--- /dev/null
+From e3c113ddf34912a235a7721896324f0e1b1da2a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 08:41:47 +0200
+Subject: atm: idt77252: Add missing `dma_map_error()`
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit c4890963350dcf4e9a909bae23665921fba4ad27 ]
+
+The DMA map functions can fail and should be tested for errors.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/idt77252.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index 25fd73fafb371..89b0ed8e51430 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -852,6 +852,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc,
+
+ IDT77252_PRV_PADDR(skb) = dma_map_single(&card->pcidev->dev, skb->data,
+ skb->len, DMA_TO_DEVICE);
++ if (dma_mapping_error(&card->pcidev->dev, IDT77252_PRV_PADDR(skb)))
++ return -ENOMEM;
+
+ error = -EINVAL;
+
+@@ -1863,6 +1865,8 @@ add_rx_skb(struct idt77252_dev *card, int queue,
+ paddr = dma_map_single(&card->pcidev->dev, skb->data,
+ skb_end_pointer(skb) - skb->data,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&card->pcidev->dev, paddr))
++ goto outpoolrm;
+ IDT77252_PRV_PADDR(skb) = paddr;
+
+ if (push_rx_skb(card, skb, queue)) {
+@@ -1877,6 +1881,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
+ dma_unmap_single(&card->pcidev->dev, IDT77252_PRV_PADDR(skb),
+ skb_end_pointer(skb) - skb->data, DMA_FROM_DEVICE);
+
++outpoolrm:
+ handle = IDT77252_PRV_POOL(skb);
+ card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL;
+
+--
+2.39.5
+
--- /dev/null
+From 8766e406adb9b3c4bd8c0506a71bbbf99a43906d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Jul 2025 02:08:03 -0400
+Subject: Bluetooth: HCI: Set extended advertising data synchronously
+
+From: Christian Eggers <ceggers@arri.de>
+
+[ Upstream commit 89fb8acc38852116d38d721ad394aad7f2871670 ]
+
+Currently, for controllers with extended advertising, the advertising
+data is set in the asynchronous response handler for extended
+adverstising params. As most advertising settings are performed in a
+synchronous context, the (asynchronous) setting of the advertising data
+is done too late (after enabling the advertising).
+
+Move setting of adverstising data from asynchronous response handler
+into synchronous context to fix ordering of HCI commands.
+
+Signed-off-by: Christian Eggers <ceggers@arri.de>
+Fixes: a0fb3726ba55 ("Bluetooth: Use Set ext adv/scan rsp data if controller supports")
+Cc: stable@vger.kernel.org
+v2: https://lore.kernel.org/linux-bluetooth/20250626115209.17839-1-ceggers@arri.de/
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 33 ---------------------------------
+ net/bluetooth/hci_request.c | 3 +++
+ 2 files changed, 3 insertions(+), 33 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 7f26c1aab9a06..2cc4aaba09abe 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -1726,36 +1726,6 @@ static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
+ hci_dev_unlock(hdev);
+ }
+
+-static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
+-{
+- struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
+- struct hci_cp_le_set_ext_adv_params *cp;
+- struct adv_info *adv_instance;
+-
+- BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+-
+- if (rp->status)
+- return;
+-
+- cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
+- if (!cp)
+- return;
+-
+- hci_dev_lock(hdev);
+- hdev->adv_addr_type = cp->own_addr_type;
+- if (!hdev->cur_adv_instance) {
+- /* Store in hdev for instance 0 */
+- hdev->adv_tx_power = rp->tx_power;
+- } else {
+- adv_instance = hci_find_adv_instance(hdev,
+- hdev->cur_adv_instance);
+- if (adv_instance)
+- adv_instance->tx_power = rp->tx_power;
+- }
+- /* Update adv data as tx power is known now */
+- hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
+- hci_dev_unlock(hdev);
+-}
+
+ static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
+ {
+@@ -3601,9 +3571,6 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ hci_cc_le_read_num_adv_sets(hdev, skb);
+ break;
+
+- case HCI_OP_LE_SET_EXT_ADV_PARAMS:
+- hci_cc_set_ext_adv_param(hdev, skb);
+- break;
+
+ case HCI_OP_LE_SET_EXT_ADV_ENABLE:
+ hci_cc_le_set_ext_adv_enable(hdev, skb);
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 7ce6db1ac558a..743ba58941f8b 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -2179,6 +2179,9 @@ int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance)
+
+ hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
+
++ /* Update adv data after setting ext adv params */
++ __hci_req_update_adv_data(req, instance);
++
+ if (own_addr_type == ADDR_LE_DEV_RANDOM &&
+ bacmp(&random_addr, BDADDR_ANY)) {
+ struct hci_cp_le_set_adv_set_rand_addr cp;
+--
+2.39.5
+
--- /dev/null
+From 5c6deec90728c840b2129b4fe316c38fc3efe6b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:39:36 -0700
+Subject: bnxt_en: Fix DCB ETS validation
+
+From: Shravya KN <shravya.k-n@broadcom.com>
+
+[ Upstream commit b74c2a2e9cc471e847abd87e50a2354c07e02040 ]
+
+In bnxt_ets_validate(), the code incorrectly loops over all possible
+traffic classes to check and add the ETS settings. Fix it to loop
+over the configured traffic classes only.
+
+The unconfigured traffic classes will default to TSA_ETS with 0
+bandwidth. Looping over these unconfigured traffic classes may
+cause the validation to fail and trigger this error message:
+
+"rejecting ETS config starving a TC\n"
+
+The .ieee_setets() will then fail.
+
+Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.")
+Reviewed-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Shravya KN <shravya.k-n@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250710213938.1959625-2-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index 8e90224c43a21..6464de38c82e2 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -447,7 +447,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc)
+
+ if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc)
+ return -EINVAL;
++ }
+
++ for (i = 0; i < max_tc; i++) {
+ switch (ets->tc_tsa[i]) {
+ case IEEE_8021QAZ_TSA_STRICT:
+ break;
+--
+2.39.5
+
--- /dev/null
+From 6bd53da597f85c952ce40ceba674a010b3d3becd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:39:38 -0700
+Subject: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
+
+From: Somnath Kotur <somnath.kotur@broadcom.com>
+
+[ Upstream commit 3cdf199d4755d477972ee87110b2aebc88b3cfad ]
+
+When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()
+with the proper length instead of 0. This bug triggers this warning
+on a system with IOMMU enabled:
+
+WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170
+RIP: 0010:__iommu_dma_unmap+0x159/0x170
+Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45
+b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00
+RSP: 0018:ff22d31181150c88 EFLAGS: 00010206
+RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000
+R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000
+R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00
+FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0
+PKRU: 55555554
+Call Trace:
+<IRQ>
+? show_regs+0x6d/0x80
+? __warn+0x89/0x160
+? __iommu_dma_unmap+0x159/0x170
+? report_bug+0x17e/0x1b0
+? handle_bug+0x46/0x90
+? exc_invalid_op+0x18/0x80
+? asm_exc_invalid_op+0x1b/0x20
+? __iommu_dma_unmap+0x159/0x170
+? __iommu_dma_unmap+0xb3/0x170
+iommu_dma_unmap_page+0x4f/0x100
+dma_unmap_page_attrs+0x52/0x220
+? srso_alias_return_thunk+0x5/0xfbef5
+? xdp_return_frame+0x2e/0xd0
+bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]
+__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]
+bnxt_poll+0xd3/0x1e0 [bnxt_en]
+
+Fixes: f18c2b77b2e4 ("bnxt_en: optimized XDP_REDIRECT support")
+Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250710213938.1959625-4-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+index fcc262064766a..dc9afaa14da8f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+@@ -65,7 +65,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp,
+ tx_buf->action = XDP_REDIRECT;
+ tx_buf->xdpf = xdpf;
+ dma_unmap_addr_set(tx_buf, mapping, mapping);
+- dma_unmap_len_set(tx_buf, len, 0);
++ dma_unmap_len_set(tx_buf, len, len);
+ }
+
+ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
+--
+2.39.5
+
--- /dev/null
+From e15b371eabf4c0fe7cff14155cb392813ab5709a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 15:58:31 +0100
+Subject: btrfs: fix inode lookup error handling during log replay
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 5f61b961599acbd2bed028d3089105a1f7d224b8 ]
+
+When replaying log trees we use read_one_inode() to get an inode, which is
+just a wrapper around btrfs_iget_logging(), which in turn is a wrapper for
+btrfs_iget(). But read_one_inode() always returns NULL for any error
+that btrfs_iget_logging() / btrfs_iget() may return and this is a problem
+because:
+
+1) In many callers of read_one_inode() we convert the NULL into -EIO,
+ which is not accurate since btrfs_iget() may return -ENOMEM and -ENOENT
+ for example, besides -EIO and other errors. So during log replay we
+ may end up reporting a false -EIO, which is confusing since we may
+ not have had any IO error at all;
+
+2) When replaying directory deletes, at replay_dir_deletes(), we assume
+ the NULL returned from read_one_inode() means that the inode doesn't
+ exist and then proceed as if no error had happened. This is wrong
+ because unless btrfs_iget() returned ERR_PTR(-ENOENT), we had an
+ actual error and the target inode may exist in the target subvolume
+ root - this may later result in the log replay code failing at a
+ later stage (if we are "lucky") or succeed but leaving some
+ inconsistency in the filesystem.
+
+So fix this by not ignoring errors from btrfs_iget_logging() and as
+a consequence remove the read_one_inode() wrapper and just use
+btrfs_iget_logging() directly. Also since btrfs_iget_logging() is
+supposed to be called only against subvolume roots, just like
+read_one_inode() which had a comment about it, add an assertion to
+btrfs_iget_logging() to check that the target root corresponds to a
+subvolume root.
+
+Fixes: 5d4f98a28c7d ("Btrfs: Mixed back reference (FORWARD ROLLING FORMAT CHANGE)")
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 153 ++++++++++++++++++++++++--------------------
+ 1 file changed, 84 insertions(+), 69 deletions(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index dd1c40019412c..503be060fa8f3 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4,10 +4,12 @@
+ */
+
+ #include <linux/sched.h>
++#include <linux/sched/mm.h>
+ #include <linux/slab.h>
+ #include <linux/blkdev.h>
+ #include <linux/list_sort.h>
+ #include <linux/iversion.h>
++#include <linux/fscrypt.h>
+ #include "misc.h"
+ #include "ctree.h"
+ #include "tree-log.h"
+@@ -129,6 +131,27 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans,
+ * and once to do all the other items.
+ */
+
++static struct inode *btrfs_iget_logging(u64 objectid, struct btrfs_root *root)
++{
++ unsigned int nofs_flag;
++ struct inode *inode;
++
++ /* Only meant to be called for subvolume roots and not for log roots. */
++ ASSERT(is_fstree(root->root_key.objectid));
++
++ /*
++ * We're holding a transaction handle whether we are logging or
++ * replaying a log tree, so we must make sure NOFS semantics apply
++ * because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL
++ * to allocate an inode, which can recurse back into the filesystem and
++ * attempt a transaction commit, resulting in a deadlock.
