS_IBITYPE_IBI:
- 		dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
--		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
-+		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
- 			svc_i3c_master_nack_ibi(master);
--		else
-+		} else {
-+			if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
-+				svc_i3c_master_ack_ibi(master, true);
-+			else
-+				svc_i3c_master_ack_ibi(master, false);
- 			svc_i3c_master_handle_ibi(master, dev);
-+		}
- 		break;
- 	case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
- 		if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
--- 
-2.51.0
-
diff --git a/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch b/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
deleted file mode 100644
index 7e721fd74e..0000000000
--- a/queue-6.16/ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From bc5e60e82100d53012c436e22305a2d7e893357c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 19:31:12 +0300
-Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
-
-From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
-
-[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
-
-When computing the delta, the sa_local_svc_timeout_ms is read without
-ib_nl_request_lock held. Though unlikely in practice, this can cause
-a race condition if multiple local service threads are managing the
-timeout.
-
-Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
-Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
-Reviewed-by: Mark Zhang <markzhang@nvidia.com>
-Signed-off-by: Edward Srouji <edwards@nvidia.com>
-Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
-Signed-off-by: Leon Romanovsky <leon@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/sa_query.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
-index 53571e6b3162c..66df5bed6a562 100644
---- a/drivers/infiniband/core/sa_query.c
-+++ b/drivers/infiniband/core/sa_query.c
-@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
- 	if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
- 		timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
- 
-+	spin_lock_irqsave(&ib_nl_request_lock, flags);
-+
- 	delta = timeout - sa_local_svc_timeout_ms;
- 	if (delta < 0)
- 		abs_delta = -delta;
-@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
- 		abs_delta = delta;
- 
- 	if (delta != 0) {
--		spin_lock_irqsave(&ib_nl_request_lock, flags);
- 		sa_local_svc_timeout_ms = timeout;
- 		list_for_each_entry(query, &ib_nl_request_list, list) {
- 			if (delta < 0 && abs_delta > query->timeout)
-@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
- 		if (delay)
- 			mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
- 					 (unsigned long)delay);
--		spin_unlock_irqrestore(&ib_nl_request_lock, flags);
- 	}
- 
-+	spin_unlock_irqrestore(&ib_nl_request_lock, flags);
-+
- settimeout_out:
- 	return 0;
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch b/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
deleted file mode 100644
index 62b52a6daa..0000000000
--- a/queue-6.16/idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 415421efc94989ec55ffb0c61535fdbf6c9b8e04 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 11:02:10 -0700
-Subject: idpf: fix mismatched free function for dma_alloc_coherent
-
-From: Alok Tiwari <alok.a.tiwari@oracle.com>
-
-[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]
-
-The mailbox receive path allocates coherent DMA memory with
-dma_alloc_coherent(), but frees it with dmam_free_coherent().
-This is incorrect since dmam_free_coherent() is only valid for
-buffers allocated with dmam_alloc_coherent().
-
-Fix the mismatch by using dma_free_coherent() instead of
-dmam_free_coherent
-
-Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
-Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
-Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
-index cb9a27307670e..edec127fb52f4 100644
---- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
-+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
-@@ -701,9 +701,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
- 		/* If post failed clear the only buffer we supplied */
- 		if (post_err) {
- 			if (dma_mem)
--				dmam_free_coherent(&adapter->pdev->dev,
--						   dma_mem->size, dma_mem->va,
--						   dma_mem->pa);
-+				dma_free_coherent(&adapter->pdev->dev,
-+						  dma_mem->size, dma_mem->va,
-+						  dma_mem->pa);
- 			break;
- 		}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch b/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
deleted file mode 100644
index 44025d1b70..0000000000
--- a/queue-6.16/idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 14eff6662965235168a680efb95e1eab2e678ac9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 17:54:56 +0200
-Subject: idpf: fix Rx descriptor ready check barrier in splitq
-
-From: Alexander Lobakin <aleksander.lobakin@intel.com>
-
-[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]
-
-No idea what the current barrier position was meant for. At that point,
-nothing is read from the descriptor, only the pointer to the actual one
-is fetched.
-The correct barrier usage here is after the generation check, so that
-only the first qword is read if the descriptor is not yet ready and we
-need to stop polling. Debatable on coherent DMA as the Rx descriptor
-size is <= cacheline size, but anyway, the current barrier position
-only makes the codegen worse.
-
-Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
-Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
-Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
-Tested-by: Ramu R <ramu.r@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
- 1 file changed, 2 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
-index cd83243e7c765..6438e371f8bd8 100644
---- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
-+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
-@@ -3434,18 +3434,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
- 		/* get the Rx desc from Rx queue based on 'next_to_clean' */
- 		rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
- 
--		/* This memory barrier is needed to keep us from reading
--		 * any other fields out of the rx_desc
--		 */
--		dma_rmb();
--
- 		/* if the descriptor isn't done, no work yet to do */
- 		gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
- 				       VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
--
- 		if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
- 			break;
- 
-+		dma_rmb();
-+
- 		rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
- 				  rx_desc->rxdid_ucast);
- 		if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
--- 
-2.51.0
-
diff --git a/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch b/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch
deleted file mode 100644
index 42d0f6f22b..0000000000
--- a/queue-6.16/iio-consumers-fix-handling-of-negative-channel-scale.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From 2bab812d73adaadacbddc8b75879a068114a2a16 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 31 Aug 2025 12:48:20 +0200
-Subject: iio: consumers: Fix handling of negative channel scale in
- iio_convert_raw_to_processed()
-
-From: Hans de Goede <hansg@kernel.org>
-
-[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
-
-There is an issue with the handling of negative channel scales
-in iio_convert_raw_to_processed_unlocked() when the channel-scale
-is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
-
-Things work for channel-scale values > -1.0 and < 0.0 because of
-the use of signed values in:
-
-	*processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
-
-Things will break however for scale values < -1.0. Lets for example say
-that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
-
-The result should then be 2 * 10 * -1.5 = -30.
-
-channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
-now lets see what gets stored in processed:
-
-1. *processed = raw64 * scale_val * scale;
-2. *processed += raw64 * scale_val2 * scale / 1000000LL;
-
-1. Sets processed to 2 * -1 * 10 = -20
-2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
-
-And the end result is processed = -20 + 10 = -10, which is not correct.
-
-Fix this by always using the abs value of both scale_val and scale_val2
-and if either is negative multiply the end-result by -1.
-
-Note there seems to be an unwritten rule about negative
-IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
-
-i.   values > -1.0 and < 0.0 are written as val=0 val2=-xxx
-ii.  values <= -1.0 are written as val=-xxx val2=xxx
-
-But iio_format_value() will also correctly display a third option:
-
-iii. values <= -1.0 written as val=-xxx val2=-xxx
-
-Since iio_format_value() uses abs(val) when val2 < 0.
-
-This fix also makes iio_convert_raw_to_processed() properly handle
-channel-scales using this third option.
-
-Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
-Cc: Matteo Martelli <matteomartelli3@gmail.com>
-Reviewed-by: Andy Shevchenko <andy@kernel.org>
-Signed-off-by: Hans de Goede <hansg@kernel.org>
-Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/inkern.c | 28 ++++++++++++++--------------
- 1 file changed, 14 insertions(+), 14 deletions(-)
-
-diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
-index c174ebb7d5e6d..d36a80a7b8a93 100644
---- a/drivers/iio/inkern.c
-+++ b/drivers/iio/inkern.c
-@@ -11,6 +11,7 @@
- #include <linux/mutex.h>
- #include <linux/property.h>
- #include <linux/slab.h>
-+#include <linux/units.h>
- 
- #include <linux/iio/iio.h>
- #include <linux/iio/iio-opaque.h>
-@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
- {
- 	int scale_type, scale_val, scale_val2;
- 	int offset_type, offset_val, offset_val2;
--	s64 raw64 = raw;
-+	s64 denominator, raw64 = raw;
- 
- 	offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
- 				       IIO_CHAN_INFO_OFFSET);
-@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
- 		*processed = raw64 * scale_val * scale;
- 		break;
- 	case IIO_VAL_INT_PLUS_MICRO:
--		if (scale_val2 < 0)
--			*processed = -raw64 * scale_val * scale;
--		else
--			*processed = raw64 * scale_val * scale;
--		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
--				      1000000LL);
--		break;
- 	case IIO_VAL_INT_PLUS_NANO:
--		if (scale_val2 < 0)
--			*processed = -raw64 * scale_val * scale;
--		else
--			*processed = raw64 * scale_val * scale;
--		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
--				      1000000000LL);
-+		switch (scale_type) {
-+		case IIO_VAL_INT_PLUS_MICRO:
-+			denominator = MICRO;
-+			break;
-+		case IIO_VAL_INT_PLUS_NANO:
-+			denominator = NANO;
-+			break;
-+		}
-+		*processed = raw64 * scale * abs(scale_val);
-+		*processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
-+		if (scale_val < 0 || scale_val2 < 0)
-+			*processed *= -1;
- 		break;
- 	case IIO_VAL_FRACTIONAL:
- 		*processed = div_s64(raw64 * (s64)scale_val * scale,
--- 
-2.51.0
-
diff --git a/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch b/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
deleted file mode 100644
index 4499098f82..0000000000
--- a/queue-6.16/iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 985f54b97470e8a00b90250b5e04d207eaf3f59b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 31 Aug 2025 12:48:21 +0200
-Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
-
-From: Hans de Goede <hansg@kernel.org>
-
-[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
-
-Fix iio_convert_raw_to_processed() offset handling for channels without
-a scale attribute.
-
-The offset has been applied to the raw64 value not to the original raw
-value. Use the raw64 value so that the offset is taken into account.
-
-Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
-Cc: Liam Beguin <liambeguin@gmail.com>
-Reviewed-by: Andy Shevchenko <andy@kernel.org>
-Signed-off-by: Hans de Goede <hansg@kernel.org>
-Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/inkern.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
-index d36a80a7b8a93..642beb4b3360d 100644
---- a/drivers/iio/inkern.c
-+++ b/drivers/iio/inkern.c
-@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
- 		 * If no channel scaling is available apply consumer scale to
- 		 * raw value and return.
- 		 */
--		*processed = raw * scale;
-+		*processed = raw64 * scale;
- 		return 0;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch b/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
deleted file mode 100644
index b4a1f9c31b..0000000000
--- a/queue-6.16/inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 6b3d207981bdb2b171b55456951e8bd13ab93b75 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 15:30:51 +0000
-Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup()
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
-
-We need to check socket netns before considering them in ping_get_port().
-Otherwise, one malicious netns could 'consume' all ports.
-
-Add corresponding check in ping_lookup().
-
-Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
-Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/ping.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 031df4c19fcc5..d2c3480df8f77 100644
---- a/net/ipv4/ping.c
-+++ b/net/ipv4/ping.c
-@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
- 
- int ping_get_port(struct sock *sk, unsigned short ident)
- {
-+	struct net *net = sock_net(sk);
- 	struct inet_sock *isk, *isk2;
- 	struct hlist_head *hlist;
- 	struct sock *sk2 = NULL;
-@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
- 		for (i = 0; i < (1L << 16); i++, result++) {
- 			if (!result)
- 				result++; /* avoid zero */
--			hlist = ping_hashslot(&ping_table, sock_net(sk),
--					    result);
-+			hlist = ping_hashslot(&ping_table, net, result);
- 			sk_for_each(sk2, hlist) {
-+				if (!net_eq(sock_net(sk2), net))
-+					continue;
- 				isk2 = inet_sk(sk2);
- 
- 				if (isk2->inet_num == result)
-@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
- 		if (i >= (1L << 16))
- 			goto fail;
- 	} else {
--		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
-+		hlist = ping_hashslot(&ping_table, net, ident);
- 		sk_for_each(sk2, hlist) {
-+			if (!net_eq(sock_net(sk2), net))
-+				continue;
- 			isk2 = inet_sk(sk2);
- 
- 			/* BUG? Why is this reuse and not reuseaddr? ping.c
-@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
- 		pr_debug("was not hashed\n");
- 		sk_add_node_rcu(sk, hlist);
- 		sock_set_flag(sk, SOCK_RCU_FREE);
--		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-+		sock_prot_inuse_add(net, sk->sk_prot, 1);
- 	}
- 	spin_unlock(&ping_table.lock);
- 	return 0;
-@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
- 	}
- 
- 	sk_for_each_rcu(sk, hslot) {
-+		if (!net_eq(sock_net(sk), net))
-+			continue;
- 		isk = inet_sk(sk);
- 
- 		pr_debug("iterate\n");
--- 
-2.51.0
-
diff --git a/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch b/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
deleted file mode 100644
index f13fcb1177..0000000000
--- a/queue-6.16/init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 081a8b3ee79499a03c18b964be938268a33b9fcc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 09:11:05 +0200
-Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
-
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-
-[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
-
-INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
-init/initramfs_test.c.  Hence add a dependency on BLK_DEV_INITRD, to
-prevent asking the user about this feature when configuring a kernel
-without initramfs support.
-
-Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Reviewed-by: Martin Wilck <mwilck@suse.com>
-Reviewed-by: David Disseldorp <ddiss@suse.de>
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- init/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/init/Kconfig b/init/Kconfig
-index 2e15b4a8478e8..32be83de9c699 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -1472,6 +1472,7 @@ config BOOT_CONFIG_EMBED_FILE
- 
- config INITRAMFS_PRESERVE_MTIME
- 	bool "Preserve cpio archive mtimes in initramfs"
-+	depends on BLK_DEV_INITRD
- 	default y
- 	help
- 	  Each entry in an initramfs cpio archive carries an mtime value. When
--- 
-2.51.0
-
diff --git a/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch b/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch
deleted file mode 100644
index 3b9e2451c1..0000000000
--- a/queue-6.16/iommu-selftest-prevent-use-of-uninitialized-variable.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From d102fdda90f7be0a6f20317d96455f84793234fd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 19:16:28 +0200
-Subject: iommu/selftest: prevent use of uninitialized variable
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Alessandro Zanni <alessandro.zanni87@gmail.com>
-
-[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ]
-
-Fix to avoid the usage of the `res` variable uninitialized in the
-following macro expansions.
-
-It solves the following warning:
-In function ‘iommufd_viommu_vdevice_alloc’,
-  inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1:
-../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized]
-  760 |   if (!(__exp _t __seen)) { \
-      |      ^
-../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’
-  513 |   __EXPECT(expected, #expected, seen, #seen, ==, 1)
-      |   ^~~~~~~~
-iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’
- 1057 |   ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents))
-      |   ^~~~~~~~~
-iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’
- 2924 |   test_cmd_trigger_vevents(dev_id, 3);
-      |   ^~~~~~~~~~~~~~~~~~~~~~~~
-
-The issue can be reproduced, building the tests, with the command: make -C
-tools/testing/selftests TARGETS=iommu
-
-Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com
-Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage")
-Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/iommu/iommufd_utils.h | 8 +++-----
- 1 file changed, 3 insertions(+), 5 deletions(-)
-
-diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
-index 6e967b58acfd3..1d4936747db45 100644
---- a/tools/testing/selftests/iommu/iommufd_utils.h
-+++ b/tools/testing/selftests/iommu/iommufd_utils.h
-@@ -995,15 +995,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)
- 			.dev_id = dev_id,
- 		},
- 	};
--	int ret;
- 
- 	while (nvevents--) {
--		ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
--			    &trigger_vevent_cmd);
--		if (ret < 0)
-+		if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
-+			    &trigger_vevent_cmd))
- 			return -1;
- 	}
--	return ret;
-+	return 0;
- }
- 
- #define test_cmd_trigger_vevents(dev_id, nvevents) \
--- 
-2.51.0
-
diff --git a/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch b/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
deleted file mode 100644
index 89de29564e..0000000000
--- a/queue-6.16/iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 570ef33688d26464eeda6d86e3c3b202d4020b12 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 13:01:59 +0800
-Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic
-
-From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
-
-[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ]
-
-In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR
-maybe uninitialized or zero in that case and may cause oops like:
-
- Oops: general protection fault, probably for non-canonical address
-       0xf00087d3f000f000: 0000 [#1] SMP NOPTI
- CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary)
- Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
- RIP: 0010:pgtable_walk_level+0x98/0x150
- RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206
- RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e
- RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000
- RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002
- R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000
- R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98
- FS:  0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000
- CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
- CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0
- PKRU: 55555554
- Call Trace:
-  <TASK>
-  pgtable_walk_level+0x88/0x150
-  domain_translation_struct_show.isra.0+0x2d9/0x300
-  dev_domain_translation_struct_show+0x20/0x40
-  seq_read_iter+0x12d/0x490
-...
-
-Avoid walking the page table if TT is not 00b or 01b.
-
-Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table")
-Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
-Reviewed-by: Kevin Tian <kevin.tian@intel.com>
-Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org
-Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++--
- 1 file changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
-index affbf4a1558de..5aa7f46a420b5 100644
---- a/drivers/iommu/intel/debugfs.c
-+++ b/drivers/iommu/intel/debugfs.c
-@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m,
- 			}
- 			pgd &= VTD_PAGE_MASK;
- 		} else { /* legacy mode */
--			pgd = context->lo & VTD_PAGE_MASK;
--			agaw = context->hi & 7;
-+			u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2;
-+
-+			/*
-+			 * According to Translation Type(TT),
-+			 * get the page table pointer(SSPTPTR).
-+			 */
-+			switch (tt) {
-+			case CONTEXT_TT_MULTI_LEVEL:
-+			case CONTEXT_TT_DEV_IOTLB:
-+				pgd = context->lo & VTD_PAGE_MASK;
-+				agaw = context->hi & 7;
-+				break;
-+			default:
-+				goto iommu_unlock;
-+			}
- 		}
- 
- 		seq_printf(m, "Device %04x:%02x:%02x.%x ",
--- 
-2.51.0
-
diff --git a/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch b/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
deleted file mode 100644
index bc117c36bf..0000000000
--- a/queue-6.16/iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 3190fbee1714c897596adeeddcc7303ef976d9a4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Sep 2025 10:41:30 +0800
-Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk
-
-From: Lu Baolu <baolu.lu@linux.intel.com>
-
-[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ]
-
-Dirty page tracking relies on the IOMMU atomically updating the dirty bit
-in the paging-structure entry. For this operation to succeed, the paging-
-structure memory must be coherent between the IOMMU and the CPU. In
-another word, if the iommu page walk is incoherent, dirty page tracking
-doesn't work.
-
-The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:
-
-"Remapping hardware encountering the need to atomically update A/EA/D bits
- in a paging-structure entry that is not snooped will result in a non-
- recoverable fault."
-
-To prevent an IOMMU from being incorrectly configured for dirty page
-tracking when it is operating in an incoherent mode, mark SSADS as
-supported only when both ecap_slads and ecap_smpwc are supported.
-
-Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains")
-Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
-Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
-Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com
-Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iommu/intel/iommu.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
-index c699ed8810f23..ca39044978fb7 100644
---- a/drivers/iommu/intel/iommu.h
-+++ b/drivers/iommu/intel/iommu.h
-@@ -541,7 +541,8 @@ enum {
- #define pasid_supported(iommu)	(sm_supported(iommu) &&			\
- 				 ecap_pasid((iommu)->ecap))
- #define ssads_supported(iommu) (sm_supported(iommu) &&                 \
--				ecap_slads((iommu)->ecap))
-+				ecap_slads((iommu)->ecap) &&           \
-+				ecap_smpwc(iommu->ecap))
- #define nested_supported(iommu)	(sm_supported(iommu) &&			\
- 				 ecap_nest((iommu)->ecap))
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch b/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch
deleted file mode 100644
index 8fcb2f609c..0000000000
--- a/queue-6.16/iommufd-register-iommufd-mock-devices-with-fwspec.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From 5ad0ad9ff782fa48839eb0e6a6699a362e448506 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 13:47:30 +0800
-Subject: iommufd: Register iommufd mock devices with fwspec
-
-From: Guixin Liu <kanie@linux.alibaba.com>
-
-[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ]
-
-Since the bus ops were retired the iommu subsystem changed to using fwspec
-to match the iommu driver to the iommu device. If a device has a NULL
-fwspec then it is matched to the first iommu driver with a NULL fwspec,
-effectively disabling support for systems with more than one non-fwspec
-iommu driver.
-
-Thus, if the iommufd selfest are run in an x86 system that registers a
-non-fwspec iommu driver they fail to bind their mock devices to the mock
-iommu driver.
-
-Fix this by allocating a software fwnode for mock iommu driver's
-iommu_device, and set it to the device which mock iommu driver created.
-
-This is done by adding a new helper iommu_mock_device_add() which abuses
-the internals of the fwspec system to establish a fwspec before the device
-is added and is careful not to leak it. A matching dummy fwspec is
-automatically added to the mock iommu driver.
-
-Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests":
-PASSED: 229 / 229 tests passed.
-
-In addition, this issue is also can be found on amd platform, and
-also tested on a amd machine.
-
-Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com
-Fixes: 17de3f5fdd35 ("iommu: Retire bus ops")
-Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
-Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
-Tested-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iommu/iommu-priv.h       |  2 ++
- drivers/iommu/iommu.c            | 26 ++++++++++++++++++++++++++
- drivers/iommu/iommufd/selftest.c |  2 +-
- 3 files changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h
-index e236b932e7668..c95394cd03a77 100644
---- a/drivers/iommu/iommu-priv.h
-+++ b/drivers/iommu/iommu-priv.h
-@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
- 				 const struct bus_type *bus,
- 				 struct notifier_block *nb);
- 
-+int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu);
-+
- struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group,
- 						    ioasid_t pasid,
- 						    unsigned int type);
-diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
-index a4b606c591da6..c9a8d19e2ab77 100644
---- a/drivers/iommu/iommu.c
-+++ b/drivers/iommu/iommu.c
-@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
- 				 struct notifier_block *nb)
- {
- 	bus_unregister_notifier(bus, nb);
-+	fwnode_remove_software_node(iommu->fwnode);
- 	iommu_device_unregister(iommu);
- }
- EXPORT_SYMBOL_GPL(iommu_device_unregister_bus);
-@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu,
- 	if (err)
- 		return err;
- 
-+	iommu->fwnode = fwnode_create_software_node(NULL, NULL);
-+	if (IS_ERR(iommu->fwnode)) {
-+		bus_unregister_notifier(bus, nb);
-+		return PTR_ERR(iommu->fwnode);
-+	}
-+
- 	spin_lock(&iommu_device_lock);
- 	list_add_tail(&iommu->list, &iommu_device_list);
- 	spin_unlock(&iommu_device_lock);
-@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu,
- 		iommu_device_unregister_bus(iommu, bus, nb);
- 		return err;
- 	}
-+	WRITE_ONCE(iommu->ready, true);
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(iommu_device_register_bus);
-+
-+int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu)
-+{
-+	int rc;
-+
-+	mutex_lock(&iommu_probe_device_lock);
-+	rc = iommu_fwspec_init(dev, iommu->fwnode);
-+	mutex_unlock(&iommu_probe_device_lock);
-+
-+	if (rc)
-+		return rc;
-+
-+	rc = device_add(dev);
-+	if (rc)
-+		iommu_fwspec_free(dev);
-+	return rc;
-+}
-+EXPORT_SYMBOL_GPL(iommu_mock_device_add);
- #endif
- 
- static struct dev_iommu *dev_iommu_get(struct device *dev)
-diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
-index c52bf037a2f01..4a558c4e6f882 100644
---- a/drivers/iommu/iommufd/selftest.c
-+++ b/drivers/iommu/iommufd/selftest.c
-@@ -981,7 +981,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags)
- 		goto err_put;
- 	}
- 
--	rc = device_add(&mdev->dev);
-+	rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev);
- 	if (rc)
- 		goto err_put;
- 	return mdev;
--- 
-2.51.0
-
diff --git a/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch b/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
deleted file mode 100644
index 7fbfdac655..0000000000
--- a/queue-6.16/ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From d03fbfb0c928e2a0f068729804c5bdcb87250585 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 01:57:59 +0800
-Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
-
-From: Slavin Liu <slavin452@gmail.com>
-
-[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
-
-On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
-before connections with valid cp->app pointers are flushed, leading to a
-use-after-free.
-
-Fix this by introducing a global `exiting_module` flag, set to true in
-ip_vs_ftp_exit() before unregistering the pernet subsystem. In
-__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
-cleanup (when exiting_module is false) and defer it to
-__ip_vs_cleanup_batch(), which unregisters all apps after all connections
-are flushed. If called during module exit, unregister ip_vs_ftp
-immediately.
-
-Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
-Suggested-by: Julian Anastasov <ja@ssi.bg>
-Signed-off-by: Slavin Liu <slavin452@gmail.com>
-Signed-off-by: Julian Anastasov <ja@ssi.bg>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
-index d8a284999544b..206c6700e2006 100644
---- a/net/netfilter/ipvs/ip_vs_ftp.c
-+++ b/net/netfilter/ipvs/ip_vs_ftp.c
-@@ -53,6 +53,7 @@ enum {
- 	IP_VS_FTP_EPSV,
- };
- 
-+static bool exiting_module;
- /*
-  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
-  * First port is set to the default port.
-@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
- {
- 	struct netns_ipvs *ipvs = net_ipvs(net);
- 
--	if (!ipvs)
-+	if (!ipvs || !exiting_module)
- 		return;
- 
- 	unregister_ip_vs_app(ipvs, &ip_vs_ftp);
-@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
-  */
- static void __exit ip_vs_ftp_exit(void)
- {
-+	exiting_module = true;
- 	unregister_pernet_subsys(&ip_vs_ftp_ops);
- 	/* rcu_barrier() is called by netns */
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch b/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch
deleted file mode 100644
index e0cbffdf4f..0000000000
--- a/queue-6.16/ipvs-use-read_once-write_once-for-ipvs-enable.patch
+++ /dev/null
@@ -1,223 +0,0 @@
-From d3ddab2680956d9d5eef0c17ade08d4edcee2d72 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 1 Sep 2025 21:46:54 +0800
-Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
-
-From: Zhang Tengfei <zhtfdev@gmail.com>
-
-[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
-
-KCSAN reported a data-race on the `ipvs->enable` flag, which is
-written in the control path and read concurrently from many other
-contexts.
-
-Following a suggestion by Julian, this patch fixes the race by
-converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
-This lightweight approach ensures atomic access and acts as a
-compiler barrier, preventing unsafe optimizations where the flag
-is checked in loops (e.g., in ip_vs_est.c).
-
-Additionally, the `enable` checks in the fast-path hooks
-(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
-removed. These are unnecessary since commit 857ca89711de
-("ipvs: register hooks only with services"). The `enable=0`
-condition they check for can only occur in two rare and non-fatal
-scenarios: 1) after hooks are registered but before the flag is set,
-and 2) after hooks are unregistered on cleanup_net. In the worst
-case, a single packet might be mishandled (e.g., dropped), which
-does not lead to a system crash or data corruption. Adding a check
-in the performance-critical fast-path to handle this harmless
-condition is not a worthwhile trade-off.
-
-Fixes: 857ca89711de ("ipvs: register hooks only with services")
-Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
-Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
-Suggested-by: Julian Anastasov <ja@ssi.bg>
-Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
-Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
-Acked-by: Julian Anastasov <ja@ssi.bg>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/ipvs/ip_vs_conn.c |  4 ++--
- net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
- net/netfilter/ipvs/ip_vs_ctl.c  |  6 +++---
- net/netfilter/ipvs/ip_vs_est.c  | 16 ++++++++--------
- 4 files changed, 17 insertions(+), 20 deletions(-)
-
-diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
-index 44b2ad695c153..35d1260dbff0d 100644
---- a/net/netfilter/ipvs/ip_vs_conn.c
-+++ b/net/netfilter/ipvs/ip_vs_conn.c
-@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
- 			 * conntrack cleanup for the net.
- 			 */
- 			smp_rmb();
--			if (ipvs->enable)
-+			if (READ_ONCE(ipvs->enable))
- 				ip_vs_conn_drop_conntrack(cp);
- 		}
- 
-@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
- 		cond_resched_rcu();
- 
- 		/* netns clean up started, abort delayed work */
--		if (!ipvs->enable)
-+		if (!READ_ONCE(ipvs->enable))
- 			break;
- 	}
- 	rcu_read_unlock();
-diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index c7a8a08b73089..5ea7ab8bf4dcc 100644
---- a/net/netfilter/ipvs/ip_vs_core.c
-+++ b/net/netfilter/ipvs/ip_vs_core.c
-@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
- 	if (unlikely(!skb_dst(skb)))
- 		return NF_ACCEPT;
- 
--	if (!ipvs->enable)
--		return NF_ACCEPT;
--
- 	ip_vs_fill_iph_skb(af, skb, false, &iph);
- #ifdef CONFIG_IP_VS_IPV6
- 	if (af == AF_INET6) {
-@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
- 		return NF_ACCEPT;
- 	}
- 	/* ipvs enabled in this netns ? */
--	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
-+	if (unlikely(sysctl_backup_only(ipvs)))
- 		return NF_ACCEPT;
- 
- 	ip_vs_fill_iph_skb(af, skb, false, &iph);
-@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
- 	int r;
- 
- 	/* ipvs enabled in this netns ? */
--	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
-+	if (unlikely(sysctl_backup_only(ipvs)))
- 		return NF_ACCEPT;
- 
- 	if (state->pf == NFPROTO_IPV4) {
-@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
- 		return -ENOMEM;
- 
- 	/* Hold the beast until a service is registered */
--	ipvs->enable = 0;
-+	WRITE_ONCE(ipvs->enable, 0);
- 	ipvs->net = net;
- 	/* Counters used for creating unique names */
- 	ipvs->gen = atomic_read(&ipvs_netns_cnt);
-@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
- 		ipvs = net_ipvs(net);
- 		ip_vs_unregister_hooks(ipvs, AF_INET);
- 		ip_vs_unregister_hooks(ipvs, AF_INET6);
--		ipvs->enable = 0;	/* Disable packet reception */
-+		WRITE_ONCE(ipvs->enable, 0);	/* Disable packet reception */
- 		smp_wmb();
- 		ip_vs_sync_net_cleanup(ipvs);
- 	}
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 6a6fc44785337..4c8fa22be88ad 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
- 		struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
- 
- 		/* netns clean up started, abort delayed work */
--		if (!ipvs->enable)
-+		if (!READ_ONCE(ipvs->enable))
- 			goto unlock;
- 		if (!kd)
- 			continue;
-@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
- 
- 	*svc_p = svc;
- 
--	if (!ipvs->enable) {
-+	if (!READ_ONCE(ipvs->enable)) {
- 		/* Now there is a service - full throttle */
--		ipvs->enable = 1;
-+		WRITE_ONCE(ipvs->enable, 1);
- 
- 		/* Start estimation for first time */
- 		ip_vs_est_reload_start(ipvs);
-diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
-index 15049b8267327..93a925f1ed9b8 100644
---- a/net/netfilter/ipvs/ip_vs_est.c
-+++ b/net/netfilter/ipvs/ip_vs_est.c
-@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
- void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
- {
- 	/* Ignore reloads before first service is added */
--	if (!ipvs->enable)
-+	if (!READ_ONCE(ipvs->enable))
- 		return;
- 	ip_vs_est_stopped_recalc(ipvs);
- 	/* Bump the kthread configuration genid */
-@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
- 	int i;
- 
- 	if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
--	    ipvs->enable && ipvs->est_max_threads)
-+	    READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
- 		return -EINVAL;
- 
- 	mutex_lock(&ipvs->est_mutex);
-@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
- 	}
- 
- 	/* Start kthread tasks only when services are present */
--	if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
-+	if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
- 		ret = ip_vs_est_kthread_start(ipvs, kd);
- 		if (ret < 0)
- 			goto out;
-@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
- 	struct ip_vs_estimator *est = &stats->est;
- 	int ret;
- 
--	if (!ipvs->est_max_threads && ipvs->enable)
-+	if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
- 		ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
- 
- 	est->ktid = -1;
-@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
- 			/* Wait for cpufreq frequency transition */
- 			wait_event_idle_timeout(wq, kthread_should_stop(),
- 						HZ / 50);
--			if (!ipvs->enable || kthread_should_stop())
-+			if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
- 				goto stop;
- 		}
- 
-@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
- 		rcu_read_unlock();
- 		local_bh_enable();
- 
--		if (!ipvs->enable || kthread_should_stop())
-+		if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
- 			goto stop;
- 		cond_resched();
- 
-@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
- 	mutex_lock(&ipvs->est_mutex);
- 	for (id = 1; id < ipvs->est_kt_count; id++) {
- 		/* netns clean up started, abort */
--		if (!ipvs->enable)
-+		if (!READ_ONCE(ipvs->enable))
- 			goto unlock2;
- 		kd = ipvs->est_kt_arr[id];
- 		if (!kd)
-@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
- 	id = ipvs->est_kt_count;
- 
- next_kt:
--	if (!ipvs->enable || kthread_should_stop())
-+	if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
- 		goto unlock;
- 	id--;
- 	if (id < 0)
--- 
-2.51.0
-
diff --git a/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch b/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
deleted file mode 100644
index 50b842447b..0000000000
--- a/queue-6.16/kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From d9466dd587fb08ffdc0a703486fc63ff3a6c12e7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 18 Feb 2025 15:26:39 -0500
-Subject: kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
-
-From: Kienan Stewart <kstewart@efficios.com>
-
-[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ]
-
-In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b
-("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
-artifacts required for building out-of-tree kernel modules had
-$(objtree) prepended to them to prepare for building in other
-directories.
-
-When building external modules for powerpc,
-arch/powerpc/lib/crtsavres.o is required for certain
-configurations. This artifact is missing the prepended $(objtree).
-
-Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=")
-Acked-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nicolas Schier <n.schier@avm.de>
-Tested-by: Nicolas Schier <n.schier@avm.de>
-Signed-off-by: Kienan Stewart <kstewart@efficios.com>
-Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
-Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
-index f3804103c56cc..9933b98df69d7 100644
---- a/arch/powerpc/Makefile
-+++ b/arch/powerpc/Makefile
-@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
- # There is a corresponding test in arch/powerpc/lib/Makefile
- KBUILD_LDFLAGS_MODULE += --save-restore-funcs
- else
--KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
-+KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o
- endif
- 
- ifdef CONFIG_CPU_LITTLE_ENDIAN
--- 
-2.51.0
-
diff --git a/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch b/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
deleted file mode 100644
index 8da13d5bb6..0000000000
--- a/queue-6.16/keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 7919890fdfd8a83307a7ee1e33d6fc5d80563850 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 21:15:50 +0000
-Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing
-
-From: Fan Wu <wufan@kernel.org>
-
-[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
-
-Fix the X.509 Basic Constraints CA flag parsing to correctly handle
-the ASN.1 DER encoded structure. The parser was incorrectly treating
-the length field as the boolean value.
-
-Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
-According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
-
-Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
-
-The basicConstraints extension with CA:TRUE is encoded as:
-
-  SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
-                             ^-- v[2]         ^-- v[3]        ^-- v[4]
-
-The parser was checking v[3] (the length field, always 0x01) instead
-of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
-
-Also handle the case where the extension is an empty SEQUENCE (30 00),
-which is valid for CA:FALSE when the default value is omitted as
-required by DER encoding rules (X.690 section 11.5).
-
-Per ITU-T X.690-0207:
-- Section 11.5: Default values must be omitted in DER
-- Section 11.1: DER requires TRUE to be encoded as 0xFF
-
-Link: https://datatracker.ietf.org/doc/html/rfc5280
-Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
-Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
-Signed-off-by: Fan Wu <wufan@kernel.org>
-Reviewed-by: Lukas Wunner <lukas@wunner.de>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
-index 2ffe4ae90bea0..8df3fa60a44f8 100644
---- a/crypto/asymmetric_keys/x509_cert_parser.c
-+++ b/crypto/asymmetric_keys/x509_cert_parser.c
-@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen,
- 		/*
- 		 * Get hold of the basicConstraints
- 		 * v[1] is the encoding size
--		 *	(Expect 0x2 or greater, making it 1 or more bytes)
-+		 *	(Expect 0x00 for empty SEQUENCE with CA:FALSE, or
-+		 *	0x03 or greater for non-empty SEQUENCE)
- 		 * v[2] is the encoding type
- 		 *	(Expect an ASN1_BOOL for the CA)
--		 * v[3] is the contents of the ASN1_BOOL
--		 *      (Expect 1 if the CA is TRUE)
-+		 * v[3] is the length of the ASN1_BOOL
-+		 *	(Expect 1 for a single byte boolean)
-+		 * v[4] is the contents of the ASN1_BOOL
-+		 *	(Expect 0xFF if the CA is TRUE)
- 		 * vlen should match the entire extension size
- 		 */
- 		if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
-@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen,
- 			return -EBADMSG;
- 		if (v[1] != vlen - 2)
- 			return -EBADMSG;
--		if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
-+		/* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
-+		if (v[1] == 0)
-+			return 0;
-+		if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
- 			ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
-+		else
-+			return -EBADMSG;
- 		return 0;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch b/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch
deleted file mode 100644
index 31907dba3e..0000000000
--- a/queue-6.16/kselftest-arm64-gcs-correctly-check-return-value-whe.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From b6a655b4310b5789d755f3aad55b35984a570d90 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 17:13:02 +0200
-Subject: kselftest/arm64/gcs: Correctly check return value when disabling GCS
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <linux@weissschuh.net>
-
-[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ]
-
-The return value was not assigned to 'ret', so the check afterwards
-does not do anything.
-
-Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program")
-Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
-Reviewed-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Will Deacon <will@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c
-index 3fb9742342a34..a4462a00111e7 100644
---- a/tools/testing/selftests/arm64/gcs/basic-gcs.c
-+++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c
-@@ -347,7 +347,7 @@ int main(void)
- 	}
- 
- 	/* One last test: disable GCS, we can do this one time */
--	my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
-+	ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
- 	if (ret != 0)
- 		ksft_print_msg("Failed to disable GCS: %d\n", ret);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch b/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch
deleted file mode 100644
index 229f78b836..0000000000
--- a/queue-6.16/leds-flash-leds-qcom-flash-update-torch-current-clam.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From ffdcf17c323eb43fe8de0b2008ed98dfb273502b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 29 Jul 2025 12:51:22 +0800
-Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting
-
-From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
-
-[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
-
-There is a register to clamp the flash current per LED channel when
-safety timer is disabled. It needs to be updated according to the
-maximum torch LED current setting to ensure the torch current won't
-be clamped unexpectedly.
-
-Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
-Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
-Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
-Signed-off-by: Lee Jones <lee@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
- 1 file changed, 36 insertions(+), 26 deletions(-)
-
-diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
-index 89cf5120f5d55..db7c2c743adc7 100644
---- a/drivers/leds/flash/leds-qcom-flash.c
-+++ b/drivers/leds/flash/leds-qcom-flash.c
-@@ -1,6 +1,6 @@
- // SPDX-License-Identifier: GPL-2.0-only
- /*
-- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #include <linux/bitfield.h>
-@@ -114,36 +114,39 @@ enum {
- 	REG_THERM_THRSH1,
- 	REG_THERM_THRSH2,
- 	REG_THERM_THRSH3,
-+	REG_TORCH_CLAMP,
- 	REG_MAX_COUNT,
- };
- 
- static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
--	REG_FIELD(0x08, 0, 7),			/* status1	*/
--	REG_FIELD(0x09, 0, 7),                  /* status2	*/
--	REG_FIELD(0x0a, 0, 7),                  /* status3	*/
--	REG_FIELD_ID(0x40, 0, 7, 3, 1),         /* chan_timer	*/
--	REG_FIELD_ID(0x43, 0, 6, 3, 1),         /* itarget	*/
--	REG_FIELD(0x46, 7, 7),                  /* module_en	*/
--	REG_FIELD(0x47, 0, 5),                  /* iresolution	*/
--	REG_FIELD_ID(0x49, 0, 2, 3, 1),         /* chan_strobe	*/
--	REG_FIELD(0x4c, 0, 2),                  /* chan_en	*/
--	REG_FIELD(0x56, 0, 2),			/* therm_thrsh1 */
--	REG_FIELD(0x57, 0, 2),			/* therm_thrsh2 */
--	REG_FIELD(0x58, 0, 2),			/* therm_thrsh3 */
-+	[REG_STATUS1]		= REG_FIELD(0x08, 0, 7),
-+	[REG_STATUS2]		= REG_FIELD(0x09, 0, 7),
-+	[REG_STATUS3]		= REG_FIELD(0x0a, 0, 7),
-+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x40, 0, 7, 3, 1),
-+	[REG_ITARGET]		= REG_FIELD_ID(0x43, 0, 6, 3, 1),
-+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
-+	[REG_IRESOLUTION]	= REG_FIELD(0x47, 0, 5),
-+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x49, 0, 2, 3, 1),
-+	[REG_CHAN_EN]		= REG_FIELD(0x4c, 0, 2),
-+	[REG_THERM_THRSH1]	= REG_FIELD(0x56, 0, 2),
-+	[REG_THERM_THRSH2]	= REG_FIELD(0x57, 0, 2),
-+	[REG_THERM_THRSH3]	= REG_FIELD(0x58, 0, 2),
-+	[REG_TORCH_CLAMP]	= REG_FIELD(0xec, 0, 6),
- };
- 
- static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
--	REG_FIELD(0x06, 0, 7),			/* status1	*/
--	REG_FIELD(0x07, 0, 6),			/* status2	*/
--	REG_FIELD(0x09, 0, 7),			/* status3	*/
--	REG_FIELD_ID(0x3e, 0, 7, 4, 1),		/* chan_timer	*/
--	REG_FIELD_ID(0x42, 0, 6, 4, 1),		/* itarget	*/
--	REG_FIELD(0x46, 7, 7),			/* module_en	*/
--	REG_FIELD(0x49, 0, 3),			/* iresolution	*/
--	REG_FIELD_ID(0x4a, 0, 6, 4, 1),		/* chan_strobe	*/
--	REG_FIELD(0x4e, 0, 3),			/* chan_en	*/
--	REG_FIELD(0x7a, 0, 2),			/* therm_thrsh1 */
--	REG_FIELD(0x78, 0, 2),			/* therm_thrsh2 */
-+	[REG_STATUS1]		= REG_FIELD(0x06, 0, 7),
-+	[REG_STATUS2]		= REG_FIELD(0x07, 0, 6),
-+	[REG_STATUS3]		= REG_FIELD(0x09, 0, 7),
-+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x3e, 0, 7, 4, 1),
-+	[REG_ITARGET]		= REG_FIELD_ID(0x42, 0, 6, 4, 1),
-+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
-+	[REG_IRESOLUTION]	= REG_FIELD(0x49, 0, 3),
-+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x4a, 0, 6, 4, 1),
-+	[REG_CHAN_EN]		= REG_FIELD(0x4e, 0, 3),
-+	[REG_THERM_THRSH1]	= REG_FIELD(0x7a, 0, 2),
-+	[REG_THERM_THRSH2]	= REG_FIELD(0x78, 0, 2),
-+	[REG_TORCH_CLAMP]	= REG_FIELD(0xed, 0, 6),
- };
- 
- struct qcom_flash_data {
-@@ -156,6 +159,7 @@ struct qcom_flash_data {
- 	u8			max_channels;
- 	u8			chan_en_bits;
- 	u8			revision;
-+	u8			torch_clamp;
- };
- 
- struct qcom_flash_led {
-@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
- 	u32 current_ua, timeout_us;
- 	u32 channels[4];
- 	int i, rc, count;
-+	u8 torch_clamp;
- 
- 	count = fwnode_property_count_u32(node, "led-sources");
- 	if (count <= 0) {
-@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
- 	current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
- 	led->max_torch_current_ma = current_ua / UA_PER_MA;
- 
-+	torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
-+	if (torch_clamp != 0)
-+		torch_clamp--;
-+
-+	flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
-+
- 	if (fwnode_property_present(node, "flash-max-microamp")) {
- 		flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
- 
-@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
- 		flash_data->leds_count++;
- 	}
- 
--	return 0;
--
-+	return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
- release:
- 	while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
- 		v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]);
--- 
-2.51.0
-
diff --git a/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch b/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
deleted file mode 100644
index 9ff87d537a..0000000000
--- a/queue-6.16/leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 9937712e653525e00cb903c685846b81e9fe4d82 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 10:47:12 +0200
-Subject: leds: leds-lp55xx: Use correct address for memory programming
-
-From: Andrei Lalaev <andrei.lalaev@anton-paar.com>
-
-[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]
-
-Memory programming doesn't work for devices without page support.
-For example, LP5562 has 3 engines but doesn't support pages,
-the start address is changed depending on engine number.
-According to datasheet [1], the PROG MEM register addresses for each
-engine are as follows:
-
-  Engine 1: 0x10
-  Engine 2: 0x30
-  Engine 3: 0x50
-
-However, the current implementation incorrectly calculates the address
-of PROG MEM register using the engine index starting from 1:
-
-  prog_mem_base = 0x10
-  LP55xx_BYTES_PER_PAGE = 0x20
-
-  Engine 1: 0x10 + 0x20 * 1 = 0x30
-  Engine 2: 0x10 + 0x20 * 2 = 0x50
-  Engine 3: 0x10 + 0x20 * 3 = 0x70
-
-This results in writing to the wrong engine memory, causing pattern
-programming to fail.
-
-To correct it, the engine index should be decreased:
-  Engine 1: 0x10 + 0x20 * 0 = 0x10
-  Engine 2: 0x10 + 0x20 * 1 = 0x30
-  Engine 3: 0x10 + 0x20 * 2 = 0x50
-
-1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf
-
-Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
-Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
-Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com
-Signed-off-by: Lee Jones <lee@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/leds/leds-lp55xx-common.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
-index e71456a56ab8d..fd447eb7eb15e 100644
---- a/drivers/leds/leds-lp55xx-common.c
-+++ b/drivers/leds/leds-lp55xx-common.c
-@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
- 	 * For LED chip that support page, PAGE is already set in load_engine.
- 	 */
- 	if (!cfg->pages_per_engine)
--		start_addr += LP55xx_BYTES_PER_PAGE * idx;
-+		start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
- 
- 	for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
- 		/* Write to the next page each 32 bytes (if supported) */
--- 
-2.51.0
-
diff --git a/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch b/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch
deleted file mode 100644
index 9bb6bde8e9..0000000000
--- a/queue-6.16/leds-max77705-function-return-instead-of-variable-as.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 716600ace6f68ca1ae087153ae8e82afebe69f10 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 27 Jul 2025 07:56:45 +0000
-Subject: leds: max77705: Function return instead of variable assignment
-
-From: Len Bao <len.bao@gmx.us>
-
-[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ]
-
-Coverity noticed that assigning value -EINVAL to 'ret' in the if
-statement is useless because 'ret' is overwritten a few lines later.
-However, after inspect the code, this warning reveals that we need to
-return -EINVAL instead of the variable assignment. So, fix it.
-
-Coverity-id: 1646104
-Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
-Signed-off-by: Len Bao <len.bao@gmx.us>
-Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us
-Signed-off-by: Lee Jones <lee@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/leds/leds-max77705.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
-index 933cb4f19be9b..b7403b3fcf5e7 100644
---- a/drivers/leds/leds-max77705.c
-+++ b/drivers/leds/leds-max77705.c
-@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
- 
- 		ret = fwnode_property_read_u32(np, "reg", &reg);
- 		if (ret || reg >= MAX77705_LED_NUM_LEDS)
--			ret = -EINVAL;
-+			return -EINVAL;
- 
- 		info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL);
- 		if (!info)
--- 
-2.51.0
-
diff --git a/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch b/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch
deleted file mode 100644
index e425c81325..0000000000
--- a/queue-6.16/libbpf-export-bpf_object__prepare-symbol.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 5698e58cf942405c4f63e661244ce06064a395a0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Aug 2025 22:51:19 +0100
-Subject: libbpf: Export bpf_object__prepare symbol
-
-From: Mykyta Yatsenko <yatsenko@meta.com>
-
-[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ]
-
-Add missing LIBBPF_API macro for bpf_object__prepare function to enable
-its export. libbpf.map had bpf_object__prepare already listed.
-
-Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load")
-Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Acked-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/lib/bpf/libbpf.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
-index 1137e7d2e1b5a..739ee60a780cd 100644
---- a/tools/lib/bpf/libbpf.h
-+++ b/tools/lib/bpf/libbpf.h
-@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
-  * @return 0, on success; negative error code, otherwise, error code is
-  * stored in errno
-  */
--int bpf_object__prepare(struct bpf_object *obj);
-+LIBBPF_API int bpf_object__prepare(struct bpf_object *obj);
- 
- /**
-  * @brief **bpf_object__load()** loads BPF object into kernel.
--- 
-2.51.0
-
diff --git a/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch b/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
deleted file mode 100644
index 5695f097d4..0000000000
--- a/queue-6.16/libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From e3943caf5115fecd755b19c4f6eb9e9b61e698e7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Sep 2025 15:17:51 +0800
-Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf
-
-From: D. Wythe <alibuda@linux.alibaba.com>
-
-[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]
-
-When a module registers a struct_ops, the struct_ops type and its
-corresponding map_value type ("bpf_struct_ops_") may reside in different
-btf objects, here are four possible case:
-
-+--------+---------------+-------------+---------------------------------+
-|        |bpf_struct_ops_| xxx_ops     |                                 |
-+--------+---------------+-------------+---------------------------------+
-| case 0 | btf_vmlinux   | btf_vmlinux | be used and reg only in vmlinux |
-+--------+---------------+-------------+---------------------------------+
-| case 1 | btf_vmlinux   | mod_btf     | INVALID                         |
-+--------+---------------+-------------+---------------------------------+
-| case 2 | mod_btf       | btf_vmlinux | reg in mod but be used both in  |
-|        |               |             | vmlinux and mod.                |
-+--------+---------------+-------------+---------------------------------+
-| case 3 | mod_btf       | mod_btf     | be used and reg only in mod     |
-+--------+---------------+-------------+---------------------------------+
-
-Currently we figure out the mod_btf by searching with the struct_ops type,
-which makes it impossible to figure out the mod_btf when the struct_ops
-type is in btf_vmlinux while it's corresponding map_value type is in
-mod_btf (case 2).
-
-The fix is to use the corresponding map_value type ("bpf_struct_ops_")
-as the lookup anchor instead of the struct_ops type to figure out the
-`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
-the kern_type_id via btf__find_by_name_kind() with the `btf` we just
-obtained from find_ksym_btf_id().
-
-With this change the lookup obtains the correct btf and mod_btf for case 2,
-preserves correct behavior for other valid cases, and still fails as
-expected for the invalid scenario (case 1).
-
-Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
-Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Acked-by: Andrii Nakryiko <andrii@kernel.org>
-Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
-Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
- 1 file changed, 17 insertions(+), 19 deletions(-)
-
-diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
-index 41c95b1220192..4abb9f4d245eb 100644
---- a/tools/lib/bpf/libbpf.c
-+++ b/tools/lib/bpf/libbpf.c
-@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
- 	const struct btf_member *kern_data_member;
- 	struct btf *btf = NULL;
- 	__s32 kern_vtype_id, kern_type_id;
--	char tname[256];
-+	char tname[192], stname[256];
- 	__u32 i;
- 
- 	snprintf(tname, sizeof(tname), "%.*s",
- 		 (int)bpf_core_essential_name_len(tname_raw), tname_raw);
- 
--	kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
--					&btf, mod_btf);
--	if (kern_type_id < 0) {
--		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
--			tname);
--		return kern_type_id;
--	}
--	kern_type = btf__type_by_id(btf, kern_type_id);
-+	snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
- 
--	/* Find the corresponding "map_value" type that will be used
--	 * in map_update(BPF_MAP_TYPE_STRUCT_OPS).  For example,
--	 * find "struct bpf_struct_ops_tcp_congestion_ops" from the
--	 * btf_vmlinux.
-+	/* Look for the corresponding "map_value" type that will be used
-+	 * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
-+	 * and the mod_btf.
-+	 * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
- 	 */
--	kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
--						tname, BTF_KIND_STRUCT);
-+	kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
- 	if (kern_vtype_id < 0) {
--		pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
--			STRUCT_OPS_VALUE_PREFIX, tname);
-+		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
- 		return kern_vtype_id;
- 	}
- 	kern_vtype = btf__type_by_id(btf, kern_vtype_id);
- 
-+	kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
-+	if (kern_type_id < 0) {
-+		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
-+		return kern_type_id;
-+	}
-+	kern_type = btf__type_by_id(btf, kern_type_id);
-+
- 	/* Find "struct tcp_congestion_ops" from
- 	 * struct bpf_struct_ops_tcp_congestion_ops {
- 	 *	[ ... ]
-@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
- 			break;
- 	}
- 	if (i == btf_vlen(kern_vtype)) {
--		pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
--			tname, STRUCT_OPS_VALUE_PREFIX, tname);
-+		pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
-+			tname, stname);
- 		return -EINVAL;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/libbpf-fix-reuse-of-devmap.patch b/queue-6.16/libbpf-fix-reuse-of-devmap.patch
deleted file mode 100644
index f17b2e39d2..0000000000
--- a/queue-6.16/libbpf-fix-reuse-of-devmap.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From eeb320d715472019bb5498f9d0b00abb6c750e1b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 14 Aug 2025 20:01:12 +0200
-Subject: libbpf: Fix reuse of DEVMAP
-
-From: Yureka Lilian <yuka@yuka.dev>
-
-[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
-
-Previously, re-using pinned DEVMAP maps would always fail, because
-get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
-but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
-
-Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
-get_map_info when checking for compatibility with an existing DEVMAP.
-
-The same problem is handled in a third-party ebpf library:
-- https://github.com/cilium/ebpf/issues/925
-- https://github.com/cilium/ebpf/pull/930
-
-Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
-Signed-off-by: Yureka Lilian <yuka@yuka.dev>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/lib/bpf/libbpf.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
-index 8fe427960eee4..41c95b1220192 100644
---- a/tools/lib/bpf/libbpf.c
-+++ b/tools/lib/bpf/libbpf.c
-@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
- 		return false;
- 	}
- 
-+	/*
-+	 * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
-+	 * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
-+	 * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
-+	 * bpf_get_map_info_by_fd() when checking for compatibility with an
-+	 * existing DEVMAP.
-+	 */
-+	if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
-+		map_info.map_flags &= ~BPF_F_RDONLY_PROG;
-+
- 	return (map_info.type == map->def.type &&
- 		map_info.key_size == map->def.key_size &&
- 		map_info.value_size == map->def.value_size &&
--- 
-2.51.0
-
diff --git a/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch b/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch
deleted file mode 100644
index 1f800744ec..0000000000
--- a/queue-6.16/lsm-config_lsm-can-depend-on-config_security.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 429703d04a12c11d95d87ee4886212b12b9014b0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 24 Aug 2025 15:28:00 -0700
-Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]
-
-When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
-not need to be visible and settable since builtin_lsm_order is defined in
-security.o, which is only built when CONFIG_SECURITY=y.
-
-So make CONFIG_LSM depend on CONFIG_SECURITY.
-
-Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-[PM: subj tweak]
-Signed-off-by: Paul Moore <paul@paul-moore.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- security/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/security/Kconfig b/security/Kconfig
-index 4816fc74f81eb..285f284dfcac4 100644
---- a/security/Kconfig
-+++ b/security/Kconfig
-@@ -269,6 +269,7 @@ endchoice
- 
- config LSM
- 	string "Ordered list of enabled LSMs"
-+	depends on SECURITY
- 	default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
- 	default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
- 	default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
--- 
-2.51.0
-
diff --git a/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch b/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch
deleted file mode 100644
index 521d9fde86..0000000000
--- a/queue-6.16/media-i2c-vd55g1-fix-duster-register-address.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 355a58d16140256e1842fe40dcc0403453ff5123 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 18 Aug 2025 15:50:58 +0200
-Subject: media: i2c: vd55g1: Fix duster register address
-
-From: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
-
-[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ]
-
-The duster register needs to be disabled on test patterns. While the
-code is correctly doing so, the register address contained a typo, thus
-not disabling the duster correctly. Fix the typo.
-
-Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor")
-
-Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
-Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
-Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/media/i2c/vd55g1.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c
-index dec6e3e231d54..37b83125bcc81 100644
---- a/drivers/media/i2c/vd55g1.c
-+++ b/drivers/media/i2c/vd55g1.c
-@@ -66,7 +66,7 @@
- #define VD55G1_REG_READOUT_CTRL				CCI_REG8(0x052e)
- #define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL		0
- #define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2		1
--#define VD55G1_REG_DUSTER_CTRL				CCI_REG8(0x03ea)
-+#define VD55G1_REG_DUSTER_CTRL				CCI_REG8(0x03ae)
- #define VD55G1_DUSTER_ENABLE				BIT(0)
- #define VD55G1_DUSTER_DISABLE				0
- #define VD55G1_DUSTER_DYN_ENABLE			BIT(1)
--- 
-2.51.0
-
diff --git a/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch b/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
deleted file mode 100644
index 4237d2dd29..0000000000
--- a/queue-6.16/media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 6b2e6197b49dad7c9a548381b72bc96b74f499f0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 Jun 2025 16:27:24 +0800
-Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
-
-From: Zhang Shurong <zhang_shurong@foxmail.com>
-
-[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
-
-rj54n1_probe() won't clean all the allocated resources in fail
-path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
-prevent memleak.
-
-Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
-Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
-Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
-Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
-Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
-index b7ca39f63dba8..6dfc912168510 100644
---- a/drivers/media/i2c/rj54n1cb0c.c
-+++ b/drivers/media/i2c/rj54n1cb0c.c
-@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
- 			V4L2_CID_GAIN, 0, 127, 1, 66);
- 	v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
- 			V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
--	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
--	if (rj54n1->hdl.error)
--		return rj54n1->hdl.error;
- 
-+	if (rj54n1->hdl.error) {
-+		ret = rj54n1->hdl.error;
-+		goto err_free_ctrl;
-+	}
-+
-+	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
- 	rj54n1->clk_div		= clk_div;
- 	rj54n1->rect.left	= RJ54N1_COLUMN_SKIP;
- 	rj54n1->rect.top	= RJ54N1_ROW_SKIP;
--- 
-2.51.0
-
diff --git a/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch b/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch
deleted file mode 100644
index 9a902e299e..0000000000
--- a/queue-6.16/media-st-delta-avoid-excessive-stack-usage.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From e7ddd940385ee9bfa1aafb1f5dff2793127c1d1e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 10 Jun 2025 11:31:56 +0200
-Subject: media: st-delta: avoid excessive stack usage
-
-From: Arnd Bergmann <arnd@arndb.de>
-
-[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
-
-Building with a reduced stack warning limit shows that delta_mjpeg_decode()
-copies a giant structure to the stack each time but only uses three of
-its members:
-
-drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
-drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
-
-Open-code the passing of the structure members that are actually used here.
-
-Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../platform/st/sti/delta/delta-mjpeg-dec.c   | 20 ++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
-index 0533d4a083d24..a078f1107300e 100644
---- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
-+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
-@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
- 	return 0;
- }
- 
--static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
-+static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
- {
- 	struct delta_dev *delta = pctx->dev;
- 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
-@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
- 
- 	memset(params, 0, sizeof(*params));
- 
--	params->picture_start_addr_p = (u32)(au->paddr);
--	params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
-+	params->picture_start_addr_p = pstart;
-+	params->picture_end_addr_p = pend;
- 
- 	/*
- 	 * !WARNING!
-@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
- 	struct delta_dev *delta = pctx->dev;
- 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
- 	int ret;
--	struct delta_au au = *pau;
-+	void *au_vaddr = pau->vaddr;
-+	dma_addr_t au_dma = pau->paddr;
-+	size_t au_size = pau->size;
- 	unsigned int data_offset = 0;
- 	struct mjpeg_header *header = &ctx->header_struct;
- 
- 	if (!ctx->header) {
--		ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
-+		ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
- 					      header, &data_offset);
- 		if (ret) {
- 			pctx->stream_errors++;
-@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
- 			goto err;
- 	}
- 
--	ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
-+	ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
- 				      ctx->header, &data_offset);
- 	if (ret) {
- 		pctx->stream_errors++;
- 		goto err;
- 	}
- 
--	au.paddr += data_offset;
--	au.vaddr += data_offset;
-+	au_dma += data_offset;
-+	au_vaddr += data_offset;
- 
--	ret = delta_mjpeg_ipc_decode(pctx, &au);
-+	ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
- 	if (ret)
- 		goto err;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/media-zoran-remove-zoran_fh-structure.patch b/queue-6.16/media-zoran-remove-zoran_fh-structure.patch
deleted file mode 100644
index d95a04dc6f..0000000000
--- a/queue-6.16/media-zoran-remove-zoran_fh-structure.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 21ca0b741168ad855e653f5036e0355e503ca702 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Aug 2025 04:30:15 +0300
-Subject: media: zoran: Remove zoran_fh structure
-
-From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
-
-[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
-
-The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
-mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
-but the structure stayed by mistake. It is now used in a single
-location, assigned from a void pointer and then recast to a void
-pointer, without being every accessed. Drop it.
-
-Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
-Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
-Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
-Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/media/pci/zoran/zoran.h        | 6 ------
- drivers/media/pci/zoran/zoran_driver.c | 3 +--
- 2 files changed, 1 insertion(+), 8 deletions(-)
-
-diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
-index 1cd990468d3de..d05e222b39215 100644
---- a/drivers/media/pci/zoran/zoran.h
-+++ b/drivers/media/pci/zoran/zoran.h
-@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
- 
- struct zoran;
- 
--/* zoran_fh contains per-open() settings */
--struct zoran_fh {
--	struct v4l2_fh fh;
--	struct zoran *zr;
--};
--
- struct card_info {
- 	enum card_type type;
- 	char name[32];
-diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
-index f42f596d3e629..ec7fc1da4cc02 100644
---- a/drivers/media/pci/zoran/zoran_driver.c
-+++ b/drivers/media/pci/zoran/zoran_driver.c
-@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
- 			       struct v4l2_format *fmt)
- {
- 	struct zoran *zr = video_drvdata(file);
--	struct zoran_fh *fh = __fh;
- 	int i;
- 	int res = 0;
- 
- 	if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
--		return zoran_s_fmt_vid_out(file, fh, fmt);
-+		return zoran_s_fmt_vid_out(file, __fh, fmt);
- 
- 	for (i = 0; i < NUM_FORMATS; i++)
- 		if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
--- 
-2.51.0
-
diff --git a/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch b/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch
deleted file mode 100644
index 5e7dd3db20..0000000000
--- a/queue-6.16/mfd-max77705-max77705_charger-move-active-discharge-.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 1107700191920d0f114098da354fae6e79bece36 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 20:06:46 +0300
-Subject: mfd: max77705: max77705_charger: move active discharge setting to mfd
- parent
-
-From: Dzmitry Sankouski <dsankouski@gmail.com>
-
-[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ]
-
-Active discharge setting is a part of MFD top level i2c device, hence
-cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1
-register from charger driver is a mistake.
-
-Move active discharge setting to MFD parent driver.
-
-Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
-Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
-Acked-by: Lee Jones <lee@kernel.org>
-Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mfd/max77705.c                  | 3 +++
- drivers/power/supply/max77705_charger.c | 3 ---
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
-index 6b263bacb8c28..ff07d0e0d5f8e 100644
---- a/drivers/mfd/max77705.c
-+++ b/drivers/mfd/max77705.c
-@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
- 	if (pmic_rev != MAX77705_PASS3)
- 		return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev);
- 
-+	/* Active Discharge Enable */
-+	regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
-+
- 	ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
- 					i2c->irq,
- 					IRQF_ONESHOT | IRQF_SHARED, 0,
-diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
-index 329b430d0e506..3b75c82b9b9ea 100644
---- a/drivers/power/supply/max77705_charger.c
-+++ b/drivers/power/supply/max77705_charger.c
-@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
- 	regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
- 				MAX77705_WDTEN_MASK, 0);
- 
--	/* Active Discharge Enable */
--	regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
--
- 	/* VBYPSET=5.0V */
- 	regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch b/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
deleted file mode 100644
index d68ae039a3..0000000000
--- a/queue-6.16/mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From acd3712440cbc1f5446e74f4963d9f0895d609bd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 21:23:07 +0300
-Subject: mfd: max77705: Setup the core driver as an interrupt controller
-
-From: Dzmitry Sankouski <dsankouski@gmail.com>
-
-[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ]
-
-Current implementation describes only MFD's own topsys interrupts.
-However, max77705 has a register which indicates interrupt source, i.e.
-it acts as an interrupt controller. There's 4 interrupt sources in
-max77705: topsys, charger, fuelgauge, usb type-c manager.
-
-Setup max77705 MFD parent as an interrupt controller. Delete topsys
-interrupts because currently unused.
-
-Remove shared interrupt flag, because we're are an interrupt controller
-now, and subdevices should request interrupts from us.
-
-Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
-
-Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
-Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com
-Signed-off-by: Lee Jones <lee@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mfd/max77705.c | 35 ++++++++++++++---------------------
- 1 file changed, 14 insertions(+), 21 deletions(-)
-
-diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
-index ff07d0e0d5f8e..e1a9bfd658560 100644
---- a/drivers/mfd/max77705.c
-+++ b/drivers/mfd/max77705.c
-@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = {
- 	.max_register = MAX77705_PMIC_REG_USBC_RESET,
- };
- 
--static const struct regmap_irq max77705_topsys_irqs[] = {
--	{ .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, },
--	{ .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, },
--	{ .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, },
--	{ .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, },
--	{ .mask = MAX77705_SYSTEM_IRQ_TM_INT, },
-+static const struct regmap_irq max77705_irqs[] = {
-+	{ .mask = MAX77705_SRC_IRQ_CHG, },
-+	{ .mask = MAX77705_SRC_IRQ_TOP, },
-+	{ .mask = MAX77705_SRC_IRQ_FG, },
-+	{ .mask = MAX77705_SRC_IRQ_USBC, },
- };
- 
--static const struct regmap_irq_chip max77705_topsys_irq_chip = {
--	.name		= "max77705-topsys",
--	.status_base	= MAX77705_PMIC_REG_SYSTEM_INT,
--	.mask_base	= MAX77705_PMIC_REG_SYSTEM_INT_MASK,
-+static const struct regmap_irq_chip max77705_irq_chip = {
-+	.name		= "max77705",
-+	.status_base	= MAX77705_PMIC_REG_INTSRC,
-+	.ack_base	= MAX77705_PMIC_REG_INTSRC,
-+	.mask_base	= MAX77705_PMIC_REG_INTSRC_MASK,
- 	.num_regs	= 1,
--	.irqs		= max77705_topsys_irqs,
--	.num_irqs	= ARRAY_SIZE(max77705_topsys_irqs),
-+	.irqs		= max77705_irqs,
-+	.num_irqs	= ARRAY_SIZE(max77705_irqs),
- };
- 
- static int max77705_i2c_probe(struct i2c_client *i2c)
-@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
- 
- 	ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
- 					i2c->irq,
--					IRQF_ONESHOT | IRQF_SHARED, 0,
--					&max77705_topsys_irq_chip,
-+					IRQF_ONESHOT, 0,
-+					&max77705_irq_chip,
- 					&irq_data);
- 	if (ret)
- 		return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
- 
--	/* Unmask interrupts from all blocks in interrupt source register */
--	ret = regmap_update_bits(max77705->regmap,
--				 MAX77705_PMIC_REG_INTSRC_MASK,
--				 MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL);
--	if (ret < 0)
--		return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n");
--
- 	domain = regmap_irq_get_domain(irq_data);
- 
- 	ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
--- 
-2.51.0
-
diff --git a/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch b/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
deleted file mode 100644
index 9481315ba0..0000000000
--- a/queue-6.16/misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From afc32d8a473d55bc59462083e3120dd85613ea65 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 12:37:12 +0100
-Subject: misc: genwqe: Fix incorrect cmd field being reported in error
-
-From: Colin Ian King <colin.i.king@gmail.com>
-
-[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
-
-There is a dev_err message that is reporting the value of
-cmd->asiv_length when it should be reporting cmd->asv_length
-instead. Fix this.
-
-Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
-Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
-Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/genwqe/card_ddcb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
-index 500b1feaf1f6f..fd7d5cd50d396 100644
---- a/drivers/misc/genwqe/card_ddcb.c
-+++ b/drivers/misc/genwqe/card_ddcb.c
-@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
- 	}
- 	if (cmd->asv_length > DDCB_ASV_LENGTH) {
- 		dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
--			__func__, cmd->asiv_length);
-+			__func__, cmd->asv_length);
- 		return -EINVAL;
- 	}
- 	rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
--- 
-2.51.0
-
diff --git a/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch b/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
deleted file mode 100644
index 743519bfa7..0000000000
--- a/queue-6.16/mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From a3abc0ffc4d5bd9ea896bb2950f90b265c899049 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 14:23:14 +0800
-Subject: mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal
-
-From: Kuan-Wei Chiu <visitorckw@gmail.com>
-
-[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ]
-
-The comparison function cmp_loc_by_count() used for sorting stack trace
-locations in debugfs currently returns -1 if a->count > b->count and 1
-otherwise. This breaks the antisymmetry property required by sort(),
-because when two counts are equal, both cmp(a, b) and cmp(b, a) return
-1.
-
-This can lead to undefined or incorrect ordering results. Fix it by
-updating the comparison logic to explicitly handle the case when counts
-are equal, and use cmp_int() to ensure the comparison function adheres
-to the required mathematical properties of antisymmetry.
-
-Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces")
-Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
-Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
-Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
-Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- mm/slub.c | 5 +----
- 1 file changed, 1 insertion(+), 4 deletions(-)
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 09b6404ac5752..a63053505a1ac 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -7738,10 +7738,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data)
- 	struct location *loc1 = (struct location *)a;
- 	struct location *loc2 = (struct location *)b;
- 
--	if (loc1->count > loc2->count)
--		return -1;
--	else
--		return 1;
-+	return cmp_int(loc2->count, loc1->count);
- }
- 
- static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos)
--- 
-2.51.0
-
diff --git a/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch b/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
deleted file mode 100644
index 5e80072a90..0000000000
--- a/queue-6.16/mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 19e9d8361570ae84122aa9109d8698e18ab39a9e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 11 Sep 2025 23:06:05 +0200
-Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
-
-From: Bean Huo <beanhuo@micron.com>
-
-[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]
-
-Rename the inner 'frm' variable to 'resp_frm' in the write path of
-mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.
-
-The function declares 'frm' at function scope pointing to the request
-frame, but then redeclares another 'frm' variable inside the write
-block pointing to the response frame. This shadowing makes the code
-confusing and error-prone.
-
-Using 'resp_frm' for the response frame makes the distinction clear
-and improves code readability.
-
-Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
-Reviewed-by: Avri Altman <avri.altman@sandisk.com>
-Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
-Signed-off-by: Bean Huo <beanhuo@micron.com>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mmc/core/block.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
-index 9cc47bf94804b..dd6cffc0df729 100644
---- a/drivers/mmc/core/block.c
-+++ b/drivers/mmc/core/block.c
-@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
- 		return -ENOMEM;
- 
- 	if (write) {
--		struct rpmb_frame *frm = (struct rpmb_frame *)resp;
-+		struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
- 
- 		/* Send write request frame(s) */
- 		set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
- 			  1 | MMC_CMD23_ARG_REL_WR, req, req_len);
- 
- 		/* Send result request frame */
--		memset(frm, 0, sizeof(*frm));
--		frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
-+		memset(resp_frm, 0, sizeof(*resp_frm));
-+		resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
- 		set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
- 			  resp_len);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch b/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
deleted file mode 100644
index b29f5beae6..0000000000
--- a/queue-6.16/mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 7e82c67f4de28a3890505a22170294dd85cc78fb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 14:07:27 +0300
-Subject: mtd: rawnand: atmel: Fix error handling path in
- atmel_nand_controller_add_nands
-
-From: Erick Karanja <karanja99erick@gmail.com>
-
-[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
-
-In case of a jump to the  err label due to atmel_nand_create() or
-atmel_nand_controller_add_nand() failure, the reference to nand_np
-need to be released
-
-Use for_each_child_of_node_scoped() to fix the issue.
-
-Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
-
-Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
-index db94d14a3807f..49e00458eebeb 100644
---- a/drivers/mtd/nand/raw/atmel/nand-controller.c
-+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
-@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
- 
- static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
- {
--	struct device_node *np, *nand_np;
-+	struct device_node *np;
- 	struct device *dev = nc->dev;
- 	int ret, reg_cells;
- 	u32 val;
-@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
- 
- 	reg_cells += val;
- 
--	for_each_child_of_node(np, nand_np) {
-+	for_each_child_of_node_scoped(np, nand_np) {
- 		struct atmel_nand *nand;
- 
- 		nand = atmel_nand_create(nc, nand_np, reg_cells);
--- 
-2.51.0
-
diff --git a/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch b/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch
deleted file mode 100644
index 0d71f71d2f..0000000000
--- a/queue-6.16/nbd-restrict-sockets-to-tcp-and-udp.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From a9f3e0578a96b8723a7b578cfb47044760e926d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 13:22:43 +0000
-Subject: nbd: restrict sockets to TCP and UDP
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
-
-Recently, syzbot started to abuse NBD with all kinds of sockets.
-
-Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
-made sure the socket supported a shutdown() method.
-
-Explicitely accept TCP and UNIX stream sockets.
-
-Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
-Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
-Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Mike Christie <mchristi@redhat.com>
-Cc: Richard W.M. Jones <rjones@redhat.com>
-Cc: Jens Axboe <axboe@kernel.dk>
-Cc: Yu Kuai <yukuai1@huaweicloud.com>
-Cc: linux-block@vger.kernel.org
-Cc: nbd@other.debian.org
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 6463d0e8d0cef..87b0b78249da3 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
- 	if (!sock)
- 		return NULL;
- 
-+	if (!sk_is_tcp(sock->sk) &&
-+	    !sk_is_stream_unix(sock->sk)) {
-+		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
-+		*err = -EINVAL;
-+		sockfd_put(sock);
-+		return NULL;
-+	}
-+
- 	if (sock->ops->shutdown == sock_no_shutdown) {
- 		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
- 		*err = -EINVAL;
--- 
-2.51.0
-
diff --git a/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch b/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch
deleted file mode 100644
index ae017bfced..0000000000
--- a/queue-6.16/net-dlink-handle-copy_thresh-allocation-failure.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From ba22f040951694b8d604feec1ea01e99af033148 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 04:01:24 +0900
-Subject: net: dlink: handle copy_thresh allocation failure
-
-From: Yeounsu Moon <yyyynoom@gmail.com>
-
-[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
-
-The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
-If the allocation failed, dereferencing `skb->protocol` could lead to
-a NULL pointer dereference.
-
-This patch tries to allocate `skb`. If the allocation fails, it falls
-back to the normal path.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Suggested-by: Jakub Kicinski <kuba@kernel.org>
-Tested-on: D-Link DGE-550T Rev-A3
-Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
-Reviewed-by: Andrew Lunn <andrew@lunn.ch>
-Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
-index f828f38cd7682..7e22f1dc4a49f 100644
---- a/drivers/net/ethernet/dlink/dl2k.c
-+++ b/drivers/net/ethernet/dlink/dl2k.c
-@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev)
- 		} else {
- 			struct sk_buff *skb;
- 
-+			skb = NULL;
- 			/* Small skbuffs for short packets */
--			if (pkt_len > copy_thresh) {
-+			if (pkt_len <= copy_thresh)
-+				skb = netdev_alloc_skb_ip_align(dev, pkt_len);
-+			if (!skb) {
- 				dma_unmap_single(&np->pdev->dev,
- 						 desc_to_dma(desc),
- 						 np->rx_buf_sz,
- 						 DMA_FROM_DEVICE);
- 				skb_put (skb = np->rx_skbuff[entry], pkt_len);
- 				np->rx_skbuff[entry] = NULL;
--			} else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
-+			} else {
- 				dma_sync_single_for_cpu(&np->pdev->dev,
- 							desc_to_dma(desc),
- 							np->rx_buf_sz,
--- 
-2.51.0
-
diff --git a/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch b/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
deleted file mode 100644
index eb831177d4..0000000000
--- a/queue-6.16/net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From fd307c2e5c1c0a6a9e9710d05ac67a1f3ff12153 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 14:02:22 +0900
-Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
- not configurable
-
-From: Kohei Enju <enjuk@amazon.com>
-
-[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
-
-In EC2 instances where the RSS hash key is not configurable, ethtool
-shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
-returns ENA_HASH_KEY_SIZE.
-
-Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
-supported") added proper handling for devices that don't support RSS
-hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
-
-When the RSS hash key is not configurable, return 0 instead of
-ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
-
-Tested on m5 instance families.
-
-Without patch:
- # ethtool -x ens5 | grep -A 1 "RSS hash key"
- RSS hash key:
- 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
-
-With patch:
- # ethtool -x ens5 | grep -A 1 "RSS hash key"
- RSS hash key:
- Operation not supported
-
-Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
-Signed-off-by: Kohei Enju <enjuk@amazon.com>
-Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
-index a3c934c3de71d..3620a4deb0187 100644
---- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
-+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
-@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
- 
- static u32 ena_get_rxfh_key_size(struct net_device *netdev)
- {
--	return ENA_HASH_KEY_SIZE;
-+	struct ena_adapter *adapter = netdev_priv(netdev);
-+	struct ena_rss *rss = &adapter->ena_dev->rss;
-+
-+	return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
- }
- 
- static int ena_indirection_table_set(struct ena_adapter *adapter,
--- 
-2.51.0
-
diff --git a/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch b/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch
deleted file mode 100644
index 71d4390197..0000000000
--- a/queue-6.16/net-enetc-fix-probing-error-message-typo-for-the-ene.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 94a7201d0fe2b97490d45764f37fceb25c082c15 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 16:27:55 +0800
-Subject: net: enetc: Fix probing error message typo for the ENETCv4 PF driver
-
-From: Claudiu Manoil <claudiu.manoil@nxp.com>
-
-[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ]
-
-Blamed commit wrongly indicates VF error in case of PF probing error.
-
-Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF")
-Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
-index b3dc1afeefd1d..a5c1f1cef3b0c 100644
---- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
-+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
-@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev,
- 	err = enetc_get_driver_data(si);
- 	if (err)
- 		return dev_err_probe(dev, err,
--				     "Could not get VF driver data\n");
-+				     "Could not get PF driver data\n");
- 
- 	err = enetc4_pf_struct_init(si);
- 	if (err)
--- 
-2.51.0
-
diff --git a/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch b/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
deleted file mode 100644
index eb19eed0ff..0000000000
--- a/queue-6.16/net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 81924896f7cd7bcf041b60b6a4d7a9840945b765 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 Sep 2025 09:39:53 +0800
-Subject: net: enetc: initialize SW PIR and CIR based HW PIR and CIR values
-
-From: Wei Fang <wei.fang@nxp.com>
-
-[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ]
-
-Software can only initialize the PIR and CIR of the command BD ring after
-a FLR, and these two registers can only be set to 0. But the reset values
-of these two registers are 0, so software does not need to update them.
-If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or
-other values by software will cause the command BD ring to work
-abnormally. This is because of an internal context in the ring prefetch
-logic that will retain the state from the first incarnation of the ring
-and continue prefetching from the stale location when the ring is
-reinitialized. The internal context can only be reset by the FLR.
-
-In addition, there is a logic error in the implementation, next_to_clean
-indicates the software CIR and next_to_use indicates the software PIR.
-But the current driver uses next_to_clean to set PIR and use next_to_use
-to set CIR. This does not cause a problem in actual use, because the
-current command BD ring is only initialized after FLR, and the initial
-values of next_to_use and next_to_clean are both 0.
-
-Therefore, this patch removes the initialization of PIR and CIR. Instead,
-next_to_use and next_to_clean are initialized by reading the values of
-PIR and CIR.
-
-Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP")
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++----------
- 1 file changed, 5 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c
-index ba32c1bbd9e18..0c1d343253bfb 100644
---- a/drivers/net/ethernet/freescale/enetc/ntmp.c
-+++ b/drivers/net/ethernet/freescale/enetc/ntmp.c
-@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
- 	cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base,
- 					  NTMP_BASE_ADDR_ALIGN);
- 
--	cbdr->next_to_clean = 0;
--	cbdr->next_to_use = 0;
- 	spin_lock_init(&cbdr->ring_lock);
- 
-+	cbdr->next_to_use = netc_read(cbdr->regs.pir);
-+	cbdr->next_to_clean = netc_read(cbdr->regs.cir);
-+
- 	/* Step 1: Configure the base address of the Control BD Ring */
- 	netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align));
- 	netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align));
- 
--	/* Step 2: Configure the producer index register */
--	netc_write(cbdr->regs.pir, cbdr->next_to_clean);
--
--	/* Step 3: Configure the consumer index register */
--	netc_write(cbdr->regs.cir, cbdr->next_to_use);
--
--	/* Step4: Configure the number of BDs of the Control BD Ring */
-+	/* Step 2: Configure the number of BDs of the Control BD Ring */
- 	netc_write(cbdr->regs.lenr, cbdr->bd_num);
- 
--	/* Step 5: Enable the Control BD Ring */
-+	/* Step 3: Enable the Control BD Ring */
- 	netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN);
- 
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch b/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
deleted file mode 100644
index 9fdfd0e403..0000000000
--- a/queue-6.16/net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 6e72c9ce5fe15802cb2c9cef57e3565d88f44ab9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 16:19:24 -0700
-Subject: net: ethtool: tsconfig: set command must provide a reply
-
-From: Vadim Fedorenko <vadfed@meta.com>
-
-[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ]
-
-Timestamping configuration through ethtool has inconsistent behavior of
-skipping the reply for set command if configuration was not changed. Fix
-it be providing reply in any case.
-
-Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config")
-Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
-Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
-Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ethtool/tsconfig.c | 12 +++++-------
- 1 file changed, 5 insertions(+), 7 deletions(-)
-
-diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c
-index 2be356bdfe873..169b413b31fc5 100644
---- a/net/ethtool/tsconfig.c
-+++ b/net/ethtool/tsconfig.c
-@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base,
- 			return ret;
- 	}
- 
--	if (hwprov_mod || config_mod) {
--		ret = tsconfig_send_reply(dev, info);
--		if (ret && ret != -EOPNOTSUPP) {
--			NL_SET_ERR_MSG(info->extack,
--				       "error while reading the new configuration set");
--			return ret;
--		}
-+	ret = tsconfig_send_reply(dev, info);
-+	if (ret && ret != -EOPNOTSUPP) {
-+		NL_SET_ERR_MSG(info->extack,
-+			       "error while reading the new configuration set");
-+		return ret;
- 	}
- 
- 	/* tsconfig has no notification */
--- 
-2.51.0
-
diff --git a/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch b/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch
deleted file mode 100644
index f041a49981..0000000000
--- a/queue-6.16/net-mlx5-fw-reset-add-reset-timeout-work.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From e81e0d172153c9e2a83894c6dc0feb8356a57352 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 00:02:09 +0300
-Subject: net/mlx5: fw reset, add reset timeout work
-
-From: Moshe Shemesh <moshe@nvidia.com>
-
-[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
-
-Add sync reset timeout to stop poll_sync_reset in case there was no
-reset done or abort event within timeout. Otherwise poll sync reset will
-just continue and in case of fw fatal error no health reporting will be
-done.
-
-Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
-Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
-Reviewed-by: Shay Drori <shayd@nvidia.com>
-Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/mellanox/mlx5/core/fw_reset.c    | 24 +++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
-index 22995131824a0..89e399606877b 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
-@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
- 	struct work_struct reset_reload_work;
- 	struct work_struct reset_now_work;
- 	struct work_struct reset_abort_work;
-+	struct delayed_work reset_timeout_work;
- 	unsigned long reset_flags;
- 	u8 reset_method;
- 	struct timer_list timer;
-@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
- 		return -EALREADY;
- 	}
- 
-+	if (current_work() != &fw_reset->reset_timeout_work.work)
-+		cancel_delayed_work(&fw_reset->reset_timeout_work);
- 	mlx5_stop_sync_reset_poll(dev);
- 	if (poll_health)
- 		mlx5_start_health_poll(dev);
-@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
- 	}
- 	mlx5_stop_health_poll(dev, true);
- 	mlx5_start_sync_reset_poll(dev);
-+
-+	if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
-+		      &fw_reset->reset_flags))
-+		schedule_delayed_work(&fw_reset->reset_timeout_work,
-+			msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
- 	return 0;
- }
- 
-@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
- 	}
- }
- 
-+static void mlx5_sync_reset_timeout_work(struct work_struct *work)
-+{
-+	struct delayed_work *dwork = container_of(work, struct delayed_work,
-+						  work);
-+	struct mlx5_fw_reset *fw_reset =
-+		container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
-+	struct mlx5_core_dev *dev = fw_reset->dev;
-+
-+	if (mlx5_sync_reset_clear_reset_requested(dev, true))
-+		return;
-+	mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
-+}
-+
- static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
- {
- 	struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
-@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
- 	cancel_work_sync(&fw_reset->reset_reload_work);
- 	cancel_work_sync(&fw_reset->reset_now_work);
- 	cancel_work_sync(&fw_reset->reset_abort_work);
-+	cancel_delayed_work(&fw_reset->reset_timeout_work);
- }
- 
- static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
-@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
- 	INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
- 	INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
- 	INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
-+	INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
-+			  mlx5_sync_reset_timeout_work);
- 
- 	init_completion(&fw_reset->done);
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch b/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
deleted file mode 100644
index 5d6812cc86..0000000000
--- a/queue-6.16/net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From e3c0e17db3a4054ee9765b414af53dbffbb2dda0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 00:02:08 +0300
-Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
- teardown
-
-From: Shay Drory <shayd@nvidia.com>
-
-[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
-
-The reclaim_pages_cmd() function sends a command to the firmware to
-reclaim pages if the command interface is active.
-
-A race condition can occur if the command interface goes down (e.g., due
-to a PCI error) while the mlx5_cmd_do() call is in flight. In this
-case, mlx5_cmd_do() will return an error. The original code would
-propagate this error immediately, bypassing the software-based page
-reclamation logic that is supposed to run when the command interface is
-down.
-
-Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
-that command interface is down. If this is the case, fall through to
-the software reclamation path. If the command failed for any another
-reason, or finished successfully, return as before.
-
-Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
-Signed-off-by: Shay Drory <shayd@nvidia.com>
-Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
-Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
-index 9bc9bd83c2324..cd68c4b2c0bf9 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
-@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
- 	u32 func_id;
- 	u32 npages;
- 	u32 i = 0;
-+	int err;
- 
--	if (!mlx5_cmd_is_down(dev))
--		return mlx5_cmd_do(dev, in, in_size, out, out_size);
-+	err = mlx5_cmd_do(dev, in, in_size, out, out_size);
-+	/* If FW is gone (-ENXIO), proceed to forceful reclaim */
-+	if (err != -ENXIO)
-+		return err;
- 
- 	/* No hard feelings, we want our pages back! */
- 	npages = MLX5_GET(manage_pages_in, in, input_num_entries);
--- 
-2.51.0
-
diff --git a/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch b/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch
deleted file mode 100644
index 22633ad5e7..0000000000
--- a/queue-6.16/net-mlx5-stop-polling-for-command-response-if-interf.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From c2d19aee8efe09777c98f61e6d5cec539e6882ea Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 00:02:07 +0300
-Subject: net/mlx5: Stop polling for command response if interface goes down
-
-From: Moshe Shemesh <moshe@nvidia.com>
-
-[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
-
-Stop polling on firmware response to command in polling mode if the
-command interface got down. This situation can occur, for example, if a
-firmware fatal error is detected during polling.
-
-This change halts the polling process when the command interface goes
-down, preventing unnecessary waits.
-
-Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
-Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
-Reviewed-by: Shay Drori <shayd@nvidia.com>
-Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
-index e395ef5f356eb..722282cebce9a 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
-@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
- 			return;
- 		}
- 		cond_resched();
-+		if (mlx5_cmd_is_down(dev)) {
-+			ent->ret = -ENXIO;
-+			return;
-+		}
- 	} while (time_before(jiffies, poll_end));
- 
- 	ent->ret = -ETIMEDOUT;
-@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work)
- 		poll_timeout(ent);
- 		/* make sure we read the descriptor after ownership is SW */
- 		rmb();
--		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
-+		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
- 	}
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch b/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
deleted file mode 100644
index 5ac9f769b4..0000000000
--- a/queue-6.16/net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From a3f26c0d306cbb8107c8be6e52a69f1f60c4950d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 19:13:50 +0530
-Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
-
-From: I Viswanath <viswanathiyyappan@gmail.com>
-
-[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
-
-syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
-This is the sequence of events that leads to the warning:
-
-rtl8150_start_xmit() {
-	netif_stop_queue();
-	usb_submit_urb(dev->tx_urb);
-}
-
-rtl8150_set_multicast() {
-	netif_stop_queue();
-	netif_wake_queue();		<-- wakes up TX queue before URB is done
-}
-
-rtl8150_start_xmit() {
-	netif_stop_queue();
-	usb_submit_urb(dev->tx_urb);	<-- double submission
-}
-
-rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
-calling netif_stop_queue and notif_start_queue as these handle
-TX queue synchronization.
-
-The net core function dev_set_rx_mode handles the synchronization
-for rtl8150_set_multicast making it safe to remove these locks.
-
-Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
-Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Tested-by: Michal Pecio <michal.pecio@gmail.com>
-Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
-Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/usb/rtl8150.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
-index ddff6f19ff98e..92add3daadbb1 100644
---- a/drivers/net/usb/rtl8150.c
-+++ b/drivers/net/usb/rtl8150.c
-@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
- 	rtl8150_t *dev = netdev_priv(netdev);
- 	u16 rx_creg = 0x9e;
- 
--	netif_stop_queue(netdev);
- 	if (netdev->flags & IFF_PROMISC) {
- 		rx_creg |= 0x0001;
- 		dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
-@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
- 		rx_creg &= 0x00fc;
- 	}
- 	async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
--	netif_wake_queue(netdev);
- }
- 
- static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
--- 
-2.51.0
-
diff --git a/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch b/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
deleted file mode 100644
index e461be9317..0000000000
--- a/queue-6.16/netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 2bc556139fe247ffe817f8eca2699ee5079b6ec3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 16:36:21 +0800
-Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
-
-From: Zhen Ni <zhen.ni@easystack.cn>
-
-[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
-
-Since the ahash_region() macro was redefined to calculate the region
-index solely from HTABLE_REGION_BITS, the htable_bits parameter became
-unused.
-
-Remove the unused htable_bits argument and its call sites, simplifying
-the code without changing semantics.
-
-Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
-Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
-Reviewed-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
-index 5251524b96afa..5e4453e9ef8e7 100644
---- a/net/netfilter/ipset/ip_set_hash_gen.h
-+++ b/net/netfilter/ipset/ip_set_hash_gen.h
-@@ -63,7 +63,7 @@ struct hbucket {
- 		: jhash_size((htable_bits) - HTABLE_REGION_BITS))
- #define ahash_sizeof_regions(htable_bits)		\
- 	(ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
--#define ahash_region(n, htable_bits)		\
-+#define ahash_region(n)		\
- 	((n) / jhash_size(HTABLE_REGION_BITS))
- #define ahash_bucket_start(h,  htable_bits)	\
- 	((htable_bits) < HTABLE_REGION_BITS ? 0	\
-@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
- #endif
- 				key = HKEY(data, h->initval, htable_bits);
- 				m = __ipset_dereference(hbucket(t, key));
--				nr = ahash_region(key, htable_bits);
-+				nr = ahash_region(key);
- 				if (!m) {
- 					m = kzalloc(sizeof(*m) +
- 					    AHASH_INIT_SIZE * dsize,
-@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
- 	rcu_read_lock_bh();
- 	t = rcu_dereference_bh(h->table);
- 	key = HKEY(value, h->initval, t->htable_bits);
--	r = ahash_region(key, t->htable_bits);
-+	r = ahash_region(key);
- 	atomic_inc(&t->uref);
- 	elements = t->hregion[r].elements;
- 	maxelem = t->maxelem;
-@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
- 	rcu_read_lock_bh();
- 	t = rcu_dereference_bh(h->table);
- 	key = HKEY(value, h->initval, t->htable_bits);
--	r = ahash_region(key, t->htable_bits);
-+	r = ahash_region(key);
- 	atomic_inc(&t->uref);
- 	rcu_read_unlock_bh();
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch b/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
deleted file mode 100644
index 7a86b4ddec..0000000000
--- a/queue-6.16/netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From a20a1ac139f5502f12f0b5323e8ebe3f2bfa6026 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 07:27:09 +0000
-Subject: netfilter: nf_conntrack: do not skip entries in
- /proc/net/nf_conntrack
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ]
-
-ct_seq_show() has an opportunistic garbage collector :
-
-if (nf_ct_should_gc(ct)) {
-    nf_ct_kill(ct);
-    goto release;
-}
-
-So if one nf_conn is killed there, next time ct_get_next() runs,
-we skip the following item in the bucket, even if it should have
-been displayed if gc did not take place.
-
-We can decrement st->skip_elems to tell ct_get_next() one of the items
-was removed from the chain.
-
-Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nf_conntrack_standalone.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
-index 6c4cff10357df..e271dd648a681 100644
---- a/net/netfilter/nf_conntrack_standalone.c
-+++ b/net/netfilter/nf_conntrack_standalone.c
-@@ -322,6 +322,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
- 	smp_acquire__after_ctrl_dep();
- 
- 	if (nf_ct_should_gc(ct)) {
-+		struct ct_iter_state *st = s->private;
-+
-+		st->skip_elems--;
- 		nf_ct_kill(ct);
- 		goto release;
- 	}
--- 
-2.51.0
-
diff --git a/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch b/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
deleted file mode 100644
index f5de61dedf..0000000000
--- a/queue-6.16/netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 7014e6bc134b0b67575660f7a2511313f2ad657d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 14:40:43 +0200
-Subject: netfilter: nfnetlink: reset nlh pointer during batch replay
-
-From: Fernando Fernandez Mancera <fmancera@suse.de>
-
-[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ]
-
-During a batch replay, the nlh pointer is not reset until the parsing of
-the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle
-ACK flags for batch messages") that is problematic as the condition to
-add an ACK for batch begin will evaluate to true even if NLM_F_ACK
-wasn't used for batch begin message.
-
-If there is an error during the command processing, netlink is sending
-an ACK despite that. This misleads userspace tools which think that the
-return code was 0. Reset the nlh pointer to the original one when a
-replay is triggered.
-
-Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")
-Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/netfilter/nfnetlink.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
-index e598a2a252b0a..811d02b4c4f7c 100644
---- a/net/netfilter/nfnetlink.c
-+++ b/net/netfilter/nfnetlink.c
-@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
- 	const struct nfnetlink_subsystem *ss;
- 	const struct nfnl_callback *nc;
- 	struct netlink_ext_ack extack;
-+	struct nlmsghdr *onlh = nlh;
- 	LIST_HEAD(err_list);
- 	u32 status;
- 	int err;
-@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
- 	status = 0;
- replay_abort:
- 	skb = netlink_skb_clone(oskb, GFP_KERNEL);
-+	nlh = onlh;
- 	if (!skb)
- 		return netlink_ack(oskb, nlh, -ENOMEM, NULL);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch b/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
deleted file mode 100644
index 620efc8647..0000000000
--- a/queue-6.16/nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 68cb2e1e884b771e49c0d4450737b0c15feceafa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 14:42:15 +0900
-Subject: nfp: fix RSS hash key size when RSS is not supported
-
-From: Kohei Enju <enjuk@amazon.com>
-
-[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
-
-The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
-devices don't support RSS, and callers treat the negative value as a
-large positive value since the return type is u32.
-
-Return 0 when devices don't support RSS, aligning with the ethtool
-interface .get_rxfh_key_size() that requires returning 0 in such cases.
-
-Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
-Signed-off-by: Kohei Enju <enjuk@amazon.com>
-Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
-index fbca8d0efd858..37a46596268a0 100644
---- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
-+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
-@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
- 	struct nfp_net *nn = netdev_priv(netdev);
- 
- 	if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
--		return -EOPNOTSUPP;
-+		return 0;
- 
- 	return nfp_net_rss_key_sz(nn);
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch b/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
deleted file mode 100644
index cf3c7c585e..0000000000
--- a/queue-6.16/nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 82222c2816dee2f673762b97d9f9d079defb1a0b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 11:00:46 +0200
-Subject: NFSv4.1: fix backchannel max_resp_sz verification check
-
-From: Anthony Iliopoulos <ailiop@suse.com>
-
-[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
-
-When the client max_resp_sz is larger than what the server encodes in
-its reply, the nfs4_verify_back_channel_attrs() check fails and this
-causes nfs4_proc_create_session() to fail, in cases where the client
-page size is larger than that of the server and the server does not want
-to negotiate upwards.
-
-While this is not a problem with the linux nfs server that will reflect
-the proposed value in its reply irrespective of the local page size,
-other nfs server implementations may insist on their own max_resp_sz
-value, which could be smaller.
-
-Fix this by accepting smaller max_resp_sz values from the server, as
-this does not violate the protocol. The server is allowed to decrease
-but not increase proposed the size, and as such values smaller than the
-client-proposed ones are valid.
-
-Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
-Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
-Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
-Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/nfs/nfs4proc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 8d492e3b21631..0366322de20f3 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -9438,7 +9438,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
- 		goto out;
- 	if (rcvd->max_rqst_sz > sent->max_rqst_sz)
- 		return -EINVAL;
--	if (rcvd->max_resp_sz < sent->max_resp_sz)
-+	if (rcvd->max_resp_sz > sent->max_resp_sz)
- 		return -EINVAL;
- 	if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
- 		return -EINVAL;
--- 
-2.51.0
-
diff --git a/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch b/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch
deleted file mode 100644
index 55cbb8fd49..0000000000
--- a/queue-6.16/null_blk-fix-the-description-of-the-cache_size-modul.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 87dd5f95877afd3c9145d0a37b595fe3b1eb19ce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 15 Aug 2025 17:07:32 +0800
-Subject: null_blk: Fix the description of the cache_size module argument
-
-From: Genjian Zhang <zhanggenjian@kylinos.cn>
-
-[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
-
-When executing modinfo null_blk, there is an error in the description
-of module parameter mbps, and the output information of cache_size is
-incomplete.The output of modinfo before and after applying this patch
-is as follows:
-
-Before:
-[...]
-parm:           cache_size:ulong
-[...]
-parm:           mbps:Cache size in MiB for memory-backed device.
-		Default: 0 (none) (uint)
-[...]
-
-After:
-[...]
-parm:           cache_size:Cache size in MiB for memory-backed device.
-		Default: 0 (none) (ulong)
-[...]
-parm:           mbps:Limit maximum bandwidth (in MiB/s).
-		Default: 0 (no limit) (uint)
-[...]
-
-Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
-Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
-Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/null_blk/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
-index aa163ae9b2aa5..8b58986d538fa 100644
---- a/drivers/block/null_blk/main.c
-+++ b/drivers/block/null_blk/main.c
-@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
- 
- static unsigned long g_cache_size;
- module_param_named(cache_size, g_cache_size, ulong, 0444);
--MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
-+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
- 
- static bool g_fua = true;
- module_param_named(fua, g_fua, bool, 0444);
--- 
-2.51.0
-
diff --git a/queue-6.16/nvme-auth-update-bi_directional-flag.patch b/queue-6.16/nvme-auth-update-bi_directional-flag.patch
deleted file mode 100644
index c57d2a5ff9..0000000000
--- a/queue-6.16/nvme-auth-update-bi_directional-flag.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 7f435c0ac926a6b550e276a3ef794984ef42c4f5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 17:19:21 +0530
-Subject: nvme-auth: update bi_directional flag
-
-From: Martin George <martinus.gpy@gmail.com>
-
-[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ]
-
-While setting chap->s2 to zero as part of secure channel
-concatenation, the host missed out to disable the bi_directional
-flag to indicate that controller authentication is not requested.
-Fix the same.