++ */
++ nofs_flag = memalloc_nofs_save();
++ inode = btrfs_iget(root->fs_info->sb, objectid, root);
++ memalloc_nofs_restore(nofs_flag);
++
++ return inode;
++}
+ /*
+ * start a sub transaction and setup the log tree
+ * this increments the log tree writer count to make the people
+@@ -543,20 +566,6 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
+-/*
+- * simple helper to read an inode off the disk from a given root
+- * This can only be called for subvolume roots and not for the log
+- */
+-static noinline struct inode *read_one_inode(struct btrfs_root *root,
+- u64 objectid)
+-{
+- struct inode *inode;
+-
+- inode = btrfs_iget(root->fs_info->sb, objectid, root);
+- if (IS_ERR(inode))
+- inode = NULL;
+- return inode;
+-}
+
+ /* replays a single extent in 'eb' at 'slot' with 'key' into the
+ * subvolume 'root'. path is released on entry and should be released
+@@ -610,11 +619,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ goto out;
+ }
+
+- inode = read_one_inode(root, key->objectid);
+- if (!inode) {
+- ret = -EIO;
+- goto out;
+- }
++ inode = btrfs_iget_logging(key->objectid, root);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
+
+ /*
+ * first check to see if we already have this extent in the
+@@ -871,9 +878,10 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
+ read_extent_buffer(leaf, name, (unsigned long)(di + 1), name_len);
+ btrfs_release_path(path);
+
+- inode = read_one_inode(root, location.objectid);
+- if (!inode) {
+- ret = -EIO;
++ inode = btrfs_iget_logging(location.objectid, root);
++ if (IS_ERR(inode)) {
++ ret = PTR_ERR(inode);
++ inode = NULL;
+ goto out;
+ }
+
+@@ -1115,10 +1123,10 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans,
+ kfree(victim_name);
+ return ret;
+ } else if (!ret) {
+- ret = -ENOENT;
+- victim_parent = read_one_inode(root,
+- parent_objectid);
+- if (victim_parent) {
++ victim_parent = btrfs_iget_logging(parent_objectid, root);
++ if (IS_ERR(victim_parent)) {
++ ret = PTR_ERR(victim_parent);
++ } else {
+ inc_nlink(&inode->vfs_inode);
+ btrfs_release_path(path);
+
+@@ -1278,9 +1286,9 @@ static int unlink_old_inode_refs(struct btrfs_trans_handle *trans,
+ struct inode *dir;
+
+ btrfs_release_path(path);
+- dir = read_one_inode(root, parent_id);
+- if (!dir) {
+- ret = -ENOENT;
++ dir = btrfs_iget_logging(parent_id, root);
++ if (IS_ERR(dir)) {
++ ret = PTR_ERR(dir);
+ kfree(name);
+ goto out;
+ }
+@@ -1386,9 +1394,9 @@ static int add_link(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ */
+ btrfs_dir_item_key_to_cpu(path->nodes[0], dir_item, &key);
+ btrfs_release_path(path);
+- other_inode = read_one_inode(root, key.objectid);
+- if (!other_inode) {
+- ret = -ENOENT;
++ other_inode = btrfs_iget_logging(key.objectid, root);
++ if (IS_ERR(other_inode)) {
++ ret = PTR_ERR(other_inode);
+ goto out;
+ }
+ ret = btrfs_unlink_inode(trans, root, BTRFS_I(dir), BTRFS_I(other_inode),
+@@ -1464,15 +1472,17 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
+ * copy the back ref in. The link count fixup code will take
+ * care of the rest
+ */
+- dir = read_one_inode(root, parent_objectid);
+- if (!dir) {
+- ret = -ENOENT;
++ dir = btrfs_iget_logging(parent_objectid, root);
++ if (IS_ERR(dir)) {
++ ret = PTR_ERR(dir);
++ dir = NULL;
+ goto out;
+ }
+
+- inode = read_one_inode(root, inode_objectid);
+- if (!inode) {
+- ret = -EIO;
++ inode = btrfs_iget_logging(inode_objectid, root);
++ if (IS_ERR(inode)) {
++ ret = PTR_ERR(inode);
++ inode = NULL;
+ goto out;
+ }
+
+@@ -1484,11 +1494,13 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
+ * parent object can change from one array
+ * item to another.
+ */
+- if (!dir)
+- dir = read_one_inode(root, parent_objectid);
+ if (!dir) {
+- ret = -ENOENT;
+- goto out;
++ dir = btrfs_iget_logging(parent_objectid, root);
++ if (IS_ERR(dir)) {
++ ret = PTR_ERR(dir);
++ dir = NULL;
++ goto out;
++ }
+ }
+ } else {
+ ret = ref_get_fields(eb, ref_ptr, &namelen, &name,
+@@ -1807,9 +1819,9 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
+ break;
+
+ btrfs_release_path(path);
+- inode = read_one_inode(root, key.offset);
+- if (!inode) {
+- ret = -EIO;
++ inode = btrfs_iget_logging(key.offset, root);
++ if (IS_ERR(inode)) {
++ ret = PTR_ERR(inode);
+ break;
+ }
+
+@@ -1844,9 +1856,9 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
+ int ret = 0;
+ struct inode *inode;
+
+- inode = read_one_inode(root, objectid);
+- if (!inode)
+- return -EIO;
++ inode = btrfs_iget_logging(objectid, root);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
+
+ key.objectid = BTRFS_TREE_LOG_FIXUP_OBJECTID;
+ key.type = BTRFS_ORPHAN_ITEM_KEY;
+@@ -1884,14 +1896,14 @@ static noinline int insert_one_name(struct btrfs_trans_handle *trans,
+ struct inode *dir;
+ int ret;
+
+- inode = read_one_inode(root, location->objectid);
+- if (!inode)
+- return -ENOENT;
++ inode = btrfs_iget_logging(location->objectid, root);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
+
+- dir = read_one_inode(root, dirid);
+- if (!dir) {
++ dir = btrfs_iget_logging(dirid, root);
++ if (IS_ERR(dir)) {
+ iput(inode);
+- return -EIO;
++ return PTR_ERR(dir);
+ }
+
+ ret = btrfs_add_link(trans, BTRFS_I(dir), BTRFS_I(inode), name,
+@@ -1939,9 +1951,9 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
+ bool update_size = (key->type == BTRFS_DIR_INDEX_KEY);
+ bool name_added = false;
+
+- dir = read_one_inode(root, key->objectid);
+- if (!dir)
+- return -EIO;
++ dir = btrfs_iget_logging(key->objectid, root);
++ if (IS_ERR(dir))
++ return PTR_ERR(dir);
+
+ name_len = btrfs_dir_name_len(eb, di);
+ name = kmalloc(name_len, GFP_NOFS);
+@@ -2287,10 +2299,10 @@ static noinline int check_item_in_log(struct btrfs_trans_handle *trans,
+ btrfs_dir_item_key_to_cpu(eb, di, &location);
+ btrfs_release_path(path);
+ btrfs_release_path(log_path);
+- inode = read_one_inode(root, location.objectid);
+- if (!inode) {
++ inode = btrfs_iget_logging(location.objectid, root);
++ if (IS_ERR(inode)) {
+ kfree(name);
+- return -EIO;
++ return PTR_ERR(inode);
+ }
+
+ ret = link_to_fixup_dir(trans, root,
+@@ -2466,14 +2478,17 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans,
+ if (!log_path)
+ return -ENOMEM;
+
+- dir = read_one_inode(root, dirid);
+- /* it isn't an error if the inode isn't there, that can happen
+- * because we replay the deletes before we copy in the inode item
+- * from the log
++ dir = btrfs_iget_logging(dirid, root);
++ /*
++ * It isn't an error if the inode isn't there, that can happen because
++ * we replay the deletes before we copy in the inode item from the log.
+ */
+- if (!dir) {
++ if (IS_ERR(dir)) {
+ btrfs_free_path(log_path);
+- return 0;
++ ret = PTR_ERR(dir);
++ if (ret == -ENOENT)
++ ret = 0;
++ return ret;
+ }
+ again:
+ range_start = 0;
+@@ -2633,9 +2648,9 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ struct inode *inode;
+ u64 from;
+
+- inode = read_one_inode(root, key.objectid);
+- if (!inode) {
+- ret = -EIO;
++ inode = btrfs_iget_logging(key.objectid, root);
++ if (IS_ERR(inode)) {
++ ret = PTR_ERR(inode);
+ break;
+ }
+ from = ALIGN(i_size_read(inode),
+--
+2.39.5
+
--- /dev/null
+From a3ed381977879099c27cd9763d6710e276226997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:12:02 +0200
+Subject: can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message
+ to debug level
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+[ Upstream commit 58805e9cbc6f6a28f35d90e740956e983a0e036e ]
+
+Downgrade the "msg lost in rx" message to debug level, to prevent
+flooding the kernel log with error messages.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Link: https://patch.msgid.link/20250711-mcan_ratelimit-v3-1-7413e8e21b84@geanix.com
+[mkl: enhance commit message]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 6181ac277b62f..1c8a7c65530fd 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -522,7 +522,7 @@ static int m_can_handle_lost_msg(struct net_device *dev)
+ struct sk_buff *skb;
+ struct can_frame *frame;
+
+- netdev_err(dev, "msg lost in rxf0\n");
++ netdev_dbg(dev, "msg lost in rxf0\n");
+
+ stats->rx_errors++;
+ stats->rx_over_errors++;
+--
+2.39.5
+
--- /dev/null
+From d3d2e9809ed0669a89ed7f3a1b3f191479cd54bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Jul 2025 05:23:25 -0400
+Subject: dma-buf: fix timeout handling in dma_resv_wait_timeout v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 2b95a7db6e0f75587bffddbb490399cbb87e4985 ]
+
+Even the kerneldoc says that with a zero timeout the function should not
+wait for anything, but still return 1 to indicate that the fences are
+signaled now.
+
+Unfortunately that isn't what was implemented, instead of only returning
+1 we also waited for at least one jiffies.
+
+Fix that by adjusting the handling to what the function is actually
+documented to do.
+
+v2: improve code readability
+
+Reported-by: Marek Olšák <marek.olsak@amd.com>
+Reported-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20250129105841.1806-1-christian.koenig@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-resv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c
+index 1187e5e80eded..539cb4e043386 100644
+--- a/drivers/dma-buf/dma-resv.c
++++ b/drivers/dma-buf/dma-resv.c
+@@ -591,7 +591,7 @@ long dma_resv_wait_timeout_rcu(struct dma_resv *obj,
+ goto retry;
+ }
+
+- ret = dma_fence_wait_timeout(fence, intr, ret);
++ ret = dma_fence_wait_timeout(fence, intr, timeout);
+ dma_fence_put(fence);
+ if (ret > 0 && wait_all && (i + 1 < shared_count))
+ goto retry;
+--
+2.39.5
+
--- /dev/null
+From 4084e76a559275262d85abb62d895f982a453d41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 15:29:59 +0800
+Subject: HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ]
+
+MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an
+audio device is requested to get specific report id, the following error
+may occur.
+
+[ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd
+[ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00
+[ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+[ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device
+[ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology
+[ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001
+[ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35
+[ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2
+[ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint
+[ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+
+Ignore HID interface. The device is working properly.
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4b8f8e0ce8ca2..981ff6b233a40 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1360,4 +1360,7 @@
+ #define USB_VENDOR_ID_SIGNOTEC 0x2133
+ #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018
+
++#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a
++#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155
++
+ #endif
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index b3e7ede8f398e..423d18a77b9e8 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -873,6 +873,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ #endif
+ { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) },
+ { }
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 9be15ff5cf9d8412343b57276a1d261f7c31ed42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 13:50:15 +0800
+Subject: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ]
+
+The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C)
+report a HID sensor interface that is not actually implemented.
+Attempting to access this non-functional sensor via iio_info causes
+system hangs as runtime PM tries to wake up an unresponsive sensor.
+
+Add these 2 devices to the HID ignore list since the sensor interface is
+non-functional by design and should not be exposed to userspace.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 981ff6b233a40..8bfa90e37ea17 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -278,6 +278,8 @@
+ #define USB_DEVICE_ID_ASUS_AK1D 0x1125
+ #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408
+ #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421
++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824
++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c
+
+ #define USB_VENDOR_ID_CHUNGHWAT 0x2247
+ #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 423d18a77b9e8..9c1c65612adb7 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -726,6 +726,8 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) },
+--
+2.39.5
+
--- /dev/null
+From 1cf53b15fa149f21890c10b2fa5ee490ac70a92b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 15:29:37 -0700
+Subject: Input: xpad - add support for Amazon Game Controller
+
+From: Matt Reynolds <mattreynolds@chromium.org>
+
+[ Upstream commit 05665cef4b745cb46b1d1b8e96deaa25464092d3 ]
+
+The Amazon Luna controller (product name "Amazon Game Controller") behaves
+like an Xbox 360 controller when connected over USB.
+
+Signed-off-by: Matt Reynolds <mattreynolds@chromium.org>
+Reviewed-by: Harry Cutts <hcutts@chromium.org>
+Link: https://lore.kernel.org/r/20210429103548.1.If5f9a44cb81e25b9350f7c6c0b3c88b4ecd81166@changeid
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 00b973e0f79ff..fb714004641b7 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -275,6 +275,7 @@ static const struct xpad_device {
+ { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 },
+ { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 },
+ { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
++ { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -462,6 +463,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
++ XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */
+ XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */
+ XPAD_XBOX360_VENDOR(0x20d6), /* PowerA Controllers */
+ XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */
+--
+2.39.5
+
--- /dev/null
+From 0ef43de3d337ee7771413345e28423cd23318350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 18:32:43 -0700
+Subject: Input: xpad - add VID for Turtle Beach controllers
+
+From: Vicki Pfau <vi@endrift.com>
+
+[ Upstream commit 1999a6b12a3b5c8953fc9ec74863ebc75a1b851d ]
+
+This adds support for the Turtle Beach REACT-R and Recon Xbox controllers
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Link: https://lore.kernel.org/r/20230225012147.276489-4-vi@endrift.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Stable-dep-of: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index fb714004641b7..21a4bf8b1f58e 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -452,6 +452,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */
+ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */
++ XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */
+ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
+ XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */
+ XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
+--
+2.39.5
+
--- /dev/null
+From 4383bb0329bae55f32fa680dbdebd4b2fcf35df7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 16:29:40 -0700
+Subject: Input: xpad - support Acer NGR 200 Controller
+
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+
+[ Upstream commit 22c69d786ef8fb789c61ca75492a272774221324 ]
+
+Add the NGR 200 Xbox 360 to the list of recognized controllers.
+
+Signed-off-by: Nilton Perim Neto <niltonperimneto@gmail.com>
+Link: https://lore.kernel.org/r/20250608060517.14967-1-niltonperimneto@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 21a4bf8b1f58e..a0362201b5d35 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -147,6 +147,7 @@ static const struct xpad_device {
+ { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX },
++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX },
+ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX },
+ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX },
+ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
+@@ -440,6 +441,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */
++ XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */
+ XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */
+ XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */
+ XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */
+--
+2.39.5
+
--- /dev/null
+From f736d49ca3a637ed4da1a0e26e37bd3e7b84bde5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 19:28:40 +0800
+Subject: md/raid1: Fix stack memory use after return in raid1_reshape
+
+From: Wang Jinchao <wangjinchao600@gmail.com>
+
+[ Upstream commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 ]
+
+In the raid1_reshape function, newpool is
+allocated on the stack and assigned to conf->r1bio_pool.
+This results in conf->r1bio_pool.wait.head pointing
+to a stack address.
+Accessing this address later can lead to a kernel panic.
+
+Example access path:
+
+raid1_reshape()
+{
+ // newpool is on the stack
+ mempool_t newpool, oldpool;
+ // initialize newpool.wait.head to stack address
+ mempool_init(&newpool, ...);
+ conf->r1bio_pool = newpool;
+}
+
+raid1_read_request() or raid1_write_request()
+{
+ alloc_r1bio()
+ {
+ mempool_alloc()
+ {
+ // if pool->alloc fails
+ remove_element()
+ {
+ --pool->curr_nr;
+ }
+ }
+ }
+}
+
+mempool_free()
+{
+ if (pool->curr_nr < pool->min_nr) {
+ // pool->wait.head is a stack address
+ // wake_up() will try to access this invalid address
+ // which leads to a kernel panic
+ return;
+ wake_up(&pool->wait);
+ }
+}
+
+Fix:
+reinit conf->r1bio_pool.wait after assigning newpool.
+
+Fixes: afeee514ce7f ("md: convert to bioset_init()/mempool_init()")
+Signed-off-by: Wang Jinchao <wangjinchao600@gmail.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/linux-raid/20250612112901.3023950-1-wangjinchao600@gmail.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index dada9b2258a61..51e05ea3f1373 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -3290,6 +3290,7 @@ static int raid1_reshape(struct mddev *mddev)
+ /* ok, everything is stopped */
+ oldpool = conf->r1bio_pool;
+ conf->r1bio_pool = newpool;
++ init_waitqueue_head(&conf->r1bio_pool.wait);
+
+ for (d = d2 = 0; d < conf->raid_disks; d++) {
+ struct md_rdev *rdev = conf->mirrors[d].rdev;
+--
+2.39.5
+
--- /dev/null
+From 3a06f9ec2cd899f612001c57426c620d2b9c6667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 03:52:51 +0000
+Subject: net: appletalk: Fix device refcount leak in atrtr_create()
+
+From: Kito Xu <veritas501@foxmail.com>
+
+[ Upstream commit 711c80f7d8b163d3ecd463cd96f07230f488e750 ]
+
+When updating an existing route entry in atrtr_create(), the old device
+reference was not being released before assigning the new device,
+leading to a device refcount leak. Fix this by calling dev_put() to
+release the old device reference before holding the new one.
+
+Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().")
+Signed-off-by: Kito Xu <veritas501@foxmail.com>
+Link: https://patch.msgid.link/tencent_E1A26771CDAB389A0396D1681A90A49E5D09@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/appletalk/ddp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 46adb8cefccf2..c9edfca153c99 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -563,6 +563,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)
+
+ /* Fill in the routing entry */
+ rt->target = ta->sat_addr;
++ dev_put(rt->dev); /* Release old device */
+ dev_hold(devhint);
+ rt->dev = devhint;
+ rt->flags = r->rt_flags;
+--
+2.39.5
+
--- /dev/null
+From b4cb0d37e18c8a09bb666195164538869aaec464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 11:06:17 -0700
+Subject: net: ll_temac: Fix missing tx_pending check in
+ ethtools_set_ringparam()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e81750b4e3826fedce7362dad839cb40384d60ae ]
+
+The function ll_temac_ethtools_set_ringparam() incorrectly checked
+rx_pending twice, once correctly for RX and once mistakenly in place
+of tx_pending. This caused tx_pending to be left unchecked against
+TX_BD_NUM_MAX.
+As a result, invalid TX ring sizes may have been accepted or valid
+ones wrongly rejected based on the RX limit, leading to potential
+misconfiguration or unexpected results.
+
+This patch corrects the condition to properly validate tx_pending.
+
+Fixes: f7b261bfc35e ("net: ll_temac: Make RX/TX ring sizes configurable")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250710180621.2383000-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index e50b59efe188b..5ace1a4905d7e 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1299,7 +1299,7 @@ static int ll_temac_ethtools_set_ringparam(struct net_device *ndev,
+ if (ering->rx_pending > RX_BD_NUM_MAX ||
+ ering->rx_mini_pending ||
+ ering->rx_jumbo_pending ||
+- ering->rx_pending > TX_BD_NUM_MAX)
++ ering->tx_pending > TX_BD_NUM_MAX)
+ return -EINVAL;
+
+ if (netif_running(ndev))
+--
+2.39.5
+
--- /dev/null
+From ca9970b98c86ebcb20a46d4ea1c36492cf7df334 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 15:07:53 +0200
+Subject: net: phy: microchip: limit 100M workaround to link-down events on
+ LAN88xx
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 ]
+
+Restrict the 100Mbit forced-mode workaround to link-down transitions
+only, to prevent repeated link reset cycles in certain configurations.
+
+The workaround was originally introduced to improve signal reliability
+when switching cables between long and short distances. It temporarily
+forces the PHY into 10 Mbps before returning to 100 Mbps.
+
+However, when used with autonegotiating link partners (e.g., Intel i350),
+executing this workaround on every link change can confuse the partner
+and cause constant renegotiation loops. This results in repeated link
+down/up transitions and the PHY never reaching a stable state.
+
+Limit the workaround to only run during the PHY_NOLINK state. This ensures
+it is triggered only once per link drop, avoiding disruptive toggling
+while still preserving its intended effect.
+
+Note: I am not able to reproduce the original issue that this workaround
+addresses. I can only confirm that 100 Mbit mode works correctly in my
+test setup. Based on code inspection, I assume the workaround aims to
+reset some internal state machine or signal block by toggling speeds.
+However, a PHY reset is already performed earlier in the function via
+phy_init_hw(), which may achieve a similar effect. Without a reproducer,
+I conservatively keep the workaround but restrict its conditions.
+
+Fixes: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250709130753.3994461-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/microchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
+index 375bbd60b38af..e6ad7d29a0559 100644
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -335,7 +335,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev)
+ * As workaround, set to 10 before setting to 100
+ * at forced 100 F/H mode.
+ */
+- if (!phydev->autoneg && phydev->speed == 100) {
++ if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) {
+ /* disable phy interrupt */
+ temp = phy_read(phydev, LAN88XX_INT_MASK);
+ temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
+--
+2.39.5
+
--- /dev/null
+From a28db74869491120dde6462fd2a9e7751064b32c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 10:27:02 +0800
+Subject: net: usb: qmi_wwan: add SIMCom 8230C composition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaowei Li <xiaowei.li@simcom.com>
+
+[ Upstream commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 ]
+
+Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.