-
-Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
-Signed-off-by: Martin George <marting@netapp.com>
-Reviewed-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/auth.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
-index f6ddbe5532890..1386e5f8682ef 100644
---- a/drivers/nvme/host/auth.c
-+++ b/drivers/nvme/host/auth.c
-@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl,
- 	} else {
- 		memset(chap->c2, 0, chap->hash_len);
- 	}
--	if (ctrl->opts->concat)
-+	if (ctrl->opts->concat) {
- 		chap->s2 = 0;
--	else
-+		chap->bi_directional = false;
-+	} else
- 		chap->s2 = nvme_auth_get_seqnum();
- 	data->seqnum = cpu_to_le32(chap->s2);
- 	if (chap->host_key_len) {
--- 
-2.51.0
-
diff --git a/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch b/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch
deleted file mode 100644
index 998f81f96f..0000000000
--- a/queue-6.16/nvme-tcp-send-only-permitted-commands-for-secure-con.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 491a598605c08da6336def33aa12e5f460c66f18 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 16:05:09 +0530
-Subject: nvme-tcp: send only permitted commands for secure concat
-
-From: Martin George <martinus.gpy@gmail.com>
-
-[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ]
-
-In addition to sending permitted commands such as connect/auth
-over the initial unencrypted admin connection as part of secure
-channel concatenation, the host also sends commands such as
-Property Get and Identify on the same. This is a spec violation
-leading to secure concat failures. Fix this by ensuring these
-additional commands are avoided on this connection.
-
-Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation")
-Signed-off-by: Martin George <marting@netapp.com>
-Reviewed-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/tcp.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
-index 9233f088fac88..7ecd9866453fb 100644
---- a/drivers/nvme/host/tcp.c
-+++ b/drivers/nvme/host/tcp.c
-@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
- 	if (error)
- 		goto out_cleanup_tagset;
- 
-+	if (ctrl->opts->concat && !ctrl->tls_pskid)
-+		return 0;
-+
- 	error = nvme_enable_ctrl(ctrl);
- 	if (error)
- 		goto out_stop_queue;
--- 
-2.51.0
-
diff --git a/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch b/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
deleted file mode 100644
index b6db99d5fc..0000000000
--- a/queue-6.16/nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 4ec17f98cc0ff435093f3a5c3c41fd1b72ca2e64 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 12:22:00 +0200
-Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Daniel Wagner <wagi@kernel.org>
-
-[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
-
-It’s possible for more than one async command to be in flight from
-__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
-
-In the current code, only one put work item is queued at a time, which
-results in a leaked reference.
-
-To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
-already tracks all resources related to the command.
-
-Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
-Reviewed-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Daniel Wagner <wagi@kernel.org>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/target/fc.c | 19 +++++++++----------
- 1 file changed, 9 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
-index 25598a46bf0d6..fb2cd1118eb83 100644
---- a/drivers/nvme/target/fc.c
-+++ b/drivers/nvme/target/fc.c
-@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op {		/* for an LS RQST XMT */
- 	int				ls_error;
- 	struct list_head		lsreq_list; /* tgtport->ls_req_list */
- 	bool				req_queued;
-+
-+	struct work_struct		put_work;
- };
- 
- 
-@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
- 	struct nvmet_fc_port_entry	*pe;
- 	struct kref			ref;
- 	u32				max_sg_cnt;
--
--	struct work_struct		put_work;
- };
- 
- struct nvmet_fc_port_entry {
-@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
- static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
- static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
- static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
--static void nvmet_fc_put_tgtport_work(struct work_struct *work)
-+static void nvmet_fc_put_lsop_work(struct work_struct *work)
- {
--	struct nvmet_fc_tgtport *tgtport =
--		container_of(work, struct nvmet_fc_tgtport, put_work);
-+	struct nvmet_fc_ls_req_op *lsop =
-+		container_of(work, struct nvmet_fc_ls_req_op, put_work);
- 
--	nvmet_fc_tgtport_put(tgtport);
-+	nvmet_fc_tgtport_put(lsop->tgtport);
-+	kfree(lsop);
- }
- static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
- static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
-@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
- 				  DMA_BIDIRECTIONAL);
- 
- out_putwork:
--	queue_work(nvmet_wq, &tgtport->put_work);
-+	queue_work(nvmet_wq, &lsop->put_work);
- }
- 
- static int
-@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
- 	lsreq->done = done;
- 	lsop->req_queued = false;
- 	INIT_LIST_HEAD(&lsop->lsreq_list);
-+	INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
- 
- 	lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
- 				  lsreq->rqstlen + lsreq->rsplen,
-@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
- 	__nvmet_fc_finish_ls_req(lsop);
- 
- 	/* fc-nvme target doesn't care about success or failure of cmd */
--
--	kfree(lsop);
- }
- 
- /*
-@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
- 	kref_init(&newrec->ref);
- 	ida_init(&newrec->assoc_cnt);
- 	newrec->max_sg_cnt = template->max_sgl_segments;
--	INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
- 
- 	ret = nvmet_fc_alloc_ls_iodlist(newrec);
- 	if (ret) {
--- 
-2.51.0
-
diff --git a/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch b/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch
deleted file mode 100644
index 943f5793da..0000000000
--- a/queue-6.16/nvmet-fcloop-call-done-callback-even-when-remote-por.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From f898a02aec6b8c550db6e7992e5954f63bf471f0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 12:22:02 +0200
-Subject: nvmet-fcloop: call done callback even when remote port is gone
-
-From: Daniel Wagner <wagi@kernel.org>
-
-[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ]
-
-When the target port is gone, it's not possible to access any of the
-request resources. The function should just silently drop the response.
-The comment is misleading in this regard.
-
-Though it's still necessary to call the driver via the ->done callback
-so the driver is able to release all resources.
-
-Reported-by: Yi Zhang <yi.zhang@redhat.com>
-Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/
-Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone")
-Reviewed-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Daniel Wagner <wagi@kernel.org>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/target/fcloop.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
-index 257b497d515a8..5dffcc5becae8 100644
---- a/drivers/nvme/target/fcloop.c
-+++ b/drivers/nvme/target/fcloop.c
-@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport,
- 	if (!targetport) {
- 		/*
- 		 * The target port is gone. The target doesn't expect any
--		 * response anymore and the ->done call is not valid
--		 * because the resources have been freed by
--		 * nvmet_fc_free_pending_reqs.
-+		 * response anymore and thus lsreq can't be accessed anymore.
- 		 *
- 		 * We end up here from delete association exchange:
- 		 * nvmet_fc_xmt_disconnect_assoc sends an async request.
-+		 *
-+		 * Return success because this is what LLDDs do; silently
-+		 * drop the response.
- 		 */
-+		lsrsp->done(lsrsp);
- 		kmem_cache_free(lsreq_cache, tls_req);
- 		return 0;
- 	}
--- 
-2.51.0
-
diff --git a/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch b/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch
deleted file mode 100644
index a7ca016bb5..0000000000
--- a/queue-6.16/ocfs2-fix-double-free-in-user_cluster_connect.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 774b9cc89b3062d44669270e29600d490a95a3b2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 23 Sep 2025 14:26:07 +0300
-Subject: ocfs2: fix double free in user_cluster_connect()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
-
-user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
-the error handling frees "lc" a second time.  Set "lc" to NULL on this
-path to avoid a double free.
-
-Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
-Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
-Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
-Cc: Mark Fasheh <mark@fasheh.com>
-Cc: Joel Becker <jlbec@evilplan.org>
-Cc: Junxiao Bi <junxiao.bi@oracle.com>
-Cc: Changwei Ge <gechangwei@live.cn>
-Cc: Jun Piao <piaojun@huawei.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ocfs2/stack_user.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
-index 77edcd70f72c2..c5236b3ed168f 100644
---- a/fs/ocfs2/stack_user.c
-+++ b/fs/ocfs2/stack_user.c
-@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
- 			printk(KERN_ERR "ocfs2: Could not determine"
- 					" locking version\n");
- 			user_cluster_disconnect(conn);
-+			lc = NULL;
- 			goto out;
- 		}
- 		wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
--- 
-2.51.0
-
diff --git a/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch b/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch
deleted file mode 100644
index b8804b20d3..0000000000
--- a/queue-6.16/octeontx2-pf-fix-bitmap-leak.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 5da60b047e39008ebf0ce039a8cf853723443377 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 Sep 2025 14:12:36 +0800
-Subject: octeontx2-pf: fix bitmap leak
-
-From: Bo Sun <bo@mboxify.com>
-
-[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ]
-
-The bitmap allocated with bitmap_zalloc() in otx2_probe() was not
-released in otx2_remove(). Unbinding and rebinding the driver therefore
-triggers a kmemleak warning:
-
-    unreferenced object (size 8):
-      backtrace:
-        bitmap_zalloc
-        otx2_probe
-
-Call bitmap_free() in the remove path to fix the leak.
-
-Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
-Signed-off-by: Bo Sun <bo@mboxify.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-index c6d2f2249cc35..12fe71dc20a79 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
-@@ -3468,6 +3468,7 @@ static void otx2_remove(struct pci_dev *pdev)
- 	otx2_disable_mbox_intr(pf);
- 	otx2_pfaf_mbox_destroy(pf);
- 	pci_free_irq_vectors(pf->pdev);
-+	bitmap_free(pf->af_xdp_zc_qidx);
- 	pci_set_drvdata(pdev, NULL);
- 	free_netdev(netdev);
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch b/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch
deleted file mode 100644
index f268fce42d..0000000000
--- a/queue-6.16/octeontx2-vf-fix-bitmap-leak.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From d183342228bf64af767b3c150057d4c7a482c21b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 Sep 2025 14:12:35 +0800
-Subject: octeontx2-vf: fix bitmap leak
-
-From: Bo Sun <bo@mboxify.com>
-
-[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ]
-
-The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not
-released in otx2vf_remove(). Unbinding and rebinding the driver therefore
-triggers a kmemleak warning:
-
-    unreferenced object (size 8):
-      backtrace:
-        bitmap_zalloc
-        otx2vf_probe
-
-Call bitmap_free() in the remove path to fix the leak.
-
-Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
-Signed-off-by: Bo Sun <bo@mboxify.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
-index 76dd2e965cf03..e9018775ffadd 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
-@@ -822,6 +822,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
- 		qmem_free(vf->dev, vf->dync_lmt);
- 	otx2vf_vfaf_mbox_destroy(vf);
- 	pci_free_irq_vectors(vf->pdev);
-+	bitmap_free(vf->af_xdp_zc_qidx);
- 	pci_set_drvdata(pdev, NULL);
- 	free_netdev(netdev);
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch b/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch
deleted file mode 100644
index 31e7cef488..0000000000
--- a/queue-6.16/once-fix-race-by-moving-do_once-to-separate-section.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 9204e93c5cc63562381033f419192d96883f4722 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 19:29:10 +0800
-Subject: once: fix race by moving DO_ONCE to separate section
-
-From: Qi Xi <xiqi2@huawei.com>
-
-[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
-
-The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
-DO_ONCE's ___done variable to .data.once section, which conflicts with
-DO_ONCE_LITE() that also uses the same section.
-
-This creates a race condition when clear_warn_once is used:
-
-Thread 1 (DO_ONCE)             Thread 2 (DO_ONCE)
-__do_once_start
-    read ___done (false)
-    acquire once_lock
-execute func
-__do_once_done
-    write ___done (true)      __do_once_start
-    release once_lock             // Thread 3 clear_warn_once reset ___done
-                                  read ___done (false)
-                                  acquire once_lock
-                              execute func
-schedule once_work            __do_once_done
-once_deferred: OK             write ___done (true)
-static_branch_disable         release once_lock
-                              schedule once_work
-                              once_deferred:
-                                  BUG_ON(!static_key_enabled)
-
-DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
-macros. Keep its ___done flag in the .data..once section and allow resetting
-by clear_warn_once, as originally intended.
-
-In contrast, DO_ONCE() is used for functions like get_random_once() and
-relies on its ___done flag for internal synchronization. We should not reset
-DO_ONCE() by clear_warn_once.
-
-Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
-shielding it from clear_warn_once.
-
-Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
-Reported-by: Hulk Robot <hulkci@huawei.com>
-Signed-off-by: Qi Xi <xiqi2@huawei.com>
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/asm-generic/vmlinux.lds.h | 1 +
- include/linux/once.h              | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
-index fa5f19b8d53a0..083d091bd7263 100644
---- a/include/asm-generic/vmlinux.lds.h
-+++ b/include/asm-generic/vmlinux.lds.h
-@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
- 	__start_once = .;						\
- 	*(.data..once)							\
- 	__end_once = .;							\
-+	*(.data..do_once)						\
- 	STRUCT_ALIGN();							\
- 	*(__tracepoints)						\
- 	/* implement dynamic printk debug */				\
-diff --git a/include/linux/once.h b/include/linux/once.h
-index 30346fcdc7995..449a0e34ad5ad 100644
---- a/include/linux/once.h
-+++ b/include/linux/once.h
-@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
- #define DO_ONCE(func, ...)						     \
- 	({								     \
- 		bool ___ret = false;					     \
--		static bool __section(".data..once") ___done = false;	     \
-+		static bool __section(".data..do_once") ___done = false;     \
- 		static DEFINE_STATIC_KEY_TRUE(___once_key);		     \
- 		if (static_branch_unlikely(&___once_key)) {		     \
- 			unsigned long ___flags;				     \
-@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
- #define DO_ONCE_SLEEPABLE(func, ...)						\
- 	({									\
- 		bool ___ret = false;						\
--		static bool __section(".data..once") ___done = false;		\
-+		static bool __section(".data..do_once") ___done = false;	\
- 		static DEFINE_STATIC_KEY_TRUE(___once_key);			\
- 		if (static_branch_unlikely(&___once_key)) {			\
- 			___ret = __do_once_sleepable_start(&___done);		\
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch b/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
deleted file mode 100644
index e7408b89e6..0000000000
--- a/queue-6.16/pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From bafdfcd3d5e9c812044913d961e34bebca872951 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 Aug 2025 14:46:42 -0700
-Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
-
-From: Nirmoy Das <nirmoyd@nvidia.com>
-
-[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]
-
-pci_acpi_preserve_config() leaks memory by returning early without freeing
-the ACPI object on success. Fix that by always freeing the obj, which is
-not needed by the caller.
-
-Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
-Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/pci-acpi.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
-index 99c58ee09fbb0..0cd8a75e22580 100644
---- a/drivers/pci/pci-acpi.c
-+++ b/drivers/pci/pci-acpi.c
-@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
- 
- bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
- {
-+	bool ret = false;
-+
- 	if (ACPI_HANDLE(&host_bridge->dev)) {
- 		union acpi_object *obj;
- 
-@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
- 					      1, DSM_PCI_PRESERVE_BOOT_CONFIG,
- 					      NULL, ACPI_TYPE_INTEGER);
- 		if (obj && obj->integer.value == 0)
--			return true;
-+			ret = true;
- 		ACPI_FREE(obj);
- 	}
- 
--	return false;
-+	return ret;
- }
- 
- /* _HPX PCI Setting Record (Type 0); same as _HPP */
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch b/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch
deleted file mode 100644
index 6890451071..0000000000
--- a/queue-6.16/pci-j721e-fix-incorrect-error-message-in-probe.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 66954a40719ea005e8ff62a5ada6bc1b0e74da83 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 14:14:34 -0700
-Subject: PCI: j721e: Fix incorrect error message in probe()
-
-From: Alok Tiwari <alok.a.tiwari@oracle.com>
-
-[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]
-
-The probe() function prints "pm_runtime_get_sync failed" when
-j721e_pcie_ctrl_init() returns an error. This is misleading since
-the failure is not from pm_runtime, but from the controller init
-routine. Update the error message to correctly reflect the source.
-
-No functional changes.
-
-Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
-Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
-Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/cadence/pci-j721e.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
-index 6c93f39d02888..5e445a7bda332 100644
---- a/drivers/pci/controller/cadence/pci-j721e.c
-+++ b/drivers/pci/controller/cadence/pci-j721e.c
-@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
- 
- 	ret = j721e_pcie_ctrl_init(pcie);
- 	if (ret < 0) {
--		dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
-+		dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
- 		goto err_get_sync;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch b/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
deleted file mode 100644
index edeb106a23..0000000000
--- a/queue-6.16/pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 5840b068521700885f229d8af75d563e2a318508 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 17:56:25 +0200
-Subject: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
-
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-
-[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ]
-
-When devm_add_action_or_reset() fails, it calls the passed cleanup
-function.  Hence the caller must not repeat that cleanup.
-
-Replace the "goto err_regulator_free" by the actual freeing, as there
-will never be a need again for a second user of this label.
-
-Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots")
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # V4H Sparrow Hawk
-Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
-Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
-Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/pwrctrl/slot.c | 12 +++---------
- 1 file changed, 3 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c
-index 18becc144913e..26b21746da50b 100644
---- a/drivers/pci/pwrctrl/slot.c
-+++ b/drivers/pci/pwrctrl/slot.c
-@@ -47,13 +47,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
- 	ret = regulator_bulk_enable(slot->num_supplies, slot->supplies);
- 	if (ret < 0) {
- 		dev_err_probe(dev, ret, "Failed to enable slot regulators\n");
--		goto err_regulator_free;
-+		regulator_bulk_free(slot->num_supplies, slot->supplies);
-+		return ret;
- 	}
- 
- 	ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off,
- 				       slot);
- 	if (ret)
--		goto err_regulator_disable;
-+		return ret;
- 
- 	pci_pwrctrl_init(&slot->ctx, dev);
- 
-@@ -62,13 +63,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
- 		return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n");
- 
- 	return 0;
--
--err_regulator_disable:
--	regulator_bulk_disable(slot->num_supplies, slot->supplies);
--err_regulator_free:
--	regulator_bulk_free(slot->num_supplies, slot->supplies);
--
--	return ret;
- }
- 
- static const struct of_device_id pci_pwrctrl_slot_of_match[] = {
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch b/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
deleted file mode 100644
index daf5810060..0000000000
--- a/queue-6.16/pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
+++ /dev/null
@@ -1,183 +0,0 @@
-From 9513a4c36480ef71b13470906639717eb4f7b73f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 4 Sep 2025 14:52:23 +0800
-Subject: PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s
-
-From: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
-
-[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ]
-
-Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link
-stability and avoid AER Correctable Errors reported on some platforms
-(eg. SA8775P).
-
-8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting.
-This setting is programmed into a group of shadow registers, which can be
-switched to configure equalization for different speeds by writing 00b,
-01b and 10b to `RATE_SHADOW_SEL`.
-
-Hence, program equalization registers in a loop using link speed as index,
-so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s
-and 32.0 GT/s.
-
-Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes")
-Co-developed-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
-Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
-Signed-off-by: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
-[mani: wrapped the warning to fit 100 columns, used post-increment for loop]
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/dwc/pcie-designware.h  |  1 -
- drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++--------
- drivers/pci/controller/dwc/pcie-qcom-common.h |  2 +-
- drivers/pci/controller/dwc/pcie-qcom-ep.c     |  6 +-
- drivers/pci/controller/dwc/pcie-qcom.c        |  6 +-
- 5 files changed, 41 insertions(+), 32 deletions(-)
-
-diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
-index ce9e18554e426..388306991467a 100644
---- a/drivers/pci/controller/dwc/pcie-designware.h
-+++ b/drivers/pci/controller/dwc/pcie-designware.h
-@@ -127,7 +127,6 @@
- #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE	BIT(16)
- #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT	24
- #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK	GENMASK(25, 24)
--#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT	0x1
- 
- #define GEN3_EQ_CONTROL_OFF			0x8A8
- #define GEN3_EQ_CONTROL_OFF_FB_MODE		GENMASK(3, 0)
-diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c
-index 3aad19b56da8f..0c6f4514f922f 100644
---- a/drivers/pci/controller/dwc/pcie-qcom-common.c
-+++ b/drivers/pci/controller/dwc/pcie-qcom-common.c
-@@ -8,9 +8,11 @@
- #include "pcie-designware.h"
- #include "pcie-qcom-common.h"
- 
--void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
-+void qcom_pcie_common_set_equalization(struct dw_pcie *pci)
- {
-+	struct device *dev = pci->dev;
- 	u32 reg;
-+	u16 speed;
- 
- 	/*
- 	 * GEN3_RELATED_OFF register is repurposed to apply equalization
-@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
- 	 * determines the data rate for which these equalization settings are
- 	 * applied.
- 	 */
--	reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
--	reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
--	reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
--	reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
--			  GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT);
--	dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
- 
--	reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
--	reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
--		GEN3_EQ_FMDC_N_EVALS |
--		GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
--		GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
--	reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
--		FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
--		FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
--		FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
--	dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
-+	for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) {
-+		if (speed > PCIE_SPEED_32_0GT) {
-+			dev_warn(dev, "Skipped equalization settings for unsupported data rate\n");
-+			break;
-+		}
- 
--	reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
--	reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
--		GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
--		GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
--		GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
--	dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
-+		reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
-+		reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
-+		reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
-+		reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
-+			  speed - PCIE_SPEED_8_0GT);
-+		dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
-+
-+		reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
-+		reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
-+			GEN3_EQ_FMDC_N_EVALS |
-+			GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
-+			GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
-+		reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
-+			FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
-+			FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
-+			FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
-+		dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
-+
-+		reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
-+		reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
-+			GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
-+			GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
-+			GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
-+		dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
-+	}
- }
--EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization);
-+EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization);
- 
- void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci)
- {
-diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h
-index 7d88d29e47661..7f5ca2fd9a72f 100644
---- a/drivers/pci/controller/dwc/pcie-qcom-common.h
-+++ b/drivers/pci/controller/dwc/pcie-qcom-common.h
-@@ -8,7 +8,7 @@
- 
- struct dw_pcie;
- 
--void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci);
-+void qcom_pcie_common_set_equalization(struct dw_pcie *pci);
- void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci);
- 
- #endif
-diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
-index bf7c6ac0f3e39..aaf060bf39d40 100644
---- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
-+++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
-@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci)
- 		goto err_disable_resources;
- 	}
- 
--	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
--		qcom_pcie_common_set_16gt_equalization(pci);
-+	qcom_pcie_common_set_equalization(pci);
-+
-+	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
- 		qcom_pcie_common_set_16gt_lane_margining(pci);
--	}
- 
- 	/*
- 	 * The physical address of the MMIO region which is exposed as the BAR
-diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
-index 9b12f2f020422..e5e686705e485 100644
---- a/drivers/pci/controller/dwc/pcie-qcom.c
-+++ b/drivers/pci/controller/dwc/pcie-qcom.c
-@@ -298,10 +298,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci)
- {
- 	struct qcom_pcie *pcie = to_qcom_pcie(pci);
- 
--	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
--		qcom_pcie_common_set_16gt_equalization(pci);
-+	qcom_pcie_common_set_equalization(pci);
-+
-+	if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
- 		qcom_pcie_common_set_16gt_lane_margining(pci);
--	}
- 
- 	/* Enable Link Training state machine */
- 	if (pcie->cfg->ops->ltssm_enable)
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch b/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
deleted file mode 100644
index a9c6720e83..0000000000
--- a/queue-6.16/pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From ba636f596a61b2a62f9bdb252d1e2f5a94e2ce3a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 15:45:58 +0200
-Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Marek Vasut <marek.vasut+renesas@mailbox.org>
-
-[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]
-
-R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
-Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
-domain, after reset has been asserted by writing a matching reset bit into
-register SRCR, it is mandatory to wait 1ms.
-
-Because it is the controller driver which can determine whether or not the
-controller is in HSC domain based on its compatible string, add the missing
-delay in the controller driver.
-
-This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
-whether S4 is affected as well. This patch does apply the extra delay on
-R-Car S4 as well.
-
-Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
-Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-[mani: added the missing r-b tag from Krzysztof]
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
-Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-index 18055807a4f5f..d9a42fa51520a 100644
---- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
- 		return ret;
- 	}
- 
--	if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
-+	if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
- 		reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
-+		/*
-+		 * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
-+		 * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
-+		 * indicates that for peripherals in HSC domain, after
-+		 * reset has been asserted by writing a matching reset bit
-+		 * into register SRCR, it is mandatory to wait 1ms.
-+		 */
-+		fsleep(1000);
-+	}
- 
- 	val = readl(rcar->base + PCIEMSR0);
- 	if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch b/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
deleted file mode 100644
index 7795f6a103..0000000000
--- a/queue-6.16/pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From f4a4e26cf3ce57afbc3fed97355e6b9ad0947d25 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 24 Sep 2025 02:55:45 +0200
-Subject: PCI: rcar-gen4: Assure reset occurs before DBI access
-
-From: Marek Vasut <marek.vasut+renesas@mailbox.org>
-
-[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]
-
-Assure the reset is latched and the core is ready for DBI access. On R-Car
-V4H, the PCIe reset is asynchronous and does not take effect immediately,
-but needs a short time to complete. In case DBI access happens in that
-short time, that access generates an SError. Make sure that condition can
-never happen, read back the state of the reset, which should turn the
-asynchronous reset into a synchronous one, and wait a little over 1ms to
-add additional safety margin.
-
-Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
-Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-index d9a42fa51520a..9ac3f0f11adad 100644
---- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
- 	if (ret)
- 		goto err_unprepare;
- 
-+	/*
-+	 * Assure the reset is latched and the core is ready for DBI access.
-+	 * On R-Car V4H, the PCIe reset is asynchronous and does not take
-+	 * effect immediately, but needs a short time to complete. In case
-+	 * DBI access happens in that short time, that access generates an
-+	 * SError. To make sure that condition can never happen, read back the
-+	 * state of the reset, which should turn the asynchronous reset into
-+	 * synchronous one, and wait a little over 1ms to add additional
-+	 * safety margin.
-+	 */
-+	reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
-+	fsleep(1000);
-+
- 	if (rcar->drvdata->additional_common_init)
- 		rcar->drvdata->additional_common_init(rcar);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch b/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
deleted file mode 100644
index b8d2389c33..0000000000
--- a/queue-6.16/pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From e8bf04acc9dda3e15ee2605f6572987e20370228 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 01:58:40 +0200
-Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization
-
-From: Marek Vasut <marek.vasut+renesas@mailbox.org>
-
-[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]
-
-R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
-Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
-figure indicates that register 0xf8 should be polled until bit 18 becomes
-set to 1.
-
-Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
-set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
-break condition is inverted and returns when register 0xf8, bit 18 is set
-to 0, which in most cases means immediately. In case
-CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
-readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
-afterward never read register 0xf8, bit 18 as 0, which leads to timeout
-and failure to start the PCIe controller.
-
-Fix this by inverting the poll condition to match the reference manual
-initialization sequence.
-
-Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
-Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-index 9ac3f0f11adad..c16c4c2be4993 100644
---- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
-@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
- 	val &= ~APP_HOLD_PHY_RST;
- 	writel(val, rcar->base + PCIERSTCTRL1);
- 
--	ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
-+	ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
- 	if (ret < 0)
- 		return ret;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch b/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
deleted file mode 100644
index 7e7d7e0601..0000000000
--- a/queue-6.16/pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 1a749bda74d696311944b61e569fa0451d8a956f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Aug 2025 08:04:08 -0700
-Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
- allocation
-
-From: Alok Tiwari <alok.a.tiwari@oracle.com>
-
-[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
-
-Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
-The original call used sizeof(phy) as the number of elements and
-port->lanes as the element size, which is reversed.  While this happens to
-produce the correct total allocation size with current pointer size and
-lane counts, the argument order is wrong.
-
-Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
-Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
-[mani: added Fixes tag]
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pci-tegra.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
-index 467ddc701adce..bb88767a37979 100644
---- a/drivers/pci/controller/pci-tegra.c
-+++ b/drivers/pci/controller/pci-tegra.c
-@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
- 	unsigned int i;
- 	int err;
- 
--	port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
-+	port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
- 	if (!port->phys)
- 		return -ENOMEM;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch b/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
deleted file mode 100644
index 249636170e..0000000000
--- a/queue-6.16/pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From c5160d5c782d7979a7388ca0541fc67e0f1d1f4e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 11 Sep 2025 11:30:22 +0200
-Subject: PCI: tegra194: Fix duplicate PLL disable in
- pex_ep_event_pex_rst_assert()
-
-From: Nagarjuna Kristam <nkristam@nvidia.com>
-
-[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
-
-During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
-called twice.
-
-pex_ep_event_pex_rst_assert() should do the opposite of
-pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
-tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
-tegra_pcie_bpmp_set_pll_state() call should instead be a call to
-tegra_pcie_bpmp_set_ctrl_state().
-
-With this, the uninitialization sequence also matches that of
-tegra_pcie_unconfig_controller().
-
-Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
-Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
-[cassel: improve commit log]
-Signed-off-by: Niklas Cassel <cassel@kernel.org>
-Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
-[mani: added Fixes tag]
-Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
-index 4f26086f25daf..0c0734aa14b68 100644
---- a/drivers/pci/controller/dwc/pcie-tegra194.c
-+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
-@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
- 				ret);
- 	}
- 
--	ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
-+	ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
- 	if (ret)
--		dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
-+		dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
- 
- 	pcie->ep_state = EP_STATE_DISABLED;
- 	dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
--- 
-2.51.0
-
diff --git a/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch b/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
deleted file mode 100644
index 5884ff5f31..0000000000
--- a/queue-6.16/perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 5b1423b1bc20ea91b0cee4564332d2759bcf2505 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 18:41:39 +0100
-Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
-
-From: Leo Yan <leo.yan@arm.com>
-
-[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
-
-Cast nr_pages to unsigned long to avoid overflow when handling large
-AUX buffer sizes (>= 2 GiB).
-
-Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
-Signed-off-by: Leo Yan <leo.yan@arm.com>
-Signed-off-by: Will Deacon <will@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/perf/arm_spe_pmu.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
-index 3efed8839a4ec..ef9b3955ac662 100644
---- a/drivers/perf/arm_spe_pmu.c
-+++ b/drivers/perf/arm_spe_pmu.c
-@@ -97,7 +97,8 @@ struct arm_spe_pmu {
- #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
- 
- /* Convert a free-running index from perf into an SPE buffer offset */
--#define PERF_IDX2OFF(idx, buf)	((idx) % ((buf)->nr_pages << PAGE_SHIFT))
-+#define PERF_IDX2OFF(idx, buf) \
-+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
- 
- /* Keep track of our dynamic hotplug state */
- static enum cpuhp_state arm_spe_pmu_online;
--- 
-2.51.0
-
diff --git a/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch b/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
deleted file mode 100644
index 5d504e0baa..0000000000
--- a/queue-6.16/perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 918ec43e00dcdc9a84ad1533d900bea0bc65b22c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 10:30:27 +0800
-Subject: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
-
-From: Dapeng Mi <dapeng1.mi@linux.intel.com>
-
-[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ]
-
-When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
- access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.
-
-[   55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
-[   55.611280] Call Trace:
-[   55.611282]  <TASK>
-[   55.611284]  ? intel_pmu_config_acr+0x87/0x160
-[   55.611289]  intel_pmu_enable_acr+0x6d/0x80
-[   55.611291]  intel_pmu_enable_event+0xce/0x460
-[   55.611293]  x86_pmu_start+0x78/0xb0
-[   55.611297]  x86_pmu_enable+0x218/0x3a0
-[   55.611300]  ? x86_pmu_enable+0x121/0x3a0
-[   55.611302]  perf_pmu_enable+0x40/0x50
-[   55.611307]  ctx_resched+0x19d/0x220
-[   55.611309]  __perf_install_in_context+0x284/0x2f0
-[   55.611311]  ? __pfx_remote_function+0x10/0x10
-[   55.611314]  remote_function+0x52/0x70
-[   55.611317]  ? __pfx_remote_function+0x10/0x10
-[   55.611319]  generic_exec_single+0x84/0x150
-[   55.611323]  smp_call_function_single+0xc5/0x1a0
-[   55.611326]  ? __pfx_remote_function+0x10/0x10
-[   55.611329]  perf_install_in_context+0xd1/0x1e0
-[   55.611331]  ? __pfx___perf_install_in_context+0x10/0x10
-[   55.611333]  __do_sys_perf_event_open+0xa76/0x1040
-[   55.611336]  __x64_sys_perf_event_open+0x26/0x30
-[   55.611337]  x64_sys_call+0x1d8e/0x20c0
-[   55.611339]  do_syscall_64+0x4f/0x120
-[   55.611343]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
-
-On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
-thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
-which requires to enable auto counter reload on GP counter 0.
-
-The root cause of causing this issue is the check for auto counter
-reload (ACR) counter mask from user space is incorrect in
-intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
-mask from user space could be set into hw.config1 and then written into
-CFG_B MSRs and trigger the MSR access warning.
-
-e.g., User may create a perf event with ACR counter mask (config2=0xcb),
-and there is only 1 event created, so "cpuc->n_events" is 1.
-
-The correct check condition should be "i + idx >= cpuc->n_events"
-instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
-the counter mask would traverse twice and an invalid "cpuc->assign[1]"
-bit (bit 0) is set into hw.config1 and cause MSR accessing error.
-
-Besides, also check if the ACR counter mask corresponding events are
-ACR events. If not, filter out these counter mask. If a event is not a
-ACR event, it could be scheduled to an HW counter which doesn't support
-ACR. It's invalid to add their counter index in ACR counter mask.
-
-Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
-user could set any invalid ACR counter mask and the warning message
-could mislead users.
-
-Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
-Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
-Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/events/intel/core.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
-index c2fb729c270ec..15da60cf69f20 100644
---- a/arch/x86/events/intel/core.c
-+++ b/arch/x86/events/intel/core.c
-@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc)
- 			if (event->group_leader != leader->group_leader)
- 				break;
- 			for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) {
--				if (WARN_ON_ONCE(i + idx > cpuc->n_events))
-+				if (i + idx >= cpuc->n_events ||
-+				    !is_acr_event_group(cpuc->event_list[i + idx]))
- 					return;
- 				__set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1);
- 			}
--- 
-2.51.0
-
diff --git a/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch b/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
deleted file mode 100644
index 987a284334..0000000000
--- a/queue-6.16/perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From d2187771c7ef3eaa6df4427f371d8cad4dec57a2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 10:30:26 +0800
-Subject: perf/x86/intel: Use early_initcall() to hook bts_init()
-
-From: Dapeng Mi <dapeng1.mi@linux.intel.com>
-
-[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ]
-
-After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS
- initialization from PEBS initialization")' is introduced, x86_pmu.bts
-would initialized in bts_init() which is hooked by arch_initcall().
-
-Whereas init_hw_perf_events() is hooked by early_initcall(). Once the
-core PMU is initialized, nmi watchdog initialization is called
-immediately before bts_init() is called. It leads to the BTS buffer is
-not really initialized since bts_init() is not called and x86_pmu.bts is
-still false at that time. Worse, BTS buffer would never be initialized
-then unless all core PMU events are freed and reserve_ds_buffers()
-is called again.
-
-Thus aligning with init_hw_perf_events(), use early_initcall() to hook
-bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog
-initialization.
-
-Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")
-Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
-Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/events/intel/bts.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
-index 61da6b8a3d519..cbac54cb3a9ec 100644
---- a/arch/x86/events/intel/bts.c
-+++ b/arch/x86/events/intel/bts.c
-@@ -643,4 +643,4 @@ static __init int bts_init(void)
- 
- 	return perf_pmu_register(&bts_pmu, "intel_bts", -1);
- }
--arch_initcall(bts_init);
-+early_initcall(bts_init);
--- 
-2.51.0
-
diff --git a/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch b/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
deleted file mode 100644
index 472e5209a2..0000000000
--- a/queue-6.16/phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From ff3fbe786ddd9325e829e0cf29bfef9adeb5200e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 23 Jul 2025 07:23:22 +0000
-Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
-
-From: Jonas Karlman <jonas@kwiboo.se>
-
-[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
-
-The boot firmware may disable the U3 port early during boot and leave it
-up to the controller or PHY driver to re-enable U3 when needed.
-
-The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
-something the Rockchip Naneng Combo PHY driver never does for RK3568.
-This may result in USB 3.0 ports being limited to only using USB 2.0 or
-in special cases not working at all on RK3568.
-
-Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
-when a PHY with PHY_TYPE_USB3 mode is used.
-
-Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
-Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
-Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
-index ce91fb1d51671..17c6310f4b54b 100644
---- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
-+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
-@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg {
- 	struct combphy_reg pipe_xpcs_phy_ready;
- 	struct combphy_reg pipe_pcie1l0_sel;
- 	struct combphy_reg pipe_pcie1l1_sel;
-+	struct combphy_reg u3otg0_port_en;
-+	struct combphy_reg u3otg1_port_en;
- };
- 
- struct rockchip_combphy_cfg {
-@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
- 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
- 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
- 		rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
-+		switch (priv->id) {
-+		case 0:
-+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
-+			break;
-+		case 1:
-+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
-+			break;
-+		}
- 		break;
- 
- 	case PHY_TYPE_SATA:
-@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
- 	/* pipe-grf */
- 	.pipe_con0_for_sata	= { 0x0000, 15, 0, 0x00, 0x2220 },
- 	.pipe_xpcs_phy_ready	= { 0x0040, 2, 2, 0x00, 0x01 },
-+	.u3otg0_port_en		= { 0x0104, 15, 0, 0x0181, 0x1100 },
-+	.u3otg1_port_en		= { 0x0144, 15, 0, 0x0181, 0x1100 },
- };
- 
- static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
--- 
-2.51.0
-
diff --git a/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch b/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
deleted file mode 100644
index 20abac3e96..0000000000
--- a/queue-6.16/pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From acab3b4a0c47761b8bc246a2c38268e0d856cbc4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 10 Sep 2025 21:26:05 +0200
-Subject: pid: use ns_capable_noaudit() when determining net sysctl permissions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Christian Göttsche <cgzones@googlemail.com>
-
-[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ]
-
-The capability check should not be audited since it is only being used
-to determine the inode permissions. A failed check does not indicate a
-violation of security policy but, when an LSM is enabled, a denial audit
-message was being generated.
-
-The denial audit message can either lead to the capability being
-unnecessarily allowed in a security policy, or being silenced potentially
-masking a legitimate capability check at a later point in time.
-
-Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when
-determining net sysctl permissions")
-
-Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace")
-CC: Christian Brauner <brauner@kernel.org>
-CC: linux-security-module@vger.kernel.org
-CC: selinux@vger.kernel.org
-Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
-Acked-by: Serge Hallyn <serge@hallyn.com>
-Reviewed-by: Paul Moore <paul@paul-moore.com>
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/pid.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/kernel/pid.c b/kernel/pid.c
-index 8317bcbc7cf7d..24f839d9c3031 100644
---- a/kernel/pid.c
-+++ b/kernel/pid.c
-@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head,
- 		container_of(head->set, struct pid_namespace, set);
- 	int mode = table->mode;
- 
--	if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) ||
-+	if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) ||
- 	    uid_eq(current_euid(), make_kuid(pidns->user_ns, 0)))
- 		mode = (mode & S_IRWXU) >> 6;
- 	else if (in_egroup_p(make_kgid(pidns->user_ns, 0)))
--- 
-2.51.0
-
diff --git a/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch b/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
deleted file mode 100644
index 495b0f9ba7..0000000000
--- a/queue-6.16/pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 4f469996b4e4a41f36206e533ba187d5a3e073a2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 19:33:34 -0400
-Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
-
-From: Da Xue <da@libre.computer>
-
-[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
-
-Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
-
-Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
-
-Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
-Signed-off-by: Da Xue <da@libre.computer>
-Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
-Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
-index 9171de657f978..a75762e4d2641 100644
---- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
-+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
-@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[]	= { GPIODV_28 };
- static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
- static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
- 
-+static const unsigned int i2c_sck_d_pins[]	= { GPIOX_11 };
-+static const unsigned int i2c_sda_d_pins[]	= { GPIOX_10 };
-+
- static const unsigned int eth_mdio_pins[]	= { GPIOZ_0 };
- static const unsigned int eth_mdc_pins[]	= { GPIOZ_1 };
- static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
-@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
- 	GPIO_GROUP(GPIO_TEST_N),
- 
- 	/* Bank X */
-+	GROUP(i2c_sda_d,	5,	5),
-+	GROUP(i2c_sck_d,	5,	4),
- 	GROUP(sdio_d0,		5,	31),
- 	GROUP(sdio_d1,		5,	30),
- 	GROUP(sdio_d2,		5,	29),
-@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
- 	"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
- };
- 
-+static const char * const i2c_d_groups[] = {
-+	"i2c_sck_d", "i2c_sda_d",
-+};
-+
- static const char * const eth_groups[] = {
- 	"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
- 	"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
-@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
- 	FUNCTION(i2c_a),
- 	FUNCTION(i2c_b),
- 	FUNCTION(i2c_c),
-+	FUNCTION(i2c_d),
- 	FUNCTION(eth),
- 	FUNCTION(pwm_a),
- 	FUNCTION(pwm_b),
--- 
-2.51.0
-
diff --git a/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch b/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
deleted file mode 100644
index ec89e6190f..0000000000
--- a/queue-6.16/pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 3924b273c44e295f6d9ac0523a78a3e163b891cb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 9 Jul 2025 17:08:13 +0100
-Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in
- rzg3s_oen_read()
-
-From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
-
-[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]
-
-rzg3s_oen_read() returns a u32 value, but previously propagated a negative
-error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
-positive value due to unsigned conversion. This caused incorrect
-output-enable reporting for certain pins.
-
-Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
-as "output enabled" in the pinconf-pins debugfs file. With this fix, only
-P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
-hardware manual.
-
-Fix this by returning 0 when the OEN bit lookup fails, treating the pin
-as output-disabled by default.
-
-Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
-Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
-index 78fa08ff0faa8..47b983ca44712 100644
---- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
-+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
-@@ -1119,7 +1119,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
- 
- 	bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
- 	if (bit < 0)
--		return bit;
-+		return 0;
- 
- 	return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch b/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch
deleted file mode 100644
index 70fc1c30d6..0000000000
--- a/queue-6.16/pinctrl-renesas-use-int-type-to-store-negative-error.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From ede27b0f3c361673324af90fe0a8bcd283d802bf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 31 Aug 2025 16:49:58 +0800
-Subject: pinctrl: renesas: Use int type to store negative error codes
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
-
-Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
-int to int, as it needs to store either negative error codes or zero
-returned by sh_pfc_pinconf_set().
-
-No effect on runtime.
-
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
-Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pinctrl/renesas/pinctrl.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
-index 29d16c9c1bd19..3a742f74ecd1d 100644
---- a/drivers/pinctrl/renesas/pinctrl.c
-+++ b/drivers/pinctrl/renesas/pinctrl.c
-@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
- 	struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
- 	const unsigned int *pins;
- 	unsigned int num_pins;
--	unsigned int i, ret;
-+	unsigned int i;
-+	int ret;
- 
- 	pins = pmx->pfc->info->groups[group].pins;
- 	num_pins = pmx->pfc->info->groups[group].nr_pins;
--- 
-2.51.0
-
diff --git a/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch b/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
deleted file mode 100644
index 4ffe760b77..0000000000
--- a/queue-6.16/pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 27b0ea1bc5b2c6a322d21a7b2e993096c21846bc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 7 Aug 2025 18:58:23 +0300
-Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
- probe()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
-
-The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
-would lead to a error pointer dereference.  Use IS_ERR_OR_NULL() to check
-that the pointer is valid.
-
-Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
-index 22fe9e631f8aa..5730076846e1b 100644
---- a/drivers/devfreq/mtk-cci-devfreq.c
-+++ b/drivers/devfreq/mtk-cci-devfreq.c
-@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
- out_free_resources:
- 	if (regulator_is_enabled(drv->proc_reg))
- 		regulator_disable(drv->proc_reg);
--	if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
-+	if (!IS_ERR_OR_NULL(drv->sram_reg) &&
-+	    regulator_is_enabled(drv->sram_reg))
- 		regulator_disable(drv->sram_reg);
- 
- 	return ret;
--- 
-2.51.0
-
diff --git a/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch b/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
deleted file mode 100644
index 6db838b897..0000000000
--- a/queue-6.16/pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From c1d8afde7a597e39b8dbe87bbc69ded64995226a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 May 2025 15:38:08 +0200
-Subject: PM / devfreq: rockchip-dfi: double count on RK3588
-
-From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
-
-[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]
-
-On RK3588 with LPDDR4X memory, the cycle count as returned by
-
-  perf stat -a -e rockchip_ddr/cycles/ sleep 1
-
-consistently reads half as much as what the actual DDR frequency is at.
-For a LPDDR4X module running at 2112MHz, I get more like 1056059916
-cycles per second, which is almost bang-on half what it should be. No,
-I'm not mixing up megatransfers and megahertz.
-
-Consulting the downstream driver, this appears to be because the RK3588
-hardware specifically (and RK3528 as well, for future reference) needs a
-multiplier of 2 to get to the correct frequency with everything but
-LPDDR5.
-
-The RK3588's actual memory bandwidth measurements in MB/s are correct
-however, as confirmed with stress-ng --stream. This makes me think the
-access counters are not affected in the same way. This tracks with the
-vendor kernel not multiplying the access counts either.
-
-Solve this by adding a new member to the dfi struct, which each SoC can
-set to whatever they want, but defaults to 1 if left unset by the SoC
-init functions. The event_get_count op can then use this multiplier if
-the cycle count is requested.
-
-The cycle multiplier is not used in rockchip_dfi_get_event because the
-vendor driver doesn't use it there either, and we don't do other actual
-bandwidth unit conversion stuff in there anyway.
-
-Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
-Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
-index 0470d7c175f4f..54effb6351965 100644
---- a/drivers/devfreq/event/rockchip-dfi.c
-+++ b/drivers/devfreq/event/rockchip-dfi.c
-@@ -116,6 +116,7 @@ struct rockchip_dfi {
- 	int buswidth[DMC_MAX_CHANNELS];
- 	int ddrmon_stride;
- 	bool ddrmon_ctrl_single;
-+	unsigned int count_multiplier;	/* number of data clocks per count */
- };
- 
- static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
-@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
- 
- 	switch (event->attr.config) {
- 	case PERF_EVENT_CYCLES:
--		count = total.c[0].clock_cycles;
-+		count = total.c[0].clock_cycles * dfi->count_multiplier;
- 		break;
- 	case PERF_EVENT_READ_BYTES:
- 		for (i = 0; i < dfi->max_channels; i++)
-@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
- 		break;
- 	}
- 
-+	if (!dfi->count_multiplier)
-+		dfi->count_multiplier = 1;
-+
- 	ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
- 	if (ret)
- 		return ret;
-@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
- 	dfi->max_channels = 4;
- 
- 	dfi->ddrmon_stride = 0x4000;
-+	dfi->count_multiplier = 2;
- 
- 	return 0;
- };
--- 
-2.51.0
-
diff --git a/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch b/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
deleted file mode 100644
index 434c7810a5..0000000000
--- a/queue-6.16/pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From c62f16114008861fa125c57e35990d42714b2d8b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 15:55:45 +0200
-Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
-
-From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-
-[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
-
-If system suspend is aborted in the "noirq" phase (for instance, due to
-an error returned by one of the device callbacks), power.is_noirq_suspended
-will not be set for some devices and device_resume_noirq() will return
-early for them.  Consequently, noirq resume callbacks will not run for
-them at all because the noirq suspend callbacks have not run for them
-yet.
-
-If any of them has power.must_resume set and late suspend has been
-skipped for it (due to power.smart_suspend), early resume should be
-skipped for it either, or its state may become inconsistent (for
-instance, if the early resume assumes that it will always follow
-noirq resume).
-
-Make that happen by clearing power.must_resume in device_resume_noirq()
-for devices with power.is_noirq_suspended clear that have been left in
-suspend by device_suspend_late(), which will subsequently cause
-device_resume_early() to leave the device in suspend and avoid
-changing its state.
-
-Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
-Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
-Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/power/main.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
-index 7a50af416cac8..9f25ae5b2dc62 100644
---- a/drivers/base/power/main.c
-+++ b/drivers/base/power/main.c
-@@ -690,8 +690,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
- 	if (dev->power.syscore || dev->power.direct_complete)
- 		goto Out;
- 
--	if (!dev->power.is_noirq_suspended)
-+	if (!dev->power.is_noirq_suspended) {
-+		/*
-+		 * This means that system suspend has been aborted in the noirq
-+		 * phase before invoking the noirq suspend callback for the
-+		 * device, so if device_suspend_late() has left it in suspend,
-+		 * device_resume_early() should leave it in suspend either in
-+		 * case the early resume of it depends on the noirq resume that
-+		 * has not run.
-+		 */
-+		if (dev_pm_skip_suspend(dev))
-+			dev->power.must_resume = false;
-+
- 		goto Out;
-+	}
- 
- 	if (!dpm_wait_for_superior(dev, async))
- 		goto Out;
--- 
-2.51.0
-
diff --git a/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch b/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
deleted file mode 100644
index 9339ff5dea..0000000000
--- a/queue-6.16/power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 54dc97eef66a0c1bdcd11b662bff68513319d641 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 18 Aug 2025 20:32:59 +0800
-Subject: power: supply: cw2015: Fix a alignment coding style issue
-
-From: Andy Yan <andyshrk@163.com>
-
-[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
-
-Fix the checkpatch warning:
-CHECK: Alignment should match open parenthesis
-
-Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
-Signed-off-by: Andy Yan <andyshrk@163.com>
-Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/power/supply/cw2015_battery.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
-index f63c3c4104515..382dff8805c62 100644
---- a/drivers/power/supply/cw2015_battery.c
-+++ b/drivers/power/supply/cw2015_battery.c
-@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
- 	if (!cw_bat->battery_workqueue)
- 		return -ENOMEM;
- 
--	devm_delayed_work_autocancel(&client->dev,
--							  &cw_bat->battery_delay_work, cw_bat_work);
-+	devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
- 	queue_delayed_work(cw_bat->battery_workqueue,
- 			   &cw_bat->battery_delay_work, msecs_to_jiffies(10));
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch b/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
deleted file mode 100644
index ed52f6285b..0000000000
--- a/queue-6.16/powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 47ef6e2bc554cfcb026d468b600dcdeeb5f80bed Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Aug 2025 08:30:18 +0200
-Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs
-
-From: Christophe Leroy <christophe.leroy@csgroup.eu>
-
-[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]
-
-Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
-PGDIRs and preallocate execmem page tables") was supposed to extend
-to powerpc 603 the copy of kernel PGD entries into all PGDIRs
-implemented in a previous patch on the 8xx. But 603 is book3s/32 and
-uses a duplicate of pgd_alloc() defined in another header.