+0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet
+T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1e0e ProdID=9071 Rev= 5.15
+S: Manufacturer=SIMCOM
+S: Product=SDXBAAGHA-IDP _SN:D744C4C5
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Xiaowei Li <xiaowei.li@simcom.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Link: https://patch.msgid.link/tencent_21D781FAA4969FEACA6ABB460362B52C9409@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 3ab7b27b6bac3..9f493d504d20f 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1360,6 +1360,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
++ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
+--
+2.39.5
+
--- /dev/null
+From 720a670541807bcc58302ef5309baead96c5b16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 22:44:43 +0100
+Subject: Revert "usb: host: xhci: mvebu: make USB 3.0 PHY optional for Armada
+ 3720"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 8e10548f7f4814e530857d2049d6af6bc78add53 ]
+
+This reverts commit 3241929b67d28c83945d3191c6816a3271fd6b85.
+
+Armada 3720 phy driver (phy-mvebu-a3700-comphy.c) does not return
+-EOPNOTSUPP from phy_power_on() callback anymore.
+
+So remove XHCI_SKIP_PHY_INIT flag from xhci_mvebu_a3700_plat_setup() and
+then also whole xhci_mvebu_a3700_plat_setup() function which is there just
+to handle -EOPNOTSUPP for XHCI_SKIP_PHY_INIT.
+
+xhci plat_setup callback is not used by any other xhci plat driver, so
+remove this callback completely.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20220203214444.1508-5-kabel@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mvebu.c | 42 -----------------------------------
+ drivers/usb/host/xhci-mvebu.h | 6 -----
+ drivers/usb/host/xhci-plat.c | 20 +----------------
+ drivers/usb/host/xhci-plat.h | 1 -
+ 4 files changed, 1 insertion(+), 68 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-mvebu.c b/drivers/usb/host/xhci-mvebu.c
+index eabccf25796b2..87f1597a0e5ab 100644
+--- a/drivers/usb/host/xhci-mvebu.c
++++ b/drivers/usb/host/xhci-mvebu.c
+@@ -8,7 +8,6 @@
+ #include <linux/mbus.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+-#include <linux/phy/phy.h>
+
+ #include <linux/usb.h>
+ #include <linux/usb/hcd.h>
+@@ -75,47 +74,6 @@ int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd)
+ return 0;
+ }
+
+-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd)
+-{
+- struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- struct device *dev = hcd->self.controller;
+- struct phy *phy;
+- int ret;
+-
+- /* Old bindings miss the PHY handle */
+- phy = of_phy_get(dev->of_node, "usb3-phy");
+- if (IS_ERR(phy) && PTR_ERR(phy) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
+- else if (IS_ERR(phy))
+- goto phy_out;
+-
+- ret = phy_init(phy);
+- if (ret)
+- goto phy_put;
+-
+- ret = phy_set_mode(phy, PHY_MODE_USB_HOST_SS);
+- if (ret)
+- goto phy_exit;
+-
+- ret = phy_power_on(phy);
+- if (ret == -EOPNOTSUPP) {
+- /* Skip initializatin of XHCI PHY when it is unsupported by firmware */
+- dev_warn(dev, "PHY unsupported by firmware\n");
+- xhci->quirks |= XHCI_SKIP_PHY_INIT;
+- }
+- if (ret)
+- goto phy_exit;
+-
+- phy_power_off(phy);
+-phy_exit:
+- phy_exit(phy);
+-phy_put:
+- of_phy_put(phy);
+-phy_out:
+-
+- return 0;
+-}
+-
+ int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+diff --git a/drivers/usb/host/xhci-mvebu.h b/drivers/usb/host/xhci-mvebu.h
+index 01bf3fcb3eca5..3be021793cc8b 100644
+--- a/drivers/usb/host/xhci-mvebu.h
++++ b/drivers/usb/host/xhci-mvebu.h
+@@ -12,7 +12,6 @@ struct usb_hcd;
+
+ #if IS_ENABLED(CONFIG_USB_XHCI_MVEBU)
+ int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd);
+-int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd);
+ int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd);
+ #else
+ static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd)
+@@ -20,11 +19,6 @@ static inline int xhci_mvebu_mbus_init_quirk(struct usb_hcd *hcd)
+ return 0;
+ }
+
+-static inline int xhci_mvebu_a3700_plat_setup(struct usb_hcd *hcd)
+-{
+- return 0;
+-}
+-
+ static inline int xhci_mvebu_a3700_init_quirk(struct usb_hcd *hcd)
+ {
+ return 0;
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 83c7dffa945c3..ae67985178b02 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -44,16 +44,6 @@ static void xhci_priv_plat_start(struct usb_hcd *hcd)
+ priv->plat_start(hcd);
+ }
+
+-static int xhci_priv_plat_setup(struct usb_hcd *hcd)
+-{
+- struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd);
+-
+- if (!priv->plat_setup)
+- return 0;
+-
+- return priv->plat_setup(hcd);
+-}
+-
+ static int xhci_priv_init_quirk(struct usb_hcd *hcd)
+ {
+ struct xhci_plat_priv *priv = hcd_to_xhci_priv(hcd);
+@@ -121,7 +111,6 @@ static const struct xhci_plat_priv xhci_plat_marvell_armada = {
+ };
+
+ static const struct xhci_plat_priv xhci_plat_marvell_armada3700 = {
+- .plat_setup = xhci_mvebu_a3700_plat_setup,
+ .init_quirk = xhci_mvebu_a3700_init_quirk,
+ };
+
+@@ -344,14 +333,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+
+ hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node);
+ xhci->shared_hcd->tpl_support = hcd->tpl_support;
+-
+- if (priv) {
+- ret = xhci_priv_plat_setup(hcd);
+- if (ret)
+- goto disable_usb_phy;
+- }
+-
+- if ((xhci->quirks & XHCI_SKIP_PHY_INIT) || (priv && (priv->quirks & XHCI_SKIP_PHY_INIT)))
++ if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT))
+ hcd->skip_phy_initialization = 1;
+
+ if (priv && (priv->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK))
+diff --git a/drivers/usb/host/xhci-plat.h b/drivers/usb/host/xhci-plat.h
+index 29f15298e315f..f3abce238207e 100644
+--- a/drivers/usb/host/xhci-plat.h
++++ b/drivers/usb/host/xhci-plat.h
+@@ -15,7 +15,6 @@ struct usb_hcd;
+ struct xhci_plat_priv {
+ const char *firmware_name;
+ unsigned long long quirks;
+- int (*plat_setup)(struct usb_hcd *);
+ void (*plat_start)(struct usb_hcd *);
+ int (*init_quirk)(struct usb_hcd *);
+ int (*suspend_quirk)(struct usb_hcd *);
+--
+2.39.5
+
pwm-mediatek-ensure-to-disable-clocks-in-error-path.patch
netlink-fix-rmem-check-in-netlink_broadcast_deliver.patch
netlink-make-sure-we-allow-at-least-one-dump-skb.patch
+bluetooth-hci-set-extended-advertising-data-synchron.patch
+btrfs-fix-inode-lookup-error-handling-during-log-rep.patch
+xhci-allow-rpm-on-the-usb-controller-1022-43f7-by-de.patch
+usb-xhci-init-root-hub-ssp-rate.patch
+xhci-add-bus-number-to-some-debug-messages.patch
+revert-usb-host-xhci-mvebu-make-usb-3.0-phy-optional.patch
+xhci-factor-out-parts-of-xhci_gen_setup.patch
+xhci-prepare-for-operation-w-o-shared-hcd.patch
+usb-host-xhci-plat-create-shared-hcd-after-having-ad.patch
+usb-host-xhci-plat-prepare-operation-w-o-shared-hcd.patch
+xhci-disable-stream-for-xhc-controller-with-xhci_bro.patch
+input-xpad-add-support-for-amazon-game-controller.patch
+input-xpad-add-vid-for-turtle-beach-controllers.patch
+input-xpad-support-acer-ngr-200-controller.patch
+usb-dwc3-clean-up-probe-declarations.patch
+usb-xhci-move-extcaps-related-macros-to-respective-h.patch
+usb-dwc3-abort-suspend-on-soft-disconnect-failure.patch
+smb-client-fix-readdir-returning-wrong-type-with-pos.patch
+dma-buf-fix-timeout-handling-in-dma_resv_wait_timeou.patch
+usb-xhci-quirk-for-data-loss-in-isoc-transfers.patch
+wifi-zd1211rw-fix-potential-null-pointer-dereference.patch
+md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch
+net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch
+net-phy-microchip-limit-100m-workaround-to-link-down.patch
+can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch
+net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch
+bnxt_en-fix-dcb-ets-validation.patch
+bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch
+atm-idt77252-add-missing-dma_map_error.patch
+um-vector-reduce-stack-usage-in-vector_eth_configure.patch
+net-usb-qmi_wwan-add-simcom-8230c-composition.patch
+vt-add-missing-notification-when-switching-back-to-t.patch
+hid-add-ignore-quirk-for-smartlinktechnology.patch
+hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch
--- /dev/null
+From 31fa9af762eed42996a29d41a1927a98bd6fb5df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jun 2025 19:05:05 +0200
+Subject: smb: client: fix readdir returning wrong type with POSIX extensions
+
+From: Philipp Kerling <pkerling@casix.org>
+
+[ Upstream commit b8f89cb723b9e66f5dbd7199e4036fee34fb0de0 ]
+
+When SMB 3.1.1 POSIX Extensions are negotiated, userspace applications
+using readdir() or getdents() calls without stat() on each individual file
+(such as a simple "ls" or "find") would misidentify file types and exhibit
+strange behavior such as not descending into directories. The reason for
+this behavior is an oversight in the cifs_posix_to_fattr conversion
+function. Instead of extracting the entry type for cf_dtype from the
+properly converted cf_mode field, it tries to extract the type from the
+PDU. While the wire representation of the entry mode is similar in
+structure to POSIX stat(), the assignments of the entry types are
+different. Applying the S_DT macro to cf_mode instead yields the correct
+result. This is also what the equivalent function
+smb311_posix_info_to_fattr in inode.c already does for stat() etc.; which
+is why "ls -l" would give the correct file type but "ls" would not (as
+identified by the colors).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Philipp Kerling <pkerling@casix.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/readdir.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 9e62d75f24651..2691785cee700 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -276,7 +276,6 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info,
+
+ if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
+ fattr->cf_mode |= S_IFDIR;
+- fattr->cf_dtype = DT_DIR;
+ } else {
+ /*
+ * mark anything that is not a dir as regular
+@@ -284,8 +283,9 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info,
+ * attribute and will be marked as needing revaluation
+ */
+ fattr->cf_mode |= S_IFREG;
+- fattr->cf_dtype = DT_REG;
+ }
++ /* Use S_DT to extract file type from cf_mode for cf_dtype */
++ fattr->cf_dtype = S_DT(fattr->cf_mode);
+
+ if (reparse_file_needs_reval(fattr))
+ fattr->cf_flags |= CIFS_FATTR_NEED_REVAL;
+--
+2.39.5
+
--- /dev/null
+From 43f4cd8db37ba7128077df842126fe7ac868f8da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 19:08:29 +0800
+Subject: um: vector: Reduce stack usage in vector_eth_configure()
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 2d65fc13be85c336c56af7077f08ccd3a3a15a4a ]
+
+When compiling with clang (19.1.7), initializing *vp using a compound
+literal may result in excessive stack usage. Fix it by initializing the
+required fields of *vp individually.