-
-So really do the copy at the correct place for the 603.
-
-Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
-Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
-Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
-Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
- arch/powerpc/include/asm/nohash/pgalloc.h    |  2 +-
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
-index dd4eb30631758..f4390704d5ba2 100644
---- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
-+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
-@@ -7,8 +7,14 @@
- 
- static inline pgd_t *pgd_alloc(struct mm_struct *mm)
- {
--	return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
--			pgtable_gfp_flags(mm, GFP_KERNEL));
-+	pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
-+				      pgtable_gfp_flags(mm, GFP_KERNEL));
-+
-+#ifdef CONFIG_PPC_BOOK3S_603
-+	memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
-+	       (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
-+#endif
-+	return pgd;
- }
- 
- static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
-diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
-index bb5f3e8ea912d..4ef780b291bc3 100644
---- a/arch/powerpc/include/asm/nohash/pgalloc.h
-+++ b/arch/powerpc/include/asm/nohash/pgalloc.h
-@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
- 	pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
- 			pgtable_gfp_flags(mm, GFP_KERNEL));
- 
--#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
-+#ifdef CONFIG_PPC_8xx
- 	memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
- 	       (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
- #endif
--- 
-2.51.0
-
diff --git a/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch b/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch
deleted file mode 100644
index 2c00e1a026..0000000000
--- a/queue-6.16/powerpc-8xx-remove-left-over-instruction-and-comment.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 52dc3e52139882c0f2430f5b3e6569ecf24bbe43 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 16 Aug 2025 18:33:26 +0200
-Subject: powerpc/8xx: Remove left-over instruction and comments in
- DataStoreTLBMiss handler
-
-From: Christophe Leroy <christophe.leroy@csgroup.eu>
-
-[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]
-
-Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
-DTLB misses") removed the test that needed the valeur in SPRN_EPN but
-failed to remove the read.
-
-Remove it.
-
-And remove related comments, including the very same comment
-in InstructionTLBMiss that should have been removed by
-commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
-ITLB misses").
-
-Also update the comment about absence of a second level table which
-has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
-remove tests on PGDIR entry validity").
-
-Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
-Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
-Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
-Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/kernel/head_8xx.S | 9 +--------
- 1 file changed, 1 insertion(+), 8 deletions(-)
-
-diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
-index 56c5ebe21b99a..613606400ee99 100644
---- a/arch/powerpc/kernel/head_8xx.S
-+++ b/arch/powerpc/kernel/head_8xx.S
-@@ -162,7 +162,7 @@ instruction_counter:
-  * For the MPC8xx, this is a software tablewalk to load the instruction
-  * TLB.  The task switch loads the M_TWB register with the pointer to the first
-  * level table.
-- * If we discover there is no second level table (value is zero) or if there
-+ * If there is no second level table (value is zero) or if there
-  * is an invalid pte, we load that into the TLB, which causes another fault
-  * into the TLB Error interrupt where we can handle such problems.
-  * We have to use the MD_xxx registers for the tablewalk because the
-@@ -183,9 +183,6 @@ instruction_counter:
- 	mtspr	SPRN_SPRG_SCRATCH2, r10
- 	mtspr	SPRN_M_TW, r11
- 
--	/* If we are faulting a kernel address, we have to use the
--	 * kernel page tables.
--	 */
- 	mfspr	r10, SPRN_SRR0	/* Get effective address of fault */
- 	INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
- 	mtspr	SPRN_MD_EPN, r10
-@@ -228,10 +225,6 @@ instruction_counter:
- 	mtspr	SPRN_SPRG_SCRATCH2, r10
- 	mtspr	SPRN_M_TW, r11
- 
--	/* If we are faulting a kernel address, we have to use the
--	 * kernel page tables.
--	 */
--	mfspr	r10, SPRN_MD_EPN
- 	mfspr	r10, SPRN_M_TWB	/* Get level 1 table */
- 	lwz	r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10)	/* Get level 1 entry */
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch b/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
deleted file mode 100644
index 636fc1c750..0000000000
--- a/queue-6.16/powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 82090854441c653641c40c031790f7da6c7fb598 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 10:27:38 -0400
-Subject: powerpc/ftrace: ensure ftrace record ops are always set for NOPs
-
-From: Joe Lawrence <joe.lawrence@redhat.com>
-
-[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ]
-
-When an ftrace call site is converted to a NOP, its corresponding
-dyn_ftrace record should have its ftrace_ops pointer set to
-ftrace_nop_ops.
-
-Correct the powerpc implementation to ensure the
-ftrace_rec_set_nop_ops() helper is called on all successful NOP
-initialization paths. This ensures all ftrace records are consistent
-before being handled by the ftrace core.
-
-Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
-Suggested-by: Naveen N Rao <naveen@kernel.org>
-Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
-Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
-Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
-Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
-index 6dca92d5a6e82..841d077e28251 100644
---- a/arch/powerpc/kernel/trace/ftrace.c
-+++ b/arch/powerpc/kernel/trace/ftrace.c
-@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
- 		return ret;
- 
- 	/* Set up out-of-line stub */
--	if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE))
--		return ftrace_init_ool_stub(mod, rec);
-+	if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) {
-+		ret = ftrace_init_ool_stub(mod, rec);
-+		goto out;
-+	}
- 
- 	/* Nop-out the ftrace location */
- 	new = ppc_inst(PPC_RAW_NOP());
-@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
- 		return -EINVAL;
- 	}
- 
-+out:
-+	if (!ret)
-+		ret = ftrace_rec_set_nop_ops(rec);
-+
- 	return ret;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch b/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
deleted file mode 100644
index bc1e3baabd..0000000000
--- a/queue-6.16/powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 84ac9169b524c175717af72705912ec4f0a6b770 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 10:27:39 -0400
-Subject: powerpc64/modules: correctly iterate over stubs in
- setup_ftrace_ool_stubs
-
-From: Joe Lawrence <joe.lawrence@redhat.com>
-
-[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ]
-
-CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to
-extend the ppc64le module .stubs section with an array of
-ftrace_ool_stub structures for each patchable function.
-
-Fix its ppc64_stub_entry stub reservation loop to properly write across
-all of the num_stubs used and not just the first entry.
-
-Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
-Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
-Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
-Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
-Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/powerpc/kernel/module_64.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
-index 126bf3b06ab7e..0e45cac4de76b 100644
---- a/arch/powerpc/kernel/module_64.c
-+++ b/arch/powerpc/kernel/module_64.c
-@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr,
- 
- 	/* reserve stubs */
- 	for (i = 0; i < num_stubs; i++)
--		if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP()))
-+		if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP()))
- 			return -1;
- #endif
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch b/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch
deleted file mode 100644
index 53bfb84673..0000000000
--- a/queue-6.16/pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From ba7b282d8c3d9318721e68a6e4bf3cff0c5a0880 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 30 Aug 2025 15:50:23 +0800
-Subject: pps: fix warning in pps_register_cdev when register device fail
-
-From: Wang Liang <wangliang74@huawei.com>
-
-[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
-
-Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
-handling in __video_register_device()"), the release hook should be set
-before device_register(). Otherwise, when device_register() return error
-and put_device() try to callback the release function, the below warning
-may happen.
-
-  ------------[ cut here ]------------
-  WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
-  Modules linked in:
-  CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
-  RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
-  Call Trace:
-   <TASK>
-   kobject_cleanup+0x136/0x410 lib/kobject.c:689
-   kobject_release lib/kobject.c:720 [inline]
-   kref_put include/linux/kref.h:65 [inline]
-   kobject_put+0xe9/0x130 lib/kobject.c:737
-   put_device+0x24/0x30 drivers/base/core.c:3797
-   pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
-   pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
-   pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
-   tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
-   tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
-   tiocsetd drivers/tty/tty_io.c:2429 [inline]
-   tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
-   vfs_ioctl fs/ioctl.c:51 [inline]
-   __do_sys_ioctl fs/ioctl.c:598 [inline]
-   __se_sys_ioctl fs/ioctl.c:584 [inline]
-   __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
-   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
-   do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
-   entry_SYSCALL_64_after_hwframe+0x76/0x7e
-   </TASK>
-
-Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
-pps_register_cdev() call device_create() to create pps->dev, which will
-init dev->release to device_create_release(). Now the comment is outdated,
-just remove it.
-
-Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
-in pps_register_source() to avoid a double free in the failure case.
-
-Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
-Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
-Signed-off-by: Wang Liang <wangliang74@huawei.com>
-Reviewed-By: Calvin Owens <calvin@wbinvd.org>
-Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pps/kapi.c | 5 +----
- drivers/pps/pps.c  | 5 ++---
- 2 files changed, 3 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
-index 92d1b62ea239d..e9389876229ea 100644
---- a/drivers/pps/kapi.c
-+++ b/drivers/pps/kapi.c
-@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
- 	if (err < 0) {
- 		pr_err("%s: unable to create char device\n",
- 					info->name);
--		goto kfree_pps;
-+		goto pps_register_source_exit;
- 	}
- 
- 	dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
- 
- 	return pps;
- 
--kfree_pps:
--	kfree(pps);
--
- pps_register_source_exit:
- 	pr_err("%s: unable to register source\n", info->name);
- 
-diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
-index 9463232af8d2e..c6b8b64782761 100644
---- a/drivers/pps/pps.c
-+++ b/drivers/pps/pps.c
-@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
- 			       pps->info.name);
- 			err = -EBUSY;
- 		}
-+		kfree(pps);
- 		goto out_unlock;
- 	}
- 	pps->id = err;
-@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
- 	pps->dev.devt = MKDEV(pps_major, pps->id);
- 	dev_set_drvdata(&pps->dev, pps);
- 	dev_set_name(&pps->dev, "pps%d", pps->id);
-+	pps->dev.release = pps_device_destruct;
- 	err = device_register(&pps->dev);
- 	if (err)
- 		goto free_idr;
- 
--	/* Override the release function with our own */
--	pps->dev.release = pps_device_destruct;
--
- 	pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
- 		 pps->id);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch b/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch
deleted file mode 100644
index 178dbe7a2e..0000000000
--- a/queue-6.16/ptp-add-a-upper-bound-on-max_vclocks.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 2161b8f891ec7bd2a4b32f051c92a8ea2afaa244 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 21:29:08 +0530
-Subject: ptp: Add a upper bound on max_vclocks
-
-From: I Viswanath <viswanathiyyappan@gmail.com>
-
-[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]
-
-syzbot reported WARNING in max_vclocks_store.
-
-This occurs when the argument max is too large for kcalloc to handle.
-
-Extend the guard to guard against values that are too large for
-kcalloc
-
-Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
-Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
-Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
-Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
-Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
-Acked-by: Richard Cochran <richardcochran@gmail.com>
-Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ptp/ptp_private.h | 1 +
- drivers/ptp/ptp_sysfs.c   | 2 +-
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
-index b352df4cd3f97..f329263f33aa1 100644
---- a/drivers/ptp/ptp_private.h
-+++ b/drivers/ptp/ptp_private.h
-@@ -22,6 +22,7 @@
- #define PTP_MAX_TIMESTAMPS 128
- #define PTP_BUF_TIMESTAMPS 30
- #define PTP_DEFAULT_MAX_VCLOCKS 20
-+#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
- #define PTP_MAX_CHANNELS 2048
- 
- enum {
-diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
-index 6b1b8f57cd951..200eaf5006968 100644
---- a/drivers/ptp/ptp_sysfs.c
-+++ b/drivers/ptp/ptp_sysfs.c
-@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
- 	size_t size;
- 	u32 max;
- 
--	if (kstrtou32(buf, 0, &max) || max == 0)
-+	if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
- 		return -EINVAL;
- 
- 	if (max == ptp->max_vclocks)
--- 
-2.51.0
-
diff --git a/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch b/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
deleted file mode 100644
index 5527c031de..0000000000
--- a/queue-6.16/pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 069b1b06b52afc035e610ca52140d649c7448455 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 18:00:59 +0200
-Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-
-[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]
-
-The pwm driver calls pm_runtime_get_sync() when the hardware becomes
-enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
-state is kept when a consumer goes away, so the call to
-pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
-a non-functional device and a reference underlow for the second consumer.
-
-The easiest fix for that issue is to just not drop the runtime PM
-reference in .free(), so do that.
-
-Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
-Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com
-Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pwm/pwm-tiehrpwm.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
-index 0125e73b98dfb..5e674a7bbf3be 100644
---- a/drivers/pwm/pwm-tiehrpwm.c
-+++ b/drivers/pwm/pwm-tiehrpwm.c
-@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
- {
- 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
- 
--	if (pwm_is_enabled(pwm)) {
--		dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
--		pm_runtime_put_sync(pwmchip_parent(chip));
--	}
--
- 	/* set period value to zero on free */
- 	pc->period_cycles[pwm->hwpwm] = 0;
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch b/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
deleted file mode 100644
index 013105553d..0000000000
--- a/queue-6.16/pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From af981354d8c58afad1a5202a3cf34de1c1ab3d87 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 18:01:02 +0200
-Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-
-[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
-
-The function set_prescale_div() is responsible for calculating the clock
-divisor settings such that the input clock rate is divided down such that
-the required period length is at most 0x10000 clock ticks. If period_cycles
-is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
-good enough. So round up in the calculation of the required divisor and
-compare it using >= instead of >.
-
-Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
-Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
-Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pwm/pwm-tiehrpwm.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
-index a23e48b8523db..7a86cb090f76f 100644
---- a/drivers/pwm/pwm-tiehrpwm.c
-+++ b/drivers/pwm/pwm-tiehrpwm.c
-@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
- 
- 			*prescale_div = (1 << clkdiv) *
- 					(hspclkdiv ? (hspclkdiv * 2) : 1);
--			if (*prescale_div > rqst_prescaler) {
-+			if (*prescale_div >= rqst_prescaler) {
- 				*tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
- 					(hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
- 				return 0;
-@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
- 	pc->period_cycles[pwm->hwpwm] = period_cycles;
- 
- 	/* Configure clock prescaler to support Low frequency PWM wave */
--	if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
-+	if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
- 			     &tb_divval)) {
- 		dev_err(pwmchip_parent(chip), "Unsupported values\n");
- 		return -EINVAL;
--- 
-2.51.0
-
diff --git a/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch b/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
deleted file mode 100644
index e6df9a24d6..0000000000
--- a/queue-6.16/pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
+++ /dev/null
@@ -1,279 +0,0 @@
-From fc22efba86f3800689b9f09eace61d3285286a49 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 18:01:01 +0200
-Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
- calculation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-
-[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]
-
-In Up-Count Mode the timer is reset to zero one tick after it reaches
-TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
-the documentation and measurements. So the value written to the TBPRD has
-to be one less than the calculated period_cycles value.
-
-A complication here is that for a 100% relative duty-cycle the value
-written to the CMPx register has to be TBPRD + 1 which might overflow if
-TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
-has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
-be skipped.
-
-Additionally the AQCTL_PRD register field has to be 0 because that defines
-the hardware's action when the maximal counter value is reached, which is
-(as above) one clock tick before the period's end. The period start edge
-has to happen when the counter is reset and so is defined in the AQCTL_ZRO
-field.
-
-Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
-Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com
-Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
- 1 file changed, 58 insertions(+), 85 deletions(-)
-
-diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
-index a94b1e387b924..a23e48b8523db 100644
---- a/drivers/pwm/pwm-tiehrpwm.c
-+++ b/drivers/pwm/pwm-tiehrpwm.c
-@@ -36,7 +36,7 @@
- 
- #define CLKDIV_MAX		7
- #define HSPCLKDIV_MAX		7
--#define PERIOD_MAX		0xFFFF
-+#define PERIOD_MAX		0x10000
- 
- /* compare module registers */
- #define CMPA			0x12
-@@ -65,14 +65,10 @@
- #define AQCTL_ZRO_FRCHIGH	BIT(1)
- #define AQCTL_ZRO_FRCTOGGLE	(BIT(1) | BIT(0))
- 
--#define AQCTL_CHANA_POLNORMAL	(AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
--				AQCTL_ZRO_FRCHIGH)
--#define AQCTL_CHANA_POLINVERSED	(AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
--				AQCTL_ZRO_FRCLOW)
--#define AQCTL_CHANB_POLNORMAL	(AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
--				AQCTL_ZRO_FRCHIGH)
--#define AQCTL_CHANB_POLINVERSED	(AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
--				AQCTL_ZRO_FRCLOW)
-+#define AQCTL_CHANA_POLNORMAL	(AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
-+#define AQCTL_CHANA_POLINVERSED	(AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
-+#define AQCTL_CHANB_POLNORMAL	(AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
-+#define AQCTL_CHANB_POLINVERSED	(AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
- 
- #define AQSFRC_RLDCSF_MASK	(BIT(7) | BIT(6))
- #define AQSFRC_RLDCSF_ZRO	0
-@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
- 	unsigned long clk_rate;
- 	void __iomem *mmio_base;
- 	unsigned long period_cycles[NUM_PWM_CHANNEL];
--	enum pwm_polarity polarity[NUM_PWM_CHANNEL];
- 	struct clk *tbclk;
- 	struct ehrpwm_context ctx;
- };
-@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
- 	return 1;
- }
- 
--static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
--{
--	u16 aqctl_val, aqctl_mask;
--	unsigned int aqctl_reg;
--
--	/*
--	 * Configure PWM output to HIGH/LOW level on counter
--	 * reaches compare register value and LOW/HIGH level
--	 * on counter value reaches period register value and
--	 * zero value on counter
--	 */
--	if (chan == 1) {
--		aqctl_reg = AQCTLB;
--		aqctl_mask = AQCTL_CBU_MASK;
--
--		if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
--			aqctl_val = AQCTL_CHANB_POLINVERSED;
--		else
--			aqctl_val = AQCTL_CHANB_POLNORMAL;
--	} else {
--		aqctl_reg = AQCTLA;
--		aqctl_mask = AQCTL_CAU_MASK;
--
--		if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
--			aqctl_val = AQCTL_CHANA_POLINVERSED;
--		else
--			aqctl_val = AQCTL_CHANA_POLNORMAL;
--	}
--
--	aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
--	ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
--}
--
- /*
-  * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
-  * duty_ns   = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
-  */
- static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
--			     u64 duty_ns, u64 period_ns)
-+			     u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
- {
- 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
- 	u32 period_cycles, duty_cycles;
- 	u16 ps_divval, tb_divval;
- 	unsigned int i, cmp_reg;
- 	unsigned long long c;
-+	u16 aqctl_val, aqctl_mask;
-+	unsigned int aqctl_reg;
- 
- 	if (period_ns > NSEC_PER_SEC)
- 		return -ERANGE;
-@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
- 	do_div(c, NSEC_PER_SEC);
- 	period_cycles = (unsigned long)c;
- 
--	if (period_cycles < 1) {
--		period_cycles = 1;
--		duty_cycles = 1;
--	} else {
--		c = pc->clk_rate;
--		c = c * duty_ns;
--		do_div(c, NSEC_PER_SEC);
--		duty_cycles = (unsigned long)c;
--	}
-+	c = pc->clk_rate;
-+	c = c * duty_ns;
-+	do_div(c, NSEC_PER_SEC);
-+	duty_cycles = (unsigned long)c;
- 
- 	/*
- 	 * Period values should be same for multiple PWM channels as IP uses
-@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
- 		return -EINVAL;
- 	}
- 
--	pm_runtime_get_sync(pwmchip_parent(chip));
--
--	/* Update clock prescaler values */
--	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
--
- 	/* Update period & duty cycle with presacler division */
- 	period_cycles = period_cycles / ps_divval;
- 	duty_cycles = duty_cycles / ps_divval;
- 
--	/* Configure shadow loading on Period register */
--	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
-+	if (period_cycles < 1)
-+		period_cycles = 1;
- 
--	ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
-+	pm_runtime_get_sync(pwmchip_parent(chip));
- 
--	/* Configure ehrpwm counter for up-count mode */
--	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
--		      TBCTL_CTRMODE_UP);
-+	/* Update clock prescaler values */
-+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
- 
--	if (pwm->hwpwm == 1)
-+	if (pwm->hwpwm == 1) {
- 		/* Channel 1 configured with compare B register */
- 		cmp_reg = CMPB;
--	else
-+
-+		aqctl_reg = AQCTLB;
-+		aqctl_mask = AQCTL_CBU_MASK;
-+
-+		if (polarity == PWM_POLARITY_INVERSED)
-+			aqctl_val = AQCTL_CHANB_POLINVERSED;
-+		else
-+			aqctl_val = AQCTL_CHANB_POLNORMAL;
-+
-+		/* if duty_cycle is big, don't toggle on CBU */
-+		if (duty_cycles > period_cycles)
-+			aqctl_val &= ~AQCTL_CBU_MASK;
-+
-+	} else {
- 		/* Channel 0 configured with compare A register */
- 		cmp_reg = CMPA;
- 
--	ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
-+		aqctl_reg = AQCTLA;
-+		aqctl_mask = AQCTL_CAU_MASK;
- 
--	pm_runtime_put_sync(pwmchip_parent(chip));
-+		if (polarity == PWM_POLARITY_INVERSED)
-+			aqctl_val = AQCTL_CHANA_POLINVERSED;
-+		else
-+			aqctl_val = AQCTL_CHANA_POLNORMAL;
- 
--	return 0;
--}
-+		/* if duty_cycle is big, don't toggle on CAU */
-+		if (duty_cycles > period_cycles)
-+			aqctl_val &= ~AQCTL_CAU_MASK;
-+	}
- 
--static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
--				   struct pwm_device *pwm,
--				   enum pwm_polarity polarity)
--{
--	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
-+	aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
-+	ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
-+
-+	/* Configure shadow loading on Period register */
-+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
-+
-+	ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
-+
-+	/* Configure ehrpwm counter for up-count mode */
-+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
-+		      TBCTL_CTRMODE_UP);
-+
-+	if (!(duty_cycles > period_cycles))
-+		ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
- 
--	/* Configuration of polarity in hardware delayed, do at enable */
--	pc->polarity[pwm->hwpwm] = polarity;
-+	pm_runtime_put_sync(pwmchip_parent(chip));
- 
- 	return 0;
- }
-@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
- 
- 	ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
- 
--	/* Channels polarity can be configured from action qualifier module */
--	configure_polarity(pc, pwm->hwpwm);
--
- 	/* Enable TBCLK */
- 	ret = clk_enable(pc->tbclk);
- 	if (ret) {
-@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
- 			ehrpwm_pwm_disable(chip, pwm);
- 			enabled = false;
- 		}
--
--		err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
--		if (err)
--			return err;
- 	}
- 
- 	if (!state->enabled) {
-@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
- 		return 0;
- 	}
- 
--	err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
-+	err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
- 	if (err)
- 		return err;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch b/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
deleted file mode 100644
index 6d70596ab2..0000000000
--- a/queue-6.16/pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 81392e5367d2a4298e998730c7d3dd75b9d7be38 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 18:01:00 +0200
-Subject: pwm: tiehrpwm: Make code comment in .free() more useful
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-
-[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]
-
-Instead of explaining trivia to everyone who can read C describe the
-higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.
-
-Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
-Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
-Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com
-Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pwm/pwm-tiehrpwm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
-index 5e674a7bbf3be..a94b1e387b924 100644
---- a/drivers/pwm/pwm-tiehrpwm.c
-+++ b/drivers/pwm/pwm-tiehrpwm.c
-@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
- {
- 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
- 
--	/* set period value to zero on free */
-+	/* Don't let a pwm without consumer block requests to the other channel */
- 	pc->period_cycles[pwm->hwpwm] = 0;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch b/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch
deleted file mode 100644
index 6e4cb6bc9a..0000000000
--- a/queue-6.16/raid6-riscv-clean-up-unused-header-file-inclusion.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 615ab6b2ae8a2b8340a93f5df6abbb7344be83e2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 18 Jul 2025 15:27:07 +0800
-Subject: raid6: riscv: Clean up unused header file inclusion
-
-From: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
-
-[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ]
-
-These two C files don't reference things defined in simd.h or types.h
-so remove these redundant #inclusions.
-
-Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations")
-Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
-Signed-off-by: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
-Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
-Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn
-Signed-off-by: Paul Walmsley <pjw@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- lib/raid6/recov_rvv.c | 2 --
- lib/raid6/rvv.c       | 3 ---
- 2 files changed, 5 deletions(-)
-
-diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c
-index f29303795ccfe..500da521a8063 100644
---- a/lib/raid6/recov_rvv.c
-+++ b/lib/raid6/recov_rvv.c
-@@ -4,9 +4,7 @@
-  * Author: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
-  */
- 
--#include <asm/simd.h>
- #include <asm/vector.h>
--#include <crypto/internal/simd.h>
- #include <linux/raid/pq.h>
- 
- static int rvv_has_vector(void)
-diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c
-index 7d82efa5b14f9..b193ea176d5d3 100644
---- a/lib/raid6/rvv.c
-+++ b/lib/raid6/rvv.c
-@@ -9,11 +9,8 @@
-  *	Copyright 2002-2004 H. Peter Anvin
-  */
- 
--#include <asm/simd.h>
- #include <asm/vector.h>
--#include <crypto/internal/simd.h>
- #include <linux/raid/pq.h>
--#include <linux/types.h>
- #include "rvv.h"
- 
- #define NSIZE	(riscv_v_vsize / 32) /* NSIZE = vlenb */
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch b/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
deleted file mode 100644
index 3c9071fbf0..0000000000
--- a/queue-6.16/rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 22414da3ca108d561fe54f14d611b5f8907872bb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 12:05:20 +0200
-Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: HÃ¥kon Bugge <haakon.bugge@oracle.com>
-
-[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
-
-When the destroy CM ID timeout kicks in, you typically get a storm of
-them which creates a log flooding. Hence, change pr_err() to
-pr_err_ratelimited() in cm_destroy_id_wait_timeout().
-
-Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
-Signed-off-by: HÃ¥kon Bugge <haakon.bugge@oracle.com>
-Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
-Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
-Signed-off-by: Leon Romanovsky <leon@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/cm.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
-index 8670e58675c6d..75b2911462628 100644
---- a/drivers/infiniband/core/cm.c
-+++ b/drivers/infiniband/core/cm.c
-@@ -1034,8 +1034,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
- 	struct cm_id_private *cm_id_priv;
- 
- 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
--	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
--	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
-+	pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
-+			   cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
- }
- 
- static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch b/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
deleted file mode 100644
index 5052fe6fcc..0000000000
--- a/queue-6.16/rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 58d684f9dc1caeb7bfc9d9877d5af2fa2d1c46f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 14:11:01 +0300
-Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
-
-From: Parav Pandit <parav@nvidia.com>
-
-[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
-
-Currently, if the next-hop netdevice does not support ARP resolution,
-the destination MAC address is silently set to zero without reporting
-an error. This leads to incorrect behavior and may result in packet
-transmission failures.
-
-Fix this by deferring MAC resolution to the IP stack via neighbour
-lookup, allowing proper resolution or error reporting as appropriate.
-
-Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
-Signed-off-by: Parav Pandit <parav@nvidia.com>
-Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
-Signed-off-by: Edward Srouji <edwards@nvidia.com>
-Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
-Signed-off-by: Leon Romanovsky <leon@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/addr.c | 10 +++-------
- 1 file changed, 3 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
-index be0743dac3fff..929e89841c12a 100644
---- a/drivers/infiniband/core/addr.c
-+++ b/drivers/infiniband/core/addr.c
-@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
- {
- 	int ret = 0;
- 
--	if (ndev_flags & IFF_LOOPBACK) {
-+	if (ndev_flags & IFF_LOOPBACK)
- 		memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
--	} else {
--		if (!(ndev_flags & IFF_NOARP)) {
--			/* If the device doesn't do ARP internally */
--			ret = fetch_ha(dst, addr, dst_in, seq);
--		}
--	}
-+	else
-+		ret = fetch_ha(dst, addr, dst_in, seq);
- 	return ret;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch b/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
deleted file mode 100644
index 2bb6c21eb6..0000000000
--- a/queue-6.16/rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 5afe228318475b91eddbd6ba8ae8b86018c48a31 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 15:39:56 +0300
-Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Or Har-Toov <ohartoov@nvidia.com>
-
-[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]
-
-The mlx5 driver currently derives max_qp_wr directly from the
-log_max_qp_sz HCA capability:
-
-    props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-
-However, this value represents the number of WQEs in units of Basic
-Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs.  Since the size
-of a WQE can vary depending on transport type and features (e.g., atomic
-operations, UMR, LSO), the actual number of WQEs can be significantly
-smaller than the WQEBB count suggests.
-
-This patch introduces a conservative estimation of the worst-case WQE size
-— considering largest segments possible with 1 SGE and no inline data or
-special features. It uses this to derive a more accurate max_qp_wr value.
-
-Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
-Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org
-Reported-by: Chuck Lever <cel@kernel.org>
-Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/
-Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
-Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
- 1 file changed, 47 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
-index df6557ddbdfc5..fdc4306878615 100644
---- a/drivers/infiniband/hw/mlx5/main.c
-+++ b/drivers/infiniband/hw/mlx5/main.c
-@@ -13,6 +13,7 @@
- #include <linux/dma-mapping.h>
- #include <linux/slab.h>
- #include <linux/bitmap.h>
-+#include <linux/log2.h>
- #include <linux/sched.h>
- #include <linux/sched/mm.h>
- #include <linux/sched/task.h>
-@@ -882,6 +883,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
- 	resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
- }
- 
-+/*
-+ * Calculate maximum SQ overhead across all QP types.
-+ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
-+ * have smaller overhead than the types calculated below,
-+ * so they are implicitly included.
-+ */
-+static u32 mlx5_ib_calc_max_sq_overhead(void)
-+{
-+	u32 max_overhead_xrc, overhead_ud_lso, a, b;
-+
-+	/* XRC_INI */
-+	max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
-+	max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
-+	a = sizeof(struct mlx5_wqe_atomic_seg) +
-+	    sizeof(struct mlx5_wqe_raddr_seg);
-+	b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
-+	    sizeof(struct mlx5_mkey_seg) +
-+	    MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
-+	max_overhead_xrc += max(a, b);
-+
-+	/* UD with LSO */
-+	overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
-+	overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
-+	overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
-+	overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
-+
-+	return max(max_overhead_xrc, overhead_ud_lso);
-+}
-+
-+static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
-+{
-+	struct mlx5_core_dev *mdev = dev->mdev;
-+	u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-+	u32 max_wqe_size;
-+	/* max QP overhead + 1 SGE, no inline, no special features */
-+	max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
-+		       sizeof(struct mlx5_wqe_data_seg);
-+
-+	max_wqe_size = roundup_pow_of_two(max_wqe_size);
-+
-+	max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
-+
-+	return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
-+}
-+
- static int mlx5_ib_query_device(struct ib_device *ibdev,
- 				struct ib_device_attr *props,
- 				struct ib_udata *uhw)
-@@ -1040,7 +1086,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
- 	props->max_mr_size	   = ~0ull;
- 	props->page_size_cap	   = ~(min_page_size - 1);
- 	props->max_qp		   = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
--	props->max_qp_wr	   = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-+	props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
- 	max_rq_sg =  MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
- 		     sizeof(struct mlx5_wqe_data_seg);
- 	max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
deleted file mode 100644
index 066b2d2edb..0000000000
--- a/queue-6.16/rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From e4b6da443b44a29101ce59bd090e061cd8bca96e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 15:41:19 +0300
-Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device
-
-From: Patrisious Haddad <phaddad@nvidia.com>
-
-[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
-
-Previously loopback for MPV was supposed to be permanently enabled,
-however other driver flows were able to over-ride that configuration and
-disable it.
-
-Add force_lb parameter that indicates that loopback should always be
-enabled which prevents all other driver flows from disabling it.
-
-Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
-Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
-Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
-Reviewed-by: Mark Bloch <mbloch@nvidia.com>
-Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/hw/mlx5/main.c    | 19 +++++++++++++++----
- drivers/infiniband/hw/mlx5/mlx5_ib.h |  1 +
- 2 files changed, 16 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
-index fdc4306878615..268ebf6609708 100644
---- a/drivers/infiniband/hw/mlx5/main.c
-+++ b/drivers/infiniband/hw/mlx5/main.c
-@@ -1838,7 +1838,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
- }
- 
- static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
--				struct mlx5_core_dev *slave)
-+				struct mlx5_core_dev *slave,
-+				struct mlx5_ib_lb_state *lb_state)
- {
- 	int err;
- 
-@@ -1850,6 +1851,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
- 	if (err)
- 		goto out;
- 
-+	lb_state->force_enable = true;
- 	return 0;
- 
- out:
-@@ -1858,16 +1860,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
- }
- 
- static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
--				  struct mlx5_core_dev *slave)
-+				  struct mlx5_core_dev *slave,
-+				  struct mlx5_ib_lb_state *lb_state)
- {
- 	mlx5_nic_vport_update_local_lb(slave, false);
- 	mlx5_nic_vport_update_local_lb(master, false);
-+
-+	lb_state->force_enable = false;
- }
- 
- int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
- {
- 	int err = 0;
- 
-+	if (dev->lb.force_enable)
-+		return 0;
-+
- 	mutex_lock(&dev->lb.mutex);
- 	if (td)
- 		dev->lb.user_td++;
-@@ -1889,6 +1897,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
- 
- void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
- {
-+	if (dev->lb.force_enable)
-+		return;
-+
- 	mutex_lock(&dev->lb.mutex);
- 	if (td)
- 		dev->lb.user_td--;
-@@ -3568,7 +3579,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
- 
- 	lockdep_assert_held(&mlx5_ib_multiport_mutex);
- 
--	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
-+	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
- 
- 	mlx5_core_mp_event_replay(ibdev->mdev,
- 				  MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
-@@ -3665,7 +3676,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
- 				  MLX5_DRIVER_EVENT_AFFILIATION_DONE,
- 				  &key);
- 
--	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
-+	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
- 	if (err)
- 		goto unbind;
- 
-diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
-index fde859d207aea..030b7c2b109b1 100644
---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
-+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
-@@ -1113,6 +1113,7 @@ struct mlx5_ib_lb_state {
- 	u32			user_td;
- 	int			qps;
- 	bool			enabled;
-+	bool			force_enable;
- };
- 
- struct mlx5_ib_pf_eq {
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch b/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch
deleted file mode 100644
index 3540c4a9a5..0000000000
--- a/queue-6.16/rdma-rxe-fix-race-in-do_task-when-draining.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 937d7c49a673c238bcd9c95cdca3d8e78036ec26 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 02:52:12 +0000
-Subject: RDMA/rxe: Fix race in do_task() when draining
-
-From: Gui-Dong Han <hanguidong02@gmail.com>
-
-[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
-
-When do_task() exhausts its iteration budget (!ret), it sets the state
-to TASK_STATE_IDLE to reschedule, without a secondary check on the
-current task->state. This can overwrite the TASK_STATE_DRAINING state
-set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
-
-While state changes are protected by a spinlock, both rxe_cleanup_task()
-and rxe_disable_task() release the lock while waiting for the task to
-finish draining in the while(!is_done(task)) loop. The race occurs if
-do_task() hits its iteration limit and acquires the lock in this window.
-The cleanup logic may then proceed while the task incorrectly
-reschedules itself, leading to a potential use-after-free.
-
-This bug was introduced during the migration from tasklets to workqueues,
-where the special handling for the draining case was lost.
-
-Fix this by restoring the original pre-migration behavior. If the state is
-TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
-force a new loop iteration. This allows the task to finish its work, so
-that a subsequent iteration can reach the switch statement and correctly
-transition the state to TASK_STATE_DRAINED, stopping the task as intended.
-
-Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
-Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
-Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
-Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
-Signed-off-by: Leon Romanovsky <leon@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
-index 6f8f353e95838..f522820b950c7 100644
---- a/drivers/infiniband/sw/rxe/rxe_task.c
-+++ b/drivers/infiniband/sw/rxe/rxe_task.c
-@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
- 		 * yield the cpu and reschedule the task
- 		 */
- 		if (!ret) {
--			task->state = TASK_STATE_IDLE;
--			resched = 1;
-+			if (task->state != TASK_STATE_DRAINING) {
-+				task->state = TASK_STATE_IDLE;
-+				resched = 1;
-+			} else {
-+				cont = 1;
-+			}
- 			goto exit;
- 		}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch b/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch
deleted file mode 100644
index 7a51641efd..0000000000
--- a/queue-6.16/rdma-siw-always-report-immediate-post-sq-errors.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 1bac02a368a9b5ea9cb92e3b72485675058a4b75 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 23 Sep 2025 16:45:36 +0200
-Subject: RDMA/siw: Always report immediate post SQ errors
-
-From: Bernard Metzler <bernard.metzler@linux.dev>
-
-[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
-
-In siw_post_send(), any immediate error encountered during processing of
-the work request list must be reported to the caller, even if previous
-work requests in that list were just accepted and added to the send queue.
-
-Not reporting those errors confuses the caller, which would wait
-indefinitely for the failing and potentially subsequently aborted work
-requests completion.
-
-This fixes a case where immediate errors were overwritten by subsequent
-code in siw_post_send().
-
-Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
-Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
-Suggested-by: Stefan Metzmacher <metze@samba.org>
-Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
-Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
- 1 file changed, 14 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
-index 2b2a7b8e93b01..3acb23d13729d 100644
---- a/drivers/infiniband/sw/siw/siw_verbs.c
-+++ b/drivers/infiniband/sw/siw/siw_verbs.c
-@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
- 	struct siw_wqe *wqe = tx_wqe(qp);
- 
- 	unsigned long flags;
--	int rv = 0;
-+	int rv = 0, imm_err = 0;
- 
- 	if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
- 		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
-@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
- 	 * Send directly if SQ processing is not in progress.
- 	 * Eventual immediate errors (rv < 0) do not affect the involved
- 	 * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
--	 * processing, if new work is already pending. But rv must be passed
--	 * to caller.
-+	 * processing, if new work is already pending. But rv and pointer
-+	 * to failed work request must be passed to caller.
- 	 */
-+	if (unlikely(rv < 0)) {
-+		/*
-+		 * Immediate error
-+		 */
-+		siw_dbg_qp(qp, "Immediate error %d\n", rv);
-+		imm_err = rv;
-+		*bad_wr = wr;
-+	}
- 	if (wqe->wr_status != SIW_WR_IDLE) {
- 		spin_unlock_irqrestore(&qp->sq_lock, flags);
- 		goto skip_direct_sending;
-@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
- 
- 	up_read(&qp->state_lock);
- 
--	if (rv >= 0)
--		return 0;
--	/*
--	 * Immediate error
--	 */
--	siw_dbg_qp(qp, "error %d\n", rv);
-+	if (unlikely(imm_err))
-+		return imm_err;
- 
--	*bad_wr = wr;
--	return rv;
-+	return (rv >= 0) ? 0 : rv;
- }
- 
- /*
--- 
-2.51.0
-
diff --git a/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch b/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch
deleted file mode 100644
index 5952974ca9..0000000000
--- a/queue-6.16/regmap-remove-superfluous-check-for-config-in-__regm.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From e3fa6a892ccb28155c4ec83f7b6501e4e7965612 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 15:07:18 +0200
-Subject: regmap: Remove superfluous check for !config in __regmap_init()
-
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-
-[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
-
-The first thing __regmap_init() do is check if config is non-NULL,
-so there is no need to check for this again later.
-
-Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/regmap/regmap.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 1f3f782a04ba2..6883e1a43fe5d 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
- 		map->read_flag_mask = bus->read_flag_mask;
- 	}
- 
--	if (config && config->read && config->write) {
-+	if (config->read && config->write) {
- 		map->reg_read  = _regmap_bus_read;
- 		if (config->reg_update_bits)
- 			map->reg_update_bits = config->reg_update_bits;
--- 
-2.51.0
-
diff --git a/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch b/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch
deleted file mode 100644
index 3db4690db8..0000000000
--- a/queue-6.16/regulator-scmi-use-int-type-to-store-negative-error-.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 16b3a245820cb1b3b7d826c4bfd26c33d97d5981 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 18:14:11 +0800
-Subject: regulator: scmi: Use int type to store negative error codes
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
-
-Change the 'ret' variable from u32 to int to store negative error codes or
-zero returned by of_property_read_u32().
-
-Storing the negative error codes in unsigned type, doesn't cause an issue
-at runtime but it's ugly as pants. Additionally, assigning negative error
-codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
-flag is enabled.
-
-No effect on runtime.
-
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
-Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
-Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/regulator/scmi-regulator.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
-index 9df726f10ad12..6d609c42e4793 100644
---- a/drivers/regulator/scmi-regulator.c
-+++ b/drivers/regulator/scmi-regulator.c
-@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
- 					  struct device_node *np,
- 					  struct scmi_regulator_info *rinfo)
- {
--	u32 dom, ret;
-+	u32 dom;
-+	int ret;
- 
- 	ret = of_property_read_u32(np, "reg", &dom);
- 	if (ret)
--- 
-2.51.0
-
diff --git a/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch b/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
deleted file mode 100644
index b56d34fc85..0000000000
--- a/queue-6.16/remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 77ad1b9b943dd43cb662c6da1195382d680323f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 18:02:35 +0200
-Subject: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
-
-From: Stephan Gerhold <stephan.gerhold@linaro.org>
-
-[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ]
-
-The ADSP firmware on X1E has separate firmware binaries for the main
-firmware and the DTB. The same applies for the "lite" firmware loaded by
-the boot firmware.
-
-When preparing to load the new ADSP firmware we shutdown the lite_pas_id
-for the main firmware, but we don't shutdown the corresponding lite pas_id
-for the DTB. The fact that we're leaving it "running" forever becomes
-obvious if you try to reuse (or just access) the memory region used by the
-"lite" firmware: The &adsp_boot_mem is accessible, but accessing the
-&adsp_boot_dtb_mem results in a crash.
-
-We don't support reusing the memory regions currently, but nevertheless we
-should not keep part of the lite firmware running. Fix this by adding the
-lite_dtb_pas_id and shutting it down as well.
-
-We don't have a way to detect if the lite firmware is actually running yet,
-so ignore the return status of qcom_scm_pas_shutdown() for now. This was
-already the case before, the assignment to "ret" is not used anywhere.
-
-Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP")
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
-Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org
-Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
-index 02e29171cbbee..f3ec5b06261e8 100644
---- a/drivers/remoteproc/qcom_q6v5_pas.c
-+++ b/drivers/remoteproc/qcom_q6v5_pas.c
-@@ -42,6 +42,7 @@ struct qcom_pas_data {
- 	int pas_id;
- 	int dtb_pas_id;
- 	int lite_pas_id;
-+	int lite_dtb_pas_id;
- 	unsigned int minidump_id;
- 	bool auto_boot;
- 	bool decrypt_shutdown;
-@@ -80,6 +81,7 @@ struct qcom_pas {
- 	int pas_id;
- 	int dtb_pas_id;
- 	int lite_pas_id;
-+	int lite_dtb_pas_id;
- 	unsigned int minidump_id;
- 	int crash_reason_smem;
- 	unsigned int smem_host_id;
-@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw)
- 
- 	if (pas->lite_pas_id)
- 		ret = qcom_scm_pas_shutdown(pas->lite_pas_id);
-+	if (pas->lite_dtb_pas_id)
-+		qcom_scm_pas_shutdown(pas->lite_dtb_pas_id);
- 
- 	if (pas->dtb_pas_id) {
- 		ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
-@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev)
- 	pas->minidump_id = desc->minidump_id;
- 	pas->pas_id = desc->pas_id;
- 	pas->lite_pas_id = desc->lite_pas_id;
-+	pas->lite_dtb_pas_id = desc->lite_dtb_pas_id;
- 	pas->info_name = desc->sysmon_name;
- 	pas->smem_host_id = desc->smem_host_id;
- 	pas->decrypt_shutdown = desc->decrypt_shutdown;
-@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = {
- 	.pas_id = 1,
- 	.dtb_pas_id = 0x24,
- 	.lite_pas_id = 0x1f,
-+	.lite_dtb_pas_id = 0x29,
- 	.minidump_id = 5,
- 	.auto_boot = true,
- 	.proxy_pd_names = (char*[]){
--- 
-2.51.0
-
diff --git a/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch b/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
deleted file mode 100644
index c806ca8481..0000000000
--- a/queue-6.16/remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 6b5470d23ef54a8c34f43fc94dde8bc530860cf6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 18:02:33 +0200
-Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
-
-From: Stephan Gerhold <stephan.gerhold@linaro.org>
-
-[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
-
-enable_irq() and disable_irq() are reference counted, so we must make sure
-that each enable_irq() is always paired with a single disable_irq(). If we
-call disable_irq() twice followed by just a single enable_irq(), the IRQ
-will remain disabled forever.
-
-For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
-will end up being called twice, because disable_irq() also happens in
-qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
-
-Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
-qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
-sense to have the rollback handled always by qcom_q6v5_unprepare().
-
-Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
-Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
-Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/remoteproc/qcom_q6v5.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
-index 4ee5e67a9f03f..769c6d6d6a731 100644
---- a/drivers/remoteproc/qcom_q6v5.c
-+++ b/drivers/remoteproc/qcom_q6v5.c
-@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
- 	int ret;
- 
- 	ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
--	if (!ret)
--		disable_irq(q6v5->handover_irq);
--
- 	return !ret ? -ETIMEDOUT : 0;
- }
- EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
--- 
-2.51.0
-
diff --git a/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch b/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
deleted file mode 100644
index 4e94a25099..0000000000
--- a/queue-6.16/remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From e1f7ff8eea47e78b25fac616e76f7826cb2efcf6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 6 Jul 2025 17:47:08 +0300
-Subject: remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974
-
-From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-
-[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ]
-
-On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw
-MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was
-specified as the firmware image.
-
-Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings")
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Tested-by: Luca Weiss <luca@lucaweiss.eu> # msm8974pro-fairphone-fp2
-Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com
-[bjorn: Unwrapped the long memcpy line, to taste]
-Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
-index 0c0199fb0e68d..3087d895b87f4 100644
---- a/drivers/remoteproc/qcom_q6v5_mss.c
-+++ b/drivers/remoteproc/qcom_q6v5_mss.c
-@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region)
- 	release_firmware(dp_fw);
- }
- 
-+#define MSM8974_B00_OFFSET 0x1000
-+
- static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
- {
- 	struct q6v5 *qproc = rproc->priv;
-@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
- 		return -EBUSY;
- 	}
- 
--	memcpy(mba_region, fw->data, fw->size);
-+	if ((qproc->version == MSS_MSM8974 ||
-+	     qproc->version == MSS_MSM8226 ||
-+	     qproc->version == MSS_MSM8926) &&
-+	    fw->size > MSM8974_B00_OFFSET &&
-+	    !memcmp(fw->data, ELFMAG, SELFMAG))
-+		memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET);
-+	else
-+		memcpy(mba_region, fw->data, fw->size);
- 	q6v5_debug_policy_load(qproc, mba_region);
- 	memunmap(mba_region);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch b/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
deleted file mode 100644
index 2c89d5590a..0000000000
--- a/queue-6.16/revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From 74383ba9b795a732a2d6ba7477437f8130877006 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Sep 2025 11:15:29 -0700
-Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
-
-From: Jakub Kicinski <kuba@kernel.org>
-
-[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
-
-This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
-
-Commit in question breaks the mapping of PGs to pools for some SKUs.
-Specifically multi-host NICs seem to be shipped with a custom buffer
-configuration which maps the lossy PG to pool 4. But the bad commit
-overrides this with pool 0 which does not have sufficient buffer space
-reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
-OOB connection completely (100% packet loss).
-
-Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
-set Xon/Xoff upon port speed set""). The breakage is exactly the same,
-the only difference is that quoted commit would break the NIC immediately
-on boot, and the currently reverted commit only when MTU is changed.
-
-Note: "good" kernels do not restore the configuration, so downgrade isn't
-enough to recover machines. A NIC power cycle seems to be necessary to
-return to a healthy state (or overriding the relevant registers using
-a custom patch).
-
-Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
-Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../mellanox/mlx5/core/en/port_buffer.h         | 12 ------------
- .../net/ethernet/mellanox/mlx5/core/en_main.c   | 17 +----------------
- 2 files changed, 1 insertion(+), 28 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
-index 66d276a1be836..f4a19ffbb641c 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
-@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
- 	struct mlx5e_bufferx_reg  buffer[MLX5E_MAX_NETWORK_BUFFER];
- };
- 
--#ifdef CONFIG_MLX5_CORE_EN_DCB
- int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
- 				    u32 change, unsigned int mtu,
- 				    struct ieee_pfc *pfc,
- 				    u32 *buffer_size,
- 				    u8 *prio2buffer);
--#else
--static inline int
--mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
--				u32 change, unsigned int mtu,
--				void *pfc,
--				u32 *buffer_size,
--				u8 *prio2buffer)
--{
--	return 0;
--}
--#endif
- 
- int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
- 			    struct mlx5e_port_buffer *port_buffer);
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-index f0142d32b648f..16d818943487b 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-@@ -48,7 +48,6 @@
- #include "en.h"
- #include "en/dim.h"
- #include "en/txrx.h"
--#include "en/port_buffer.h"
- #include "en_tc.h"
- #include "en_rep.h"
- #include "en_accel/ipsec.h"
-@@ -2986,11 +2985,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
- 	struct mlx5e_params *params = &priv->channels.params;
- 	struct net_device *netdev = priv->netdev;
- 	struct mlx5_core_dev *mdev = priv->mdev;
--	u16 mtu, prev_mtu;
-+	u16 mtu;
- 	int err;
- 
--	mlx5e_query_mtu(mdev, params, &prev_mtu);
--
- 	err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
- 	if (err)
- 		return err;
-@@ -3000,18 +2997,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
- 		netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
- 			    __func__, mtu, params->sw_mtu);
- 
--	if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
--		err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
--						      NULL, NULL, NULL);
--		if (err) {
--			netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
--				    __func__, mtu, err, prev_mtu);
--
--			mlx5e_set_mtu(mdev, params, prev_mtu);
--			return err;
--		}
--	}
--
- 	params->sw_mtu = mtu;
- 	return 0;
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch b/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
deleted file mode 100644
index 1434d2e7ed..0000000000
--- a/queue-6.16/revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 0d94bfa3dca317a6120b62abf8f017a7877489ce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 00:07:20 +0300
-Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
- seems Running"
-
-From: Michal Pecio <michal.pecio@gmail.com>
-
-[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
-
-This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
-
-No actual HW bugs are known where Endpoint Context shows Running state
-but Stop Endpoint fails repeatedly with Context State Error and leaves
-the endpoint state unchanged. Stop Endpoint retries on Running EPs have
-been performed since early 2021 with no such issues reported so far.
-
-Trying to handle this hypothetical case brings a more realistic danger:
-if Stop Endpoint fails on an endpoint which hasn't yet started after a
-doorbell ring and enough latency occurs before this completion event is
-handled, the driver may time out and begin removing cancelled TDs from
-a running endpoint, even though one more retry would stop it reliably.
-
-Such high latency is rare but not impossible, and removing TDs from a
-running endpoint can cause more damage than not giving back a cancelled
-URB (which wasn't happening anyway). So err on the side of caution and
-revert to the old policy of always retrying if the EP appears running.
-
-[Remove stable tag as we are dealing with theoretical cases -Mathias]
-
-Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
-Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
-Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
-Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/xhci-ring.c | 11 ++++-------
- 1 file changed, 4 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index 4f8f5aab109d0..6309200e93dc3 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
- 			 * Stopped state, but it will soon change to Running.
- 			 *
- 			 * Assume this bug on unexpected Stop Endpoint failures.
--			 * Keep retrying until the EP starts and stops again.
-+			 * Keep retrying until the EP starts and stops again, on
-+			 * chips where this is known to help. Wait for 100ms.
- 			 */
-+			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
-+				break;
- 			fallthrough;
- 		case EP_STATE_RUNNING:
- 			/* Race, HW handled stop ep cmd before ep was running */
- 			xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
- 					GET_EP_CTX_STATE(ep_ctx));
--			/*
--			 * Don't retry forever if we guessed wrong or a defective HC never starts
--			 * the EP or says 'Running' but fails the command. We must give back TDs.
--			 */
--			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
--				break;
- 
- 			command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
- 			if (!command) {
--- 
-2.51.0
-
diff --git a/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch b/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
deleted file mode 100644
index 74963c2c25..0000000000
--- a/queue-6.16/riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 4b788aa7069a33835b239020db74d6472c372fee Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 8 Sep 2025 01:24:48 +0000
-Subject: riscv, bpf: Sign extend struct ops return values properly
-
-From: Hengqi Chen <hengqi.chen@gmail.com>
-
-[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]
-
-The ns_bpf_qdisc selftest triggers a kernel panic:
-
-    Unable to handle kernel paging request at virtual address ffffffffa38dbf58
-    Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
-    [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
-    Oops [#1]
-    Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
-    CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE
-    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
-    Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
-    epc : __qdisc_run+0x82/0x6f0
-     ra : __qdisc_run+0x6e/0x6f0
-    epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
-     gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
-     t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
-     s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
-     a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
-     a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
-     s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
-     s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
-     s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
-     s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
-     t5 : 0000000000000000 t6 : ff60000093a6a8b6
-    status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
-    [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
-    [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
-    [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
-    [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
-    [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
-    [<ffffffff80d31446>] ip6_output+0x5e/0x178
-    [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
-    [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
-    [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
-    [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
-    [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
-    [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
-    [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
-    [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
-    [<ffffffff80b42bee>] __sys_connect+0x96/0xc8
-    [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
-    [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
-    [<ffffffff80e69af2>] handle_exception+0x14a/0x156
-    Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
-    ---[ end trace 0000000000000000 ]---
-
-The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
-is treated as a 32bit value and sign extend to 64bit in epilogue. This
-behavior is right for most bpf prog types but wrong for struct ops which
-requires RISC-V ABI.
-
-So let's sign extend struct ops return values according to the function
-model and RISC-V ABI([0]).
-
-  [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
-
-Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
-Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Tested-by: Pu Lehui <pulehui@huawei.com>
-Reviewed-by: Pu Lehui <pulehui@huawei.com>
-Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
- 1 file changed, 41 insertions(+), 1 deletion(-)
-
-diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
-index 9883a55d61b5b..f1efa4d6b27f3 100644
---- a/arch/riscv/net/bpf_jit_comp64.c
-+++ b/arch/riscv/net/bpf_jit_comp64.c
-@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn,
- 	return 0;
- }
- 
-+/*
-+ * Sign-extend the register if necessary
-+ */
-+static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
-+{
-+	if (!sign && (sz == 1 || sz == 2)) {
-+		if (rd != rs)
-+			emit_mv(rd, rs, ctx);
-+		return 0;
-+	}
-+
-+	switch (sz) {
-+	case 1:
-+		emit_sextb(rd, rs, ctx);
-+		break;
-+	case 2:
-+		emit_sexth(rd, rs, ctx);
-+		break;
-+	case 4:
-+		emit_sextw(rd, rs, ctx);
-+		break;
-+	case 8:
-+		if (rd != rs)
-+			emit_mv(rd, rs, ctx);
-+		break;
-+	default:
-+		pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
- #define BPF_FIXUP_OFFSET_MASK   GENMASK(26, 0)
- #define BPF_FIXUP_REG_MASK      GENMASK(31, 27)
- #define REG_DONT_CLEAR_MARKER	0	/* RV_REG_ZERO unused in pt_regmap */
-@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
- 		restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
- 
- 	if (save_ret) {
--		emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
- 		emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
-+		if (is_struct_ops) {
-+			ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
-+					  m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
-+			if (ret)
-+				goto out;
-+		} else {
-+			emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
-+		}
- 	}
- 
- 	emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
--- 
-2.51.0
-
diff --git a/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch b/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
deleted file mode 100644
index 2f84a7a318..0000000000
--- a/queue-6.16/rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 35ce44a31d6a8c8f3cdd34ee5e815f9893f23bd0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 25 Jul 2025 22:02:58 +0200
-Subject: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Czémán <barnabas.czeman@mainlining.org>
-
-[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ]
-
-mbox_request_channel() returning value was changed in case of error.
-It uses returning value of of_parse_phandle_with_args().
-It is returning with -ENOENT instead of -ENODEV when no mboxes property
-exists.
-
-Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()")
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
-Tested-by: Stephan Gerhold <stephan.gerhold@linaro.org> # msm8939
-Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
-Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org
-Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/rpmsg/qcom_smd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
-index 87c944d4b4f31..1cbe457b4e96f 100644
---- a/drivers/rpmsg/qcom_smd.c
-+++ b/drivers/rpmsg/qcom_smd.c
-@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev,
- 	edge->mbox_client.knows_txdone = true;
- 	edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
- 	if (IS_ERR(edge->mbox_chan)) {
--		if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
-+		if (PTR_ERR(edge->mbox_chan) != -ENOENT) {
- 			ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan),
- 					    "failed to acquire IPC mailbox\n");
- 			goto put_node;
--- 
-2.51.0
-
diff --git a/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch b/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch
deleted file mode 100644
index fc881a3fd4..0000000000
--- a/queue-6.16/rust-cpumask-mark-cpumaskvar-as-transparent.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 5abb1511a4a79f8fa2b32e6cda8eb0926eabf264 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 16:42:11 +0200
-Subject: rust: cpumask: Mark CpumaskVar as transparent
-
-From: Baptiste Lepers <baptiste.lepers@gmail.com>
-
-[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ]
-
-Unsafe code in CpumaskVar's methods assumes that the type has the same
-layout as `bindings::cpumask_var_t`. This is not guaranteed by
-the default struct representation in Rust, but requires specifying the
-`transparent` representation.
-
-Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions")
-Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
-Reviewed-by: Alice Ryhl <aliceryhl@google.com>
-Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- rust/kernel/cpumask.rs | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs
-index 19c607709b5fd..8bc8325b200dc 100644
---- a/rust/kernel/cpumask.rs
-+++ b/rust/kernel/cpumask.rs
-@@ -215,6 +215,7 @@ impl Cpumask {
- /// }
- /// assert_eq!(mask2.weight(), count);
- /// ```
-+#[repr(transparent)]
- pub struct CpumaskVar {
-     #[cfg(CONFIG_CPUMASK_OFFSTACK)]
-     ptr: NonNull<Cpumask>,
--- 
-2.51.0
-
diff --git a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
deleted file mode 100644
index 7dcb96639c..0000000000
--- a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 0138fe973bbc3899540a7b7f3200b9d960622195 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 14:06:29 +0200
-Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
-
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-
-[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
-
-The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
-as follows:
-
-  entry()
-    subprog_tail()
-      bpf_tail_call_static(0) -> entry + tail_call_start
-    subprog_tail()
-      bpf_tail_call_static(0) -> entry + tail_call_start
-
-entry() copies its tail call counter to the subprog_tail()'s frame,
-which then increments it. However, the incremented result is discarded,
-leading to an astronomically large number of tail calls.
-
-Fix by writing the incremented counter back to the entry()'s frame.
-
-Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
- 1 file changed, 16 insertions(+), 7 deletions(-)
-
-diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
-index 0c9a35782c833..794f99675cef4 100644
---- a/arch/s390/net/bpf_jit_comp.c
-+++ b/arch/s390/net/bpf_jit_comp.c
-@@ -1778,13 +1778,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
- 		jit->seen |= SEEN_FUNC;
- 		/*
- 		 * Copy the tail call counter to where the callee expects it.
--		 *
--		 * Note 1: The callee can increment the tail call counter, but
--		 * we do not load it back, since the x86 JIT does not do this
--		 * either.
--		 *
--		 * Note 2: We assume that the verifier does not let us call the
--		 * main program, which clears the tail call counter on entry.
- 		 */
- 		/* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
- 		_EMIT6(0xd203f000 | STK_OFF_TCCNT,
-@@ -1810,6 +1803,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
- 		call_r1(jit);
- 		/* lgr %b0,%r2: load return value into %b0 */
- 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
-+
-+		/*
-+		 * Copy the potentially updated tail call counter back.
-+		 */
-+
-+		if (insn->src_reg == BPF_PSEUDO_CALL)
-+			/*
-+			 * mvc frame_off+tail_call_cnt(%r15),
-+			 *     tail_call_cnt(4,%r15)
-+			 */
-+			_EMIT6(0xd203f000 | (jit->frame_off +
-+					     offsetof(struct prog_frame,
-+						      tail_call_cnt)),
-+			       0xf000 | offsetof(struct prog_frame,
-+						 tail_call_cnt));
-+
- 		break;
- 	}
- 	case BPF_JMP | BPF_TAIL_CALL: {
--- 
-2.51.0
-
diff --git a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch b/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
deleted file mode 100644
index 2c8649ac0e..0000000000
--- a/queue-6.16/s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 26a6ee9b28e1aaa8fad7a3b7e2a9e92ac4e2430b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Aug 2025 14:06:30 +0200
-Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
-
-From: Ilya Leoshkevich <iii@linux.ibm.com>
-
-[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
-
-The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
-graph is as follows:
-
-  entry()
-    subprog_tail()
-      trampoline()
-        fentry()
-        the rest of subprog_tail()  # via BPF_TRAMP_F_CALL_ORIG
-        return to entry()
-
-The problem is that the rest of subprog_tail() increments the tail call
-counter, but the trampoline discards the incremented value. This
-results in an astronomically large number of tail calls.
-
-Fix by making the trampoline write the incremented tail call counter
-back.
-
-Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
-Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/net/bpf_jit_comp.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
-index 794f99675cef4..47046e3080355 100644
---- a/arch/s390/net/bpf_jit_comp.c
-+++ b/arch/s390/net/bpf_jit_comp.c
-@@ -2811,6 +2811,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
- 		/* stg %r2,retval_off(%r15) */
- 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
- 			      tjit->retval_off);
-+		/* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
-+		_EMIT6(0xd203f000 | tjit->tccnt_off,
-+		       0xf000 | offsetof(struct prog_frame, tail_call_cnt));
- 
- 		im->ip_after_call = jit->prg_buf + jit->prg;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch b/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
deleted file mode 100644
index 94083c61ae..0000000000
--- a/queue-6.16/scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From c29dc45d58e9ecbcc0dfe8285407792a5ab0f73e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 15:21:10 +0530
-Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
-
-From: Ranjan Kumar <ranjan.kumar@broadcom.com>
-
-[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
-
-During mpt3sas_transport_port_remove(), messages were logged with
-dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
-transport device may already be partially unregistered or freed, leading
-to a crash when accessing its struct device.
-
-Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
-guaranteed to remain valid until driver removal.
-
-[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
-[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G           OE       6.16.0-rc1+ #1 PREEMPT(voluntary)
-[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
-[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
-[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
-[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
-[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
-[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
-[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
-[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
-[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
-[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
-[83428.295833] FS:  00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
-[83428.295837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
-[83428.295844] PKRU: 55555554
-[83428.295846] Call Trace:
-[83428.295848]  <TASK>
-[83428.295850]  _dev_printk+0x5c/0x80
-[83428.295857]  ? srso_alias_return_thunk+0x5/0xfbef5
-[83428.295863]  mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
-[83428.295882]  _scsih_remove_device+0x21b/0x280 [mpt3sas]
-[83428.295894]  ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
-[83428.295906]  ? srso_alias_return_thunk+0x5/0xfbef5
-[83428.295910]  mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
-[83428.295921]  _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
-[83428.295933]  _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
-[83428.295944]  scsih_remove+0x3f0/0x4a0 [mpt3sas]
-[83428.295957]  pci_device_remove+0x3b/0xb0
-[83428.295962]  device_release_driver_internal+0x193/0x200
-[83428.295968]  driver_detach+0x44/0x90
-[83428.295971]  bus_remove_driver+0x69/0xf0
-[83428.295975]  pci_unregister_driver+0x2a/0xb0
-[83428.295979]  _mpt3sas_exit+0x1f/0x300 [mpt3sas]
-[83428.295991]  __do_sys_delete_module.constprop.0+0x174/0x310
-[83428.295997]  ? srso_alias_return_thunk+0x5/0xfbef5
-[83428.296000]  ? __x64_sys_getdents64+0x9a/0x110
-[83428.296005]  ? srso_alias_return_thunk+0x5/0xfbef5
-[83428.296009]  ? syscall_trace_enter+0xf6/0x1b0
-[83428.296014]  do_syscall_64+0x7b/0x2c0
-[83428.296019]  ? srso_alias_return_thunk+0x5/0xfbef5
-[83428.296023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
-
-Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
-Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
- 1 file changed, 3 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
-index dc74ebc6405ac..66fd301f03b0d 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
-@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
- 	list_for_each_entry_safe(mpt3sas_phy, next_phy,
- 	    &mpt3sas_port->phy_list, port_siblings) {
- 		if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
--			dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
--			    "remove: sas_addr(0x%016llx), phy(%d)\n",
--			    (unsigned long long)
--			    mpt3sas_port->remote_identify.sas_address,
--			    mpt3sas_phy->phy_id);
-+			ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
-+				(unsigned long long) mpt3sas_port->remote_identify.sas_address,
-+					mpt3sas_phy->phy_id);
- 		mpt3sas_phy->phy_belongs_to_port = 0;
- 		if (!ioc->remove_host)
- 			sas_port_delete_phy(mpt3sas_port->port,
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch b/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch
deleted file mode 100644
index 1b1fac0c1b..0000000000
--- a/queue-6.16/scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 51c0819725af9b72f6f62f8b7f255c38ae9eb1df Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 25 Jul 2025 10:31:06 +0200
-Subject: scsi: myrs: Fix dma_alloc_coherent() error check
-
-From: Thomas Fourier <fourier.thomas@gmail.com>
-
-[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
-
-Check for NULL return value with dma_alloc_coherent(), because DMA
-address is not always set by dma_alloc_coherent() on failure.
-
-Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
-Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
-Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrs.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
-index 95af3bb03834c..a58abd796603b 100644
---- a/drivers/scsi/myrs.c
-+++ b/drivers/scsi/myrs.c
-@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
- 	/* Temporary dma mapping, used only in the scope of this function */
- 	mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
- 				  &mbox_addr, GFP_KERNEL);
--	if (dma_mapping_error(&pdev->dev, mbox_addr))
-+	if (!mbox)
- 		return false;
- 
- 	/* These are the base addresses for the command memory mailbox array */
- 	cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
- 	cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
- 				      &cs->cmd_mbox_addr, GFP_KERNEL);
--	if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
-+	if (!cmd_mbox) {
- 		dev_err(&pdev->dev, "Failed to map command mailbox\n");
- 		goto out_free;
- 	}
-@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
- 	cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
- 	stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
- 				       &cs->stat_mbox_addr, GFP_KERNEL);
--	if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
-+	if (!stat_mbox) {
- 		dev_err(&pdev->dev, "Failed to map status mailbox\n");
- 		goto out_free;
- 	}
-@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
- 	cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
- 					    sizeof(struct myrs_fwstat),
- 					    &cs->fwstat_addr, GFP_KERNEL);
--	if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
-+	if (!cs->fwstat_buf) {
- 		dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
- 		cs->fwstat_buf = NULL;
- 		goto out_free;
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch b/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
deleted file mode 100644
index 77a9b1e09a..0000000000
--- a/queue-6.16/scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 4a3389c2af7d30e951d89195ea60d1040b1983b3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 14 Aug 2025 19:32:17 +0200
-Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
-
-From: Niklas Cassel <cassel@kernel.org>
-
-[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
-
-Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
-device is gone") UBSAN reports:
-
-  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
-  index 28 is out of range for type 'pm8001_phy [16]'
-
-on rmmod when using an expander.
-
-For a direct attached device, attached_phy contains the local phy id.
-For a device behind an expander, attached_phy contains the remote phy
-id, not the local phy id.
-
-I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
-device behind an expander, attached_phy can be much larger than
-pm8001_ha->chip->n_phy (depending on the amount of phys of the
-expander).
-
-E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
-ports has an expander connected.  The expander has 31 phys with phy ids
-0-30.
-
-The pm8001_ha->phy array only contains the phys of the HBA.  It does not
-contain the phys of the expander.  Thus, it is wrong to use attached_phy
-to index the pm8001_ha->phy array for a device behind an expander.
-
-Thus, we can only clear phy_attached for devices that are directly
-attached.
-
-Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
-Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
-Signed-off-by: Niklas Cassel <cassel@kernel.org>
-Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
-Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
-Tested-by: Damien Le Moal <dlemoal@kernel.org>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
-index 753c09363cbbc..3e1dac4b820fe 100644
---- a/drivers/scsi/pm8001/pm8001_sas.c
-+++ b/drivers/scsi/pm8001/pm8001_sas.c
-@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
- 	unsigned long flags = 0;
- 	struct pm8001_hba_info *pm8001_ha;
- 	struct pm8001_device *pm8001_dev = dev->lldd_dev;
-+	struct domain_device *parent_dev = dev->parent;
- 
- 	pm8001_ha = pm8001_find_ha_by_dev(dev);
- 	spin_lock_irqsave(&pm8001_ha->lock, flags);
-@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
- 			spin_lock_irqsave(&pm8001_ha->lock, flags);
- 		}
- 		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
--		pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
-+
-+		/*
-+		 * The phy array only contains local phys. Thus, we cannot clear
-+		 * phy_attached for a device behind an expander.
-+		 */
-+		if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
-+			pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
- 		pm8001_free_dev(pm8001_dev);
- 	} else {
- 		pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch b/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch
deleted file mode 100644
index 21149a0e3e..0000000000
--- a/queue-6.16/scsi-pm80xx-restore-support-for-expanders.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 9ab4d406299701ae4e0dbe3a3595b7134a48e318 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 14 Aug 2025 19:32:16 +0200
-Subject: scsi: pm80xx: Restore support for expanders
-
-From: Niklas Cassel <cassel@kernel.org>
-
-[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ]
-
-Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke
-support for expanders. After the commit, devices behind an expander are
-no longer detected.
-
-Simply reverting the commit restores support for devices behind an
-expander.
-
-Instead of reverting the commit (and reintroducing a helper to get the
-port), get the port directly from the lldd_port pointer in struct
-asd_sas_port.
-
-Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID")
-Suggested-by: Igor Pylypiv <ipylypiv@google.com>
-Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
-Signed-off-by: Niklas Cassel <cassel@kernel.org>
-Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org
-Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
-Tested-by: Damien Le Moal <dlemoal@kernel.org>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
-index f7067878b34f3..753c09363cbbc 100644
---- a/drivers/scsi/pm8001/pm8001_sas.c
-+++ b/drivers/scsi/pm8001/pm8001_sas.c
-@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
- 	struct pm8001_device *pm8001_dev = dev->lldd_dev;
- 	bool internal_abort = sas_is_internal_abort(task);
- 	struct pm8001_hba_info *pm8001_ha;
--	struct pm8001_port *port = NULL;
-+	struct pm8001_port *port;
- 	struct pm8001_ccb_info *ccb;
- 	unsigned long flags;
- 	u32 n_elem = 0;
-@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
- 
- 	spin_lock_irqsave(&pm8001_ha->lock, flags);
- 
--	pm8001_dev = dev->lldd_dev;
--	port = pm8001_ha->phy[pm8001_dev->attached_phy].port;
-+	port = dev->port->lldd_port;
- 
- 	if (!internal_abort &&
- 	    (DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) {
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch b/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
deleted file mode 100644
index e64c166e24..0000000000
--- a/queue-6.16/scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5e43b3b22579579c5775904ec5928d3603929c39 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 15:54:43 +0800
-Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
-
-Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
-qla_edif_process_els() to align with qla2x00_start_sp() returning
-negative error codes or QLA_SUCCESS, preventing logical errors.
-
-Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
-index 91bbd3b75bff9..ccd4485087a10 100644
---- a/drivers/scsi/qla2xxx/qla_edif.c
-+++ b/drivers/scsi/qla2xxx/qla_edif.c
-@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
- 	switch (rval) {
- 	case QLA_SUCCESS:
- 		break;
--	case EAGAIN:
-+	case -EAGAIN:
- 		msleep(EDIF_MSLEEP_INTERVAL);
- 		cnt++;
- 		if (cnt < EDIF_RETRY_COUNT)
-@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
- 		       p->e.extra_rx_xchg_address, p->e.extra_control_flags,
- 		       sp->handle, sp->remap.req.len, bsg_job);
- 		break;
--	case EAGAIN:
-+	case -EAGAIN:
- 		msleep(EDIF_MSLEEP_INTERVAL);
- 		cnt++;
- 		if (cnt < EDIF_RETRY_COUNT)
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
deleted file mode 100644
index 0ac47bac04..0000000000
--- a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 1ac65f86203e886d7c837ad6d3ad91ac77ec6a6e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 15:54:45 +0800
-Subject: scsi: qla2xxx: Fix incorrect sign of error code in
- qla_nvme_xmt_ls_rsp()
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
-
-Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
-align with qla2x00_start_sp() returning negative error codes or
-QLA_SUCCESS, preventing logical errors.
-
-Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
-index 8ee2e337c9e1b..316594aa40cc5 100644
---- a/drivers/scsi/qla2xxx/qla_nvme.c
-+++ b/drivers/scsi/qla2xxx/qla_nvme.c
-@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
- 	switch (rval) {
- 	case QLA_SUCCESS:
- 		break;
--	case EAGAIN:
-+	case -EAGAIN:
- 		msleep(PURLS_MSLEEP_INTERVAL);
- 		cnt++;
- 		if (cnt < PURLS_RETRY_COUNT)
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch b/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
deleted file mode 100644
index f65caa43ad..0000000000
--- a/queue-6.16/scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 45b62c45695e905d3ee10d88c6cabc8b9aced7dd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 15:54:44 +0800
-Subject: scsi: qla2xxx: Fix incorrect sign of error code in
- START_SP_W_RETRIES()
-
-From: Qianfeng Rong <rongqianfeng@vivo.com>
-
-[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
-
-Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
-with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
-preventing logical errors.  Additionally, the '_rval' variable should
-store negative error codes to conform to Linux kernel error code
-conventions.
-
-Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
-Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
-Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_init.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
-index 514934dd6f80e..caba003abfd69 100644
---- a/drivers/scsi/qla2xxx/qla_init.c
-+++ b/drivers/scsi/qla2xxx/qla_init.c
-@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
- 	int cnt = 5; \
- 	do { \
- 		if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
--			_rval = EINVAL; \
-+			_rval = -EINVAL; \
- 			break; \
- 		} \
- 		_rval = qla2x00_start_sp(_sp); \
--		if (_rval == EAGAIN) \
-+		if (_rval == -EAGAIN) \
- 			msleep(1); \
- 		else \
- 			break; \
--- 
-2.51.0
-
diff --git a/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch b/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
deleted file mode 100644
index e6103de177..0000000000
--- a/queue-6.16/scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 5333326ef0baa485207a1fc903ac054fc54183fd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 17:41:43 +0800
-Subject: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
-
-From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
-
-[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ]
-
-The cpu_latency_qos_add/remove/update_request interfaces lack internal
-synchronization by design, requiring the caller to ensure thread safety.
-The current implementation relies on the 'pm_qos_enabled' flag, which is
-insufficient to prevent concurrent access and cannot serve as a proper
-synchronization mechanism. This has led to data races and list
-corruption issues.
-
-A typical race condition call trace is:
-
-[Thread A]
-ufshcd_pm_qos_exit()
-  --> cpu_latency_qos_remove_request()
-    --> cpu_latency_qos_apply();
-      --> pm_qos_update_target()
-        --> plist_del              <--(1) delete plist node
-    --> memset(req, 0, sizeof(*req));
-  --> hba->pm_qos_enabled = false;
-
-[Thread B]
-ufshcd_devfreq_target
-  --> ufshcd_devfreq_scale
-    --> ufshcd_scale_clks
-      --> ufshcd_pm_qos_update     <--(2) pm_qos_enabled is true
-        --> cpu_latency_qos_update_request
-          --> pm_qos_update_target
-            --> plist_del          <--(3) plist node use-after-free
-
-Introduces a dedicated mutex to serialize PM QoS operations, preventing
-data races and ensuring safe access to PM QoS resources, including sysfs
-interface reads.
-
-Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver")
-Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
-Reviewed-by: Bart Van Assche <bvanassche@acm.org>
-Tested-by: Huan Tang <tanghuan@vivo.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ufs/core/ufs-sysfs.c | 2 ++
- drivers/ufs/core/ufshcd.c    | 9 +++++++++
- include/ufs/ufshcd.h         | 3 +++
- 3 files changed, 14 insertions(+)
-
-diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c
-index fcb4b14a710ff..62c7a3ecfb7eb 100644
---- a/drivers/ufs/core/ufs-sysfs.c
-+++ b/drivers/ufs/core/ufs-sysfs.c
-@@ -494,6 +494,8 @@ static ssize_t pm_qos_enable_show(struct device *dev,
- {
- 	struct ufs_hba *hba = dev_get_drvdata(dev);
- 
-+	guard(mutex)(&hba->pm_qos_mutex);
-+
- 	return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled);
- }
- 
-diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
-index 5224a21454021..b698e2fdc15fb 100644
---- a/drivers/ufs/core/ufshcd.c
-+++ b/drivers/ufs/core/ufshcd.c
-@@ -1017,6 +1017,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active);
-  */
- void ufshcd_pm_qos_init(struct ufs_hba *hba)
- {
-+	guard(mutex)(&hba->pm_qos_mutex);
- 
- 	if (hba->pm_qos_enabled)
- 		return;
-@@ -1033,6 +1034,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba)
-  */
- void ufshcd_pm_qos_exit(struct ufs_hba *hba)
- {
-+	guard(mutex)(&hba->pm_qos_mutex);
-+
- 	if (!hba->pm_qos_enabled)
- 		return;
- 
-@@ -1047,6 +1050,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
-  */
- static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on)
- {
-+	guard(mutex)(&hba->pm_qos_mutex);
-+
- 	if (!hba->pm_qos_enabled)
- 		return;
- 
-@@ -10711,6 +10716,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
- 	mutex_init(&hba->ee_ctrl_mutex);
- 
- 	mutex_init(&hba->wb_mutex);
-+
-+	/* Initialize mutex for PM QoS request synchronization */
-+	mutex_init(&hba->pm_qos_mutex);
-+
- 	init_rwsem(&hba->clk_scaling_lock);
- 
- 	ufshcd_init_clk_gating(hba);
-diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
-index 9b3515cee7117..b94afda2233d6 100644
---- a/include/ufs/ufshcd.h
-+++ b/include/ufs/ufshcd.h
-@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr {
-  * @ufs_rtc_update_work: A work for UFS RTC periodic update
-  * @pm_qos_req: PM QoS request handle
-  * @pm_qos_enabled: flag to check if pm qos is enabled
-+ * @pm_qos_mutex: synchronizes PM QoS request and status updates
-  * @critical_health_count: count of critical health exceptions
-  * @dev_lvl_exception_count: count of device level exceptions since last reset
-  * @dev_lvl_exception_id: vendor specific information about the
-@@ -1136,6 +1137,8 @@ struct ufs_hba {
- 	struct delayed_work ufs_rtc_update_work;
- 	struct pm_qos_request pm_qos_req;
- 	bool pm_qos_enabled;
-+	/* synchronizes PM QoS request and status updates */
-+	struct mutex pm_qos_mutex;
- 
- 	int critical_health_count;
- 	atomic_t dev_lvl_exception_count;
--- 
-2.51.0
-
diff --git a/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch b/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
deleted file mode 100644
index 96d4f76f32..0000000000
--- a/queue-6.16/seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 98fe73eaee81920a717d4c178c17cc478dda0729 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 25 Jul 2025 18:31:18 +0200
-Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
- fast
-
-From: Johannes Nixdorf <johannes@nixdorf.dev>
-
-[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
-
-Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
-event to the tracer, and starts to wait interruptibly. With
-SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
-message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
-and is subsequently interrupted, the tracee begins to wait again
-uninterruptibly (but killable).
-
-This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
-is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
-condition to begin waiting again. In this case the tracee is interrupted
-even though the tracer already acted on its behalf. This breaks the
-assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
-namely that the tracer can be sure the syscall is not interrupted or
-restarted on the tracee after it is received on the tracer. Fix this
-by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
-switch to uninterruptible waiting.
-
-With the condition changed the loop in seccomp_do_user_notification()
-would exit immediately after deciding that noninterruptible waiting
-is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
-skipping the code that processes pending addfd commands first. Prevent
-this by executing the remaining loop body one last time in this case.
-
-Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
-Reported-by: Ali Polatel <alip@chesswob.org>
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
-Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
-Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
-Signed-off-by: Kees Cook <kees@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/seccomp.c | 12 +++++-------
- 1 file changed, 5 insertions(+), 7 deletions(-)
-
-diff --git a/kernel/seccomp.c b/kernel/seccomp.c
-index 41aa761c7738c..3bbfba30a777a 100644
---- a/kernel/seccomp.c
-+++ b/kernel/seccomp.c
-@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
- static bool should_sleep_killable(struct seccomp_filter *match,
- 				  struct seccomp_knotif *n)
- {
--	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
-+	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
- }
- 
- static int seccomp_do_user_notification(int this_syscall,
-@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall,
- 
- 		if (err != 0) {
- 			/*
--			 * Check to see if the notifcation got picked up and
--			 * whether we should switch to wait killable.
-+			 * Check to see whether we should switch to wait
-+			 * killable. Only return the interrupted error if not.
- 			 */
--			if (!wait_killable && should_sleep_killable(match, &n))
--				continue;
--
--			goto interrupted;
-+			if (!(!wait_killable && should_sleep_killable(match, &n)))
-+				goto interrupted;
- 		}
- 
- 		addfd = list_first_entry_or_null(&n.addfd,
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch b/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch
deleted file mode 100644
index a4f2ba0de7..0000000000
--- a/queue-6.16/selftests-always-install-uapi-headers-to-the-correct.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 57836f0ae04ac873f872cf8180696a9b9233c6cf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 18 Sep 2025 11:56:36 +0200
-Subject: selftests: always install UAPI headers to the correct directory
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-
-[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ]
-
-Currently the UAPI headers are always installed into the source directory.
-When building out-of-tree this doesn't work, as the include path will be
-wrong and it dirties the source tree, leading to complains by kbuild.
-
-Make sure the 'headers' target installs the UAPI headers in the correctly.
-
-The real target directory can come from multiple places. To handle them all
-extract the target directory from KHDR_INCLUDES.
-
-Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de
-Reported-by: Jason Gunthorpe <jgg@nvidia.com>
-Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/
-Fixes: 1a59f5d31569 ("selftests: Add headers target")
-Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/lib.mk | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
-index 5303900339292..a448fae57831d 100644
---- a/tools/testing/selftests/lib.mk
-+++ b/tools/testing/selftests/lib.mk
-@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S
- 	$(LINK.S) $^ $(LDLIBS) -o $@
- endif
- 
-+# Extract the expected header directory
-+khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES)))
-+
- headers:
--	$(Q)$(MAKE) -C $(top_srcdir) headers
-+	$(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers
- 
- .PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch b/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch
deleted file mode 100644
index 65ac97540f..0000000000
--- a/queue-6.16/selftests-arm64-check-fread-return-value-in-exec_tar.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From e4177c850ddbcd87af072c3248256d12b88ebdc6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 8 Aug 2025 13:38:30 +0530
-Subject: selftests: arm64: Check fread return value in exec_target
-
-From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
-
-[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
-
-Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
-by checking fread's return value and handling errors, preventing
-potential failures when reading from stdin.
-
-Fixes compiler warning:
-warning: ignoring return value of 'fread' declared with attribute
-'warn_unused_result' [-Wunused-result]
-
-Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
-
-Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
-Reviewed-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Will Deacon <will@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
-index 4435600ca400d..e597861b26d6b 100644
---- a/tools/testing/selftests/arm64/pauth/exec_target.c
-+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
-@@ -13,7 +13,12 @@ int main(void)
- 	unsigned long hwcaps;
- 	size_t val;
- 
--	fread(&val, sizeof(size_t), 1, stdin);
-+	size_t size = fread(&val, sizeof(size_t), 1, stdin);
-+
-+	if (size != 1) {
-+		fprintf(stderr, "Could not read input from stdin\n");
-+		return EXIT_FAILURE;
-+	}
- 
- 	/* don't try to execute illegal (unimplemented) instructions) caller
- 	 * should have checked this and keep worker simple
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch b/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch
deleted file mode 100644
index f7662314f2..0000000000
--- a/queue-6.16/selftests-bpf-copy-test_kmods-when-installing-selfte.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From c515097583306509e25831331d6a2e2c3ef4448f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 10:50:39 -0700
-Subject: selftests/bpf: Copy test_kmods when installing selftest
-
-From: Amery Hung <ameryhung@gmail.com>
-
-[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ]
-
-Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into
-common directory") consolidated the Makefile of test_kmods. However,
-since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel
-modules required by bpf selftests are now missing from kselftest_install
-when "make install". Fix it by adding test_kmod to TEST_GEN_FILES.
-
-Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory")
-Signed-off-by: Amery Hung <ameryhung@gmail.com>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/bpf/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
-index 910d8d6402ef1..159b7cb3dcb9b 100644
---- a/tools/testing/selftests/bpf/Makefile
-+++ b/tools/testing/selftests/bpf/Makefile
-@@ -136,7 +136,7 @@ TEST_GEN_PROGS_EXTENDED = \
- 	xdping \
- 	xskxceiver
- 
--TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
-+TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi
- 
- ifneq ($(V),1)
- submake_extras := feature_display=0
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch b/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
deleted file mode 100644
index 1dd83a7e7b..0000000000
--- a/queue-6.16/selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From d3342dd7181f347947149450a21df24de9bd37b7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Aug 2025 16:33:49 -0300
-Subject: selftests/bpf: Fix count write in testapp_xdp_metadata_copy()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Ricardo B. Marlière <rbm@suse.com>
-
-[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ]
-
-Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support
-check") added a new global to xsk_xdp_progs.c, but left out the access in
-the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will
-write to the whole bss section, it gets truncated. Fix by writing to
-skel_rx->bss->count directly.
-
-Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check")
-Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/bpf/xskxceiver.c | 14 +-------------
- 1 file changed, 1 insertion(+), 13 deletions(-)
-
-diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
-index 0ced4026ee443..50b03b89f2ee2 100644
---- a/tools/testing/selftests/bpf/xskxceiver.c
-+++ b/tools/testing/selftests/bpf/xskxceiver.c
-@@ -2240,25 +2240,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test)
- {
- 	struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs;
- 	struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs;
--	struct bpf_map *data_map;
--	int count = 0;
--	int key = 0;
- 
- 	test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata,
- 			       skel_tx->progs.xsk_xdp_populate_metadata,
- 			       skel_rx->maps.xsk, skel_tx->maps.xsk);
- 	test->ifobj_rx->use_metadata = true;
- 
--	data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss");
--	if (!data_map || !bpf_map__is_internal(data_map)) {
--		ksft_print_msg("Error: could not find bss section of XDP program\n");
--		return TEST_FAILURE;
--	}
--
--	if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) {
--		ksft_print_msg("Error: could not update count element\n");
--		return TEST_FAILURE;
--	}
-+	skel_rx->bss->count = 0;
- 
- 	return testapp_validate_traffic(test);
- }
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch b/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch
deleted file mode 100644
index 30028a6010..0000000000
--- a/queue-6.16/selftests-cgroup-make-test_pids-backwards-compatible.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From d730cf70b01c3dae5ae6e23db215e60fcfcef94c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Aug 2025 17:53:00 +0200
-Subject: selftests: cgroup: Make test_pids backwards compatible
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Michal Koutný <mkoutny@suse.com>
-
-[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ]
-
-The predicates in test expect event counting from 73e75e6fc352b
-("cgroup/pids: Separate semantics of pids.events related to pids.max")
-and the test would fail on older kernels. We want to have one version of
-tests for all, so detect the feature and skip the test on old kernels.
-(The test could even switch to check v1 semantics based on the flag but
-keep it simple for now.)
-
-Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller")
-Signed-off-by: Michal Koutný <mkoutny@suse.com>
-Tested-by: Sebastian Chlad <sebastian.chlad@suse.com>
-Signed-off-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/cgroup/lib/cgroup_util.c     | 12 ++++++++++++
- .../selftests/cgroup/lib/include/cgroup_util.h       |  1 +
- tools/testing/selftests/cgroup/test_pids.c           |  3 +++
- 3 files changed, 16 insertions(+)
-
-diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c
-index 8832f3d1cb614..84c2b5a021a77 100644
---- a/tools/testing/selftests/cgroup/lib/cgroup_util.c
-+++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c
-@@ -520,6 +520,18 @@ int proc_mount_contains(const char *option)
- 	return strstr(buf, option) != NULL;
- }
- 
-+int cgroup_feature(const char *feature)
-+{
-+	char buf[PAGE_SIZE];
-+	ssize_t read;
-+
-+	read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf));
-+	if (read < 0)
-+		return read;
-+
-+	return strstr(buf, feature) != NULL;
-+}
-+
- ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size)
- {
- 	char path[PATH_MAX];
-diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
-index adb2bc1931839..e726c959d6538 100644
---- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
-+++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
-@@ -56,6 +56,7 @@ extern int cg_run_nowait(const char *cgroup,
- extern int cg_wait_for_proc_count(const char *cgroup, int count);
- extern int cg_killall(const char *cgroup);
- int proc_mount_contains(const char *option);
-+int cgroup_feature(const char *feature);
- extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size);
- extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle);
- extern pid_t clone_into_cgroup(int cgroup_fd);
-diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c
-index 9ecb83c6cc5cb..d8a1d1cd50072 100644
---- a/tools/testing/selftests/cgroup/test_pids.c
-+++ b/tools/testing/selftests/cgroup/test_pids.c
-@@ -77,6 +77,9 @@ static int test_pids_events(const char *root)
- 	char *cg_parent = NULL, *cg_child = NULL;
- 	int pid;
- 
-+	if (cgroup_feature("pids_localevents") <= 0)
-+		return KSFT_SKIP;
-+
- 	cg_parent = cg_name(root, "pids_parent");
- 	cg_child = cg_name(cg_parent, "pids_child");
- 	if (!cg_parent || !cg_child)
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch b/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch
deleted file mode 100644
index 8198f121f8..0000000000
--- a/queue-6.16/selftests-futex-fix-some-futex_numa_mpol-subtests.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 95ac739a3596224d48a3a30aee09272a9686d337 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Aug 2025 15:00:08 +0200
-Subject: selftests/futex: Fix some futex_numa_mpol subtests
-
-From: Waiman Long <longman@redhat.com>
-
-[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ]
-
-The "Memory out of range" subtest of futex_numa_mpol assumes that memory
-access outside of the mmap'ed area is invalid. That may not be the case
-depending on the actual memory layout of the test application. When that
-subtest was run on an x86-64 system with latest upstream kernel, the test
-passed as an error was returned from futex_wake(). On another PowerPC system,
-the same subtest failed because futex_wake() returned 0.
-
-  Bail out! futex2_wake(64, 0x86) should fail, but didn't
-
-Looking further into the passed subtest on x86-64, it was found that an
--EINVAL was returned instead of -EFAULT. The -EINVAL error was returned
-because the node value test with FLAGS_NUMA set failed with a node value
-of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed
-because the supposed node number wasn't valid. If that memory location
-happens to have a very small value (e.g. 0), the test will pass and no
-error will be returned.
-
-Since this subtest is non-deterministic, drop it unless a guard page beyond
-the mmap region is explicitly set.
-
-The other problematic test is the "Memory too small" test. The futex_wake()
-function returns the -EINVAL error code because the given futex address isn't
-8-byte aligned, not because only 4 of the 8 bytes are valid and the other
-4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to
-reflect the reality.
-
-  [ bp: Massage commit message. ]
-
-Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol")
-Signed-off-by: Waiman Long <longman@redhat.com>
-Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
-index a9ecfb2d3932a..802c15c821906 100644
---- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
-+++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
-@@ -182,12 +182,10 @@ int main(int argc, char *argv[])
- 	if (futex_numa->numa == FUTEX_NO_NODE)
- 		ksft_exit_fail_msg("NUMA node is left uninitialized\n");
- 
--	ksft_print_msg("Memory too small\n");
-+	/* FUTEX2_NUMA futex must be 8-byte aligned */
-+	ksft_print_msg("Mis-aligned futex\n");
- 	test_futex(futex_ptr + mem_size - 4, 1);
- 
--	ksft_print_msg("Memory out of range\n");
--	test_futex(futex_ptr + mem_size, 1);
--
- 	futex_numa->numa = FUTEX_NO_NODE;
- 	mprotect(futex_ptr, mem_size, PROT_READ);
- 	ksft_print_msg("Memory, RO\n");
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch b/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch
deleted file mode 100644
index f6fa1490ab..0000000000
--- a/queue-6.16/selftests-kselftest_harness-add-harness-selftest.exp.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 448aca94b3a3298d6ba4bf6f2b476b53cf4ac94d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 16:26:19 +0800
-Subject: selftests/kselftest_harness: Add harness-selftest.expected to
- TEST_FILES
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Yi Lai <yi1.lai@intel.com>
-
-[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ]
-
-The harness-selftest.expected is not installed in INSTALL_PATH.
-Attempting to execute harness-selftest.sh shows warning:
-
-diff: ./kselftest_harness/harness-selftest.expected: No such file or
-directory
-
-Add harness-selftest.expected to TEST_FILES.
-
-Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com
-Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest")
-Signed-off-by: Yi Lai <yi1.lai@intel.com>
-Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/kselftest_harness/Makefile | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile
-index 0617535a6ce42..d2369c01701a0 100644
---- a/tools/testing/selftests/kselftest_harness/Makefile
-+++ b/tools/testing/selftests/kselftest_harness/Makefile
-@@ -2,6 +2,7 @@
- 
- TEST_GEN_PROGS_EXTENDED := harness-selftest
- TEST_PROGS := harness-selftest.sh
-+TEST_FILES := harness-selftest.expected
- EXTRA_CLEAN := harness-selftest.seen
- 
- include ../lib.mk
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch b/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
deleted file mode 100644
index bb78663985..0000000000
--- a/queue-6.16/selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 5fe56e0a2b3dd5a0fe27a6c240633d26c71909e6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 12 Sep 2025 09:37:11 +0800
-Subject: selftests/mm: fix va_high_addr_switch.sh failure on x86_64
-
-From: Chunyu Hu <chuhu@redhat.com>
-
-[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ]
-
-The test will fail as below on x86_64 with cpu la57 support (will skip if
-no la57 support).  Note, the test requries nr_hugepages to be set first.
-
-  # running bash ./va_high_addr_switch.sh
-  # -------------------------------------
-  # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
-  # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK
-  # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
-  # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
-  # mmap(NULL): 0x7f55b60f9000 - OK
-  # mmap(low_addr): 0x40000000 - OK
-  # mmap(high_addr): 0x1000000000000 - OK
-  # mmap(high_addr) again: 0xffff55b6136000 - OK
-  # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK
-  # mmap(-1): 0xffff55b6134000 - OK
-  # mmap(-1) again: 0xffff55b6132000 - OK
-  # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
-  # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK
-  # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK
-  # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
-  # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
-  # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK
-  # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK
-  # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK
-  # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK
-  # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK
-  # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK
-  # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK
-  # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED
-  # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK
-  # [FAIL]
-
-addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for
-x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit.
-
-Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
-functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch
-code arch/x86/mm/hugetlbpage.c and addr is checked with
-map_address_hint_valid() after align with 'addr &= huge_page_mask(h)'
-which is a round down way, and it will fail the check because the addr is
-within the DEFAULT_MAP_WINDOW but (addr + len) is above the
-DFEFAULT_MAP_WINDOW.  So it wil go through the
-hugetlb_get_unmmaped_area_top_down() to find an area within the
-DFEFAULT_MAP_WINDOW.
-
-After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
-functions").  The addr hint for hugetlb_get_unmmaped_area() will be
-rounded up and aligned to hugepage size with ALIGN() for all arches.  And
-after the align, the addr will be above the default MAP_DEFAULT_WINDOW,
-and the map_addresshint_valid() check will pass because both aligned addr
-(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned
-hint address (0x800000000000) is returned as an suitable gap is found
-there, in arch_get_unmapped_area_topdown().
-
-To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and
-addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last
-hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr,
-and the addr + len (2 hugepages) will be one hugepage above the
-DEFAULT_MAP_WINDOW.  An aligned address won't be affected by the page
-round up or round down from kernel, so it's determistic.
-
-Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com
-Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions")
-Signed-off-by: Chunyu Hu <chuhu@redhat.com>
-Suggested-by: David Hildenbrand <david@redhat.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c
-index 896b3f73fc53b..306eba8251077 100644
---- a/tools/testing/selftests/mm/va_high_addr_switch.c
-+++ b/tools/testing/selftests/mm/va_high_addr_switch.c
-@@ -230,10 +230,10 @@ void testcases_init(void)
- 			.msg = "mmap(-1, MAP_HUGETLB) again",
- 		},
- 		{
--			.addr = (void *)(addr_switch_hint - pagesize),
-+			.addr = (void *)(addr_switch_hint - hugepagesize),
- 			.size = 2 * hugepagesize,
- 			.flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS,
--			.msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)",
-+			.msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)",
- 			.low_addr_required = 1,
- 			.keep_mapped = 1,
- 		},
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch b/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch
deleted file mode 100644
index 198147053d..0000000000
--- a/queue-6.16/selftests-nolibc-fix-expect_nz-macro.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From dc9543f633b53b297a85e8513a7812e792c845a7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 22:12:22 +0200
-Subject: selftests/nolibc: fix EXPECT_NZ macro
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Benjamin Berg <benjamin.berg@intel.com>
-
-[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
-
-The expect non-zero macro was incorrect and never used. Fix its
-definition.
-
-Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
-Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
-Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
-Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
-index b5c04c1372495..c2f0c40c1856f 100644
---- a/tools/testing/selftests/nolibc/nolibc-test.c
-+++ b/tools/testing/selftests/nolibc/nolibc-test.c
-@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
- }
- 
- 
--#define EXPECT_NZ(cond, expr, val)			\
--	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
-+#define EXPECT_NZ(cond, expr)				\
-+	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
- 
- static __attribute__((unused))
- int expect_nz(int expr, int llen)
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch b/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
deleted file mode 100644
index 525dc0d758..0000000000
--- a/queue-6.16/selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 60af0c353f0cd4a1778d4cb3f16567d186b6fdbe Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 07:39:02 +0200
-Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-
-[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]
-
-The _rval register variable is meant to be an output operand of the asm
-statement but is instead used as input operand.
-clang 20.1 notices this and triggers -Wuninitialized warnings:
-
-tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
-  154 |                 return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
-      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
-   59 |                 : "r" (_rval)                                           \
-      |                        ^~~~~
-tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
-tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
-   47 |         register long _rval asm ("r3");                                 \
-      |         ^
-
-It seems the list of input and output operands have been switched around.
-However as the argument registers are not always initialized they can not
-be marked as pure inputs as that would trigger -Wuninitialized warnings.
-Adding _rval as another input and output operand does also not work as it
-would collide with the existing _r3 variable.
-
-Instead reuse _r3 for both the argument and the return value.
-
-Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
-Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de
-Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
-index bb237d771051b..e7205584cbdca 100644
---- a/tools/testing/selftests/vDSO/vdso_call.h
-+++ b/tools/testing/selftests/vDSO/vdso_call.h
-@@ -44,7 +44,6 @@
- 	register long _r6 asm ("r6");					\
- 	register long _r7 asm ("r7");					\
- 	register long _r8 asm ("r8");					\
--	register long _rval asm ("r3");					\
- 									\
- 	LOADARGS_##nr(fn, args);					\
- 									\
-@@ -54,13 +53,13 @@
- 		"	bns+	1f\n"					\
- 		"	neg	3, 3\n"					\
- 		"1:"							\
--		: "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5),	\
-+		: "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5),	\
- 		  "+r" (_r6), "+r" (_r7), "+r" (_r8)			\
--		: "r" (_rval)						\
-+		:							\
- 		: "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5",	\
- 		  "cr6", "cr7", "xer", "lr", "ctr", "memory"		\
- 	);								\
--	_rval;								\
-+	_r3;								\
- })
- 
- #else
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch b/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
deleted file mode 100644
index a04ce6f1e2..0000000000
--- a/queue-6.16/selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 537af440da373ab81d548095064e9249784c3163 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 07:39:03 +0200
-Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with
- missing vDSO
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-
-[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]
-
-If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
-Currently this results in the following output:
-
-	TAP version 13
-	1..16
-	# AT_SYSINFO_EHDR is not present!