+
+Without this patch:
+
+$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
+...
+0x0000000000000540 vector_eth_configure [vector_kern.o]:1472
+...
+
+With this patch:
+
+$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
+...
+0x0000000000000540 vector_eth_configure [vector_kern.o]:208
+...
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506221017.WtB7Usua-lkp@intel.com/
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Link: https://patch.msgid.link/20250623110829.314864-1-tiwei.btw@antgroup.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/vector_kern.c | 42 +++++++++++------------------------
+ 1 file changed, 13 insertions(+), 29 deletions(-)
+
+diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
+index da05bfdaeb1db..a37007e42265a 100644
+--- a/arch/um/drivers/vector_kern.c
++++ b/arch/um/drivers/vector_kern.c
+@@ -1600,35 +1600,19 @@ static void vector_eth_configure(
+
+ device->dev = dev;
+
+- *vp = ((struct vector_private)
+- {
+- .list = LIST_HEAD_INIT(vp->list),
+- .dev = dev,
+- .unit = n,
+- .options = get_transport_options(def),
+- .rx_irq = 0,
+- .tx_irq = 0,
+- .parsed = def,
+- .max_packet = get_mtu(def) + ETH_HEADER_OTHER,
+- /* TODO - we need to calculate headroom so that ip header
+- * is 16 byte aligned all the time
+- */
+- .headroom = get_headroom(def),
+- .form_header = NULL,
+- .verify_header = NULL,
+- .header_rxbuffer = NULL,
+- .header_txbuffer = NULL,
+- .header_size = 0,
+- .rx_header_size = 0,
+- .rexmit_scheduled = false,
+- .opened = false,
+- .transport_data = NULL,
+- .in_write_poll = false,
+- .coalesce = 2,
+- .req_size = get_req_size(def),
+- .in_error = false,
+- .bpf = NULL
+- });
++ INIT_LIST_HEAD(&vp->list);
++ vp->dev = dev;
++ vp->unit = n;
++ vp->options = get_transport_options(def);
++ vp->parsed = def;
++ vp->max_packet = get_mtu(def) + ETH_HEADER_OTHER;
++ /*
++ * TODO - we need to calculate headroom so that ip header
++ * is 16 byte aligned all the time
++ */
++ vp->headroom = get_headroom(def);
++ vp->coalesce = 2;
++ vp->req_size = get_req_size(def);
+
+ dev->features = dev->hw_features = (NETIF_F_SG | NETIF_F_FRAGLIST);
+ tasklet_init(&vp->tx_poll, vector_tx_poll, (unsigned long)vp);
+--
+2.39.5
+
--- /dev/null
+From 28907062b07677367be1e4229fe70a0990bedef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Jul 2025 04:38:08 -0400
+Subject: usb: dwc3: Abort suspend on soft disconnect failure
+
+From: Kuen-Han Tsai <khtsai@google.com>
+
+[ Upstream commit 630a1dec3b0eba2a695b9063f1c205d585cbfec9 ]
+
+When dwc3_gadget_soft_disconnect() fails, dwc3_suspend_common() keeps
+going with the suspend, resulting in a period where the power domain is
+off, but the gadget driver remains connected. Within this time frame,
+invoking vbus_event_work() will cause an error as it attempts to access
+DWC3 registers for endpoint disabling after the power domain has been
+completely shut down.
+
+Abort the suspend sequence when dwc3_gadget_suspend() cannot halt the
+controller and proceeds with a soft connect.
+
+Fixes: 9f8a67b65a49 ("usb: dwc3: gadget: fix gadget suspend/resume")
+Cc: stable <stable@kernel.org>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
+Link: https://lore.kernel.org/r/20250528100315.2162699-1-khtsai@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.c | 34 +++++++++++++++++++++++++++-------
+ drivers/usb/dwc3/core.h | 2 ++
+ drivers/usb/dwc3/gadget.c | 25 ++++++++++++++++++++++---
+ 3 files changed, 51 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 3537afd17a26e..102ad4d2d4ebc 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1733,16 +1733,29 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc)
+
+ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
+ {
+- unsigned long flags;
+ u32 reg;
++ int ret;
++
++ if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) {
++ dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) &
++ DWC3_GUSB2PHYCFG_SUSPHY) ||
++ (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) &
++ DWC3_GUSB3PIPECTL_SUSPHY);
++ /*
++ * TI AM62 platform requires SUSPHY to be
++ * enabled for system suspend to work.
++ */
++ if (!dwc->susphy_state)
++ dwc3_enable_susphy(dwc, true);
++ }
+
+ switch (dwc->current_dr_role) {
+ case DWC3_GCTL_PRTCAP_DEVICE:
+ if (pm_runtime_suspended(dwc->dev))
+ break;
+- spin_lock_irqsave(&dwc->lock, flags);
+- dwc3_gadget_suspend(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
++ ret = dwc3_gadget_suspend(dwc);
++ if (ret)
++ return ret;
+ synchronize_irq(dwc->irq_gadget);
+ dwc3_core_exit(dwc);
+ break;
+@@ -1773,9 +1786,9 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
+ break;
+
+ if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
+- spin_lock_irqsave(&dwc->lock, flags);
+- dwc3_gadget_suspend(dwc);
+- spin_unlock_irqrestore(&dwc->lock, flags);
++ ret = dwc3_gadget_suspend(dwc);
++ if (ret)
++ return ret;
+ synchronize_irq(dwc->irq_gadget);
+ }
+
+@@ -1986,6 +1999,13 @@ static void dwc3_complete(struct device *dev)
+ reg |= DWC3_GUCTL3_SPLITDISABLE;
+ dwc3_writel(dwc->regs, DWC3_GUCTL3, reg);
+ }
++
++ /*
++ * Restore SUSPHY state to the original setting
++ * if it was cleared during suspend
++ */
++ if (!dwc->susphy_state)
++ dwc3_enable_susphy(dwc, false);
+ }
+ #else
+ #define dwc3_complete NULL
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 4ccbd2dc1bf81..97d361ab3e86f 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -1269,6 +1269,8 @@ struct dwc3 {
+ unsigned dis_split_quirk:1;
+
+ u16 imod_interval;
++
++ unsigned susphy_state:1;
+ };
+
+ #define INCRX_BURST_MODE 0
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f3103baa74590..422efb4e61434 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -4106,12 +4106,31 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
+
+ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ {
++ unsigned long flags;
++ int ret;
++
+ if (!dwc->gadget_driver)
+ return 0;
+
+- dwc3_gadget_run_stop(dwc, false, false);
+- dwc3_disconnect_gadget(dwc);
+- __dwc3_gadget_stop(dwc);
++ ret = dwc3_gadget_soft_disconnect(dwc);
++ /*
++ * Attempt to reset the controller's state. Likely no
++ * communication can be established until the host
++ * performs a port reset.
++ */
++ if (ret && dwc->softconnect) {
++ /* Soft connect logic - similar to pullup when is_on is true */
++ dwc3_core_soft_reset(dwc);
++ dwc3_event_buffers_setup(dwc);
++ __dwc3_gadget_start(dwc);
++ dwc3_gadget_run_stop(dwc, true, false);
++ return -EAGAIN;
++ }
++
++ spin_lock_irqsave(&dwc->lock, flags);
++ if (dwc->gadget_driver)
++ dwc3_disconnect_gadget(dwc);
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 2aa5523414e8be871a769f12dd0570ae2e0017bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 09:25:24 +0200
+Subject: USB: dwc3: clean up probe declarations
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 9a4d7dd1990383df8ffa09d6879cecb0534405e1 ]
+
+Clean up the probe variable declarations by removing the stray newlines.
+
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230404072524.19014-12-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 1264683d45f20..3537afd17a26e 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1526,12 +1526,10 @@ static int dwc3_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct resource *res, dwc_res;
++ void __iomem *regs;
+ struct dwc3 *dwc;
+-
+ int ret;
+
+- void __iomem *regs;
+-
+ dwc = devm_kzalloc(dev, sizeof(*dwc), GFP_KERNEL);
+ if (!dwc)
+ return -ENOMEM;
+--
+2.39.5
+
--- /dev/null
+From d77936304f8496621ce7b5796f3cf35a88e667ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 01:04:44 +0300
+Subject: usb: host: xhci-plat: create shared hcd after having added main hcd
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 0cf1ea040a7e2cae4776216d16d33d3898ea58de ]
+
+This patch is in preparation of an extension where in case of a
+root hub with no ports no shared hcd will be created.
+Whether one of the root hubs has no ports we figure our in
+usb_add_hcd() for the primary hcd. Therefore create the shared hcd
+only after this call.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220511220450.85367-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index ae67985178b02..b363063edab91 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -290,12 +290,6 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ device_set_wakeup_capable(&pdev->dev, true);
+
+ xhci->main_hcd = hcd;
+- xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
+- dev_name(&pdev->dev), hcd);
+- if (!xhci->shared_hcd) {
+- ret = -ENOMEM;
+- goto disable_clk;
+- }
+
+ /* imod_interval is the interrupt moderation value in nanoseconds. */
+ xhci->imod_interval = 40000;
+@@ -323,16 +317,16 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ if (IS_ERR(hcd->usb_phy)) {
+ ret = PTR_ERR(hcd->usb_phy);
+ if (ret == -EPROBE_DEFER)
+- goto put_usb3_hcd;
++ goto disable_clk;
+ hcd->usb_phy = NULL;
+ } else {
+ ret = usb_phy_init(hcd->usb_phy);
+ if (ret)
+- goto put_usb3_hcd;
++ goto disable_clk;
+ }
+
+ hcd->tpl_support = of_usb_host_tpl_support(sysdev->of_node);
+- xhci->shared_hcd->tpl_support = hcd->tpl_support;
++
+ if (priv && (priv->quirks & XHCI_SKIP_PHY_INIT))
+ hcd->skip_phy_initialization = 1;
+
+@@ -343,12 +337,21 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ if (ret)
+ goto disable_usb_phy;
+
++ xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
++ dev_name(&pdev->dev), hcd);
++ if (!xhci->shared_hcd) {
++ ret = -ENOMEM;
++ goto dealloc_usb2_hcd;
++ }
++
++ xhci->shared_hcd->tpl_support = hcd->tpl_support;
++
+ if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+ xhci->shared_hcd->can_do_streams = 1;
+
+ ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
+ if (ret)
+- goto dealloc_usb2_hcd;
++ goto put_usb3_hcd;
+
+ device_enable_async_suspend(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+@@ -362,15 +365,15 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ return 0;
+
+
++put_usb3_hcd:
++ usb_put_hcd(xhci->shared_hcd);
++
+ dealloc_usb2_hcd:
+ usb_remove_hcd(hcd);
+
+ disable_usb_phy:
+ usb_phy_shutdown(hcd->usb_phy);
+
+-put_usb3_hcd:
+- usb_put_hcd(xhci->shared_hcd);
+-
+ disable_clk:
+ clk_disable_unprepare(xhci->clk);
+
+--
+2.39.5
+
--- /dev/null
+From ccc922bf9c9e3149575629e8328d7cf3612aaef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 01:04:45 +0300
+Subject: usb: host: xhci-plat: prepare operation w/o shared hcd
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit e0fe986972f5b6b12086c73569206dd29c520be9 ]
+
+This patch prepares xhci-plat for the following scenario
+- If either of the root hubs has no ports, then omit shared hcd
+- Main hcd can be USB3 if there are no USB2 ports
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220511220450.85367-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 31 ++++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index b363063edab91..c7fe96c9ba6a4 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -180,7 +180,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ struct device *sysdev, *tmpdev;
+ struct xhci_hcd *xhci;
+ struct resource *res;
+- struct usb_hcd *hcd;
++ struct usb_hcd *hcd, *usb3_hcd;
+ int ret;
+ int irq;
+ struct xhci_plat_priv *priv = NULL;
+@@ -337,21 +337,26 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ if (ret)
+ goto disable_usb_phy;
+
+- xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
+- dev_name(&pdev->dev), hcd);
+- if (!xhci->shared_hcd) {
+- ret = -ENOMEM;
+- goto dealloc_usb2_hcd;
+- }
++ if (!xhci_has_one_roothub(xhci)) {
++ xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
++ dev_name(&pdev->dev), hcd);
++ if (!xhci->shared_hcd) {
++ ret = -ENOMEM;
++ goto dealloc_usb2_hcd;
++ }
+
+- xhci->shared_hcd->tpl_support = hcd->tpl_support;
++ xhci->shared_hcd->tpl_support = hcd->tpl_support;
++ }
+
+- if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+- xhci->shared_hcd->can_do_streams = 1;
++ usb3_hcd = xhci_get_usb3_hcd(xhci);
++ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4)
++ usb3_hcd->can_do_streams = 1;
+
+- ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
+- if (ret)
+- goto put_usb3_hcd;
++ if (xhci->shared_hcd) {
++ ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
++ if (ret)
++ goto put_usb3_hcd;
++ }
+
+ device_enable_async_suspend(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+--
+2.39.5
+
--- /dev/null
+From fab985a4bbc03ee869aff52710282024fc1c2a6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 19:43:15 -0800
+Subject: usb: xhci: Init root hub SSP rate
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit cd8d66cfae4989ed4b99c98b0c24d0eecba7005f ]
+
+Initialize USB 3.x root hub SuperSpeed Plus rate.
+
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/f1698a96d5f9dfaefb857b95e5db6135ae0c9e93.1615432770.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 908445cff24f8..e45353286e1b9 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -5272,10 +5272,12 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
+ hcd->self.root_hub->rx_lanes = 2;
+ hcd->self.root_hub->tx_lanes = 2;
++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2;
+ break;
+ case 1:
+ hcd->speed = HCD_USB31;
+ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1;
+ break;
+ }
+ xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n",
+--
+2.39.5
+
--- /dev/null
+From 404887679202c521a4a732b5ae58a85c0933e981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 19:00:23 +0530
+Subject: usb: xhci: Move extcaps related macros to respective header file
+
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+
+[ Upstream commit 60958b3abacc4eeea21236aa61bfacd1c3520168 ]
+
+DWC3 driver needs access to XHCI Extended Capabilities registers to
+read number of usb2 ports and usb3 ports present on multiport controller.
+Since the extcaps header is sufficient to parse this info, move port_count
+related macros and structure from xhci.h to xhci-ext-caps.h.
+
+Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
+Link: https://lore.kernel.org/r/20230828133033.11988-4-quic_kriskura@quicinc.com
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 630a1dec3b0e ("usb: dwc3: Abort suspend on soft disconnect failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ext-caps.h | 27 +++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h | 27 ---------------------------
+ 2 files changed, 27 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
+index e8af0a125f84b..96eb36a587382 100644
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -79,6 +79,33 @@
+ /* true: Controller Not Ready to accept doorbell or op reg writes after reset */
+ #define XHCI_STS_CNR (1 << 11)
+
++/**
++ * struct xhci_protocol_caps
++ * @revision: major revision, minor revision, capability ID,
++ * and next capability pointer.
++ * @name_string: Four ASCII characters to say which spec this xHC
++ * follows, typically "USB ".
++ * @port_info: Port offset, count, and protocol-defined information.
++ */
++struct xhci_protocol_caps {
++ u32 revision;
++ u32 name_string;
++ u32 port_info;
++};
++
++#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff)
++#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff)
++#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f)
++#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff)
++#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff)
++
++#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f)
++#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03)
++#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03)
++#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01)
++#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03)
++#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff)
++
+ #include <linux/io.h>
+
+ /**
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 166978caa6db3..bf3798ce716f3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -555,33 +555,6 @@ struct xhci_doorbell_array {
+ #define DB_VALUE(ep, stream) ((((ep) + 1) & 0xff) | ((stream) << 16))
+ #define DB_VALUE_HOST 0x00000000
+
+-/**
+- * struct xhci_protocol_caps
+- * @revision: major revision, minor revision, capability ID,
+- * and next capability pointer.
+- * @name_string: Four ASCII characters to say which spec this xHC
+- * follows, typically "USB ".
+- * @port_info: Port offset, count, and protocol-defined information.
+- */
+-struct xhci_protocol_caps {
+- u32 revision;
+- u32 name_string;
+- u32 port_info;
+-};
+-
+-#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff)
+-#define XHCI_EXT_PORT_MINOR(x) (((x) >> 16) & 0xff)
+-#define XHCI_EXT_PORT_PSIC(x) (((x) >> 28) & 0x0f)
+-#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff)
+-#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff)
+-
+-#define XHCI_EXT_PORT_PSIV(x) (((x) >> 0) & 0x0f)
+-#define XHCI_EXT_PORT_PSIE(x) (((x) >> 4) & 0x03)
+-#define XHCI_EXT_PORT_PLT(x) (((x) >> 6) & 0x03)
+-#define XHCI_EXT_PORT_PFD(x) (((x) >> 8) & 0x01)
+-#define XHCI_EXT_PORT_LP(x) (((x) >> 14) & 0x03)
+-#define XHCI_EXT_PORT_PSIM(x) (((x) >> 16) & 0xffff)
+-
+ #define PLT_MASK (0x03 << 6)
+ #define PLT_SYM (0x00 << 6)
+ #define PLT_ASYM_RX (0x02 << 6)
+--
+2.39.5
+
--- /dev/null
+From 7ddf51a70191e6b03869cd20216ed1fd91823335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 17:41:19 +0300
+Subject: usb: xhci: quirk for data loss in ISOC transfers
+
+From: Raju Rangoju <Raju.Rangoju@amd.com>
+
+[ Upstream commit cbc889ab0122366f6cdbe3c28d477c683ebcebc2 ]
+
+During the High-Speed Isochronous Audio transfers, xHCI
+controller on certain AMD platforms experiences momentary data
+loss. This results in Missed Service Errors (MSE) being
+generated by the xHCI.
+
+The root cause of the MSE is attributed to the ISOC OUT endpoint
+being omitted from scheduling. This can happen when an IN
+endpoint with a 64ms service interval either is pre-scheduled
+prior to the ISOC OUT endpoint or the interval of the ISOC OUT
+endpoint is shorter than that of the IN endpoint. Consequently,
+the OUT service is neglected when an IN endpoint with a service
+interval exceeding 32ms is scheduled concurrently (every 64ms in
+this scenario).
+
+This issue is particularly seen on certain older AMD platforms.
+To mitigate this problem, it is recommended to adjust the service
+interval of the IN endpoint to not exceed 32ms (interval 8). This
+adjustment ensures that the OUT endpoint will not be bypassed,
+even if a smaller interval value is utilized.
+
+Cc: stable <stable@kernel.org>
+Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250627144127.3889714-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mem.c | 4 ++++
+ drivers/usb/host/xhci-pci.c | 26 ++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h | 1 +
+ 3 files changed, 31 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 0891f0d21af16..5b1aa82f7701d 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1480,6 +1480,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ /* Periodic endpoint bInterval limit quirk */
+ if (usb_endpoint_xfer_int(&ep->desc) ||
+ usb_endpoint_xfer_isoc(&ep->desc)) {
++ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_9) &&
++ interval >= 9) {
++ interval = 8;
++ }
+ if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) &&
+ udev->speed >= USB_SPEED_HIGH &&
+ interval >= 7) {
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 202c176eb894a..4153bed4062c9 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -64,11 +64,22 @@
+ #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed
+ #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI 0x54ed
+
++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI 0x13ed
++#define PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI 0x13ee
++#define PCI_DEVICE_ID_AMD_STARSHIP_XHCI 0x148c
++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI 0x15d4
++#define PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI 0x15d5
++#define PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI 0x15e0
++#define PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI 0x15e1
++#define PCI_DEVICE_ID_AMD_RAVEN2_XHCI 0x15e5
++#define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc
+
++#define PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI 0x7316
++
+ #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042
+ #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142
+ #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242
+@@ -163,6 +174,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+
++ if (pdev->vendor == PCI_VENDOR_ID_AMD &&
++ (pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEC_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_ARIEL_TYPEA_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_STARSHIP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D4_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_FIREFLIGHT_15D5_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E0_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN_15E1_XHCI ||
++ pdev->device == PCI_DEVICE_ID_AMD_RAVEN2_XHCI))
++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9;
++
++ if (pdev->vendor == PCI_VENDOR_ID_ATI &&
++ pdev->device == PCI_DEVICE_ID_ATI_NAVI10_7316_XHCI)
++ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_9;
++
+ if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version == 0x96)
+ xhci->quirks |= XHCI_AMD_0x96_HOST;
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index bf3798ce716f3..18b89c1576388 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1877,6 +1877,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_TO_DEFAULT BIT_ULL(44)
+ #define XHCI_TRB_OVERFETCH BIT_ULL(45)
+ #define XHCI_ZHAOXIN_HOST BIT_ULL(46)
++#define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(47)
+
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+--
+2.39.5
+
--- /dev/null
+From 85576fcbf9448c6dd9e942819fd71dd59e03b9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 21:41:44 -0400
+Subject: vt: add missing notification when switching back to text mode
+
+From: Nicolas Pitre <npitre@baylibre.com>
+
+[ Upstream commit ff78538e07fa284ce08cbbcb0730daa91ed16722 ]
+
+Programs using poll() on /dev/vcsa to be notified when VT changes occur
+were missing one case: the switch from gfx to text mode.