-
-This output is incorrect, as "1..16" still requires the subtest lines to
-be printed, which isn't done however.
-
-Switch to the correct skipping functions, so the output now correctly
-indicates that no subtests are being run:
-
-	TAP version 13
-	1..0 # SKIP AT_SYSINFO_EHDR is not present!
-
-Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
-Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
-index a54424e2336f4..67cbfc56e4e1b 100644
---- a/tools/testing/selftests/vDSO/vdso_test_abi.c
-+++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
-@@ -182,12 +182,11 @@ int main(int argc, char **argv)
- 	unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
- 
- 	ksft_print_header();
--	ksft_set_plan(VDSO_TEST_PLAN);
- 
--	if (!sysinfo_ehdr) {
--		ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
--		return KSFT_SKIP;
--	}
-+	if (!sysinfo_ehdr)
-+		ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
-+
-+	ksft_set_plan(VDSO_TEST_PLAN);
- 
- 	version = versions[VDSO_VERSION];
- 	name = (const char **)&names[VDSO_NAMES];
--- 
-2.51.0
-
diff --git a/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch b/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
deleted file mode 100644
index 09d043731f..0000000000
--- a/queue-6.16/selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 7d70db8f301c6b93f0ccee62ce66707c5a08ebb7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 14 Sep 2025 20:58:41 +0530
-Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
- supported
-
-From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
-
-[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
-
-Check if watchdog device supports WDIOF_KEEPALIVEPING option before
-entering keep_alive() ping test loop. Fix watchdog-test silently looping
-if ioctl based ping is not supported by the device. Exit from test in
-such case instead of getting stuck in loop executing failing keep_alive()
-
-watchdog_info:
- identity:              m41t93 rtc Watchdog
- firmware_version:      0
-Support/Status: Set timeout (in seconds)
-Support/Status: Watchdog triggers a management or other external alarm not a reboot
-
-Watchdog card disabled.
-Watchdog timeout set to 5 seconds.
-Watchdog ping rate set to 2 seconds.
-Watchdog card enabled.
-WDIOC_KEEPALIVE not supported by this device
-
-without this change
-Watchdog card disabled.
-Watchdog timeout set to 5 seconds.
-Watchdog ping rate set to 2 seconds.
-Watchdog card enabled.
-Watchdog Ticking Away!
-(Where test stuck here forver silently)
-
-Updated change log at commit time:
-Shuah Khan <skhan@linuxfoundation.org>
-
-Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
-Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
-Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
-index a1f506ba55786..4f09c5db0c7f3 100644
---- a/tools/testing/selftests/watchdog/watchdog-test.c
-+++ b/tools/testing/selftests/watchdog/watchdog-test.c
-@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
- 	if (oneshot)
- 		goto end;
- 
-+	/* Check if WDIOF_KEEPALIVEPING is supported */
-+	if (!(info.options & WDIOF_KEEPALIVEPING)) {
-+		printf("WDIOC_KEEPALIVE not supported by this device\n");
-+		goto end;
-+	}
-+
- 	printf("Watchdog Ticking Away!\n");
- 
- 	/*
--- 
-2.51.0
-
diff --git a/queue-6.16/serial-max310x-add-error-checking-in-probe.patch b/queue-6.16/serial-max310x-add-error-checking-in-probe.patch
deleted file mode 100644
index 0dfa17fd46..0000000000
--- a/queue-6.16/serial-max310x-add-error-checking-in-probe.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From f5f9a093d2381a944ab58013fb0d77b6b20ed6e9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 7 Aug 2025 18:54:37 +0300
-Subject: serial: max310x: Add error checking in probe()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
-
-Check if devm_i2c_new_dummy_device() fails.
-
-Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/max310x.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
-index 541c790c01090..2b42a4c21a9b8 100644
---- a/drivers/tty/serial/max310x.c
-+++ b/drivers/tty/serial/max310x.c
-@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
- 		port_client = devm_i2c_new_dummy_device(&client->dev,
- 							client->adapter,
- 							port_addr);
-+		if (IS_ERR(port_client))
-+			return PTR_ERR(port_client);
- 
- 		regcfg_i2c.name = max310x_regmap_name(i);
- 		regmaps[i] = devm_regmap_init_i2c(port_client, &regcfg_i2c);
--- 
-2.51.0
-
diff --git a/queue-6.16/series b/queue-6.16/series
deleted file mode 100644
index cffd61b731..0000000000
--- a/queue-6.16/series
+++ /dev/null
@@ -1,332 +0,0 @@
-arch-copy_thread-pass-clone_flags-as-u64.patch
-filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
-init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
-pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
-seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
-kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
-selftests-arm64-check-fread-return-value-in-exec_tar.patch
-kselftest-arm64-gcs-correctly-check-return-value-whe.patch
-gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
-powerpc-8xx-remove-left-over-instruction-and-comment.patch
-powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
-powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
-powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
-uprobes-uprobe_warn-should-use-passed-task.patch
-raid6-riscv-clean-up-unused-header-file-inclusion.patch
-coresight-trbe-prevent-overflow-in-perf_idx2off.patch
-perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
-smb-server-fix-ird-ord-negotiation-with-the-client.patch
-edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
-perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
-perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
-x86-vdso-fix-output-operand-size-of-rdpid.patch
-selftests-cgroup-make-test_pids-backwards-compatible.patch
-lsm-config_lsm-can-depend-on-config_security.patch
-cpuset-fix-failure-to-enable-isolated-partition-when.patch
-btrfs-return-any-hit-error-from-extent_writepage_io.patch
-pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
-arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
-bpf-tidy-verifier-bug-message.patch
-regmap-remove-superfluous-check-for-config-in-__regm.patch
-selftests-bpf-copy-test_kmods-when-installing-selfte.patch
-rust-cpumask-mark-cpumaskvar-as-transparent.patch
-bpf-selftests-fix-test_tcpnotify_user.patch
-bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
-libbpf-fix-reuse-of-devmap.patch
-arm-dts-renesas-porter-fix-can-pin-group.patch
-leds-max77705-function-return-instead-of-variable-as.patch
-leds-flash-leds-qcom-flash-update-torch-current-clam.patch
-s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
-s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
-cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
-arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
-arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
-libbpf-export-bpf_object__prepare-symbol.patch
-firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
-arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
-arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
-arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
-acpi-processor-idle-fix-memory-leak-when-register-cp.patch
-soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
-pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
-blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
-arm-at91-pm-fix-mckx-restore-routine.patch
-arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
-regulator-scmi-use-int-type-to-store-negative-error-.patch
-selftests-futex-fix-some-futex_numa_mpol-subtests.patch
-selftests-nolibc-fix-expect_nz-macro.patch
-leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
-block-use-int-to-store-blk_stack_limits-return-value.patch
-arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
-dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
-selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
-vdso-datastore-gate-time-data-behind-config_generic_.patch
-pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
-vdso-add-struct-__kernel_old_timeval-forward-declara.patch
-arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
-arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
-arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
-pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
-power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
-pinctrl-renesas-use-int-type-to-store-negative-error.patch
-null_blk-fix-the-description-of-the-cache_size-modul.patch
-blk-throttle-fix-access-race-during-throttle-policy-.patch
-selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
-selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
-tick-do-not-set-device-to-detached-state-in-tick_shu.patch
-arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
-nbd-restrict-sockets-to-tcp-and-udp.patch
-pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
-firmware-firmware-meson-sm-fix-compile-test-default.patch
-dts-arm-amlogic-fix-pwm-node-for-c3.patch
-soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
-soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
-cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
-arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
-arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
-arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
-arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
-arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
-mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
-arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
-arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
-arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
-arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
-pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
-pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
-pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
-pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
-acpica-apply-acpi_nonstring.patch
-acpica-fix-largest-possible-resource-descriptor-inde.patch
-riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
-nvme-auth-update-bi_directional-flag.patch
-nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
-nvmet-fcloop-call-done-callback-even-when-remote-por.patch
-nvme-tcp-send-only-permitted-commands-for-secure-con.patch
-i3c-master-svc-use-manual-response-for-ibi-events.patch
-i3c-master-svc-recycle-unused-ibi-slot.patch
-selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
-selftests-kselftest_harness-add-harness-selftest.exp.patch
-blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
-bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
-bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
-selftests-always-install-uapi-headers-to-the-correct.patch
-smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
-mfd-max77705-max77705_charger-move-active-discharge-.patch
-tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
-spi-fix-return-code-when-spi-device-has-too-many-chi.patch
-clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
-clocksource-drivers-tegra186-avoid-64-bit-division.patch
-bpf-mark-kfuncs-as-__noclone.patch
-once-fix-race-by-moving-do_once-to-separate-section.patch
-hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
-thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
-thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
-i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
-i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
-i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
-i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
-i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
-i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
-i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
-i2c-designware-add-disabling-clocks-when-probe-fails.patch
-libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
-bpf-enforce-expected_attach_type-for-tailcall-compat.patch
-mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
-drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
-drm-panel-novatek-nt35560-fix-invalid-return-value.patch
-drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
-drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
-drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
-f2fs-fix-condition-in-__allow_reserved_blocks.patch
-f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
-f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
-drm-bridge-it6505-select-regmap_i2c.patch
-wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
-hid-steelseries-refactor-probe-and-remove.patch
-media-zoran-remove-zoran_fh-structure.patch
-phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
-drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
-usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
-usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
-pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
-serial-max310x-add-error-checking-in-probe.patch
-drm-amd-display-remove-redundant-semicolons.patch
-drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
-crypto-keembay-add-missing-check-after-sg_nents_for_.patch
-hwrng-nomadik-add-arm_amba-dependency.patch
-docs-iio-ad3552r-fix-malformed-code-block-directive.patch
-fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
-scsi-pm80xx-restore-support-for-expanders.patch
-scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
-scsi-myrs-fix-dma_alloc_coherent-error-check.patch
-crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
-drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
-media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
-media-i2c-vd55g1-fix-duster-register-address.patch
-rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
-wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
-pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
-alsa-lx_core-use-int-type-to-store-negative-error-co.patch
-media-st-delta-avoid-excessive-stack-usage.patch
-accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
-crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
-crypto-hisilicon-re-enable-address-prefetch-after-de.patch
-crypto-hisilicon-check-the-sva-module-status-while-e.patch
-crypto-hisilicon-qm-check-whether-the-input-function.patch
-crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
-inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
-dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
-coresight-trbe-add-isb-after-trblimitr-write.patch
-coresight-fix-missing-include-for-field_get.patch
-coresight-only-register-perf-symlink-for-sinks-with-.patch
-drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
-drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
-drm-amd-pm-fix-si_upload_smc_data-v3.patch
-drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
-drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
-drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
-drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
-wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
-drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
-pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
-pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
-tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
-fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
-drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
-usb-phy-twl6030-fix-incorrect-type-for-ret.patch
-usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
-tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
-misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
-pps-fix-warning-in-pps_register_cdev-when-register-d.patch
-wifi-iwlwifi-remove-redundant-header-files.patch
-idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
-asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
-asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
-asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
-drm-msm-dpu-fix-incorrect-type-for-ret.patch
-fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
-fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
-iio-consumers-fix-handling-of-negative-channel-scale.patch
-iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
-mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
-tools-ynl-fix-undefined-variable-name.patch
-netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
-ipvs-use-read_once-write_once-for-ipvs-enable.patch
-hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
-watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
-watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
-drivers-base-node-handle-error-properly-in-register_.patch
-rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
-wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
-wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
-wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
-wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
-wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
-wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
-wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
-wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
-wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
-asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
-srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
-drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
-f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
-f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
-f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
-alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
-acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
-scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
-scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
-scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
-hid-hidraw-tighten-ioctl-command-parsing.patch
-f2fs-fix-zero-sized-extent-for-precache-extents.patch
-revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
-rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
-ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
-documentation-trace-historgram-design-separate-sched.patch
-wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
-wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
-wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
-wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
-wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
-wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
-iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
-wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
-asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
-sparc-fix-accurate-exception-reporting-in-copy_-from.patch
-sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082
-sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084
-sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
-sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584
-vfio-pds-replace-bitmap_free-with-vfree.patch
-crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
-wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
-rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
-remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
-rdma-rxe-fix-race-in-do_task-when-draining.patch
-selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
-wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
-wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
-pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
-remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
-remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
-wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
-dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
-coresight-fix-indentation-error-in-cscfg_remove_owne.patch
-coresight-etm4x-conditionally-access-register-trcext.patch
-coresight-tmc-support-atclk.patch
-coresight-catu-support-atclk.patch
-coresight-etm4x-support-atclk.patch
-coresight-appropriately-disable-programming-clocks.patch
-coresight-appropriately-disable-trace-bus-clocks.patch
-coresight-avoid-enable-programming-clock-duplicately.patch
-coresight-trbe-return-null-pointer-for-allocation-fa.patch
-coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
-coresight-fix-incorrect-handling-for-return-value-of.patch
-nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
-net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
-ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
-netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
-netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
-scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
-scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
-usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
-pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
-pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
-pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
-iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
-iommu-selftest-prevent-use-of-uninitialized-variable.patch
-rdma-siw-always-report-immediate-post-sq-errors.patch
-net-enetc-fix-probing-error-message-typo-for-the-ene.patch
-net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
-ptp-add-a-upper-bound-on-max_vclocks.patch
-vhost-vringh-fix-copy_to_iter-return-value-check.patch
-bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
-bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
-bluetooth-iso-free-rx_skb-if-not-consumed.patch
-bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
-bluetooth-hci_sync-fix-using-random-address-for-big-.patch
-keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
-hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
-ocfs2-fix-double-free-in-user_cluster_connect.patch
-drivers-base-node-fix-double-free-in-register_one_no.patch
-hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
-mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
-pci-j721e-fix-incorrect-error-message-in-probe.patch
-idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
-nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
-net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
-net-dlink-handle-copy_thresh-allocation-failure.patch
-net-mlx5-stop-polling-for-command-response-if-interf.patch
-net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
-net-mlx5-fw-reset-add-reset-timeout-work.patch
-smb-client-fix-crypto-buffers-in-non-linear-memory.patch
-bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
-net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
-iommufd-register-iommufd-mock-devices-with-fwspec.patch
-revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
-octeontx2-vf-fix-bitmap-leak.patch
-octeontx2-pf-fix-bitmap-leak.patch
-vhost-vringh-modify-the-return-value-check.patch
-bpf-reject-negative-offsets-for-alu-ops.patch
diff --git a/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch b/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch
deleted file mode 100644
index 714494e788..0000000000
--- a/queue-6.16/smb-client-fix-crypto-buffers-in-non-linear-memory.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From 410968e585100d9c0642272ba9d2b068c80482a9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 12:10:33 -0300
-Subject: smb: client: fix crypto buffers in non-linear memory
-
-From: Enzo Matsumiya <ematsumiya@suse.de>
-
-[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
-
-The crypto API, through the scatterlist API, expects input buffers to be
-in linear memory.  We handle this with the cifs_sg_set_buf() helper
-that converts vmalloc'd memory to their corresponding pages.
-
-However, when we allocate our aead_request buffer (@creq in
-smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
-puts aead_request->__ctx in vmalloc area.
-
-AEAD algorithm then uses ->__ctx for its private/internal data and
-operations, and uses sg_set_buf() for such data on a few places.
-
-This works fine as long as @creq falls into kmalloc zone (small
-requests) or vmalloc'd memory is still within linear range.
-
-Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
-many tasks will increment the base stacks' addresses to a point where
-virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
-happens.
-
-In practice: too many parallel reads and writes on an encrypted mount
-will trigger this bug.
-
-To fix this, always alloc @creq with kmalloc() instead.
-Also drop the @sensitive_size variable/arguments since
-kfree_sensitive() doesn't need it.
-
-Backtrace:
-
-[  945.272081] ------------[ cut here ]------------
-[  945.272774] kernel BUG at include/linux/scatterlist.h:209!
-[  945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
-[  945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
-[  945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
-[  945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
-[  945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
-[  945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
-[  945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
-[  945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
-[  945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
-[  945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
-[  945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
-[  945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
-[  945.284407] FS:  0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
-[  945.285262] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[  945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
-[  945.286683] Call Trace:
-[  945.286952]  <TASK>
-[  945.287184]  ? crypt_message+0x33f/0xad0 [cifs]
-[  945.287719]  crypto_gcm_encrypt+0x36/0xe0
-[  945.288152]  crypt_message+0x54a/0xad0 [cifs]
-[  945.288724]  smb3_init_transform_rq+0x277/0x300 [cifs]
-[  945.289300]  smb_send_rqst+0xa3/0x160 [cifs]
-[  945.289944]  cifs_call_async+0x178/0x340 [cifs]
-[  945.290514]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
-[  945.291177]  smb2_async_writev+0x3e3/0x670 [cifs]
-[  945.291759]  ? find_held_lock+0x32/0x90
-[  945.292212]  ? netfs_advance_write+0xf2/0x310
-[  945.292723]  netfs_advance_write+0xf2/0x310
-[  945.293210]  netfs_write_folio+0x346/0xcc0
-[  945.293689]  ? __pfx__raw_spin_unlock_irq+0x10/0x10
-[  945.294250]  netfs_writepages+0x117/0x460
-[  945.294724]  do_writepages+0xbe/0x170
-[  945.295152]  ? find_held_lock+0x32/0x90
-[  945.295600]  ? kvm_sched_clock_read+0x11/0x20
-[  945.296103]  __writeback_single_inode+0x56/0x4b0
-[  945.296643]  writeback_sb_inodes+0x229/0x550
-[  945.297140]  __writeback_inodes_wb+0x4c/0xe0
-[  945.297642]  wb_writeback+0x2f1/0x3f0
-[  945.298069]  wb_workfn+0x300/0x490
-[  945.298472]  process_one_work+0x1fe/0x590
-[  945.298949]  worker_thread+0x1ce/0x3c0
-[  945.299397]  ? __pfx_worker_thread+0x10/0x10
-[  945.299900]  kthread+0x119/0x210
-[  945.300285]  ? __pfx_kthread+0x10/0x10
-[  945.300729]  ret_from_fork+0x119/0x1b0
-[  945.301163]  ? __pfx_kthread+0x10/0x10
-[  945.301601]  ret_from_fork_asm+0x1a/0x30
-[  945.302055]  </TASK>
-
-Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
-Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/smb/client/smb2ops.c | 17 ++++++-----------
- 1 file changed, 6 insertions(+), 11 deletions(-)
-
-diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
-index cd051bb1a9d60..62d6a465dfa10 100644
---- a/fs/smb/client/smb2ops.c
-+++ b/fs/smb/client/smb2ops.c
-@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
- static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
- 				 int num_rqst, const u8 *sig, u8 **iv,
- 				 struct aead_request **req, struct sg_table *sgt,
--				 unsigned int *num_sgs, size_t *sensitive_size)
-+				 unsigned int *num_sgs)
- {
- 	unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
- 	unsigned int iv_size = crypto_aead_ivsize(tfm);
-@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
- 	len += req_size;
- 	len = ALIGN(len, __alignof__(struct scatterlist));
- 	len += array_size(*num_sgs, sizeof(struct scatterlist));
--	*sensitive_size = len;
- 
--	p = kvzalloc(len, GFP_NOFS);
-+	p = kzalloc(len, GFP_NOFS);
- 	if (!p)
- 		return ERR_PTR(-ENOMEM);
- 
-@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
- 
- static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
- 			       int num_rqst, const u8 *sig, u8 **iv,
--			       struct aead_request **req, struct scatterlist **sgl,
--			       size_t *sensitive_size)
-+			       struct aead_request **req, struct scatterlist **sgl)
- {
- 	struct sg_table sgtable = {};
- 	unsigned int skip, num_sgs, i, j;
- 	ssize_t rc;
- 	void *p;
- 
--	p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
--				&num_sgs, sensitive_size);
-+	p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
- 	if (IS_ERR(p))
- 		return ERR_CAST(p);
- 
-@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
- 	DECLARE_CRYPTO_WAIT(wait);
- 	unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
- 	void *creq;
--	size_t sensitive_size;
- 
- 	rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
- 	if (rc) {
-@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
- 		return rc;
- 	}
- 
--	creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
--				 &sensitive_size);
-+	creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
- 	if (IS_ERR(creq))
- 		return PTR_ERR(creq);
- 
-@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
- 	if (!rc && enc)
- 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
- 
--	kvfree_sensitive(creq, sensitive_size);
-+	kfree_sensitive(creq);
- 	return rc;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch b/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch
deleted file mode 100644
index 7ff14e586b..0000000000
--- a/queue-6.16/smb-server-fix-ird-ord-negotiation-with-the-client.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-From 92876ffc0a3fbb9b5f61a05cb5bdfc012f0db042 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 20 Aug 2025 15:34:58 +0200
-Subject: smb: server: fix IRD/ORD negotiation with the client
-
-From: Stefan Metzmacher <metze@samba.org>
-
-[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
-
-Already do real negotiation in smb_direct_handle_connect_request()
-where we see the requested initiator_depth and responder_resources
-from the client.
-
-We should detect legacy iwarp clients using MPA v1
-with the custom IRD/ORD negotiation.
-
-We need to send the custom IRD/ORD in big endian,
-but we need to try to let clients with broken requests
-using little endian (older cifs.ko) to work.
-
-Note the reason why this uses u8 for
-initiator_depth and responder_resources is
-that the rdma layer also uses it.
-
-Acked-by: Namjae Jeon <linkinjeon@kernel.org>
-Cc: Steve French <smfrench@gmail.com>
-Cc: Tom Talpey <tom@talpey.com>
-Cc: linux-cifs@vger.kernel.org
-Cc: samba-technical@lists.samba.org
-Cc: linux-rdma@vger.kernel.org
-Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
- 1 file changed, 85 insertions(+), 14 deletions(-)
-
-diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
-index 74dfb6496095d..e1f659d3b4cf5 100644
---- a/fs/smb/server/transport_rdma.c
-+++ b/fs/smb/server/transport_rdma.c
-@@ -153,6 +153,10 @@ struct smb_direct_transport {
- 	struct work_struct	disconnect_work;
- 
- 	bool			negotiation_requested;
-+
-+	bool			legacy_iwarp;
-+	u8			initiator_depth;
-+	u8			responder_resources;
- };
- 
- #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
-@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
- 	t->cm_id = cm_id;
- 	cm_id->context = t;
- 
-+	t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
-+	t->responder_resources = 1;
-+
- 	t->status = SMB_DIRECT_CS_NEW;
- 	init_waitqueue_head(&t->wait_status);
- 
-@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
- static int smb_direct_accept_client(struct smb_direct_transport *t)
- {
- 	struct rdma_conn_param conn_param;
--	struct ib_port_immutable port_immutable;
--	u32 ird_ord_hdr[2];
-+	__be32 ird_ord_hdr[2];
- 	int ret;
- 
-+	/*
-+	 * smb_direct_handle_connect_request()
-+	 * already negotiated t->initiator_depth
-+	 * and t->responder_resources
-+	 */
- 	memset(&conn_param, 0, sizeof(conn_param));
--	conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
--					   SMB_DIRECT_CM_INITIATOR_DEPTH);
--	conn_param.responder_resources = 0;
--
--	t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
--						 t->cm_id->port_num,
--						 &port_immutable);
--	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
--		ird_ord_hdr[0] = conn_param.responder_resources;
--		ird_ord_hdr[1] = 1;
-+	conn_param.initiator_depth = t->initiator_depth;
-+	conn_param.responder_resources = t->responder_resources;
-+
-+	if (t->legacy_iwarp) {
-+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
-+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
- 		conn_param.private_data = ird_ord_hdr;
- 		conn_param.private_data_len = sizeof(ird_ord_hdr);
- 	} else {
-@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
- 	return true;
- }
- 
--static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
-+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
-+					     struct rdma_cm_event *event)
- {
- 	struct smb_direct_transport *t;
- 	struct task_struct *handler;
-+	u8 peer_initiator_depth;
-+	u8 peer_responder_resources;
- 	int ret;
- 
- 	if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
-@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
- 	if (!t)
- 		return -ENOMEM;
- 
-+	peer_initiator_depth = event->param.conn.initiator_depth;
-+	peer_responder_resources = event->param.conn.responder_resources;
-+	if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
-+	    event->param.conn.private_data_len == 8) {
-+		/*
-+		 * Legacy clients with only iWarp MPA v1 support
-+		 * need a private blob in order to negotiate
-+		 * the IRD/ORD values.
-+		 */
-+		const __be32 *ird_ord_hdr = event->param.conn.private_data;
-+		u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
-+		u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
-+
-+		/*
-+		 * cifs.ko sends the legacy IRD/ORD negotiation
-+		 * event if iWarp MPA v2 was used.
-+		 *
-+		 * Here we check that the values match and only
-+		 * mark the client as legacy if they don't match.
-+		 */
-+		if ((u32)event->param.conn.initiator_depth != ird32 ||
-+		    (u32)event->param.conn.responder_resources != ord32) {
-+			/*
-+			 * There are broken clients (old cifs.ko)
-+			 * using little endian and also
-+			 * struct rdma_conn_param only uses u8
-+			 * for initiator_depth and responder_resources,
-+			 * so we truncate the value to U8_MAX.
-+			 *
-+			 * smb_direct_accept_client() will then
-+			 * do the real negotiation in order to
-+			 * select the minimum between client and
-+			 * server.
-+			 */
-+			ird32 = min_t(u32, ird32, U8_MAX);
-+			ord32 = min_t(u32, ord32, U8_MAX);
-+
-+			t->legacy_iwarp = true;
-+			peer_initiator_depth = (u8)ird32;
-+			peer_responder_resources = (u8)ord32;
-+		}
-+	}
-+
-+	/*
-+	 * First set what the we as server are able to support
-+	 */
-+	t->initiator_depth = min_t(u8, t->initiator_depth,
-+				   new_cm_id->device->attrs.max_qp_rd_atom);
-+
-+	/*
-+	 * negotiate the value by using the minimum
-+	 * between client and server if the client provided
-+	 * non 0 values.
-+	 */
-+	if (peer_initiator_depth != 0)
-+		t->initiator_depth = min_t(u8, t->initiator_depth,
-+					   peer_initiator_depth);
-+	if (peer_responder_resources != 0)
-+		t->responder_resources = min_t(u8, t->responder_resources,
-+					       peer_responder_resources);
-+
- 	ret = smb_direct_connect(t);
- 	if (ret)
- 		goto out_err;
-@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
- {
- 	switch (event->event) {
- 	case RDMA_CM_EVENT_CONNECT_REQUEST: {
--		int ret = smb_direct_handle_connect_request(cm_id);
-+		int ret = smb_direct_handle_connect_request(cm_id, event);
- 
- 		if (ret) {
- 			pr_err("Can't create transport: %d\n", ret);
--- 
-2.51.0
-
diff --git a/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch b/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
deleted file mode 100644
index 78c26c50bd..0000000000
--- a/queue-6.16/smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 1ae3a2d8f97f193cae52bdc438142f56daa59846 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 13:44:14 +0200
-Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
-
-From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-
-[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
-
-The smp_call_function_many() kerneldoc comment got out of sync with the
-function definition (bool parameter "wait" is incorrectly described as a
-bitmask in it), so fix it up by copying the "wait" description from the
-smp_call_function() kerneldoc and add information regarding the handling
-of the local CPU to it.
-
-Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
-Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/smp.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/kernel/smp.c b/kernel/smp.c
-index 974f3a3962e8d..35af7e58b075f 100644
---- a/kernel/smp.c
-+++ b/kernel/smp.c
-@@ -892,16 +892,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
-  * @mask: The set of cpus to run on (only runs on online subset).
-  * @func: The function to run. This must be fast and non-blocking.
-  * @info: An arbitrary pointer to pass to the function.
-- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
-- *        (atomically) until function has completed on other CPUs. If
-- *        %SCF_RUN_LOCAL is set, the function will also be run locally
-- *        if the local CPU is set in the @cpumask.
-- *
-- * If @wait is true, then returns once @func has returned.
-+ * @wait: If true, wait (atomically) until function has completed
-+ *        on other CPUs.
-  *
-  * You must not call this function with disabled interrupts or from a
-  * hardware interrupt handler or from a bottom half handler. Preemption
-  * must be disabled when calling this function.
-+ *
-+ * @func is not called on the local CPU even if @mask contains it.  Consider
-+ * using on_each_cpu_cond_mask() instead if this is not desirable.
-  */
- void smp_call_function_many(const struct cpumask *mask,
- 			    smp_call_func_t func, void *info, bool wait)
--- 
-2.51.0
-
diff --git a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
deleted file mode 100644
index 74e8734b21..0000000000
--- a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From b4c275df9e4ef430bcc48f89c8b08e5817cb74bc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 11:56:50 +0200
-Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
-
-From: Johan Hovold <johan@kernel.org>
-
-[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]
-
-Make sure to drop the references taken by of_find_device_by_node() when
-looking up the thermal sensor and opp devices during probe on probe
-failure (e.g. probe deferral) and on driver unbind.
-
-Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
-Cc: Roger Lu <roger.lu@mediatek.com>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
-index 7c349a94b45c0..48804e1e5a6c8 100644
---- a/drivers/soc/mediatek/mtk-svs.c
-+++ b/drivers/soc/mediatek/mtk-svs.c
-@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
- 	return dev;
- }
- 
-+static void svs_put_device(void *_dev)
-+{
-+	struct device *dev = _dev;
-+
-+	put_device(dev);
-+}
-+
- static int svs_mt8192_platform_probe(struct svs_platform *svsp)
- {
- 	struct device *dev;
-@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
- {
- 	struct device *dev;
- 	u32 idx;
-+	int ret;
- 
- 	dev = svs_add_device_link(svsp, "thermal-sensor");
- 	if (IS_ERR(dev))
- 		return dev_err_probe(svsp->dev, PTR_ERR(dev),
- 				     "failed to get thermal device\n");
-+	put_device(dev);
- 
- 	for (idx = 0; idx < svsp->bank_max; idx++) {
- 		struct svs_bank *svsb = &svsp->banks[idx];
-@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
- 		case SVSB_SWID_CPU_LITTLE:
- 		case SVSB_SWID_CPU_BIG:
- 			svsb->opp_dev = get_cpu_device(bdata->cpu_id);
-+			get_device(svsb->opp_dev);
- 			break;
- 		case SVSB_SWID_CCI:
- 			svsb->opp_dev = svs_add_device_link(svsp, "cci");
-@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
- 			return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
- 					     "failed to get OPP device for bank %d\n",
- 					     idx);
-+
-+		ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
-+					       svsb->opp_dev);
-+		if (ret)
-+			return ret;
- 	}
- 
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch b/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
deleted file mode 100644
index 1973bfdd43..0000000000
--- a/queue-6.16/soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From ed3d4c1ba0edce1a72d745e243e75e2f53538bd1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 11:56:51 +0200
-Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
-
-From: Johan Hovold <johan@kernel.org>
-
-[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ]
-
-Make sure to drop the references taken by of_find_device_by_node() when
-looking up the thermal sensor and opp devices during probe on probe
-failure (e.g. probe deferral) and on driver unbind.
-
-Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
-Cc: Roger Lu <roger.lu@mediatek.com>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
-Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org
-Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soc/mediatek/mtk-svs.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
-index 48804e1e5a6c8..f45537546553e 100644
---- a/drivers/soc/mediatek/mtk-svs.c
-+++ b/drivers/soc/mediatek/mtk-svs.c
-@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
- {
- 	struct device *dev;
- 	u32 idx;
-+	int ret;
- 
- 	svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst");
- 	if (IS_ERR(svsp->rst))
-@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
- 	if (IS_ERR(dev))
- 		return dev_err_probe(svsp->dev, PTR_ERR(dev),
- 				     "failed to get lvts device\n");
-+	put_device(dev);
- 
- 	for (idx = 0; idx < svsp->bank_max; idx++) {
- 		struct svs_bank *svsb = &svsp->banks[idx];
-@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
- 		case SVSB_SWID_CPU_LITTLE:
- 		case SVSB_SWID_CPU_BIG:
- 			svsb->opp_dev = get_cpu_device(bdata->cpu_id);
-+			get_device(svsb->opp_dev);
- 			break;
- 		case SVSB_SWID_CCI:
- 			svsb->opp_dev = svs_add_device_link(svsp, "cci");
-@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
- 			return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
- 					     "failed to get OPP device for bank %d\n",
- 					     idx);
-+
-+		ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
-+					       svsb->opp_dev);
-+		if (ret)
-+			return ret;
- 	}
- 
- 	return 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch b/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
deleted file mode 100644
index 1fac0f2a1c..0000000000
--- a/queue-6.16/soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 9eba8eb3205e6523be168eefe837352abfa9104c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 Aug 2025 11:53:50 +0530
-Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
-
-From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
-
-[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
-
-Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
-transaction completes. Previously this bit was only cleared when
-a wake TCS was borrowed as an AMC TCS but not for dedicated
-AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
-power modes can generate a false completion IRQ.
-
-Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
-bit upon receiving a completion IRQ.
-
-Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
-Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
-Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
-index fdab2b1067dbb..c6f7d5c9c493d 100644
---- a/drivers/soc/qcom/rpmh-rsc.c
-+++ b/drivers/soc/qcom/rpmh-rsc.c
-@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
- 
- 		trace_rpmh_tx_done(drv, i, req);
- 
--		/*
--		 * If wake tcs was re-purposed for sending active
--		 * votes, clear AMC trigger & enable modes and
-+		/* Clear AMC trigger & enable modes and
- 		 * disable interrupt for this TCS
- 		 */
--		if (!drv->tcs[ACTIVE_TCS].num_tcs)
--			__tcs_set_trigger(drv, i, false);
-+		__tcs_set_trigger(drv, i, false);
- skip:
- 		/* Reclaim the TCS */
- 		write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
--- 
-2.51.0
-
diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch
deleted file mode 100644
index f8dc61afcb..0000000000
--- a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 33201b3c93695aa4309694221a6c80a90f8a495e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 00:03:30 +0200
-Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
- UltraSPARC
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-
-[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
-
-The referenced commit introduced exception handlers on user-space memory
-references in copy_from_user and copy_to_user. These handlers return from
-the respective function and calculate the remaining bytes left to copy
-using the current register contents. This commit fixes a couple of bad
-calculations. This will fix the return value of copy_from_user and
-copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
-
-Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
-Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
-Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
-Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
-Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-Reviewed-by: Andreas Larsson <andreas@gaisler.com>
-Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
-Signed-off-by: Andreas Larsson <andreas@gaisler.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
- 1 file changed, 10 insertions(+), 9 deletions(-)
-
-diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
-index 635398ec7540e..154fbd35400ca 100644
---- a/arch/sparc/lib/U1memcpy.S
-+++ b/arch/sparc/lib/U1memcpy.S
-@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
- 	retl
- 	 add		%o0, %o2, %o0
- ENDPROC(U1_gs_40_fp)
--ENTRY(U1_g3_0_fp)
--	VISExitHalf
--	retl
--	 add		%g3, %o2, %o0
--ENDPROC(U1_g3_0_fp)
- ENTRY(U1_g3_8_fp)
- 	VISExitHalf
- 	add		%g3, 8, %g3
- 	retl
- 	 add		%g3, %o2, %o0
- ENDPROC(U1_g3_8_fp)
-+ENTRY(U1_g3_16_fp)
-+	VISExitHalf
-+	add		%g3, 16, %g3
-+	retl
-+	 add		%g3, %o2, %o0
-+ENDPROC(U1_g3_16_fp)
- ENTRY(U1_o2_0_fp)
- 	VISExitHalf
- 	retl
-@@ -547,18 +548,18 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
- 62:	FINISH_VISCHUNK(o0, f44, f46)
- 63:	UNEVEN_VISCHUNK_LAST(o0, f46, f0)
- 
--93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
-+93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
- 	add		%o1, 8, %o1
- 	subcc		%g3, 8, %g3
- 	faligndata	%f0, %f2, %f8
--	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
-+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
- 	bl,pn		%xcc, 95f
- 	 add		%o0, 8, %o0
--	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
-+	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
- 	add		%o1, 8, %o1
- 	subcc		%g3, 8, %g3
- 	faligndata	%f2, %f0, %f8
--	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
-+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
- 	bge,pt		%xcc, 93b
- 	 add		%o0, 8, %o0
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084
deleted file mode 100644
index 8419462e6a..0000000000
--- a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084
+++ /dev/null
@@ -1,111 +0,0 @@
-From 00d90918d1633bb081c039a9a6c0ca06f18db432 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 00:03:32 +0200
-Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
- Niagara
-
-From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-
-[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
-
-The referenced commit introduced exception handlers on user-space memory
-references in copy_from_user and copy_to_user. These handlers return from
-the respective function and calculate the remaining bytes left to copy
-using the current register contents. This commit fixes a couple of bad
-calculations and a broken epilogue in the exception handlers. This will
-prevent crashes and ensure correct return values of copy_from_user and
-copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
-
-Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
-Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
-Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
-Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
-Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
-Reviewed-by: Andreas Larsson <andreas@gaisler.com>
-Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
-Signed-off-by: Andreas Larsson <andreas@gaisler.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
- 1 file changed, 18 insertions(+), 11 deletions(-)
-
-diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
-index ee51c12306894..bbd3ea0a64822 100644
---- a/arch/sparc/lib/NGmemcpy.S
-+++ b/arch/sparc/lib/NGmemcpy.S
-@@ -79,8 +79,8 @@
- #ifndef EX_RETVAL
- #define EX_RETVAL(x)	x
- __restore_asi:
--	ret
- 	wr	%g0, ASI_AIUS, %asi
-+	ret
- 	 restore
- ENTRY(NG_ret_i2_plus_i4_plus_1)
- 	ba,pt	%xcc, __restore_asi
-@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
- 	ba,pt	%xcc, __restore_asi
- 	 add	%i2, %g1, %i0
- ENDPROC(NG_ret_i2_plus_g1_minus_56)
--ENTRY(NG_ret_i2_plus_i4)
-+ENTRY(NG_ret_i2_plus_i4_plus_16)
-+        add     %i4, 16, %i4
- 	ba,pt	%xcc, __restore_asi
- 	 add	%i2, %i4, %i0
--ENDPROC(NG_ret_i2_plus_i4)
--ENTRY(NG_ret_i2_plus_i4_minus_8)
--	sub	%i4, 8, %i4
-+ENDPROC(NG_ret_i2_plus_i4_plus_16)
-+ENTRY(NG_ret_i2_plus_i4_plus_8)
-+	add	%i4, 8, %i4
- 	ba,pt	%xcc, __restore_asi
- 	 add	%i2, %i4, %i0
--ENDPROC(NG_ret_i2_plus_i4_minus_8)
-+ENDPROC(NG_ret_i2_plus_i4_plus_8)
- ENTRY(NG_ret_i2_plus_8)
- 	ba,pt	%xcc, __restore_asi
- 	 add	%i2, 8, %i0
-@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
- 	ba,pt	%xcc, __restore_asi
- 	 add	%i2, %i4, %i0
- ENDPROC(NG_ret_i2_and_7_plus_i4)
-+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
-+	and	%i2, 7, %i2
-+	add	%i4, 8, %i4
-+	ba,pt	%xcc, __restore_asi
-+	 add	%i2, %i4, %i0
-+ENDPROC(NG_ret_i2_and_7_plus_i4)
- #endif
- 
- 	.align		64
-@@ -405,13 +412,13 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
- 	andn		%i2, 0xf, %i4
- 	and		%i2, 0xf, %i2
- 1:	subcc		%i4, 0x10, %i4
--	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
-+	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
- 	add		%i1, 0x08, %i1
--	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
-+	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
- 	sub		%i1, 0x08, %i1
--	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
-+	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
- 	add		%i1, 0x8, %i1
--	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
-+	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
- 	bgu,pt		%XCC, 1b
- 	 add		%i1, 0x8, %i1
- 73:	andcc		%i2, 0x8, %g0
-@@ -468,7 +475,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
- 	subcc		%i4, 0x8, %i4
- 	srlx		%g3, %i3, %i5
- 	or		%i5, %g2, %i5
--	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
-+	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
- 	add		%o0, 0x8, %o0
- 	bgu,pt		%icc, 1b
- 	 sllx		%g3, %g1, %g2
--- 
-2.51.0
-
diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082
deleted file mode 100644
index 4c25c3b50c..0000000000
--- a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082
+++ /dev/null
@@ -1,67 +0,0 @@
-From 211c7e7ce88c6cec9683dc4991eb8d55f71706b8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 00:03:31 +0200
-Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
- UltraSPARC III
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-
-[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
-
-Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
-enabled resulted from copy_from_user() returning impossibly large values
-greater than the size to be copied. This lead to __copy_from_iter()
-returning impossible values instead of the actual number of bytes it was
-able to copy.
-
-The BUG_ON has been reported in
-https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
-
-The referenced commit introduced exception handlers on user-space memory
-references in copy_from_user and copy_to_user. These handlers return from
-the respective function and calculate the remaining bytes left to copy
-using the current register contents. The exception handlers expect that
-%o2 has already been masked during the bulk copy loop, but the masking was
-performed after that loop. This will fix the return value of copy_from_user
-and copy_to_user in the faulting case. The behaviour of memcpy stays
-unchanged.
-
-Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
-Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
-Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
-Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
-Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-Reviewed-by: Andreas Larsson <andreas@gaisler.com>
-Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
-Signed-off-by: Andreas Larsson <andreas@gaisler.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/sparc/lib/U3memcpy.S | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
-index 9248d59c734ce..bace3a18f836f 100644
---- a/arch/sparc/lib/U3memcpy.S
-+++ b/arch/sparc/lib/U3memcpy.S
-@@ -267,6 +267,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
- 	faligndata	%f10, %f12, %f26
- 	EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
- 
-+	and		%o2, 0x3f, %o2
- 	subcc		GLOBAL_SPARE, 0x80, GLOBAL_SPARE
- 	add		%o1, 0x40, %o1
- 	bgu,pt		%XCC, 1f
-@@ -336,7 +337,6 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
- 	 * Also notice how this code is careful not to perform a
- 	 * load past the end of the src buffer.
- 	 */
--	and		%o2, 0x3f, %o2
- 	andcc		%o2, 0x38, %g2
- 	be,pn		%XCC, 2f
- 	 subcc		%g2, 0x8, %g2
--- 
-2.51.0
-
diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584 b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584
deleted file mode 100644
index 8a72a2caa4..0000000000
--- a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584
+++ /dev/null
@@ -1,112 +0,0 @@
-From d737d1e83bc6099846b3c1e323e74488ea365f23 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 00:03:34 +0200
-Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
-
-From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-
-[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
-
-The referenced commit introduced exception handlers on user-space memory
-references in copy_from_user and copy_to_user. These handlers return from
-the respective function and calculate the remaining bytes left to copy
-using the current register contents. This commit fixes a couple of bad
-calculations. This will fix the return value of copy_from_user and
-copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
-
-Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
-Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
-Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
-Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-Reviewed-by: Andreas Larsson <andreas@gaisler.com>
-Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
-Signed-off-by: Andreas Larsson <andreas@gaisler.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/sparc/lib/M7memcpy.S     | 20 ++++++++++----------
- arch/sparc/lib/Memcpy_utils.S |  9 +++++++++
- 2 files changed, 19 insertions(+), 10 deletions(-)
-
-diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
-index cbd42ea7c3f7c..99357bfa8e82a 100644
---- a/arch/sparc/lib/M7memcpy.S
-+++ b/arch/sparc/lib/M7memcpy.S
-@@ -696,16 +696,16 @@ FUNC_NAME:
- 	EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
- 	faligndata %f24, %f26, %f10
- 	EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
--	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
-+	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
- 	faligndata %f26, %f28, %f12
--	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
-+	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
- 	add	%o4, 64, %o4
--	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
-+	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
- 	faligndata %f28, %f30, %f14
--	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
--	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
-+	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
-+	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
- 	add	%o0, 64, %o0
--	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
-+	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
- 	fsrc2	%f30, %f14
- 	bgu,pt	%xcc, .Lunalign_sloop
- 	 prefetch [%o4 + (8 * BLOCK_SIZE)], 20
-@@ -728,7 +728,7 @@ FUNC_NAME:
- 	add	%o4, 8, %o4
- 	faligndata %f0, %f2, %f16
- 	subcc	%o5, 8, %o5
--	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
-+	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
- 	fsrc2	%f2, %f0
- 	bgu,pt	%xcc, .Lunalign_by8
- 	 add	%o0, 8, %o0
-@@ -772,7 +772,7 @@ FUNC_NAME:
- 	subcc	%o5, 0x20, %o5
- 	EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
- 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
--	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
-+	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
- 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
- 	bne,pt	%xcc, 1b
- 	 add	%o0, 0x20, %o0
-@@ -804,12 +804,12 @@ FUNC_NAME:
- 	brz,pt	%o3, 2f
- 	 sub	%o2, %o3, %o2
- 
--1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
-+1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
- 	add	%o1, 1, %o1
- 	subcc	%o3, 1, %o3
- 	add	%o0, 1, %o0
- 	bne,pt	%xcc, 1b
--	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
-+	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
- 2:
- 	and	%o1, 0x7, %o3
- 	brz,pn	%o3, .Lmedium_noprefetch_cp
-diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
-index 64fbac28b3db1..207343367bb2d 100644
---- a/arch/sparc/lib/Memcpy_utils.S
-+++ b/arch/sparc/lib/Memcpy_utils.S
-@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
- 	ba,pt	%xcc, __restore_asi
- 	 add	%o2, 8, %o0
- ENDPROC(memcpy_retl_o2_plus_63_8)
-+ENTRY(memcpy_retl_o2_plus_o3)
-+	ba,pt	%xcc, __restore_asi
-+	 add	%o2, %o3, %o0
-+ENDPROC(memcpy_retl_o2_plus_o3)
-+ENTRY(memcpy_retl_o2_plus_o3_plus_1)
-+	add	%o3, 1, %o3
-+	ba,pt	%xcc, __restore_asi
-+	 add	%o2, %o3, %o0
-+ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
- ENTRY(memcpy_retl_o2_plus_o5)
- 	ba,pt	%xcc, __restore_asi
- 	 add	%o2, %o5, %o0
--- 
-2.51.0
-
diff --git a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch b/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
deleted file mode 100644
index 411c0bf969..0000000000
--- a/queue-6.16/sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 27c3a9f853ca71452906e0e8ae994b0f8baab2ec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 00:03:33 +0200
-Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
-
-From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-
-[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
-
-The referenced commit introduced exception handlers on user-space memory
-references in copy_from_user and copy_to_user. These handlers return from
-the respective function and calculate the remaining bytes left to copy
-using the current register contents. This commit fixes a bad calculation.
-This will fix the return value of copy_to_user in a specific faulting case.
-The behaviour of memcpy stays unchanged.
-
-Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
-Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
-Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
-Reviewed-by: Andreas Larsson <andreas@gaisler.com>
-Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
-Signed-off-by: Andreas Larsson <andreas@gaisler.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/sparc/lib/NG4memcpy.S | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
-index 7ad58ebe0d009..df0ec1bd19489 100644
---- a/arch/sparc/lib/NG4memcpy.S
-+++ b/arch/sparc/lib/NG4memcpy.S
-@@ -281,7 +281,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
- 	subcc		%o5, 0x20, %o5
- 	EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
- 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
--	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
-+	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
- 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
- 	bne,pt		%icc, 1b
- 	 add		%o0, 0x20, %o0
--- 
-2.51.0
-
diff --git a/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch b/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch
deleted file mode 100644
index cfff9498ae..0000000000
--- a/queue-6.16/spi-fix-return-code-when-spi-device-has-too-many-chi.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 9bb998ca4ba880c9ab805cebd7003dea83ca1d6b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 20:37:19 +0200
-Subject: spi: fix return code when spi device has too many chipselects
-
-From: Jonas Gorski <jonas.gorski@gmail.com>
-
-[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]
-
-Don't return a positive value when there are too many chipselects.
-
-Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
-Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
-Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/spi/spi.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 0ffa3f9f28707..68222a9898a4b 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -2450,7 +2450,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
- 	if (rc > ctlr->num_chipselect) {
- 		dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
- 			nc, rc);
--		return rc;
-+		return -EINVAL;
- 	}
- 	if ((of_property_present(nc, "parallel-memories")) &&
- 	    (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
--- 
-2.51.0
-
diff --git a/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch b/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
deleted file mode 100644
index d36618ec66..0000000000
--- a/queue-6.16/srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 25c5735cc2b1bc93a063024d3db934224e3bbafa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 11 Sep 2025 20:51:55 +0800
-Subject: srcu/tiny: Remove preempt_disable/enable() in
- srcu_gp_start_if_needed()
-
-From: Zqiang <qiang.zhang@linux.dev>
-
-[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ]
-
-Currently, the srcu_gp_start_if_needed() is always be invoked in
-preempt disable's critical section, this commit therefore remove
-redundant preempt_disable/enable() in srcu_gp_start_if_needed()
-and adds a call to lockdep_assert_preemption_disabled() in order
-to enable lockdep to diagnose mistaken invocations of this function
-from preempts-enabled code.
-
-Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption")
-Signed-off-by: Zqiang <qiang.zhang@linux.dev>
-Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/rcu/srcutiny.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
-index 6e9fe2ce1075d..e3b64a5e0ec7e 100644
---- a/kernel/rcu/srcutiny.c
-+++ b/kernel/rcu/srcutiny.c
-@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
- {
- 	unsigned long cookie;
- 
--	preempt_disable();  // Needed for PREEMPT_LAZY
-+	lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY
- 	cookie = get_state_synchronize_srcu(ssp);
- 	if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) {
--		preempt_enable();
- 		return;
- 	}
- 	WRITE_ONCE(ssp->srcu_idx_max, cookie);
-@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
- 		else if (list_empty(&ssp->srcu_work.entry))
- 			list_add(&ssp->srcu_work.entry, &srcu_boot_list);
- 	}
--	preempt_enable();
- }
- 
- /*
--- 
-2.51.0
-
diff --git a/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch b/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
deleted file mode 100644
index 671b911703..0000000000
--- a/queue-6.16/tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 7d1d82fd1749bb83ca9be73b5baab5d8f1e074b4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 3 Sep 2025 08:47:18 +0000
-Subject: tcp: fix __tcp_close() to only send RST when required
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
-
-If the receive queue contains payload that was already
-received, __tcp_close() can send an unexpected RST.