+
+Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
+Link: https://lore.kernel.org/r/9o5ro928-0pp4-05rq-70p4-ro385n21n723@onlyvoer.pbz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 5d9de3a53548b..98ca54330d771 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4452,6 +4452,7 @@ void do_unblank_screen(int leaving_gfx)
+ set_palette(vc);
+ set_cursor(vc);
+ vt_event_post(VT_EVENT_UNBLANK, vc->vc_num, vc->vc_num);
++ notify_update(vc);
+ }
+ EXPORT_SYMBOL(do_unblank_screen);
+
+--
+2.39.5
+
--- /dev/null
+From e1cda43acf37ec7f52939b19f0997133c74a684f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 14:46:19 +0300
+Subject: wifi: zd1211rw: Fix potential NULL pointer dereference in
+ zd_mac_tx_to_dev()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ]
+
+There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For
+example, the following is possible:
+
+ T0 T1
+zd_mac_tx_to_dev()
+ /* len == skb_queue_len(q) */
+ while (len > ZD_MAC_MAX_ACK_WAITERS) {
+
+ filter_ack()
+ spin_lock_irqsave(&q->lock, flags);
+ /* position == skb_queue_len(q) */
+ for (i=1; i<position; i++)
+ skb = __skb_dequeue(q)
+
+ if (mac->type == NL80211_IFTYPE_AP)
+ skb = __skb_dequeue(q);
+ spin_unlock_irqrestore(&q->lock, flags);
+
+ skb_dequeue() -> NULL
+
+Since there is a small gap between checking skb queue length and skb being
+unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL.
+Then the pointer is passed to zd_mac_tx_status() where it is dereferenced.
+
+In order to avoid potential NULL pointer dereference due to situations like
+above, check if skb is not NULL before passing it to zd_mac_tx_status().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 459c51ad6e1f ("zd1211rw: port to mac80211")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Link: https://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+index 3ef8533205f91..0a7f368f0d99c 100644
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -583,7 +583,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
+
+ skb_queue_tail(q, skb);
+ while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
+- zd_mac_tx_status(hw, skb_dequeue(q),
++ skb = skb_dequeue(q);
++ if (!skb)
++ break;
++
++ zd_mac_tx_status(hw, skb,
+ mac->ack_pending ? mac->ack_signal : 0,
+ NULL);
+ mac->ack_pending = 0;
+--
+2.39.5
+
--- /dev/null
+From 18e1d600069cb425c0766c63485544ecc2554b6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 15:35:03 +0300
+Subject: xhci: Add bus number to some debug messages
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 669bc5a188b40a4edc9c2a42e5b32f19182767d9 ]
+
+As we register two usb buses for each xHC, and systems with several
+hosts are more and more common it is getting hard to follow the
+flow of debug messages without knowing which bus they belong to
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210820123503.2605901-7-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 6 ++++--
+ drivers/usb/host/xhci-ring.c | 3 ++-
+ drivers/usb/host/xhci.c | 6 ++++--
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index e92f920256b2e..ab28e0971e4a0 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1597,7 +1597,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ status = 1;
+ }
+ if (!status && !reset_change) {
+- xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
++ xhci_dbg(xhci, "%s: stopping usb%d port polling\n",
++ __func__, hcd->self.busnum);
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ }
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1629,7 +1630,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ if (bus_state->resuming_ports || /* USB2 */
+ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because a port is resuming\n");
++ xhci_dbg(xhci, "usb%d bus suspend to fail because a port is resuming\n",
++ hcd->self.busnum);
+ return -EBUSY;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 954cd962e113c..6cf1688c39d4a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1929,7 +1929,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ * bits are still set. When an event occurs, switch over to
+ * polling to avoid losing status changes.
+ */
+- xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
++ xhci_dbg(xhci, "%s: starting usb%d port polling.\n",
++ __func__, hcd->self.busnum);
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ spin_unlock(&xhci->lock);
+ /* Pass this up to the core */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index e45353286e1b9..26ee29e684c5d 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1017,7 +1017,8 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ xhci_dbc_suspend(xhci);
+
+ /* Don't poll the roothubs on bus suspend. */
+- xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n",
++ __func__, hcd->self.busnum);
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ del_timer_sync(&hcd->rh_timer);
+ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+@@ -1289,7 +1290,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ usb_asmedia_modifyflowcontrol(to_pci_dev(hcd->self.controller));
+
+ /* Re-enable port polling. */
+- xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
++ xhci_dbg(xhci, "%s: starting usb%d port polling.\n",
++ __func__, hcd->self.busnum);
+ set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+ usb_hcd_poll_rh_status(xhci->shared_hcd);
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+--
+2.39.5
+
--- /dev/null
+From 147b99ebb9b28be96ae25773e60c53ab43d898aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 11:13:27 +0530
+Subject: xhci: Allow RPM on the USB controller (1022:43f7) by default
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 28cbed496059fe1868203b76e9e0ef285733524d ]
+
+Enable runtime PM by default for older AMD 1022:43f7 xHCI 1.1 host as it
+is proven to work.
+Driver enables runtime PM by default for newer xHCI 1.2 host.
+
+Link: https://lore.kernel.org/all/12335218.O9o76ZdvQC@natalenko.name/
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20240304054327.2564500-1-Basavaraj.Natikar@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cbc889ab0122 ("usb: xhci: quirk for data loss in ISOC transfers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 2be84d5e9261d..202c176eb894a 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -186,8 +186,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+ }
+
+- if (pdev->vendor == PCI_VENDOR_ID_AMD)
++ if (pdev->vendor == PCI_VENDOR_ID_AMD) {
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++ if (pdev->device == 0x43f7)
++ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
++ }
+
+ if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
+ ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
+--
+2.39.5
+
--- /dev/null
+From 12b3dffca6f9d80893e84ecfef4bb5fd9b77f853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 17:41:20 +0300
+Subject: xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit cd65ee81240e8bc3c3119b46db7f60c80864b90b ]
+
+Disable stream for platform xHC controller with broken stream.
+
+Fixes: 14aec589327a6 ("storage: accept some UAS devices if streams are unavailable")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250627144127.3889714-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index c7fe96c9ba6a4..06c303c1e353a 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -349,7 +349,8 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ }
+
+ usb3_hcd = xhci_get_usb3_hcd(xhci);
+- if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4)
++ if (usb3_hcd && HCC_MAX_PSA(xhci->hcc_params) >= 4 &&
++ !(xhci->quirks & XHCI_BROKEN_STREAMS))
+ usb3_hcd->can_do_streams = 1;
+
+ if (xhci->shared_hcd) {
+--
+2.39.5
+
--- /dev/null
+From 85016548b24f809655c16c15da229c898e2721b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 01:04:42 +0300
+Subject: xhci: factor out parts of xhci_gen_setup()
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 57f23cd0bf2f56d339f810a913a9c0c5abfcfc7e ]
+
+Factoring out parts of xhci_gen_setup() has two motivations:
+- When adding functionaliy to omit shared hcd if not needed in a
+ subsequent patch, we'll have to call xhci_hcd_init_usb3_data()
+ from two places.
+- It reduces size of xhci_gen_setup() and makes it better readable.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220511220450.85367-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 104 +++++++++++++++++++++-------------------
+ 1 file changed, 54 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 26ee29e684c5d..f2e868089ec1e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -5217,6 +5217,57 @@ static int xhci_get_frame(struct usb_hcd *hcd)
+ return readl(&xhci->run_regs->microframe_index) >> 3;
+ }
+
++static void xhci_hcd_init_usb2_data(struct xhci_hcd *xhci, struct usb_hcd *hcd)
++{
++ xhci->usb2_rhub.hcd = hcd;
++ hcd->speed = HCD_USB2;
++ hcd->self.root_hub->speed = USB_SPEED_HIGH;
++ /*
++ * USB 2.0 roothub under xHCI has an integrated TT,
++ * (rate matching hub) as opposed to having an OHCI/UHCI
++ * companion controller.
++ */
++ hcd->has_tt = 1;
++}
++
++static void xhci_hcd_init_usb3_data(struct xhci_hcd *xhci, struct usb_hcd *hcd)
++{
++ unsigned int minor_rev;
++
++ /*
++ * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts
++ * should return 0x31 for sbrn, or that the minor revision
++ * is a two digit BCD containig minor and sub-minor numbers.
++ * This was later clarified in xHCI 1.2.
++ *
++ * Some USB 3.1 capable hosts therefore have sbrn 0x30, and
++ * minor revision set to 0x1 instead of 0x10.
++ */
++ if (xhci->usb3_rhub.min_rev == 0x1)
++ minor_rev = 1;
++ else
++ minor_rev = xhci->usb3_rhub.min_rev / 0x10;
++
++ switch (minor_rev) {
++ case 2:
++ hcd->speed = HCD_USB32;
++ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
++ hcd->self.root_hub->rx_lanes = 2;
++ hcd->self.root_hub->tx_lanes = 2;
++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2;
++ break;
++ case 1:
++ hcd->speed = HCD_USB31;
++ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
++ hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1;
++ break;
++ }
++ xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n",
++ minor_rev, minor_rev ? "Enhanced " : "");
++
++ xhci->usb3_rhub.hcd = hcd;
++}
++
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ {
+ struct xhci_hcd *xhci;
+@@ -5225,7 +5276,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ * quirks
+ */
+ struct device *dev = hcd->self.sysdev;
+- unsigned int minor_rev;
+ int retval;
+
+ /* Accept arbitrarily long scatter-gather lists */
+@@ -5240,60 +5290,14 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ xhci = hcd_to_xhci(hcd);
+
+ if (usb_hcd_is_primary_hcd(hcd)) {
+- xhci->main_hcd = hcd;
+- xhci->usb2_rhub.hcd = hcd;
+- /* Mark the first roothub as being USB 2.0.
+- * The xHCI driver will register the USB 3.0 roothub.
+- */
+- hcd->speed = HCD_USB2;
+- hcd->self.root_hub->speed = USB_SPEED_HIGH;
+- /*
+- * USB 2.0 roothub under xHCI has an integrated TT,
+- * (rate matching hub) as opposed to having an OHCI/UHCI
+- * companion controller.
+- */
+- hcd->has_tt = 1;
++ xhci_hcd_init_usb2_data(xhci, hcd);
+ } else {
+- /*
+- * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts
+- * should return 0x31 for sbrn, or that the minor revision
+- * is a two digit BCD containig minor and sub-minor numbers.
+- * This was later clarified in xHCI 1.2.
+- *
+- * Some USB 3.1 capable hosts therefore have sbrn 0x30, and
+- * minor revision set to 0x1 instead of 0x10.
+- */
+- if (xhci->usb3_rhub.min_rev == 0x1)
+- minor_rev = 1;
+- else
+- minor_rev = xhci->usb3_rhub.min_rev / 0x10;
+-
+- switch (minor_rev) {
+- case 2:
+- hcd->speed = HCD_USB32;
+- hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
+- hcd->self.root_hub->rx_lanes = 2;
+- hcd->self.root_hub->tx_lanes = 2;
+- hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x2;
+- break;
+- case 1:
+- hcd->speed = HCD_USB31;
+- hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
+- hcd->self.root_hub->ssp_rate = USB_SSP_GEN_2x1;
+- break;
+- }
+- xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n",
+- minor_rev,
+- minor_rev ? "Enhanced " : "");
+-
+- xhci->usb3_rhub.hcd = hcd;
+- /* xHCI private pointer was set in xhci_pci_probe for the second
+- * registered roothub.
+- */
++ xhci_hcd_init_usb3_data(xhci, hcd);
+ return 0;
+ }
+
+ mutex_init(&xhci->mutex);
++ xhci->main_hcd = hcd;
+ xhci->cap_regs = hcd->regs;
+ xhci->op_regs = hcd->regs +
+ HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
+--
+2.39.5
+
--- /dev/null
+From 047d50cb07e81cd5241655702b2da260b1a42ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 01:04:43 +0300
+Subject: xhci: prepare for operation w/o shared hcd
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 873f323618c202cd0675324a1027dcecc7745d0b ]
+
+This patch prepares xhci for the following scenario:
+- If either of the root hubs has no ports, then omit shared hcd
+- Main hcd can be USB3 if there are no USB2 ports
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20220511220450.85367-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: cd65ee81240e ("xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 3 ++-
+ drivers/usb/host/xhci-mem.c | 11 ++++----
+ drivers/usb/host/xhci.c | 53 ++++++++++++++++++++++++-------------
+ drivers/usb/host/xhci.h | 26 ++++++++++++++++++
+ 4 files changed, 68 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index ab28e0971e4a0..3e165d4050873 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -621,6 +621,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci,
+ u16 test_mode, u16 wIndex, unsigned long *flags)
+ __must_hold(&xhci->lock)
+ {
++ struct usb_hcd *usb3_hcd = xhci_get_usb3_hcd(xhci);
+ int i, retval;
+
+ /* Disable all Device Slots */
+@@ -641,7 +642,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci,
+ xhci_dbg(xhci, "Disable all port (PP = 0)\n");
+ /* Power off USB3 ports*/
+ for (i = 0; i < xhci->usb3_rhub.num_ports; i++)
+- xhci_set_port_power(xhci, xhci->shared_hcd, i, false, flags);
++ xhci_set_port_power(xhci, usb3_hcd, i, false, flags);
+ /* Power off USB2 ports*/
+ for (i = 0; i < xhci->usb2_rhub.num_ports; i++)
+ xhci_set_port_power(xhci, xhci->main_hcd, i, false, flags);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 5b0e009783229..0891f0d21af16 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1099,7 +1099,7 @@ static u32 xhci_find_real_port_number(struct xhci_hcd *xhci,
+ struct usb_hcd *hcd;
+
+ if (udev->speed >= USB_SPEED_SUPER)
+- hcd = xhci->shared_hcd;
++ hcd = xhci_get_usb3_hcd(xhci);
+ else
+ hcd = xhci->main_hcd;
+
+@@ -2415,10 +2415,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
+ xhci->usb2_rhub.num_ports = USB_MAXCHILDREN;
+ }
+
+- /*
+- * Note we could have all USB 3.0 ports, or all USB 2.0 ports.
+- * Not sure how the USB core will handle a hub with no ports...
+- */
++ if (!xhci->usb2_rhub.num_ports)
++ xhci_info(xhci, "USB2 root hub has no ports\n");
++
++ if (!xhci->usb3_rhub.num_ports)
++ xhci_info(xhci, "USB3 root hub has no ports\n");
+
+ xhci_create_rhub_port_array(xhci, &xhci->usb2_rhub, flags);
+ xhci_create_rhub_port_array(xhci, &xhci->usb3_rhub, flags);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index f2e868089ec1e..9ba1825dcbcc3 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -490,6 +490,10 @@ static void compliance_mode_recovery(struct timer_list *t)
+
+ xhci = from_timer(xhci, t, comp_mode_recovery_timer);
+ rhub = &xhci->usb3_rhub;
++ hcd = rhub->hcd;
++
++ if (!hcd)
++ return;
+
+ for (i = 0; i < rhub->num_ports; i++) {
+ temp = readl(rhub->ports[i]->addr);
+@@ -503,7 +507,6 @@ static void compliance_mode_recovery(struct timer_list *t)
+ i + 1);
+ xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+ "Attempting compliance mode recovery");
+- hcd = xhci->shared_hcd;
+
+ if (hcd->state == HC_STATE_SUSPENDED)
+ usb_hcd_resume_root_hub(hcd);
+@@ -616,14 +619,11 @@ static int xhci_run_finished(struct xhci_hcd *xhci)
+ xhci_halt(xhci);
+ return -ENODEV;
+ }
+- xhci->shared_hcd->state = HC_STATE_RUNNING;
+ xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
+
+ if (xhci->quirks & XHCI_NEC_HOST)
+ xhci_ring_cmd_db(xhci);
+
+- xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+- "Finished xhci_run for USB3 roothub");
+ return 0;
+ }
+
+@@ -698,7 +698,7 @@ int xhci_run(struct usb_hcd *hcd)
+ xhci_free_command(xhci, command);
+ }
+ xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+- "Finished xhci_run for USB2 roothub");
++ "Finished %s for main hcd", __func__);
+
+ set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags);
+
+@@ -706,6 +706,9 @@ int xhci_run(struct usb_hcd *hcd)
+
+ xhci_debugfs_init(xhci);
+
++ if (xhci_has_one_roothub(xhci))
++ return xhci_run_finished(xhci);
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(xhci_run);
+@@ -1004,7 +1007,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ return 0;
+
+ if (hcd->state != HC_STATE_SUSPENDED ||
+- xhci->shared_hcd->state != HC_STATE_SUSPENDED)
++ (xhci->shared_hcd && xhci->shared_hcd->state != HC_STATE_SUSPENDED))
+ return -EINVAL;
+
+ /* Clear root port wake on bits if wakeup not allowed. */
+@@ -1021,15 +1024,18 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ __func__, hcd->self.busnum);
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ del_timer_sync(&hcd->rh_timer);
+- clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+- del_timer_sync(&xhci->shared_hcd->rh_timer);
++ if (xhci->shared_hcd) {
++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
++ del_timer_sync(&xhci->shared_hcd->rh_timer);
++ }
+
+ if (xhci->quirks & XHCI_SUSPEND_DELAY)
+ usleep_range(1000, 1500);
+
+ spin_lock_irq(&xhci->lock);
+ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+- clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
++ if (xhci->shared_hcd)
++ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
+ /* step 1: stop endpoint */
+ /* skipped assuming that port suspend has done */
+
+@@ -1129,7 +1135,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ msleep(100);
+
+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+- set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
++ if (xhci->shared_hcd)
++ set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
+
+ spin_lock_irq(&xhci->lock);
+
+@@ -1190,7 +1197,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+
+ /* Let the USB core know _both_ roothubs lost power. */
+ usb_root_hub_lost_power(xhci->main_hcd->self.root_hub);
+- usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub);
++ if (xhci->shared_hcd)
++ usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub);
+
+ xhci_dbg(xhci, "Stop HCD\n");
+ xhci_halt(xhci);
+@@ -1230,12 +1238,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+
+ xhci_dbg(xhci, "Start the primary HCD\n");
+ retval = xhci_run(hcd->primary_hcd);
+- if (!retval) {
++ if (!retval && secondary_hcd) {
+ xhci_dbg(xhci, "Start the secondary HCD\n");
+ retval = xhci_run(secondary_hcd);
+ }
+ hcd->state = HC_STATE_SUSPENDED;
+- xhci->shared_hcd->state = HC_STATE_SUSPENDED;
++ if (xhci->shared_hcd)
++ xhci->shared_hcd->state = HC_STATE_SUSPENDED;
+ goto done;
+ }
+
+@@ -1273,7 +1282,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ }
+
+ if (pending_portevent) {
+- usb_hcd_resume_root_hub(xhci->shared_hcd);
++ if (xhci->shared_hcd)
++ usb_hcd_resume_root_hub(xhci->shared_hcd);
+ usb_hcd_resume_root_hub(hcd);
+ }
+ }
+@@ -1292,8 +1302,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ /* Re-enable port polling. */
+ xhci_dbg(xhci, "%s: starting usb%d port polling.\n",
+ __func__, hcd->self.busnum);
+- set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
+- usb_hcd_poll_rh_status(xhci->shared_hcd);
++ if (xhci->shared_hcd) {
++ set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
++ usb_hcd_poll_rh_status(xhci->shared_hcd);
++ }
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ usb_hcd_poll_rh_status(hcd);
+
+@@ -5289,9 +5301,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+
+ xhci = hcd_to_xhci(hcd);
+
+- if (usb_hcd_is_primary_hcd(hcd)) {
+- xhci_hcd_init_usb2_data(xhci, hcd);
+- } else {
++ if (!usb_hcd_is_primary_hcd(hcd)) {
+ xhci_hcd_init_usb3_data(xhci, hcd);
+ return 0;
+ }
+@@ -5373,6 +5383,11 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ return retval;
+ xhci_dbg(xhci, "Called HCD init\n");
+
++ if (xhci_hcd_is_usb3(hcd))
++ xhci_hcd_init_usb3_data(xhci, hcd);
++ else
++ xhci_hcd_init_usb2_data(xhci, hcd);
++
+ xhci_info(xhci, "hcc params 0x%08x hci version 0x%x quirks 0x%016llx\n",
+ xhci->hcc_params, xhci->hci_version, xhci->quirks);
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 2d2e9c59add62..166978caa6db3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1914,6 +1914,8 @@ struct xhci_hcd {
+ unsigned hw_lpm_support:1;
+ /* Broken Suspend flag for SNPS Suspend resume issue */
+ unsigned broken_suspend:1;
++ /* Indicates that omitting hcd is supported if root hub has no ports */
++ unsigned allow_single_roothub:1;
+ /* cached usb2 extened protocol capabilites */
+ u32 *ext_caps;
+ unsigned int num_ext_caps;
+@@ -1967,6 +1969,30 @@ static inline struct usb_hcd *xhci_to_hcd(struct xhci_hcd *xhci)
+ return xhci->main_hcd;
+ }
+
++static inline struct usb_hcd *xhci_get_usb3_hcd(struct xhci_hcd *xhci)
++{
++ if (xhci->shared_hcd)
++ return xhci->shared_hcd;
++
++ if (!xhci->usb2_rhub.num_ports)
++ return xhci->main_hcd;
++
++ return NULL;
++}
++
++static inline bool xhci_hcd_is_usb3(struct usb_hcd *hcd)
++{
++ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++
++ return hcd == xhci_get_usb3_hcd(xhci);
++}
++
++static inline bool xhci_has_one_roothub(struct xhci_hcd *xhci)
++{
++ return xhci->allow_single_roothub &&
++ (!xhci->usb2_rhub.num_ports || !xhci->usb3_rhub.num_ports);
++}
++
+ #define xhci_dbg(xhci, fmt, args...) \
+ dev_dbg(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
+ #define xhci_err(xhci, fmt, args...) \
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