-
-Refine the code to take tp->copied_seq into account,
-as we already do in tcp recvmsg().
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Reviewed-by: Neal Cardwell <ncardwell@google.com>
-Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
-Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
-Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv4/tcp.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 98da33e0c308b..c818a8b32daeb 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -3102,8 +3102,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
- 
- void __tcp_close(struct sock *sk, long timeout)
- {
-+	bool data_was_unread = false;
- 	struct sk_buff *skb;
--	int data_was_unread = 0;
- 	int state;
- 
- 	WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
-@@ -3122,11 +3122,12 @@ void __tcp_close(struct sock *sk, long timeout)
- 	 *  reader process may not have drained the data yet!
- 	 */
- 	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
--		u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
-+		u32 end_seq = TCP_SKB_CB(skb)->end_seq;
- 
- 		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
--			len--;
--		data_was_unread += len;
-+			end_seq--;
-+		if (after(end_seq, tcp_sk(sk)->copied_seq))
-+			data_was_unread = true;
- 		__kfree_skb(skb);
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch b/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
deleted file mode 100644
index 9f9609cba2..0000000000
--- a/queue-6.16/thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From e96e9466538b93d5f9b2f3c6f7624fd13b8cf548 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Jul 2025 15:18:24 +0300
-Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
-
-From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-
-[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
-
-As reported by LKP, the Qualcomm LMH driver needs to include several
-IRQ-related headers, which decrlare necessary IRQ functionality.
-Currently driver builds on ARM64 platforms, where the headers are pulled
-in implicitly by other headers, but fails to build on other platforms.
-
-Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/thermal/qcom/lmh.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
-index 991d1573983d9..dff3dc062d736 100644
---- a/drivers/thermal/qcom/lmh.c
-+++ b/drivers/thermal/qcom/lmh.c
-@@ -5,6 +5,8 @@
-  */
- #include <linux/module.h>
- #include <linux/interrupt.h>
-+#include <linux/irq.h>
-+#include <linux/irqdesc.h>
- #include <linux/irqdomain.h>
- #include <linux/err.h>
- #include <linux/platform_device.h>
--- 
-2.51.0
-
diff --git a/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch b/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
deleted file mode 100644
index f3ab0288c6..0000000000
--- a/queue-6.16/thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 7b5c8fd0a70bf302bf375beb1d6e56716ca5715d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 28 Jul 2025 15:18:23 +0300
-Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
-
-From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-
-[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
-
-The QCOM_SCM symbol is not user-visible, so it makes little sense to
-depend on it. Make LMH driver select QCOM_SCM as all other drivers do
-and, as the dependecy is now correctly handled, enable || COMPILE_TEST
-in order to include the driver into broader set of build tests.
-
-Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/thermal/qcom/Kconfig | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
-index 2c7f3f9a26ebb..a6bb01082ec69 100644
---- a/drivers/thermal/qcom/Kconfig
-+++ b/drivers/thermal/qcom/Kconfig
-@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
- 
- config QCOM_LMH
- 	tristate "Qualcomm Limits Management Hardware"
--	depends on ARCH_QCOM && QCOM_SCM
-+	depends on ARCH_QCOM || COMPILE_TEST
-+	select QCOM_SCM
- 	help
- 	  This enables initialization of Qualcomm limits management
- 	  hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
--- 
-2.51.0
-
diff --git a/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch b/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch
deleted file mode 100644
index 237d71667d..0000000000
--- a/queue-6.16/tick-do-not-set-device-to-detached-state-in-tick_shu.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 8f4fa97e635945af0cbdb17e0fe32e5a4cc36b6c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 6 Sep 2025 14:49:51 +0800
-Subject: tick: Do not set device to detached state in tick_shutdown()
-
-From: Bibo Mao <maobibo@loongson.cn>
-
-[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ]
-
-tick_shutdown() sets the state of the clockevent device to detached
-first and the invokes clockevents_exchange_device(), which in turn
-invokes clockevents_switch_state().
-
-But clockevents_switch_state() returns without invoking the device shutdown
-callback as the device is already in detached state. As a consequence the
-timer device is not shutdown when a CPU goes offline.
-
-tick_shutdown() does this because it was originally invoked on a online CPU
-and not on the outgoing CPU. It therefore could not access the clockevent
-device of the already offlined CPU and just set the state.
-
-Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so
-the hardware device can be accessed.
-
-Remove the state set before calling clockevents_exchange_device(), so that
-the subsequent clockevents_switch_state() handles the state transition and
-invokes the shutdown callback of the clockevent device.
-
-[ tglx: Massaged change log ]
-
-Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING")
-Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
-Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/time/clockevents.c   |  2 +-
- kernel/time/tick-common.c   | 16 +++++-----------
- kernel/time/tick-internal.h |  2 +-
- 3 files changed, 7 insertions(+), 13 deletions(-)
-
-diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
-index f3e831f62906f..a59bc75ab7c5b 100644
---- a/kernel/time/clockevents.c
-+++ b/kernel/time/clockevents.c
-@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu)
- 	raw_spin_lock(&clockevents_lock);
- 
- 	tick_broadcast_offline(cpu);
--	tick_shutdown(cpu);
-+	tick_shutdown();
- 
- 	/*
- 	 * Unregister the clock event devices which were
-diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
-index 9a3859443c042..7e33d3f2e889b 100644
---- a/kernel/time/tick-common.c
-+++ b/kernel/time/tick-common.c
-@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu)
- }
- 
- /*
-- * Shutdown an event device on a given cpu:
-+ * Shutdown an event device on the outgoing CPU:
-  *
-- * This is called on a life CPU, when a CPU is dead. So we cannot
-- * access the hardware device itself.
-- * We just set the mode and remove it from the lists.
-+ * Called by the dying CPU during teardown, with clockevents_lock held
-+ * and interrupts disabled.
-  */
--void tick_shutdown(unsigned int cpu)
-+void tick_shutdown(void)
- {
--	struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
-+	struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
- 	struct clock_event_device *dev = td->evtdev;
- 
- 	td->mode = TICKDEV_MODE_PERIODIC;
- 	if (dev) {
--		/*
--		 * Prevent that the clock events layer tries to call
--		 * the set mode function!
--		 */
--		clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
- 		clockevents_exchange_device(dev, NULL);
- 		dev->event_handler = clockevents_handle_noop;
- 		td->evtdev = NULL;
-diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
-index faac36de35b9e..4e4f7bbe2a64b 100644
---- a/kernel/time/tick-internal.h
-+++ b/kernel/time/tick-internal.h
-@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
- extern void tick_handle_periodic(struct clock_event_device *dev);
- extern void tick_check_new_device(struct clock_event_device *dev);
- extern void tick_offline_cpu(unsigned int cpu);
--extern void tick_shutdown(unsigned int cpu);
-+extern void tick_shutdown(void);
- extern void tick_suspend(void);
- extern void tick_resume(void);
- extern bool tick_check_replacement(struct clock_event_device *curdev,
--- 
-2.51.0
-
diff --git a/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch b/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
deleted file mode 100644
index 2d9fbb0abf..0000000000
--- a/queue-6.16/tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From d35607ef99c26b9d8ef77bcbf37b7d8de669ba93 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 Sep 2025 01:46:43 +0000
-Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
- host headers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Zhouyi Zhou <zhouzhouyi@gmail.com>
-
-[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
-
-Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
-__kernel_old_time_t") made nolibc use the kernel's time type so that
-`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
-
-But since __kernel_old_time_t is fairly new, notably from 2020 in commit
-94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
-nolibc builds that rely on host headers may fail.
-
-Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
-has existed for longer.
-
-Tested in PPC VM of Open Source Lab of Oregon State University
-(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
-
-Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
-Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
-[Thomas: Reformat commit and its message a bit]
-Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/include/nolibc/std.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
-index ba950f0e73384..2c1ad23b9b5c1 100644
---- a/tools/include/nolibc/std.h
-+++ b/tools/include/nolibc/std.h
-@@ -29,6 +29,6 @@ typedef unsigned long       nlink_t;
- typedef   signed long         off_t;
- typedef   signed long     blksize_t;
- typedef   signed long      blkcnt_t;
--typedef __kernel_old_time_t  time_t;
-+typedef __kernel_time_t      time_t;
- 
- #endif /* _NOLIBC_STD_H */
--- 
-2.51.0
-
diff --git a/queue-6.16/tools-ynl-fix-undefined-variable-name.patch b/queue-6.16/tools-ynl-fix-undefined-variable-name.patch
deleted file mode 100644
index f0baab2c8f..0000000000
--- a/queue-6.16/tools-ynl-fix-undefined-variable-name.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From e048876e6207334177f3f23516d80cf096a9f199 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 23:07:47 +0200
-Subject: tools: ynl: fix undefined variable name
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
-
-[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ]
-
-This variable used in the error path was not defined according to Ruff.
-msg_format.attr_set is used instead, presumably the one that was
-supposed to be used originally.
-
-This is linked to Ruff error F821 [1]:
-
-  An undefined name is likely to raise NameError at runtime.
-
-Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl")
-Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1]
-Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
-Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
-Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
-Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/net/ynl/pyynl/lib/ynl.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py
-index 61deb59230671..7f49573896fd0 100644
---- a/tools/net/ynl/pyynl/lib/ynl.py
-+++ b/tools/net/ynl/pyynl/lib/ynl.py
-@@ -731,7 +731,7 @@ class YnlFamily(SpecFamily):
-                 subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set)
-                 decoded.update(subdict)
-             else:
--                raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'")
-+                raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'")
-         return decoded
- 
-     def _decode(self, attrs, space, outer_attrs = None):
--- 
-2.51.0
-
diff --git a/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch b/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
deleted file mode 100644
index 0d9acaa95b..0000000000
--- a/queue-6.16/tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 8e8cbeb90552f9eac6379c7a55609e7f05d9dd63 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Aug 2025 15:26:56 +0300
-Subject: tty: n_gsm: Don't block input queue by waiting MSC
-
-From: Seppo Takalo <seppo.takalo@nordicsemi.no>
-
-[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
-
-Currently gsm_queue() processes incoming frames and when opening
-a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
-If basic mode is used it calls gsm_modem_upd_via_msc() and it
-cannot block the input queue by waiting the response to come
-into the same input queue.
-
-Instead allow sending Modem Status Command without waiting for remote
-end to respond. Define a new function gsm_modem_send_initial_msc()
-for this purpose. As MSC is only valid for basic encoding, it does
-not do anything for advanced or when convergence layer type 2 is used.
-
-Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
-Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
-Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
- 1 file changed, 24 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
-index 7fc535452c0b3..553d8c70352b1 100644
---- a/drivers/tty/n_gsm.c
-+++ b/drivers/tty/n_gsm.c
-@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
- static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
- static void gsmld_write_trigger(struct gsm_mux *gsm);
- static void gsmld_write_task(struct work_struct *work);
-+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
- 
- /**
-  *	gsm_fcs_add	-	update FCS
-@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
- 		pr_debug("DLCI %d goes open.\n", dlci->addr);
- 	/* Send current modem state */
- 	if (dlci->addr) {
--		gsm_modem_update(dlci, 0);
-+		gsm_modem_send_initial_msc(dlci);
- 	} else {
- 		/* Start keep-alive control */
- 		gsm->ka_num = 0;
-@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
- 	return gsm_control_wait(dlci->gsm, ctrl);
- }
- 
-+/**
-+ * gsm_modem_send_initial_msc - Send initial modem status message
-+ *
-+ * @dlci channel
-+ *
-+ * Send an initial MSC message after DLCI open to set the initial
-+ * modem status lines. This is only done for basic mode.
-+ * Does not wait for a response as we cannot block the input queue
-+ * processing.
-+ */
-+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
-+{
-+	u8 modembits[2];
-+
-+	if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
-+		return 0;
-+
-+	modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
-+	modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
-+	return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
-+}
-+
- /**
-  *	gsm_modem_update	-	send modem status line state
-  *	@dlci: channel
--- 
-2.51.0
-
diff --git a/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch b/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch
deleted file mode 100644
index 9332776073..0000000000
--- a/queue-6.16/uprobes-uprobe_warn-should-use-passed-task.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 7d41eb3ce5c7de94f2ad829fffa2c6c21b78fa75 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 24 Aug 2025 22:34:21 -0500
-Subject: uprobes: uprobe_warn should use passed task
-
-From: Jeremy Linton <jeremy.linton@arm.com>
-
-[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ]
-
-uprobe_warn() is passed a task structure, yet its using current. For
-the most part this shouldn't matter, but since a task structure is
-provided, lets use it.
-
-Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances")
-Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
-Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
-Acked-by: Oleg Nesterov <oleg@redhat.com>
-Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Will Deacon <will@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/events/uprobes.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
-index 84ee7b590861a..d0a17f0e5b419 100644
---- a/kernel/events/uprobes.c
-+++ b/kernel/events/uprobes.c
-@@ -121,7 +121,7 @@ struct xol_area {
- 
- static void uprobe_warn(struct task_struct *t, const char *msg)
- {
--	pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg);
-+	pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg);
- }
- 
- /*
--- 
-2.51.0
-
diff --git a/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch b/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
deleted file mode 100644
index 88d3d924cd..0000000000
--- a/queue-6.16/usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 568aa438a34c1d38b83dc16f3c46a360e1e7bc0e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 22 Aug 2025 11:36:09 +0800
-Subject: usb: gadget: configfs: Correctly set use_os_string at bind
-
-From: William Wu <william.wu@rock-chips.com>
-
-[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
-
-Once the use_os_string flag is set to true for some functions
-(e.g. adb/mtp) which need to response the OS string, and then
-if we re-bind the ConfigFS gadget to use the other functions
-(e.g. hid) which should not to response the OS string, however,
-because the use_os_string flag is still true, so the usb gadget
-response the OS string descriptor incorrectly, this can cause
-the USB device to be unrecognizable on the Windows system.
-
-An example of this as follows:
-
-echo 1 > os_desc/use
-ln -s functions/ffs.adb configs/b.1/function0
-start adbd
-echo "<udc device>" > UDC   #succeed
-
-stop adbd
-rm configs/b.1/function0
-echo 0 > os_desc/use
-ln -s functions/hid.gs0 configs/b.1/function0
-echo "<udc device>" > UDC  #fail to connect on Windows
-
-This patch sets the use_os_string flag to false at bind if
-the functions not support OS Descriptors.
-
-Signed-off-by: William Wu <william.wu@rock-chips.com>
-Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
-Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/gadget/configfs.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
-index f94ea196ce547..6bcac85c55501 100644
---- a/drivers/usb/gadget/configfs.c
-+++ b/drivers/usb/gadget/configfs.c
-@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
- 		cdev->use_os_string = true;
- 		cdev->b_vendor_code = gi->b_vendor_code;
- 		memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
-+	} else {
-+		cdev->use_os_string = false;
- 	}
- 
- 	if (gadget_is_otg(gadget) && !otg_desc[0]) {
--- 
-2.51.0
-
diff --git a/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch b/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
deleted file mode 100644
index 112c0681ad..0000000000
--- a/queue-6.16/usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From d82c9ebea854b3cd22ec08045592e409a88767a5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 7 Aug 2025 18:55:00 +0300
-Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
- cleanup
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
-
-The kthread_run() function returns error pointers so the
-max3421_hcd->spi_thread pointer can be either error pointers or NULL.
-Check for both before dereferencing it.
-
-Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/max3421-hcd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
-index dcf31a592f5d1..4b5f03f683f77 100644
---- a/drivers/usb/host/max3421-hcd.c
-+++ b/drivers/usb/host/max3421-hcd.c
-@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
- 	if (hcd) {
- 		kfree(max3421_hcd->tx);
- 		kfree(max3421_hcd->rx);
--		if (max3421_hcd->spi_thread)
-+		if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
- 			kthread_stop(max3421_hcd->spi_thread);
- 		usb_put_hcd(hcd);
- 	}
--- 
-2.51.0
-
diff --git a/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch b/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
deleted file mode 100644
index 2dc3a99312..0000000000
--- a/queue-6.16/usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 4c3b438d7c30290dba41af9d2a2d8db2a8bf18d8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Jul 2025 14:31:32 +0530
-Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
-
-From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
-
-[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
-
-EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
-as read-only for operating system running at EL1, enforcing access
-restrictions that prohibit direct memory-mapped writes via writel().
-
-Attempts to write to this region from HLOS can result in silent failures
-or memory access violations, particularly when toggling EUD (Embedded
-USB Debugger) state. To ensure secure register access, modify the driver
-to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
-Secure Channel Monitor (SCM). SCM has the necessary permissions to access
-protected memory regions, enabling reliable control over EUD state.
-
-SC7280, the only user of EUD is also affected, indicating that this could
-never have worked on a properly fused device.
-
-Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
-Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
-Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
-Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
-Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
-Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
-Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/misc/Kconfig    |  1 +
- drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
- 2 files changed, 25 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
-index 6497c4e81e951..9bf8fc6247bac 100644
---- a/drivers/usb/misc/Kconfig
-+++ b/drivers/usb/misc/Kconfig
-@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
- config USB_QCOM_EUD
- 	tristate "QCOM Embedded USB Debugger(EUD) Driver"
- 	depends on ARCH_QCOM || COMPILE_TEST
-+	select QCOM_SCM
- 	select USB_ROLE_SWITCH
- 	help
- 	  This module enables support for Qualcomm Technologies, Inc.
-diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
-index 83079c414b4f2..05c8bdc943a88 100644
---- a/drivers/usb/misc/qcom_eud.c
-+++ b/drivers/usb/misc/qcom_eud.c
-@@ -15,6 +15,7 @@
- #include <linux/slab.h>
- #include <linux/sysfs.h>
- #include <linux/usb/role.h>
-+#include <linux/firmware/qcom/qcom_scm.h>
- 
- #define EUD_REG_INT1_EN_MASK	0x0024
- #define EUD_REG_INT_STATUS_1	0x0044
-@@ -34,7 +35,7 @@ struct eud_chip {
- 	struct device			*dev;
- 	struct usb_role_switch		*role_sw;
- 	void __iomem			*base;
--	void __iomem			*mode_mgr;
-+	phys_addr_t			mode_mgr;
- 	unsigned int			int_status;
- 	int				irq;
- 	bool				enabled;
-@@ -43,18 +44,29 @@ struct eud_chip {
- 
- static int enable_eud(struct eud_chip *priv)
- {
-+	int ret;
-+
-+	ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
-+	if (ret)
-+		return ret;
-+
- 	writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
- 	writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
- 			priv->base + EUD_REG_INT1_EN_MASK);
--	writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
- 
- 	return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
- }
- 
--static void disable_eud(struct eud_chip *priv)
-+static int disable_eud(struct eud_chip *priv)
- {
-+	int ret;
-+
-+	ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
-+	if (ret)
-+		return ret;
-+
- 	writel(0, priv->base + EUD_REG_CSR_EUD_EN);
--	writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
-+	return 0;
- }
- 
- static ssize_t enable_show(struct device *dev,
-@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
- 			chip->enabled = enable;
- 		else
- 			disable_eud(chip);
-+
- 	} else {
--		disable_eud(chip);
-+		ret = disable_eud(chip);
- 	}
- 
--	return count;
-+	return ret < 0 ? ret : count;
- }
- 
- static DEVICE_ATTR_RW(enable);
-@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
- static int eud_probe(struct platform_device *pdev)
- {
- 	struct eud_chip *chip;
-+	struct resource *res;
- 	int ret;
- 
- 	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
-@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
- 	if (IS_ERR(chip->base))
- 		return PTR_ERR(chip->base);
- 
--	chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
--	if (IS_ERR(chip->mode_mgr))
--		return PTR_ERR(chip->mode_mgr);
-+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-+	if (!res)
-+		return -ENODEV;
-+	chip->mode_mgr = res->start;
- 
- 	chip->irq = platform_get_irq(pdev, 0);
- 	if (chip->irq < 0)
--- 
-2.51.0
-
diff --git a/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch b/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch
deleted file mode 100644
index ed608991d8..0000000000
--- a/queue-6.16/usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From aa1ee3cfde970a78d7ef13a22b199612493ee918 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 22 Aug 2025 17:22:24 +0800
-Subject: usb: phy: twl6030: Fix incorrect type for ret
-
-From: Xichao Zhao <zhao.xichao@vivo.com>
-
-[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
-
-In the twl6030_usb_probe(), the variable ret is declared as
-a u32 type. However, since ret may receive -ENODEV when accepting
-the return value of omap_usb2_set_comparator().Therefore, its type
-should be changed to int.
-
-Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
-Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
-Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/phy/phy-twl6030-usb.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
-index 49d79c1257f3a..8c09db750bfd6 100644
---- a/drivers/usb/phy/phy-twl6030-usb.c
-+++ b/drivers/usb/phy/phy-twl6030-usb.c
-@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
- 
- static int twl6030_usb_probe(struct platform_device *pdev)
- {
--	u32 ret;
- 	struct twl6030_usb	*twl;
--	int			status, err;
-+	int			status, err, ret;
- 	struct device_node	*np = pdev->dev.of_node;
- 	struct device		*dev = &pdev->dev;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch b/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
deleted file mode 100644
index 5da3e52899..0000000000
--- a/queue-6.16/usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 4550c8ce503d72368ce63bbcf993bb0c0c51ee10 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 2 Sep 2025 15:15:46 +0300
-Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
-
-From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
-
-[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
-
-The VHCI platform driver aims to forbid entering system suspend when at
-least one of the virtual USB ports are bound to an active USB/IP
-connection.
-
-However, in some cases, the detection logic doesn't work reliably, i.e.
-when all devices attached to the virtual root hub have been already
-suspended, leading to a broken suspend state, with unrecoverable resume.
-
-Ensure the virtually attached devices do not enter suspend by setting
-the syscore PM flag.  Note this is currently limited to the client side
-only, since the server side doesn't implement system suspend prevention.
-
-Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
-Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
-Acked-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
-index e70fba9f55d6a..0d6c10a8490c0 100644
---- a/drivers/usb/usbip/vhci_hcd.c
-+++ b/drivers/usb/usbip/vhci_hcd.c
-@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
- 				 ctrlreq->wValue, vdev->rhport);
- 
- 			vdev->udev = usb_get_dev(urb->dev);
-+			/*
-+			 * NOTE: A similar operation has been done via
-+			 * USB_REQ_GET_DESCRIPTOR handler below, which is
-+			 * supposed to always precede USB_REQ_SET_ADDRESS.
-+			 *
-+			 * It's not entirely clear if operating on a different
-+			 * usb_device instance here is a real possibility,
-+			 * otherwise this call and vdev->udev assignment above
-+			 * should be dropped.
-+			 */
-+			dev_pm_syscore_device(&vdev->udev->dev, true);
- 			usb_put_dev(old);
- 
- 			spin_lock(&vdev->ud.lock);
-@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
- 					"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
- 
- 			vdev->udev = usb_get_dev(urb->dev);
-+			/*
-+			 * Set syscore PM flag for the virtually attached
-+			 * devices to ensure they will not enter suspend on
-+			 * the client side.
-+			 *
-+			 * Note this doesn't have any impact on the physical
-+			 * devices attached to the host system on the server
-+			 * side, hence there is no need to undo the operation
-+			 * on disconnect.
-+			 */
-+			dev_pm_syscore_device(&vdev->udev->dev, true);
- 			usb_put_dev(old);
- 			goto out;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch b/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch
deleted file mode 100644
index a409ffce5d..0000000000
--- a/queue-6.16/vdso-add-struct-__kernel_old_timeval-forward-declara.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From baa4101c732878b92e8d4d79d4bcc304381531be Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 15 Aug 2025 12:41:10 +0200
-Subject: vdso: Add struct __kernel_old_timeval forward declaration to
- gettime.h
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-
-[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]
-
-The prototype of __vdso_gettimeofday() uses this struct.  However
-gettime.h's own includes do not provide a definition for it.
-
-Add a forward declaration, similar to other used structs.
-
-Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
-Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/vdso/gettime.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
-index c50d152e7b3e0..9ac161866653a 100644
---- a/include/vdso/gettime.h
-+++ b/include/vdso/gettime.h
-@@ -5,6 +5,7 @@
- #include <linux/types.h>
- 
- struct __kernel_timespec;
-+struct __kernel_old_timeval;
- struct timezone;
- 
- #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
--- 
-2.51.0
-
diff --git a/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch b/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch
deleted file mode 100644
index daec20e2f7..0000000000
--- a/queue-6.16/vdso-datastore-gate-time-data-behind-config_generic_.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From a16ebfb7d2a6e9ad2a383e06ce78ed645617bab2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Aug 2025 08:17:04 +0200
-Subject: vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-
-[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ]
-
-When the generic vDSO does not provide time functions, as for example on
-riscv32, then the time data store is not necessary.
-
-Avoid allocating these time data pages when not used.
-
-Fixes: df7fcbefa710 ("vdso: Add generic time data storage")
-Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- lib/vdso/datastore.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c
-index 3693c6caf2c4d..a565c30c71a04 100644
---- a/lib/vdso/datastore.c
-+++ b/lib/vdso/datastore.c
-@@ -11,14 +11,14 @@
- /*
-  * The vDSO data page.
-  */
--#ifdef CONFIG_HAVE_GENERIC_VDSO
-+#ifdef CONFIG_GENERIC_GETTIMEOFDAY
- static union {
- 	struct vdso_time_data	data;
- 	u8			page[PAGE_SIZE];
- } vdso_time_data_store __page_aligned_data;
- struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data;
- static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE);
--#endif /* CONFIG_HAVE_GENERIC_VDSO */
-+#endif /* CONFIG_GENERIC_GETTIMEOFDAY */
- 
- #ifdef CONFIG_VDSO_GETRANDOM
- static union {
-@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
- 
- 	switch (vmf->pgoff) {
- 	case VDSO_TIME_PAGE_OFFSET:
--		if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO))
-+		if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY))
- 			return VM_FAULT_SIGBUS;
- 		pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data));
- 		if (timens_page) {
--- 
-2.51.0
-
diff --git a/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch b/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch
deleted file mode 100644
index da053df222..0000000000
--- a/queue-6.16/vfio-pds-replace-bitmap_free-with-vfree.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 243e2837359056017a342c754ad6eaafae370b0f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 13 Sep 2025 15:31:54 +0000
-Subject: vfio/pds: replace bitmap_free with vfree
-
-From: Zilin Guan <zilin@seu.edu.cn>
-
-[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
-
-host_seq_bmp is allocated with vzalloc but is currently freed with
-bitmap_free, which uses kfree internally. This mismach prevents the
-resource from being released properly and may result in memory leaks
-or other issues.
-
-Fix this by freeing host_seq_bmp with vfree to match the vzalloc
-allocation.
-
-Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
-Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
-Reviewed-by: Brett Creeley <brett.creeley@amd.com>
-Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/vfio/pci/pds/dirty.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
-index c51f5e4c3dd6d..481992142f790 100644
---- a/drivers/vfio/pci/pds/dirty.c
-+++ b/drivers/vfio/pci/pds/dirty.c
-@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
- 
- 	host_ack_bmp = vzalloc(bytes);
- 	if (!host_ack_bmp) {
--		bitmap_free(host_seq_bmp);
-+		vfree(host_seq_bmp);
- 		return -ENOMEM;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch b/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch
deleted file mode 100644
index 142049cd94..0000000000
--- a/queue-6.16/vhost-vringh-fix-copy_to_iter-return-value-check.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From dcfbda4e9e02b9f0bbcb355f60fbfe53ef2f36be Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 25 Sep 2025 02:04:08 -0400
-Subject: vhost: vringh: Fix copy_to_iter return value check
-
-From: Michael S. Tsirkin <mst@redhat.com>
-
-[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
-
-The return value of copy_to_iter can't be negative, check whether the
-copied length is equal to the requested length instead of checking for
-negative values.
-
-Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
-Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
-Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/vhost/vringh.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
-index bbce654527013..e547bdc21940b 100644
---- a/drivers/vhost/vringh.c
-+++ b/drivers/vhost/vringh.c
-@@ -1236,6 +1236,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
- 		struct iov_iter iter;
- 		u64 translated;
- 		int ret;
-+		size_t size;
- 
- 		ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
- 				      len - total_translated, &translated,
-@@ -1253,9 +1254,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
- 				      translated);
- 		}
- 
--		ret = copy_to_iter(src, translated, &iter);
--		if (ret < 0)
--			return ret;
-+		size = copy_to_iter(src, translated, &iter);
-+		if (size != translated)
-+			return -EFAULT;
- 
- 		src += translated;
- 		dst += translated;
--- 
-2.51.0
-
diff --git a/queue-6.16/vhost-vringh-modify-the-return-value-check.patch b/queue-6.16/vhost-vringh-modify-the-return-value-check.patch
deleted file mode 100644
index 035ff79f09..0000000000
--- a/queue-6.16/vhost-vringh-modify-the-return-value-check.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 8477c47a7bacd7db420d93f6db22d3711aa9d609 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 10 Sep 2025 17:17:38 +0800
-Subject: vhost: vringh: Modify the return value check
-
-From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
-
-[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
-
-The return value of copy_from_iter and copy_to_iter can't be negative,
-check whether the copied lengths are equal.
-
-Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
-Cc: "Stefano Garzarella" <sgarzare@redhat.com>
-Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
-Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/vhost/vringh.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
-index e547bdc21940b..1e7c5e25860b7 100644
---- a/drivers/vhost/vringh.c
-+++ b/drivers/vhost/vringh.c
-@@ -1190,6 +1190,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
- 		struct iov_iter iter;
- 		u64 translated;
- 		int ret;
-+		size_t size;
- 
- 		ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
- 				      len - total_translated, &translated,
-@@ -1207,9 +1208,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
- 				      translated);
- 		}
- 
--		ret = copy_from_iter(dst, translated, &iter);
--		if (ret < 0)
--			return ret;
-+		size = copy_from_iter(dst, translated, &iter);
-+		if (size != translated)
-+			return -EFAULT;
- 
- 		src += translated;
- 		dst += translated;
--- 
-2.51.0
-
diff --git a/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch b/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
deleted file mode 100644
index 79ac32b7c5..0000000000
--- a/queue-6.16/watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From e5c2e55b680380f9a80cc1c42f2ef97741807a02 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Aug 2025 07:48:17 -0700
-Subject: watchdog: intel_oc_wdt: Do not try to write into const memory
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Guenter Roeck <linux@roeck-us.net>
-
-[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ]
-
-The code tries to update the intel_oc_wdt_info data structure if the
-watchdog is locked. That data structure is marked as const and can not
-be written into. Copy it into struct intel_oc_wdt and modify it there
-to fix the problem.
-
-Reported-by: Petar Kulić <cooleech@gmail.com>
-Cc: Diogo Ivo <diogo.ivo@siemens.com>
-Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Reviewed-by: Diogo Ivo <diogo.ivo@siemens.com>
-Tested-by: Diogo Ivo <diogo.ivo@siemens.com>
-Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/intel_oc_wdt.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c
-index 7c0551106981b..a39892c10770e 100644
---- a/drivers/watchdog/intel_oc_wdt.c
-+++ b/drivers/watchdog/intel_oc_wdt.c
-@@ -41,6 +41,7 @@
- struct intel_oc_wdt {
- 	struct watchdog_device wdd;
- 	struct resource *ctrl_res;
-+	struct watchdog_info info;
- 	bool locked;
- };
- 
-@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = {
- 
- static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
- {
--	struct watchdog_info *info;
- 	unsigned long val;
- 
- 	val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt));
-@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
- 		set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status);
- 
- 		if (oc_wdt->locked) {
--			info = (struct watchdog_info *)&intel_oc_wdt_info;
- 			/*
- 			 * Set nowayout unconditionally as we cannot stop
- 			 * the watchdog.
-@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
- 			 * and inform the core we can't change it.
- 			 */
- 			oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1;
--			info->options &= ~WDIOF_SETTIMEOUT;
-+			oc_wdt->info.options &= ~WDIOF_SETTIMEOUT;
- 
- 			dev_info(oc_wdt->wdd.parent,
- 				 "Register access locked, heartbeat fixed at: %u s\n",
-@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev)
- 	wdd->min_timeout = INTEL_OC_WDT_MIN_TOV;
- 	wdd->max_timeout = INTEL_OC_WDT_MAX_TOV;
- 	wdd->timeout = INTEL_OC_WDT_DEF_TOV;
--	wdd->info = &intel_oc_wdt_info;
-+	oc_wdt->info = intel_oc_wdt_info;
-+	wdd->info = &oc_wdt->info;
- 	wdd->ops = &intel_oc_wdt_ops;
- 	wdd->parent = dev;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch b/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
deleted file mode 100644
index 9ffb0934c5..0000000000
--- a/queue-6.16/watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 709fc8103c0fafe1b25076ebf63b1fe447dfd060 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 12 Aug 2025 14:51:26 +0200
-Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
- watchdog
-
-From: Christophe Leroy <christophe.leroy@csgroup.eu>
-
-[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
-
-When the watchdog gets enabled with this driver, it leaves enough time
-for the core watchdog subsystem to start pinging it. But when the
-watchdog is already started by hardware or by the boot loader, little
-time remains before it fires and it happens that the core watchdog
-subsystem doesn't have time to start pinging it.
-
-Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
-function") pinging was managed by the driver itself and the watchdog
-was immediately pinged by setting the timer expiry to 0.
-
-So restore similar behaviour by pinging it when enabling it so that
-if it was already enabled the watchdog timer counter is reloaded.
-
-Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
-Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/mpc8xxx_wdt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
-index 867f9f3113797..a4b497ecfa205 100644
---- a/drivers/watchdog/mpc8xxx_wdt.c
-+++ b/drivers/watchdog/mpc8xxx_wdt.c
-@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
- 	ddata->swtc = tmp >> 16;
- 	set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
- 
-+	mpc8xxx_wdt_keepalive(ddata);
-+
- 	return 0;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch b/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
deleted file mode 100644
index 0861a57f6e..0000000000
--- a/queue-6.16/wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 05f1efa98556cbf018127cc0f08147dfacca9c93 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 Aug 2025 17:26:45 +0800
-Subject: wifi: ath10k: avoid unnecessary wait for service ready message
-
-From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-
-[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
-
-Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
-failing") works around the failure in waiting for the service ready
-message by active polling. Note the polling is triggered after initial
-wait timeout, which means that the wait-till-timeout can not be avoided
-even the message is ready.
-
-A possible fix is to do polling once before wait as well, however this
-can not handle the race that the message arrives right after polling.
-So the solution is to do periodic polling until timeout.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
-
-Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
-Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
-Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
-Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
- 1 file changed, 19 insertions(+), 20 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
-index cb8ae751eb312..e595b0979a56d 100644
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
- 
- int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
- {
-+	unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
- 	unsigned long time_left, i;
- 
--	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
--						WMI_SERVICE_READY_TIMEOUT_HZ);
--	if (!time_left) {
--		/* Sometimes the PCI HIF doesn't receive interrupt
--		 * for the service ready message even if the buffer
--		 * was completed. PCIe sniffer shows that it's
--		 * because the corresponding CE ring doesn't fires
--		 * it. Workaround here by polling CE rings once.
--		 */
--		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
--
-+	/* Sometimes the PCI HIF doesn't receive interrupt
-+	 * for the service ready message even if the buffer
-+	 * was completed. PCIe sniffer shows that it's
-+	 * because the corresponding CE ring doesn't fires
-+	 * it. Workaround here by polling CE rings. Since
-+	 * the message could arrive at any time, continue
-+	 * polling until timeout.
-+	 */
-+	do {
- 		for (i = 0; i < CE_COUNT; i++)
- 			ath10k_hif_send_complete_check(ar, i, 1);
- 
-+		/* The 100 ms granularity is a tradeoff considering scheduler
-+		 * overhead and response latency
-+		 */
- 		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
--							WMI_SERVICE_READY_TIMEOUT_HZ);
--		if (!time_left) {
--			ath10k_warn(ar, "polling timed out\n");
--			return -ETIMEDOUT;
--		}
--
--		ath10k_warn(ar, "service ready completion received, continuing normally\n");
--	}
-+							msecs_to_jiffies(100));
-+		if (time_left)
-+			return 0;
-+	} while (time_before(jiffies, timeout));
- 
--	return 0;
-+	ath10k_warn(ar, "failed to receive service ready completion\n");
-+	return -ETIMEDOUT;
- }
- 
- int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch b/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
deleted file mode 100644
index ce24f13c78..0000000000
--- a/queue-6.16/wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 4d25d86128a4a5f84a33aadcb27d0242287df7f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 00:36:51 +0530
-Subject: wifi: ath12k: Add fallback for invalid channel number in PHY metadata
-
-From: Sriram R <quic_srirrama@quicinc.com>
-
-[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ]
-
-Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency
-based on the channel number and center frequency from the RX descriptor's
-PHY metadata. However, in rare cases, it is observed that frequency
-retrieved from the metadata may be invalid or unexpected especially for
-6 GHz frames.
-This can result in a NULL sband, which prevents proper frequency assignment
-in rx_status and potentially leading to incorrect RX packet classification.
-
-To fix this potential issue, add a fallback mechanism that uses
-ar->rx_channel to populate the band and frequency when the derived
-sband is invalid or missing.
-
-Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
-
-Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
-Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
-Co-developed-by: Vinith Kumar R <quic_vinithku@quicinc.com>
-Signed-off-by: Vinith Kumar R <quic_vinithku@quicinc.com>
-Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
-Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
-index e9137ffeb5ab4..5a57290927f19 100644
---- a/drivers/net/wireless/ath/ath12k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
-@@ -2504,6 +2504,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
- 	channel_num = meta_data;
- 	center_freq = meta_data >> 16;
- 
-+	rx_status->band = NUM_NL80211_BANDS;
-+
- 	if (center_freq >= ATH12K_MIN_6GHZ_FREQ &&
- 	    center_freq <= ATH12K_MAX_6GHZ_FREQ) {
- 		rx_status->band = NL80211_BAND_6GHZ;
-@@ -2512,21 +2514,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
- 		rx_status->band = NL80211_BAND_2GHZ;
- 	} else if (channel_num >= 36 && channel_num <= 173) {
- 		rx_status->band = NL80211_BAND_5GHZ;
--	} else {
-+	}
-+
-+	if (unlikely(rx_status->band == NUM_NL80211_BANDS ||
-+		     !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) {
-+		ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n",
-+			    rx_status->band, channel_num, center_freq, ar->pdev_idx);
-+
- 		spin_lock_bh(&ar->data_lock);
- 		channel = ar->rx_channel;
- 		if (channel) {
- 			rx_status->band = channel->band;
- 			channel_num =
- 				ieee80211_frequency_to_channel(channel->center_freq);
-+			rx_status->freq = ieee80211_channel_to_frequency(channel_num,
-+									 rx_status->band);
-+		} else {
-+			ath12k_err(ar->ab, "unable to determine channel, band for rx packet");
- 		}
- 		spin_unlock_bh(&ar->data_lock);
-+		goto h_rate;
- 	}
- 
- 	if (rx_status->band != NL80211_BAND_6GHZ)
- 		rx_status->freq = ieee80211_channel_to_frequency(channel_num,
- 								 rx_status->band);
- 
-+h_rate:
- 	ath12k_dp_rx_h_rate(ar, rx_info);
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch b/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
deleted file mode 100644
index cf8383447a..0000000000
--- a/queue-6.16/wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 4d55c533f1e7e85be8e40f1e80dc85d585edaa6d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Jul 2025 17:59:33 +0800
-Subject: wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode
-
-From: Kang Yang <kang.yang@oss.qualcomm.com>
-
-[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ]
-
-Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with
-struct hal_phyrx_common_user_info.
-
-Obviously, they do not match. The original intention here was to parse
-HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing
-HAL_PHYRX_COMMON_USER_INFO instead.
-
-Also add LTF parsing and report to radiotap along with GI.
-
-Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
-Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
-
-Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support")
-Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
-Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++----
- drivers/net/wireless/ath/ath12k/hal_rx.h |  3 +-
- 2 files changed, 32 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
-index 6a0915a0c7aae..559cbb1ae20f2 100644
---- a/drivers/net/wireless/ath/ath12k/dp_mon.c
-+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
-@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap)
- 		*errmap |= HAL_RX_MPDU_ERR_MPDU_LEN;
- }
- 
-+static void
-+ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info,
-+			  struct hal_rx_mon_ppdu_info *ppdu_info)
-+{
-+	struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht;
-+	u32 known, data, cp_setting, ltf_size;
-+
-+	known = __le32_to_cpu(eht->known);
-+	known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI |
-+		IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF;
-+	eht->known = cpu_to_le32(known);
-+
-+	cp_setting = le32_get_bits(cmn_usr_info->info0,
-+				   HAL_RX_CMN_USR_INFO0_CP_SETTING);
-+	ltf_size = le32_get_bits(cmn_usr_info->info0,
-+				 HAL_RX_CMN_USR_INFO0_LTF_SIZE);
-+
-+	data = __le32_to_cpu(eht->data[0]);
-+	data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI);
-+	data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF);
-+	eht->data[0] = cpu_to_le32(data);
-+
-+	if (!ppdu_info->ltf_size)
-+		ppdu_info->ltf_size = ltf_size;
-+	if (!ppdu_info->gi)
-+		ppdu_info->gi = cp_setting;
-+}
-+
- static void
- ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon,
- 				    const struct hal_rx_msdu_end *msdu_end)
-@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
- 					     HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
- 		break;
- 	}
--	case HAL_PHYRX_OTHER_RECEIVE_INFO: {
--		const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data;
--
--		ppdu_info->gi = le32_get_bits(cmn_usr_info->info0,
--					      HAL_RX_PHY_CMN_USER_INFO0_GI);
-+	case HAL_PHYRX_COMMON_USER_INFO: {
-+		ath12k_parse_cmn_usr_info(tlv_data, ppdu_info);
- 		break;
- 	}
- 	case HAL_RX_PPDU_START_USER_INFO:
-diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
-index a3ab588aae19d..801a5f6d3458b 100644
---- a/drivers/net/wireless/ath/ath12k/hal_rx.h
-+++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
-@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info {
- #define HAL_RX_MPDU_ERR_MPDU_LEN		BIT(6)
- #define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME	BIT(7)
- 
--#define HAL_RX_PHY_CMN_USER_INFO0_GI		GENMASK(17, 16)
-+#define HAL_RX_CMN_USR_INFO0_CP_SETTING			GENMASK(17, 16)
-+#define HAL_RX_CMN_USR_INFO0_LTF_SIZE			GENMASK(19, 18)
- 
- struct hal_phyrx_common_user_info {
- 	__le32 rsvd[2];
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch b/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
deleted file mode 100644
index acade1f1a7..0000000000
--- a/queue-6.16/wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From d10032d9db337715ca7d12e65e66a340b5a58302 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 4 Aug 2025 11:03:11 +0800
-Subject: wifi: ath12k: fix overflow warning on num_pwr_levels
-
-From: Baochen Qiang <quic_bqiang@quicinc.com>
-
-[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ]
-
-In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is
-limited by ATH12K_NUM_PWR_LEVELS which is 16:
-
-	if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
-		tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
-
-Then it is used to iterate entries in local_non_psd->power[] and
-reg_non_psd->power[]:
-
-	for (i = 0; i < tpc_info->num_pwr_levels; i++) {
-		tpc_info->tpe[i] = min(local_non_psd->power[i],
-				       reg_non_psd->power[i]) / 2;
-
-Since the two array are of size 5, Smatch warns:
-
-drivers/net/wireless/ath/ath12k/mac.c:9812
-ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15
-drivers/net/wireless/ath/ath12k/mac.c:9812
-ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15
-
-This is a false positive as there is already implicit limitation:
-
-	tpc_info->num_pwr_levels = max(local_non_psd->count,
-				       reg_non_psd->count);
-
-meaning it won't exceed 5.
-
-However, to make robot happy, add explicit limit there.
-
-Also add the same to the PSD case, although no warning due to
-ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ.
-
-Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
-
-Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element")
-Reported-by: kernel test robot <lkp@intel.com>
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/
-Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
-index 708dc3dd4347a..4f66f79091e37 100644
---- a/drivers/net/wireless/ath/ath12k/mac.c
-+++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -10609,8 +10609,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
- 
- 		tpc_info->num_pwr_levels = max(local_psd->count,
- 					       reg_psd->count);
--		if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
--			tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
-+		tpc_info->num_pwr_levels =
-+				min3(tpc_info->num_pwr_levels,
-+				     IEEE80211_TPE_PSD_ENTRIES_320MHZ,
-+				     ATH12K_NUM_PWR_LEVELS);
- 
- 		for (i = 0; i < tpc_info->num_pwr_levels; i++) {
- 			tpc_info->tpe[i] = min(local_psd->power[i],
-@@ -10625,8 +10627,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
- 
- 		tpc_info->num_pwr_levels = max(local_non_psd->count,
- 					       reg_non_psd->count);
--		if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
--			tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
-+		tpc_info->num_pwr_levels =
-+				min3(tpc_info->num_pwr_levels,
-+				     IEEE80211_TPE_EIRP_ENTRIES_320MHZ,
-+				     ATH12K_NUM_PWR_LEVELS);
- 
- 		for (i = 0; i < tpc_info->num_pwr_levels; i++) {
- 			tpc_info->tpe[i] = min(local_non_psd->power[i],
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch b/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
deleted file mode 100644
index 9fff3c3e70..0000000000
--- a/queue-6.16/wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 059be386de6ad215d84ed0dcac69bb3c48d15fc6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 24 Jul 2025 09:35:52 +0530
-Subject: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
-
-From: Hari Chandrakanthan <quic_haric@quicinc.com>
-
-[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ]
-
-In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because
-rxcb->peer_id is not updated with a valid value. This is expected
-in monitor mode, where RX frames bypass the regular RX
-descriptor path that typically sets rxcb->peer_id.
-As a result, the peer is NULL, and link_id and link_valid fields
-in the RX status are not populated. This leads to a WARN_ON in
-mac80211 when it receives data frame from an associated station
-with invalid link_id.
-
-Fix this potential issue by using ppduinfo->peer_id, which holds
-the correct peer id for the received frame. This ensures that the
-peer is correctly found and the associated link metadata is updated
-accordingly.
-
-Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
-
-Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info")
-Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
-Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
-Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
-index 3be6bcd2a3d92..212a30fb9824a 100644
---- a/drivers/net/wireless/ath/ath12k/dp_mon.c
-+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
-@@ -2264,6 +2264,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
- 
- static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi,
- 					  struct sk_buff *msdu,
-+					  const struct hal_rx_mon_ppdu_info *ppduinfo,
- 					  struct ieee80211_rx_status *status,
- 					  u8 decap)
- {
-@@ -2277,7 +2278,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
- 	struct ieee80211_sta *pubsta = NULL;
- 	struct ath12k_peer *peer;
- 	struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu);
--	struct ath12k_dp_rx_info rx_info;
- 	bool is_mcbc = rxcb->is_mcbc;
- 	bool is_eapol_tkip = rxcb->is_eapol;
- 
-@@ -2291,8 +2291,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
- 	}
- 
- 	spin_lock_bh(&ar->ab->base_lock);
--	rx_info.addr2_present = false;
--	peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info);
-+	peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id);
- 	if (peer && peer->sta) {
- 		pubsta = peer->sta;
- 		if (pubsta->valid_links) {
-@@ -2385,7 +2384,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar,
- 			decap = mon_mpdu->decap_format;
- 
- 		ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs);
--		ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap);
-+		ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap);
- 		mon_skb = skb_next;
- 	} while (mon_skb);
- 	rxs->flag = 0;
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch b/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
deleted file mode 100644
index 9952041345..0000000000
--- a/queue-6.16/wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From aca18bde882da33dc9bcc249e5608434b4dfffce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Jul 2025 17:59:34 +0800
-Subject: wifi: ath12k: fix the fetching of combined rssi
-
-From: Kang Yang <kang.yang@oss.qualcomm.com>
-
-[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ]
-
-Currently, host fetches combined rssi from rssi_comb in struct
-hal_rx_phyrx_rssi_legacy_info.
-
-rssi_comb is 8th to 15th bits of the second to last variable.
-rssi_comb_ppdu is the 0th to 7th of the last variable.
-
-When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth >
-20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power
-of primary 20 MHz while rssi_comb_ppdu includes power of active
-RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu.
-
-Also related macro definitions are too long, rename them.
-
-Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
-Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
-
-Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
-Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
-Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++----
- drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++----
- 2 files changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
-index 559cbb1ae20f2..3be6bcd2a3d92 100644
---- a/drivers/net/wireless/ath/ath12k/dp_mon.c
-+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
-@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
- 		const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data;
- 
- 		info[0] = __le32_to_cpu(rssi->info0);
--		info[1] = __le32_to_cpu(rssi->info1);
-+		info[2] = __le32_to_cpu(rssi->info2);
- 
- 		/* TODO: Please note that the combined rssi will not be accurate
- 		 * in MU case. Rssi in MU needs to be retrieved from
- 		 * PHYRX_OTHER_RECEIVE_INFO TLV.
- 		 */
- 		ppdu_info->rssi_comb =
--			u32_get_bits(info[1],
--				     HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB);
-+			u32_get_bits(info[2],
-+				     HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU);
- 
- 		ppdu_info->bw = u32_get_bits(info[0],
--					     HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
-+					     HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW);
- 		break;
- 	}
- 	case HAL_PHYRX_COMMON_USER_INFO: {
-diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
-index 801a5f6d3458b..d1ad7747b82c4 100644
---- a/drivers/net/wireless/ath/ath12k/hal_rx.h
-+++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
-@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type {
- 	HAL_RECEPTION_TYPE_FRAMELESS
- };
- 
--#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION	GENMASK(3, 0)
--#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW	GENMASK(7, 5)
--#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB	GENMASK(15, 8)
-+#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION		GENMASK(3, 0)
-+#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW		GENMASK(7, 5)
-+#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB		GENMASK(15, 8)
-+#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU	GENMASK(7, 0)
- 
- struct hal_rx_phyrx_rssi_legacy_info {
- 	__le32 info0;
- 	__le32 rsvd0[39];
- 	__le32 info1;
--	__le32 rsvd1;
-+	__le32 info2;
- } __packed;
- 
- #define HAL_RX_MPDU_START_INFO0_PPDU_ID			GENMASK(31, 16)
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch b/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
deleted file mode 100644
index 026b668d72..0000000000
--- a/queue-6.16/wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From f098bf4770187cb653a9193899b447aa6adb7b44 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 15 Aug 2025 09:44:57 +0800
-Subject: wifi: ath12k: fix wrong logging ID used for CE
-
-From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-
-[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ]
-
-ATH12K_DBG_AHB is used for CE logging which is not proper. Add
-ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it.
-
-Compile tested only.
-
-Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
-Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
-Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath12k/ce.c    | 2 +-
- drivers/net/wireless/ath/ath12k/debug.h | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
-index f7c15b547504d..139365cbf89de 100644
---- a/drivers/net/wireless/ath/ath12k/ce.c
-+++ b/drivers/net/wireless/ath/ath12k/ce.c
-@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe)
- 	}
- 
- 	while ((skb = __skb_dequeue(&list))) {
--		ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n",
-+		ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n",
- 			   pipe->pipe_num, skb->len);
- 		pipe->recv_cb(ab, skb);
- 	}
-diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h
-index 48916e4e1f601..bf254e43a68d0 100644
---- a/drivers/net/wireless/ath/ath12k/debug.h
-+++ b/drivers/net/wireless/ath/ath12k/debug.h
-@@ -26,6 +26,7 @@ enum ath12k_debug_mask {
- 	ATH12K_DBG_DP_TX	= 0x00002000,
- 	ATH12K_DBG_DP_RX	= 0x00004000,
- 	ATH12K_DBG_WOW		= 0x00008000,
-+	ATH12K_DBG_CE		= 0x00010000,
- 	ATH12K_DBG_ANY		= 0xffffffff,
- };
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch b/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
deleted file mode 100644
index ac2c91f133..0000000000
--- a/queue-6.16/wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 580faf44cb1c538467bd0fa8d23936ef289a878b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 Sep 2025 22:19:08 +0000
-Subject: wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid()
-
-From: Ryder Lee <ryder.lee@mediatek.com>
-
-[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ]
-
-The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz.
-However, the expected unit is KHz.
-
-Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio")
-Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
-Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/wireless/util.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/wireless/util.c b/net/wireless/util.c
-index 1ad5a6bdfd755..c1c4d32a8efcf 100644
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -2956,7 +2956,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
- 	u32 freq, width;
- 
- 	freq = ieee80211_chandef_to_khz(chandef);
--	width = cfg80211_chandef_get_width(chandef);
-+	width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef));
- 	if (!ieee80211_radio_freq_range_valid(radio, freq, width))
- 		return false;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch b/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch
deleted file mode 100644
index cccfcd7f16..0000000000
--- a/queue-6.16/wifi-iwlwifi-remove-redundant-header-files.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 5f79a6878a4e04bac01d4c6accea8f02d359fc4d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Aug 2025 20:11:51 +0800
-Subject: wifi: iwlwifi: Remove redundant header files
-
-From: Liao Yuanhong <liaoyuanhong@vivo.com>
-
-[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]
-
-The header file "fw/img.h" is already included on line 9. Remove the
-redundant include.
-
-Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
-Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
-Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
-Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
-index 9bed3d573b1ef..c676e0d14f310 100644
---- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
-+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
-@@ -12,7 +12,6 @@
- #include "fw/api/phy.h"
- #include "fw/api/config.h"
- #include "fw/api/nvm-reg.h"
--#include "fw/img.h"
- #include "iwl-trans.h"
- 
- #define BIOS_SAR_MAX_PROFILE_NUM	4
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch b/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
deleted file mode 100644
index 82219c9da9..0000000000
--- a/queue-6.16/wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 918d624e19d0ff62f8fff8cdee50574cea50f1f0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 Sep 2025 12:42:03 +0530
-Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
- available
-
-From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
-
-[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
-
-In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
-information, an attempt is made to find the station using the address 2
-(source address) field in the header. Since pubsta is missing, link
-information such as link_valid and link_id is also unavailable. Now if such
-a situation comes, and if a matching ML station entry is found based on
-the source address, currently the packet is dropped due to missing link ID
-in the status field which is not correct.
-
-Hence, to fix this issue, if link_valid is not set and the station is an
-ML station, make an attempt to find a link station entry using the source
-address. If a valid link station is found, derive the link ID and proceed
-with packet processing. Otherwise, drop the packet as per the existing
-flow.
-
-Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
-Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
-Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
-Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/mac80211/rx.c | 28 ++++++++++++++++++++++------
- 1 file changed, 22 insertions(+), 6 deletions(-)
-
-diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 7b801dd3f569a..ad6776069ded0 100644
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -5210,12 +5210,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
- 			}
- 
- 			rx.sdata = prev_sta->sdata;
-+			if (!status->link_valid && prev_sta->sta.mlo) {
-+				struct link_sta_info *link_sta;
-+
-+				link_sta = link_sta_info_get_bss(rx.sdata,
-+								 hdr->addr2);
-+				if (!link_sta)
-+					continue;
-+
-+				link_id = link_sta->link_id;
-+			}
-+
- 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
- 				goto out;
- 
--			if (!status->link_valid && prev_sta->sta.mlo)
--				continue;
--
- 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
- 
- 			prev_sta = sta;
-@@ -5223,10 +5231,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
- 
- 		if (prev_sta) {
- 			rx.sdata = prev_sta->sdata;
--			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
--				goto out;
-+			if (!status->link_valid && prev_sta->sta.mlo) {
-+				struct link_sta_info *link_sta;
-+
-+				link_sta = link_sta_info_get_bss(rx.sdata,
-+								 hdr->addr2);
-+				if (!link_sta)
-+					goto out;
- 
--			if (!status->link_valid && prev_sta->sta.mlo)
-+				link_id = link_sta->link_id;
-+			}
-+
-+			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
- 				goto out;
- 
- 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch b/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
deleted file mode 100644
index a437474fd3..0000000000
--- a/queue-6.16/wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 872efdd9e868ab90b2d5bf8ee4ed7563ec13a90d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 9 Jul 2025 20:25:30 +0530
-Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
-
-From: Abdun Nihaal <abdun.nihaal@gmail.com>
-
-[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
-
-In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
-is allocated for both struct ieee80211_hw and a workqueue. However, on
-the error path, the workqueue is not freed. Fix that by calling
-mt76_free_device() on the error path.
-
-Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
-Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
-index 08590aa68356f..1dd3723720480 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
-@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
- 
- 	return 0;
- error:
--	ieee80211_free_hw(mt76_hw(dev));
-+	mt76_free_device(mdev);
- 	return ret;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch b/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
deleted file mode 100644
index c8900f5f2f..0000000000
--- a/queue-6.16/wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From 678a5c64698638e1b40a60eac9439eca73baa741 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 14:48:24 +0800
-Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration
-
-From: Zhi-Jun You <hujy652@gmail.com>
-
-[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]
-
-In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
-although the chip doesn't support it.
-
-mt76 doesn't take this into account which results in reading from the
-incorrect offset.
-
-For devices with precal, this would lead to lower bitrate.
-
-Fix this by aligning groupcal size with vendor driver and switch to
-freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.
-
-Below are iwinfo of the test device with two clients connected
-(iPhone 16, Intel AX210).
-Before :
-	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
-	Center Channel 1: 42 2: unknown
-	Tx-Power: 23 dBm  Link Quality: 43/70
-	Signal: -67 dBm  Noise: -92 dBm
-	Bit Rate: 612.4 MBit/s
-	Encryption: WPA3 SAE (CCMP)
-	Type: nl80211  HW Mode(s): 802.11ac/ax/n
-	Hardware: embedded [MediaTek MT7981]
-
-After:
-	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
-	Center Channel 1: 42 2: unknown
-	Tx-Power: 23 dBm  Link Quality: 43/70
-	Signal: -67 dBm  Noise: -92 dBm
-	Bit Rate: 900.6 MBit/s
-	Encryption: WPA3 SAE (CCMP)
-	Type: nl80211  HW Mode(s): 802.11ac/ax/n
-	Hardware: embedded [MediaTek MT7981]
-
-Tested-on: mt7981 20240823
-
-Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
-Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
-Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../wireless/mediatek/mt76/mt7915/eeprom.h    |  6 ++--
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 29 +++++--------------
- 2 files changed, 10 insertions(+), 25 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
-index 31aec0f40232a..73611c9d26e15 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
-@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
- #define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
- #define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
- #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
-+#define MT_EE_CAL_GROUP_SIZE_7981		(144 * MT_EE_CAL_UNIT + 16)
- #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
- #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
--#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
- 
- #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF0_RX_PATH		GENMASK(5, 3)
-@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
- 		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
- 		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
- 							 MT_EE_CAL_GROUP_SIZE_7916;
-+	} else if (is_mt7981(&dev->mt76)) {
-+		return MT_EE_CAL_GROUP_SIZE_7981;
- 	} else if (mt7915_check_adie(dev, false)) {
- 		return MT_EE_CAL_GROUP_SIZE_7976;
- 	} else {
-@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
- {
- 	if (is_mt7915(&dev->mt76))
- 		return MT_EE_CAL_DPD_SIZE_V1;
--	else if (is_mt7981(&dev->mt76))
--		return MT_EE_CAL_DPD_SIZE_V2_7981;
- 	else
- 		return MT_EE_CAL_DPD_SIZE_V2;
- }
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-index c1cfdbc2fe848..9689a49020a4b 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-@@ -3050,30 +3050,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
- 		/* 5G BW160 */
- 		5250, 5570, 5815
- 	};
--	static const u16 freq_list_v2_7981[] = {
--		/* 5G BW20 */
--		5180, 5200, 5220, 5240,
--		5260, 5280, 5300, 5320,
--		5500, 5520, 5540, 5560,
--		5580, 5600, 5620, 5640,
--		5660, 5680, 5700, 5720,
--		5745, 5765, 5785, 5805,
--		5825, 5845, 5865, 5885,
--		/* 5G BW160 */
--		5250, 5570, 5815
--	};
--	const u16 *freq_list = freq_list_v1;
--	int n_freqs = ARRAY_SIZE(freq_list_v1);
--	int idx;
-+	const u16 *freq_list;
-+	int idx, n_freqs;
- 
- 	if (!is_mt7915(&dev->mt76)) {
--		if (is_mt7981(&dev->mt76)) {
--			freq_list = freq_list_v2_7981;
--			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
--		} else {
--			freq_list = freq_list_v2;
--			n_freqs = ARRAY_SIZE(freq_list_v2);
--		}
-+		freq_list = freq_list_v2;
-+		n_freqs = ARRAY_SIZE(freq_list_v2);
-+	} else {
-+		freq_list = freq_list_v1;
-+		n_freqs = ARRAY_SIZE(freq_list_v1);
- 	}
- 
- 	if (freq < 4000) {
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch b/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
deleted file mode 100644
index 22d95892bb..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 5218384a4fcd4d61dbd461795def49dce093a12f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 11:45:19 +0200
-Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]
-
-Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
-break endianness
-
-Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/mediatek/mt76/mt7996/init.c   |  8 +++++---
- drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
- 2 files changed, 10 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-index be729db5b75c1..84015ab24af62 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
- static int mt7996_wed_rro_init(struct mt7996_dev *dev)
- {
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
- 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
- 	u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
- 	struct mt7996_wed_rro_addr *addr;
-@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
- 
- 		addr = dev->wed_rro.addr_elem[i].ptr;
- 		for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
--			addr->signature = 0xff;
-+			addr->data = cpu_to_le32(val);
- 			addr++;
- 		}
- 
-@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
- 	dev->wed_rro.session.ptr = ptr;
- 	addr = dev->wed_rro.session.ptr;
- 	for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
--		addr->signature = 0xff;
-+		addr->data = cpu_to_le32(val);
- 		addr++;
- 	}
- 
-@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
- static void mt7996_wed_rro_work(struct work_struct *work)
- {
- #ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
- 	struct mt7996_dev *dev;
- 	LIST_HEAD(list);
- 
-@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
- 				MT7996_RRO_WINDOW_MAX_LEN;
- reset:
- 			elem = ptr + elem_id * sizeof(*elem);
--			elem->signature = 0xff;
-+			elem->data |= cpu_to_le32(val);
- 		}
- 		mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
- out:
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-index b98cfe6e5be8c..048d9a9898c6e 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-@@ -277,13 +277,12 @@ struct mt7996_hif {
- 	int irq;
- };
- 
-+#define WED_RRO_ADDR_SIGNATURE_MASK	GENMASK(31, 24)
-+#define WED_RRO_ADDR_COUNT_MASK		GENMASK(14, 4)
-+#define WED_RRO_ADDR_HEAD_HIGH_MASK	GENMASK(3, 0)
- struct mt7996_wed_rro_addr {
--	u32 head_low;
--	u32 head_high : 4;
--	u32 count: 11;
--	u32 oor: 1;
--	u32 rsv : 8;
--	u32 signature : 8;
-+	__le32 head_low;
-+	__le32 data;
- };
- 
- struct mt7996_wed_rro_session_id {
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
deleted file mode 100644
index 723dc3b4b0..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-From 26e84f3f887edd048259df1a4cef8185410b87bb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Jul 2025 10:26:19 +0200
-Subject: wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ]
-
-Update mt7996_mcu_bss_mld_tlv routine to properly support MLO
-configuring the BSS.
-
-Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/wireless/mediatek/mt76/mt7996/main.c  | 46 ++++++++++++++++++-
- .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 26 ++++++++---
- .../net/wireless/mediatek/mt76/mt7996/mcu.h   |  3 +-
- .../wireless/mediatek/mt76/mt7996/mt7996.h    |  8 ++++
- 4 files changed, 75 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-index cb522153113ce..1394155a68ce7 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
- 	return -1;
- }
- 
-+static int get_own_mld_idx(u64 mask, bool group_mld)
-+{
-+	u8 start = group_mld ? 0 : 16;
-+	u8 end = group_mld ? 15 : 63;
-+	int idx;
-+
-+	idx = get_free_idx(mask, start, end);
-+	if (idx)
-+		return idx - 1;
-+
-+	/* If the 16-63 range is not available, perform another lookup in the
-+	 * range 0-15
-+	 */
-+	if (!group_mld) {
-+		idx = get_free_idx(mask, 0, 15);
-+		if (idx)
-+			return idx - 1;
-+	}
-+
-+	return -EINVAL;
-+}
-+
- static void
- mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink)
- {
-@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 	struct mt7996_dev *dev = phy->dev;
- 	u8 band_idx = phy->mt76->band_idx;
- 	struct mt76_txq *mtxq;
--	int idx, ret;
-+	int mld_idx, idx, ret;
- 
- 	mlink->idx = __ffs64(~dev->mt76.vif_mask);
- 	if (mlink->idx >= mt7996_max_interface_num(dev))
-@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 	if (idx < 0)
- 		return -ENOSPC;
- 
-+	if (!dev->mld_idx_mask) { /* first link in the group */
-+		mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true);
-+		mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask,
-+						   0, 15);
-+	}
-+
-+	mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
-+	if (mld_idx < 0)
-+		return -ENOSPC;
-+
-+	link->mld_idx = mld_idx;
- 	link->phy = phy;
- 	mlink->omac_idx = idx;
- 	mlink->band_idx = band_idx;
-@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 		return ret;
- 
- 	dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
-+	if (!dev->mld_idx_mask) {
-+		dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
-+		dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
-+	}
-+	dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
- 	phy->omac_mask |= BIT_ULL(mlink->omac_idx);
- 
- 	idx = MT7996_WTBL_RESERVED - mlink->idx;
-@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
- 	}
- 
- 	dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
-+	dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
- 	phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
-+	if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) {
-+		/* last link */
-+		dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
-+		dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
-+	}
- 
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
- 	if (!list_empty(&msta_link->wcid.poll_list))
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-index d422b65737966..14373b2285438 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
- }
- 
- static void
--mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
-+mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
-+		       struct ieee80211_bss_conf *link_conf,
-+		       struct mt7996_vif_link *link)
- {
-+	struct ieee80211_vif *vif = link_conf->vif;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_mld_tlv *mld;
- 	struct tlv *tlv;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
--
- 	mld = (struct bss_mld_tlv *)tlv;
--	mld->group_mld_id = 0xff;
--	mld->own_mld_id = mlink->idx;
--	mld->remap_idx = 0xff;
-+	mld->own_mld_id = link->mld_idx;
-+	mld->link_id = link_conf->link_id;
-+
-+	if (ieee80211_vif_is_mld(vif)) {
-+		mld->group_mld_id = mvif->mld_group_idx;
-+		mld->remap_idx = mvif->mld_remap_idx;
-+		memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
-+	} else {
-+		mld->group_mld_id = 0xff;
-+		mld->remap_idx = 0xff;
-+	}
- }
- 
- static void
-@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		goto out;
- 
- 	if (enable) {
-+		struct mt7996_vif_link *link;
-+
- 		mt7996_mcu_bss_rfch_tlv(skb, phy);
- 		mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
- 		mt7996_mcu_bss_ra_tlv(skb, phy);
-@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 			mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
- 
- 		/* this tag is necessary no matter if the vif is MLD */
--		mt7996_mcu_bss_mld_tlv(skb, mlink);
-+		link = container_of(mlink, struct mt7996_vif_link, mt76);
-+		mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
- 	}
- 
- 	mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
-index 130ea95626d5b..7b21d6ae7e435 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
-@@ -481,7 +481,8 @@ struct bss_mld_tlv {
- 	u8 own_mld_id;
- 	u8 mac_addr[ETH_ALEN];
- 	u8 remap_idx;
--	u8 __rsv[3];
-+	u8 link_id;
-+	u8 __rsv[2];
- } __packed;
- 
- struct sta_rec_ht_uni {
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-index bbd4679edc9d3..b98cfe6e5be8c 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-@@ -248,11 +248,16 @@ struct mt7996_vif_link {
- 
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
- 	struct cfg80211_bitrate_mask bitrate_mask;
-+
-+	u8 mld_idx;
- };
- 
- struct mt7996_vif {
- 	struct mt7996_vif_link deflink; /* must be first */
- 	struct mt76_vif_data mt76;
-+
-+	u8 mld_group_idx;
-+	u8 mld_remap_idx;
- };
- 
- /* crash-dump */
-@@ -337,6 +342,9 @@ struct mt7996_dev {
- 	u32 q_int_mask[MT7996_MAX_QUEUE];
- 	u32 q_wfdma_mask;
- 
-+	u64 mld_idx_mask;
-+	u64 mld_remap_idx_mask;
-+
- 	const struct mt76_bus_ops *bus_ops;
- 	struct mt7996_phy phy;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch b/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
deleted file mode 100644
index 3de5b34f44..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 8c1a3da9cfc578ba8f1a0f29ee4c07f8fc3cbfbd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 8 Jul 2025 09:12:05 +0200
-Subject: wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ]
-
-Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly
-support MLO scenario.
-
-Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/mediatek/mt76/mt7996/main.c   |  6 ++++--
- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    | 12 +++++++-----
- drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h |  3 ++-
- 3 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-index f6590ef85c0d0..cb522153113ce 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-@@ -1321,11 +1321,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		case IEEE80211_AMPDU_RX_START:
- 			mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid,
- 					   ssn, params->buf_size);
--			ret = mt7996_mcu_add_rx_ba(dev, params, link, true);
-+			ret = mt7996_mcu_add_rx_ba(dev, params, link,
-+						   msta_link, true);
- 			break;
- 		case IEEE80211_AMPDU_RX_STOP:
- 			mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid);
--			ret = mt7996_mcu_add_rx_ba(dev, params, link, false);
-+			ret = mt7996_mcu_add_rx_ba(dev, params, link,
-+						   msta_link, false);
- 			break;
- 		case IEEE80211_AMPDU_TX_OPERATIONAL:
- 			mtxq->aggr = true;
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-index a808218da394c..d422b65737966 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- static int
- mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
- 		  struct ieee80211_ampdu_params *params,
--		  bool enable, bool tx)
-+		  struct mt76_wcid *wcid, bool enable, bool tx)
- {
--	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
- 	struct sta_rec_ba_uni *ba;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
-@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- 	if (enable && !params->amsdu)
- 		msta_link->wcid.amsdu = false;
- 
--	return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true);
-+	return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
-+				 enable, true);
- }
- 
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
--			 struct mt7996_vif_link *link, bool enable)
-+			 struct mt7996_vif_link *link,
-+			 struct mt7996_sta_link *msta_link, bool enable)
- {
--	return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false);
-+	return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
-+				 enable, false);
- }
- 
- static void
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-index 8509d508e1e19..bbd4679edc9d3 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
-@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- 			 struct mt7996_sta_link *msta_link, bool enable);
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
--			 struct mt7996_vif_link *link, bool enable);
-+			 struct mt7996_vif_link *link,
-+			 struct mt7996_sta_link *msta_link, bool enable);
- int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
- 				struct mt76_vif_link *mlink,
- 				struct cfg80211_he_bss_color *he_bss_color);
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch b/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
deleted file mode 100644
index 3427664adb..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From ff2cc0a148f52e4dad2f746836e44332776873c5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 11:45:17 +0200
-Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED
- device
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]
-
-In order to properly set the number of rx packets for primary WED device
-if hif device is available, move hif pointer initialization before
-running mt7996_mmio_wed_init routine.
-
-Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
-index 19e99bc1c6c41..f5ce50056ee94 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
-@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
- 	mdev = &dev->mt76;
- 	mt7996_wfsys_reset(dev);
- 	hif2 = mt7996_pci_init_hif2(pdev);
-+	dev->hif2 = hif2;
- 
- 	ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
- 	if (ret < 0)
-@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
- 
- 	if (hif2) {
- 		hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
--		dev->hif2 = hif2;
- 
- 		ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
- 		if (ret < 0)
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch b/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
deleted file mode 100644
index 2609dd13fe..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 04ea838323eed6cb17e6a5d442d87d692cb2e29f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 9 Sep 2025 11:45:16 +0200
-Subject: wifi: mt76: mt7996: Fix tx-queues initialization for second phy on
- mt7996
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ]
-
-Fix the second phy tx queue initialization if hif device is not
-available for MT7990 chipset.
-
-Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
-Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
-Co-developed-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Co-developed-by: Rex Lu <rex.lu@mediatek.com>
-Signed-off-by: Rex Lu <rex.lu@mediatek.com>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/wireless/mediatek/mt76/mt7996/init.c  | 21 ++++++++++++-------
- 1 file changed, 14 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-index a9599c286328e..be729db5b75c1 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
-@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)
- 
- 	/* init wiphy according to mphy and phy */
- 	mt7996_init_wiphy_band(mphy->hw, phy);
--	ret = mt7996_init_tx_queues(mphy->priv,
--				    MT_TXQ_ID(band),
--				    MT7996_TX_RING_SIZE,
--				    MT_TXQ_RING_BASE(band) + hif1_ofs,
--				    wed);
--	if (ret)
--		goto error;
-+
-+	if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) {
-+		int i;
-+
-+		for (i = 0; i <= MT_TXQ_PSD; i++)
-+			mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0];
-+	} else {
-+		ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band),
-+					    MT7996_TX_RING_SIZE,
-+					    MT_TXQ_RING_BASE(band) + hif1_ofs,
-+					    wed);
-+		if (ret)
-+			goto error;
-+	}
- 
- 	ret = mt76_register_phy(mphy, true, mt76_rates,
- 				ARRAY_SIZE(mt76_rates));
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch b/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
deleted file mode 100644
index de6a3015c6..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
+++ /dev/null
@@ -1,275 +0,0 @@
-From 8f0387f05c3f1afa599db49758065ce18482ceaf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 Sep 2025 09:58:56 +0200
-Subject: wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during
- restart
-
-From: Felix Fietkau <nbd@nbd.name>
-
-[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ]
-
-There is only one wiphy, so extra calls must be removed.
-For calls that need to remain per-wiphy, use mt7996_for_each_phy
-
-Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
-Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/wireless/mediatek/mt76/mt7996/mac.c   | 137 +++++-------------
- 1 file changed, 35 insertions(+), 102 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
-index a7a5ac8b7d265..e276cd1dc0cee 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
-@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
- static int
- mt7996_mac_restart(struct mt7996_dev *dev)
- {
--	struct mt7996_phy *phy2, *phy3;
- 	struct mt76_dev *mdev = &dev->mt76;
-+	struct mt7996_phy *phy;
- 	int i, ret;
- 
--	phy2 = mt7996_phy2(dev);
--	phy3 = mt7996_phy3(dev);
--
- 	if (dev->hif2) {
- 		mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
- 		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
-@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev)
- 			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
- 	}
- 
--	set_bit(MT76_RESET, &dev->mphy.state);
- 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
-+	mt7996_for_each_phy(dev, phy)
-+		set_bit(MT76_RESET, &phy->mt76->state);
- 	wake_up(&dev->mt76.mcu.wait);
--	if (phy2)
--		set_bit(MT76_RESET, &phy2->mt76->state);
--	if (phy3)
--		set_bit(MT76_RESET, &phy3->mt76->state);
- 
- 	/* lock/unlock all queues to ensure that no tx is pending */
--	mt76_txq_schedule_all(&dev->mphy);
--	if (phy2)
--		mt76_txq_schedule_all(phy2->mt76);
--	if (phy3)
--		mt76_txq_schedule_all(phy3->mt76);
-+	mt7996_for_each_phy(dev, phy)
-+		mt76_txq_schedule_all(phy->mt76);
- 
- 	/* disable all tx/rx napi */
- 	mt76_worker_disable(&dev->mt76.tx_worker);
-@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev)
- 		goto out;
- 
- 	mt7996_mac_init(dev);
--	mt7996_init_txpower(&dev->phy);
--	mt7996_init_txpower(phy2);
--	mt7996_init_txpower(phy3);
-+	mt7996_for_each_phy(dev, phy)
-+		mt7996_init_txpower(phy);
- 	ret = mt7996_txbf_init(dev);
-+	if (ret)
-+		goto out;
- 
--	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
--		ret = mt7996_run(&dev->phy);
--		if (ret)
--			goto out;
--	}
--
--	if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
--		ret = mt7996_run(phy2);
--		if (ret)
--			goto out;
--	}
-+	mt7996_for_each_phy(dev, phy) {
-+		if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-+			continue;
- 
--	if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
--		ret = mt7996_run(phy3);
-+		ret = mt7996_run(&dev->phy);
- 		if (ret)
- 			goto out;
- 	}
- 
- out:
- 	/* reset done */
--	clear_bit(MT76_RESET, &dev->mphy.state);
--	if (phy2)
--		clear_bit(MT76_RESET, &phy2->mt76->state);
--	if (phy3)
--		clear_bit(MT76_RESET, &phy3->mt76->state);
-+	mt7996_for_each_phy(dev, phy)
-+		clear_bit(MT76_RESET, &phy->mt76->state);
- 
- 	napi_enable(&dev->mt76.tx_napi);
- 	local_bh_disable();
-@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev)
- static void
- mt7996_mac_full_reset(struct mt7996_dev *dev)
- {
--	struct mt7996_phy *phy2, *phy3;
-+	struct ieee80211_hw *hw = mt76_hw(dev);
-+	struct mt7996_phy *phy;
- 	int i;
- 
--	phy2 = mt7996_phy2(dev);
--	phy3 = mt7996_phy3(dev);
- 	dev->recovery.hw_full_reset = true;
- 
- 	wake_up(&dev->mt76.mcu.wait);
--	ieee80211_stop_queues(mt76_hw(dev));
--	if (phy2)
--		ieee80211_stop_queues(phy2->mt76->hw);
--	if (phy3)
--		ieee80211_stop_queues(phy3->mt76->hw);
-+	ieee80211_stop_queues(hw);
- 
- 	cancel_work_sync(&dev->wed_rro.work);
--	cancel_delayed_work_sync(&dev->mphy.mac_work);
--	if (phy2)
--		cancel_delayed_work_sync(&phy2->mt76->mac_work);
--	if (phy3)
--		cancel_delayed_work_sync(&phy3->mt76->mac_work);
-+	mt7996_for_each_phy(dev, phy)
-+		cancel_delayed_work_sync(&phy->mt76->mac_work);
- 
- 	mutex_lock(&dev->mt76.mutex);
- 	for (i = 0; i < 10; i++) {
-@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
- 		dev_err(dev->mt76.dev, "chip full reset failed\n");
- 
- 	ieee80211_restart_hw(mt76_hw(dev));
--	if (phy2)
--		ieee80211_restart_hw(phy2->mt76->hw);
--	if (phy3)
--		ieee80211_restart_hw(phy3->mt76->hw);
--
- 	ieee80211_wake_queues(mt76_hw(dev));
--	if (phy2)
--		ieee80211_wake_queues(phy2->mt76->hw);
--	if (phy3)
--		ieee80211_wake_queues(phy3->mt76->hw);
- 
- 	dev->recovery.hw_full_reset = false;
--	ieee80211_queue_delayed_work(mt76_hw(dev),
--				     &dev->mphy.mac_work,
--				     MT7996_WATCHDOG_TIME);
--	if (phy2)
--		ieee80211_queue_delayed_work(phy2->mt76->hw,
--					     &phy2->mt76->mac_work,
--					     MT7996_WATCHDOG_TIME);
--	if (phy3)
--		ieee80211_queue_delayed_work(phy3->mt76->hw,
--					     &phy3->mt76->mac_work,
-+	mt7996_for_each_phy(dev, phy)
-+		ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
- 					     MT7996_WATCHDOG_TIME);
- }
- 
- void mt7996_mac_reset_work(struct work_struct *work)
- {
--	struct mt7996_phy *phy2, *phy3;
-+	struct ieee80211_hw *hw;
- 	struct mt7996_dev *dev;
-+	struct mt7996_phy *phy;
- 	int i;
- 
- 	dev = container_of(work, struct mt7996_dev, reset_work);
--	phy2 = mt7996_phy2(dev);
--	phy3 = mt7996_phy3(dev);
-+	hw = mt76_hw(dev);
- 
- 	/* chip full reset */
- 	if (dev->recovery.restart) {
-@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 		return;
- 
- 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
--		 wiphy_name(dev->mt76.hw->wiphy));
-+		 wiphy_name(hw->wiphy));
- 
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
- 		mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2);
-@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 		mtk_wed_device_stop(&dev->mt76.mmio.wed);
- 
- 	ieee80211_stop_queues(mt76_hw(dev));
--	if (phy2)
--		ieee80211_stop_queues(phy2->mt76->hw);
--	if (phy3)
--		ieee80211_stop_queues(phy3->mt76->hw);
- 
- 	set_bit(MT76_RESET, &dev->mphy.state);
- 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
- 	wake_up(&dev->mt76.mcu.wait);
- 
- 	cancel_work_sync(&dev->wed_rro.work);
--	cancel_delayed_work_sync(&dev->mphy.mac_work);
--	if (phy2) {
--		set_bit(MT76_RESET, &phy2->mt76->state);
--		cancel_delayed_work_sync(&phy2->mt76->mac_work);
--	}
--	if (phy3) {
--		set_bit(MT76_RESET, &phy3->mt76->state);
--		cancel_delayed_work_sync(&phy3->mt76->mac_work);
-+	mt7996_for_each_phy(dev, phy) {
-+		set_bit(MT76_RESET, &phy->mt76->state);
-+		cancel_delayed_work_sync(&phy->mt76->mac_work);
- 	}
-+
- 	mt76_worker_disable(&dev->mt76.tx_worker);
- 	mt76_for_each_q_rx(&dev->mt76, i) {
- 		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	}
- 
- 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
--	clear_bit(MT76_RESET, &dev->mphy.state);
--	if (phy2)
--		clear_bit(MT76_RESET, &phy2->mt76->state);
--	if (phy3)
--		clear_bit(MT76_RESET, &phy3->mt76->state);
-+	mt7996_for_each_phy(dev, phy)
-+		clear_bit(MT76_RESET, &phy->mt76->state);
- 
- 	mt76_for_each_q_rx(&dev->mt76, i) {
- 		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	napi_schedule(&dev->mt76.tx_napi);
- 	local_bh_enable();
- 
--	ieee80211_wake_queues(mt76_hw(dev));
--	if (phy2)
--		ieee80211_wake_queues(phy2->mt76->hw);
--	if (phy3)
--		ieee80211_wake_queues(phy3->mt76->hw);
-+	ieee80211_wake_queues(hw);
- 
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	mt7996_update_beacons(dev);
- 
--	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
--				     MT7996_WATCHDOG_TIME);
--	if (phy2)
--		ieee80211_queue_delayed_work(phy2->mt76->hw,
--					     &phy2->mt76->mac_work,
--					     MT7996_WATCHDOG_TIME);
--	if (phy3)
--		ieee80211_queue_delayed_work(phy3->mt76->hw,
--					     &phy3->mt76->mac_work,
-+	mt7996_for_each_phy(dev, phy)
-+		ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
- 					     MT7996_WATCHDOG_TIME);
- 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
- 		 wiphy_name(dev->mt76.hw->wiphy));
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch b/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
deleted file mode 100644
index a15553a052..0000000000
--- a/queue-6.16/wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 12935b6800c9c89fe7b62aa78075b4b0b7147a2f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 1 Sep 2025 00:14:37 +0200
-Subject: wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback
-
-From: Lorenzo Bianconi <lorenzo@kernel.org>
-
-[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ]
-
-Do not always use deflink_id in link_sta_rc_update mac80211
-callback but use the proper link_id provided by mac80211.
-
-Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO")
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
-Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/wireless/mediatek/mt76/mt7996/main.c  | 43 ++++++++++++-------
- 1 file changed, 28 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-index 1394155a68ce7..92ddb35ea8747 100644
---- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
-@@ -1655,19 +1655,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 	}
- }
- 
--static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
-+static void mt7996_link_rate_ctrl_update(void *data,
-+					 struct mt7996_sta_link *msta_link)
- {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_sta *msta = msta_link->sta;
- 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
--	struct mt7996_sta_link *msta_link;
- 	u32 *changed = data;
- 
--	rcu_read_lock();
--
--	msta_link = rcu_dereference(msta->link[msta->deflink_id]);
--	if (!msta_link)
--		goto out;
--
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
- 
- 	msta_link->changed |= *changed;
-@@ -1675,8 +1669,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
- 		list_add_tail(&msta_link->rc_list, &dev->sta_rc_list);
- 
- 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
--out:
--	rcu_read_unlock();
- }
- 
- static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
-@@ -1684,11 +1676,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
- 				      struct ieee80211_link_sta *link_sta,
- 				      u32 changed)
- {
--	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct ieee80211_sta *sta = link_sta->sta;
-+	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_sta_link *msta_link;
- 
--	mt7996_link_rate_ctrl_update(&changed, sta);
--	ieee80211_queue_work(hw, &dev->rc_work);
-+	rcu_read_lock();
-+
-+	msta_link = rcu_dereference(msta->link[link_sta->link_id]);
-+	if (msta_link) {
-+		struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+
-+		mt7996_link_rate_ctrl_update(&changed, msta_link);
-+		ieee80211_queue_work(hw, &dev->rc_work);
-+	}
-+
-+	rcu_read_unlock();
-+}
-+
-+static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
-+{
-+	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_sta_link *msta_link;
-+	u32 *changed = data;
-+
-+	msta_link = rcu_dereference(msta->link[msta->deflink_id]);
-+	if (msta_link)
-+		mt7996_link_rate_ctrl_update(&changed, msta_link);
- }
- 
- static int
-@@ -1709,7 +1722,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	 * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
- 	 * then multiple MCS setting (MCS 4,5,6) is not supported.
- 	 */
--	ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update,
-+	ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update,
- 					  &changed);
- 	ieee80211_queue_work(hw, &dev->rc_work);
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch b/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
deleted file mode 100644
index cb8c3b57bb..0000000000
--- a/queue-6.16/wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From caaba2618a45ceca6f70fbe3f52065aa4661b56f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 4 Aug 2025 16:16:59 +0200
-Subject: wifi: mwifiex: send world regulatory domain to driver
-
-From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
-
-[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
-
-The world regulatory domain is a restrictive subset of channel
-configurations which allows legal operation of the adapter all over the
-world. Changing to this domain should not be prevented.
-
-Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
-Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
-Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
-Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-index 8085a1ae4bdbb..a57c72d6533c4 100644
---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
- 		return;
- 	}
- 
--	/* Don't send world or same regdom info to firmware */
--	if (strncmp(request->alpha2, "00", 2) &&
--	    strncmp(request->alpha2, adapter->country_code,
--		    sizeof(request->alpha2))) {
-+	/* Don't send same regdom info to firmware */
-+	if (strncmp(request->alpha2, adapter->country_code,
-+		    sizeof(request->alpha2)) != 0) {
- 		memcpy(adapter->country_code, request->alpha2,
- 		       sizeof(request->alpha2));
- 		mwifiex_send_domain_info_cmd_fw(wiphy);
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch b/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
deleted file mode 100644
index 341c5ea269..0000000000
--- a/queue-6.16/wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From e1ceaf1d26f0a0cd8da64de849a90fda67613950 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 1 Aug 2025 23:08:24 +0300
-Subject: wifi: rtw88: Lock rtwdev->mutex before setting the LED
-
-From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-
-[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ]
-
-Some users report that the LED blinking breaks AP mode somehow. Most
-likely the LED code and the dynamic mechanism are trying to access the
-hardware registers at the same time. Fix it by locking rtwdev->mutex
-before setting the LED and unlocking it after.
-
-Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking")
-Closes: https://github.com/lwfinger/rtw88/issues/305
-Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
-index 25aa6cbaa7286..7f9ace351a5b7 100644
---- a/drivers/net/wireless/realtek/rtw88/led.c
-+++ b/drivers/net/wireless/realtek/rtw88/led.c
-@@ -6,13 +6,23 @@
- #include "debug.h"
- #include "led.h"
- 
--static int rtw_led_set_blocking(struct led_classdev *led,
--				enum led_brightness brightness)
-+static void rtw_led_set(struct led_classdev *led,
-+			enum led_brightness brightness)
- {
- 	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
- 
-+	mutex_lock(&rtwdev->mutex);
-+
- 	rtwdev->chip->ops->led_set(led, brightness);
- 
-+	mutex_unlock(&rtwdev->mutex);
-+}
-+
-+static int rtw_led_set_blocking(struct led_classdev *led,
-+				enum led_brightness brightness)
-+{
-+	rtw_led_set(led, brightness);
-+
- 	return 0;
- }
- 
-@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
- 		return;
- 
- 	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
--		led->brightness_set = rtwdev->chip->ops->led_set;
-+		led->brightness_set = rtw_led_set;
- 	else
- 		led->brightness_set_blocking = rtw_led_set_blocking;
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch b/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
deleted file mode 100644
index 2bee022941..0000000000
--- a/queue-6.16/wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 96a3944040eea2b6d1c858c1b480d8e3b1d4ffd5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Aug 2025 21:46:02 +0300
-Subject: wifi: rtw88: Use led->brightness_set_blocking for PCI too
-
-From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-
-[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ]
-
-Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting
-the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by
-using the brightness_set_blocking member of struct led_classdev for
-PCI devices too. This one is allowed to sleep.
-
-bad: scheduling from the idle thread!
-nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G        W  O        6.16.0 #1-NixOS PREEMPT(voluntary)
-nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE
-nix kernel: Hardware name: [REDACTED]
-nix kernel: Call Trace:
-nix kernel:  <IRQ>
-nix kernel:  dump_stack_lvl+0x63/0x90
-nix kernel:  dequeue_task_idle+0x2d/0x50
-nix kernel:  __schedule+0x191/0x1310
-nix kernel:  ? xas_load+0x11/0xd0
-nix kernel:  schedule+0x2b/0xe0
-nix kernel:  schedule_preempt_disabled+0x19/0x30
-nix kernel:  __mutex_lock.constprop.0+0x3fd/0x7d0
-nix kernel:  rtw_led_set+0x27/0x60 [rtw_core]
-nix kernel:  led_blink_set_nosleep+0x56/0xb0
-nix kernel:  led_trigger_blink+0x49/0x80
-nix kernel:  ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
-nix kernel:  call_timer_fn+0x2f/0x140
-nix kernel:  ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
-nix kernel:  __run_timers+0x21a/0x2b0
-nix kernel:  run_timer_softirq+0x8e/0x100
-nix kernel:  handle_softirqs+0xea/0x2c0
-nix kernel:  ? srso_alias_return_thunk+0x5/0xfbef5
-nix kernel:  __irq_exit_rcu+0xdc/0x100
-nix kernel:  sysvec_apic_timer_interrupt+0x7c/0x90
-nix kernel:  </IRQ>
-nix kernel:  <TASK>
-nix kernel:  asm_sysvec_apic_timer_interrupt+0x1a/0x20
-nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450
-nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0>
-nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246
-nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
-nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
-nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000
-nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400
-nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003
-nix kernel:  ? cpuidle_enter_state+0xbc/0x450
-nix kernel:  cpuidle_enter+0x32/0x50
-nix kernel:  do_idle+0x1b1/0x210
-nix kernel:  cpu_startup_entry+0x2d/0x30
-nix kernel:  start_secondary+0x118/0x140
-nix kernel:  common_startup_64+0x13e/0x141
-nix kernel:  </TASK>
-
-Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED")
-Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------
- 1 file changed, 3 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
-index 7f9ace351a5b7..4cc62e49d1679 100644
---- a/drivers/net/wireless/realtek/rtw88/led.c
-+++ b/drivers/net/wireless/realtek/rtw88/led.c
-@@ -6,8 +6,8 @@
- #include "debug.h"
- #include "led.h"
- 
--static void rtw_led_set(struct led_classdev *led,
--			enum led_brightness brightness)
-+static int rtw_led_set(struct led_classdev *led,
-+		       enum led_brightness brightness)
- {
- 	struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
- 
-@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led,
- 	rtwdev->chip->ops->led_set(led, brightness);
- 
- 	mutex_unlock(&rtwdev->mutex);
--}
--
--static int rtw_led_set_blocking(struct led_classdev *led,
--				enum led_brightness brightness)
--{
--	rtw_led_set(led, brightness);
- 
- 	return 0;
- }
-@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
- 	if (!rtwdev->chip->ops->led_set)
- 		return;
- 
--	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
--		led->brightness_set = rtw_led_set;
--	else
--		led->brightness_set_blocking = rtw_led_set_blocking;
-+	led->brightness_set_blocking = rtw_led_set;
- 
- 	snprintf(rtwdev->led_name, sizeof(rtwdev->led_name),
- 		 "rtw88-%s", dev_name(rtwdev->dev));
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch b/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
deleted file mode 100644
index d57b5e2b9e..0000000000
--- a/queue-6.16/wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-From cbbc56d667df5e484d700b66d89225c4c9bbb9b6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 20 Sep 2025 00:08:50 +0300
-Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
-
-From: Fedor Pchelkin <pchelkin@ispras.ru>
-
-[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
-
-Lockdep gives a splat [1] when ser_hdl_work item is executed.  It is
-scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
-wiphy lock inside.  However, this workqueue can be flushed when e.g.
-closing the interface and wiphy lock is already taken in that case.
-
-Choosing wiphy_work_queue() for SER is likely not suitable.  Back on to
-the global workqueue.
-
-[1]:
-
- WARNING: possible circular locking dependency detected
- 6.17.0-rc2 #17 Not tainted
- ------------------------------------------------------
- kworker/u32:1/61 is trying to acquire lock:
- ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
-
- but task is already holding lock:
- ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
-
- which lock already depends on the new lock.
-
- the existing dependency chain (in reverse order) is:
-
- -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
-        process_one_work+0x7c6/0x1450
-        worker_thread+0x49e/0xd00
-        kthread+0x313/0x640
-        ret_from_fork+0x221/0x300
-        ret_from_fork_asm+0x1a/0x30
-
- -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
-        touch_wq_lockdep_map+0x8e/0x180
-        __flush_workqueue+0x129/0x10d0
-        ieee80211_stop_device+0xa8/0x110
-        ieee80211_do_stop+0x14ce/0x2880
-        ieee80211_stop+0x13a/0x2c0
-        __dev_close_many+0x18f/0x510
-        __dev_change_flags+0x25f/0x670
-        netif_change_flags+0x7b/0x160
-        do_setlink.isra.0+0x1640/0x35d0
-        rtnl_newlink+0xd8c/0x1d30
-        rtnetlink_rcv_msg+0x700/0xb80
-        netlink_rcv_skb+0x11d/0x350
-        netlink_unicast+0x49a/0x7a0
-        netlink_sendmsg+0x759/0xc20
-        ____sys_sendmsg+0x812/0xa00
-        ___sys_sendmsg+0xf7/0x180
-        __sys_sendmsg+0x11f/0x1b0
-        do_syscall_64+0xbb/0x360
-        entry_SYSCALL_64_after_hwframe+0x77/0x7f
-
- -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
-        __lock_acquire+0x124c/0x1d20
-        lock_acquire+0x154/0x2e0
-        __mutex_lock+0x17b/0x12f0
-        ser_state_run+0x5e/0x180 [rtw89_core]
-        rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
-        process_one_work+0x82d/0x1450
-        worker_thread+0x49e/0xd00
-        kthread+0x313/0x640
-        ret_from_fork+0x221/0x300
-        ret_from_fork_asm+0x1a/0x30
-
- other info that might help us debug this:
-
- Chain exists of:
-   &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
-
-  Possible unsafe locking scenario:
-
-        CPU0                    CPU1
-        ----                    ----
-   lock((work_completion)(&ser->ser_hdl_work));
-                                lock((wq_completion)phy0);
-                                lock((work_completion)(&ser->ser_hdl_work));
-   lock(&rdev->wiphy.mtx);
-
-  *** DEADLOCK ***
-
- 2 locks held by kworker/u32:1/61:
-  #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
-  #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
-
- stack backtrace:
- CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
- Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
- Call Trace:
-  <TASK>
-  dump_stack_lvl+0x5d/0x80
-  print_circular_bug.cold+0x178/0x1be
-  check_noncircular+0x14c/0x170
-  __lock_acquire+0x124c/0x1d20
-  lock_acquire+0x154/0x2e0
-  __mutex_lock+0x17b/0x12f0
-  ser_state_run+0x5e/0x180 [rtw89_core]
-  rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
-  process_one_work+0x82d/0x1450
-  worker_thread+0x49e/0xd00
-  kthread+0x313/0x640
-  ret_from_fork+0x221/0x300
-  ret_from_fork_asm+0x1a/0x30
-  </TASK>
-
-Found by Linux Verification Center (linuxtesting.org).
-
-Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
-Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
-index 869ab22a79681..803c88d37ec37 100644
---- a/drivers/net/wireless/realtek/rtw89/ser.c
-+++ b/drivers/net/wireless/realtek/rtw89/ser.c
-@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
- 
- static int ser_send_msg(struct rtw89_ser *ser, u8 event)
- {
--	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
- 	struct ser_msg *msg = NULL;
- 
- 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
-@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
- 	list_add(&msg->list, &ser->msg_q);
- 	spin_unlock_irq(&ser->msg_q_lock);
- 
--	ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
-+	schedule_work(&ser->ser_hdl_work);
- 	return 0;
- }
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch b/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
deleted file mode 100644
index de6a4f3d0c..0000000000
--- a/queue-6.16/wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From a6b298b22af29727562c33bbe32f21b428ef68a3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 20 Sep 2025 00:08:49 +0300
-Subject: wifi: rtw89: fix leak in rtw89_core_send_nullfunc()
-
-From: Fedor Pchelkin <pchelkin@ispras.ru>
-
-[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ]
-
-If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated
-skb is leaked.  Free it on the error handling path.
-
-Found by Linux Verification Center (linuxtesting.org).
-
-Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link")
-Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw89/core.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
-index b506afaaa3ec9..725f668308b8e 100644
---- a/drivers/net/wireless/realtek/rtw89/core.c
-+++ b/drivers/net/wireless/realtek/rtw89/core.c
-@@ -3389,6 +3389,7 @@ static int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev,
- 	rtwsta_link = rtwsta->links[rtwvif_link->link_id];
- 	if (unlikely(!rtwsta_link)) {
- 		ret = -ENOLINK;
-+		dev_kfree_skb_any(skb);
- 		goto out;
- 	}
- 
--- 
-2.51.0
-
diff --git a/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch b/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch
deleted file mode 100644
index 7fca1aac38..0000000000
--- a/queue-6.16/x86-vdso-fix-output-operand-size-of-rdpid.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 9e09c5e5e76f1bb0480722f36d5a266d2faaf00d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 Jun 2025 11:52:57 +0200
-Subject: x86/vdso: Fix output operand size of RDPID
-
-From: Uros Bizjak <ubizjak@gmail.com>
-
-[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
-
-RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
-32-bit on x86_32). Use an unsigned long variable to store the correct size.
-
-LSL outputs to 32-bit register, use %k operand prefix to always print the
-32-bit name of the register.
-
-Use RDPID insn mnemonic while at it as the minimum binutils version of
-2.30 supports it.
-
-  [ bp: Merge two patches touching the same function into a single one. ]
-
-Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
-Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/segment.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
-index 77d8f49b92bdd..f59ae7186940a 100644
---- a/arch/x86/include/asm/segment.h
-+++ b/arch/x86/include/asm/segment.h
-@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
- 
- static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
- {
--	unsigned int p;
-+	unsigned long p;
- 
- 	/*
- 	 * Load CPU and node number from the GDT.  LSL is faster than RDTSCP
-@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
- 	 *
- 	 * If RDPID is available, use it.
- 	 */
--	alternative_io ("lsl %[seg],%[p]",
--			".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
-+	alternative_io ("lsl %[seg],%k[p]",
-+			"rdpid %[p]",
- 			X86_FEATURE_RDPID,
--			[p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
-+			[p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
- 
- 	if (cpu)
- 		*cpu = (p & VDSO_CPUNODE_MASK);
--- 
-2.51.0
-
-- 
2.47.3